CL-STA-0049: Palo Alto Networks Unit 42 Threat Cluster
CL-STA-0049 is a threat cluster tracked by Palo Alto Networks Unit 42 that overlaps with Jewelbug. It is associated with cyber espionage…
Tag: Unit 42
Kimwolf v7 Android Botnet Uses HTTP/2 to Evade DDoS Detection
Cybersecurity researchers have uncovered a new version of the Kimwolf/AISURU Android and IoT botnet, tracked as Kimwolf v7, which introduces significant enhancements…
New Passkey Attacks Recover Synced Private Keys or Bypass Phishing-Resistant MFA
Three independent research efforts presented at Black Hat USA 2026 and in subsequent disclosures have demonstrated practical attacks against passkey implementations, undermining…
Ransom Cartel Creator Sentenced to 16 Years in Prison for Ransomware-as-a-Service Operation
A federal judge in Alexandria, Virginia, sentenced Maksim Silnikau, a 40-year-old Belarusian national, to 16 years in prison on August 5, 2026,…
Palo Alto Networks Unit 42: Analyzing ClickFix Variants and Evasion Techniques
Palo Alto Networks Unit 42 is the threat intelligence team at Palo Alto Networks. They analyzed recent ClickFix variants, including one abusing…
Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts
Unit 42 researchers have disclosed three attack paths against Google Password Manager in Chrome on Windows, which could allow malware already running…
Google Password Manager Synced Passkeys Vulnerable to Private Key Recovery
Unit 42 demonstrated that Google Password Manager's synced passkeys can be compromised via the Security Domain Secret, allowing recovery of private keys.…
Chinese Hacker Uses DeepSeek via Telegram to Drive Autonomous Attacks
Palo Alto Networks' Unit 42 has uncovered a Chinese-speaking threat actor who leveraged the DeepSeek AI model through the open-source Hermes Agent…
Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes
A Russian state-sponsored espionage group exploited a zero-day vulnerability in Zimbra's webmail client to steal emails, passwords, and two-factor authentication recovery codes…
TuxBot v3 Evolution: LLM-Assisted IoT Botnet Framework Uncovered by Unit 42
Cybersecurity researchers at Palo Alto Networks Unit 42 have disclosed a previously unreported IoT botnet framework named TuxBot v3 Evolution, which shows…