Blog
Cloud Security
Cortex Cloud Security Research

Cortex Cloud Security Research

JavaGhost’s Persistent Phishing Attacks From the Cloud

JavaGhost’s Persistent Phishing Attacks From the Cloud

Unit 42 researchers have observed phishing activity that we track as TGR-UNK-0011. We assess with high confidence that this cluster overlaps with the threat actor group JavaGhost. The threat actor group JavaGhost has been active for over five years and continues to target cloud environments to send out phishing campaigns to unsuspecting targets.

Business Email Compromise

Cloud Cybersecurity Research

Threat Research

Amazon Simple Email Service

Feb 28, 2025

By Margaret Kelley

Malware, Threat Actor Groups, Bookworm, DLL Sideloading, Stately Taurus, ToneShell

Stately Taurus Activity in Southeast Asia Links to Bookworm Malware

This article reviews nine vulnerabilities we recently discovered in two utilities called cuobjdump and nvdisasm, both from NVIDIA's Compute Unified De...

Feb 20, 2025

By Robert Falcone

Malware, Threat Actor Groups, Threat Research, China, CL-STA-0048, Cobalt Strike, data exfiltration, Mimikatz, PlugX, web shells

CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asi...

We identified a cluster of activity that we track as CL-STA-0048. This cluster targeted hi...

Jan 29, 2025

By Lior Rochberger, Yoav Zemah

Cybercrime, Malware, Threat Actor Groups, Threat Research, Active Directory, AdFind, ALPHV, Ambitious Scorpius, Blackcat, BloodHound

LDAP Enumeration: Unveiling the Double-Edged Sword of Active Directory

Unit 42 researchers have discovered new security vulnerabilities in the Azure Data Factory...

Dec 17, 2024

By Stav Setty, Shachar Roitman, Tom Fakterman

Cloud Cybersecurity Research, Threat Research, Apache Airflow, Containers, Kubernetes, Microsoft Azure, Microsoft Azure Data Factory

Dirty DAG: New Vulnerabilities in Azure Data Factory’s Apache Airflow Integ...

Unit 42 spent six months researching the China-based cybercrime group Rocke, which is the...

Dec 16, 2024

By Ofir Balassiano, David Orlovsky

Cybercrime, High Profile Threats, Ransomware, Threat Actor Groups, BlackSuit ransomware, construction, Education, Extortion, Ignoble Scorpius, leaksite

Threat Assessment: Ignoble Scorpius, Distributors of BlackSuit Ransomware

Unit 42 researchers have observed an increase in BlackSuit r...

Nov 20, 2024

By Unit 42

Business Email Compromise, Threat Actor Groups, Threat Research, BeaverTail, CL-STA-0237, Contagious Interview, DPRK, Fake IT Worker, InvisibleFerret, Lazarus

Fake North Korean IT Worker Linked to BeaverTail Video Conference App Phish...

Unit 42 researchers identified a North Korean IT worker acti...

Nov 14, 2024

By Unit 42

Cloud Cybersecurity Research, Threat Research, data exfiltration, Google Cloud, Kubernetes, LLM, poisoned model, privilege escalation, Vertex AI

ModeLeak: Privilege Escalation to LLM Model Exfiltration in Vertex AI

In the race to gain a competitive edge, organizations are increasingly training artificial...

Nov 12, 2024

By Ofir Balassiano, Ofir Shaty

Cybercrime, Threat Actor Groups, Threat Research, C++, CL-CRI-0941, CVE-2017-11317, CVE-2019-18935, GodPotato, Python, Remote Code Execution

Silent Skimmer Gets Loud (Again)

This article introduces a simple and straightforward technique for jailbreaking that we call Deceptive Delight. Deceptive Delight is a multi-turn tech...

Nov 07, 2024

By Veronika Senderovych, Chema Garcia, Zack Fink

Nation-State Cyberattacks, Ransomware, Threat Actor Groups, Threat Research, Cobalt Strike, DPRK, DTrack, Fiddling Scorpius, Infostealer, Jumpy Pisces

Jumpy Pisces Engages in Play Ransomware

Unit 42 has identified Jumpy Pisces, a North Korean state-sponsored threat group associated with the Reconnaissance Gene...

Oct 30, 2024

By Unit 42

Malware, Threat Actor Groups, Threat Research, Advanced Persistent Threat, BeaverTail, CL-STA-240, Contagious Interview, DPRK, InvisibleFerret, North Korea

Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to ...

Unit 42 has tracked activity from threat actors associated w...

Oct 09, 2024

By Unit 42

Malware, Threat Actor Groups, APT43, DPRK, FPSpy, G0086, Keylogger, Kimsuky, KLogExe, MITRE

Unraveling Sparkling Pisces’s Tool Set: KLogEXE and FPSpy

Unit 42 researchers discovered two malware samples used by the Sparkling Pisces (aka Kimsuky) threat group. This includes an undocumented keylogger, c...

Sep 26, 2024

By Daniel Frank, Lior Rochberger

Malware, Threat Actor Groups, AppleJeus, Citrine Sleet, Cryptocurrency, Gleaming Pisces, Linux, macOS, North Korea, PondRAT

Gleaming Pisces Poisoned Python Packages Campaign Delivers PondRAT Linux an...

Unit 42 researchers have been tracking the activity of an ongoing poisoned Python packages...

Sep 18, 2024

By Yoav Zemah

Cybercrime, High Profile Threats, Ransomware, Threat Actor Groups, Threat Research, ALPHV, Ambitious Scorpius, Bashful Scorpius, BlackCat ransomware, Cicada3301

Threat Assessment: Repellent Scorpius, Distributors of Cicada3301 Ransomwar...

Repellent Scorpius is a new ransomware-as-a-service (RaaS) g...

Sep 10, 2024

By Navin Thomas, Jerome Tujague

Cybercrime, High Profile Threats, Malware, Nation-State Cyberattacks, Threat Actor Groups, Advanced Persistent Threat, Alluring Pisces, Andariel, Bluenoroff, Citrine Sleet

Threat Assessment: North Korean Threat Groups

Lazarus has been used in public reporting as an umbrella term for threat actors from the D...

Sep 09, 2024

By Unit 42

Malware, Threat Actor Groups, Advanced Persistent Threat, China, DLL Sideloading, Dropbox, Espionage, Government, Microsoft Visual Studio, Mimikatz

Chinese APT Abuses VSCode to Target Government in Asia

In the summer of 2018, Unit 42 released reporting regarding activity in the Middle East surrounding a cluster of activit...

Sep 06, 2024

By Tom Fakterman

Cloud Cybersecurity Research, Ransomware, Threat Actor Groups, AWS, AWS credential stealing, Bling Libra, Extortion, MITRE, S3, ShinyHunters

Bling Libra’s Tactical Evolution: The Threat Actor Group Behind ShinyHunter...

In an incident response engagement handled by Unit 42, the threat actor group Bling Libra...

Aug 23, 2024

By Margaret Zimmermann, Chandni Vaya

Load more

Load more

Get the latest news, invites to events, and threat alerts