Tag: threat actors
-
Unit 42: Bookworm to Stately Taurus Using the Unit 42 Attribution Framework
Source URL: https://unit42.paloaltonetworks.com/bookworm-to-stately-taurus/ Source: Unit 42 Title: Bookworm to Stately Taurus Using the Unit 42 Attribution Framework Feedly Summary: We connect Bookworm malware to Chinese APT Stately Taurus using our attribution framework, enhancing our understanding of threat group tradecraft. The post Bookworm to Stately Taurus Using the Unit 42 Attribution Framework appeared first on Unit…
-
Cisco Talos Blog: How RainyDay, Turian and a new PlugX variant abuse DLL search order hijacking
Source URL: https://blog.talosintelligence.com/how-rainyday-turian-and-a-new-plugx-variant-abuse-dll-search-order-hijacking/ Source: Cisco Talos Blog Title: How RainyDay, Turian and a new PlugX variant abuse DLL search order hijacking Feedly Summary: Talos discovered that a new PlugX variant’s features overlap with both the RainyDay and Turian backdoors AI Summary and Description: Yes Summary: Cisco Talos has identified a new variant of the PlugX…
-
Cloud Blog: New DNS Armor can help detect, mitigate domain name system risks
Source URL: https://cloud.google.com/blog/products/identity-security/introducing-dns-armor-to-mitigate-domain-name-system-risks/ Source: Cloud Blog Title: New DNS Armor can help detect, mitigate domain name system risks Feedly Summary: The Domain Name System (DNS) is like the internet’s phone book, automatically and near-instantly translating requests for websites and mobile apps from their domain names to the Internet Protocol addresses of the actual computers hosting…
-
The Register: AI-powered penetration tool, an attacker’s dream, downloaded 10K times in 2 months
Source URL: https://www.theregister.com/2025/09/11/cobalt_strikes_ai_successor_downloaded/ Source: The Register Title: AI-powered penetration tool, an attacker’s dream, downloaded 10K times in 2 months Feedly Summary: Shady, China-based company, all the apps needed for a fully automated attack – sounds totally legit Villager, a new penetration-testing tool linked to a suspicious China-based company and described by researchers as “Cobalt Strike’s…
-
The Register: Beijing went to ‘EggStreme’ lengths to attack Philippines military, researchers say
Source URL: https://www.theregister.com/2025/09/11/eggstreme_malware_china_philippines/ Source: The Register Title: Beijing went to ‘EggStreme’ lengths to attack Philippines military, researchers say Feedly Summary: Ovoid-themed in-memory malware offers a menu for mayhem ‘EggStreme’ framework looks like the sort of thing Beijing would find handy in its ongoing territorial beefs Infosec outfit Bitdefender says it’s spotted a strain of in-memory…
-
Unit 42: Threat Brief: Salesloft Drift Integration Used To Compromise Salesforce Instances
Source URL: https://unit42.paloaltonetworks.com/threat-brief-compromised-salesforce-instances/ Source: Unit 42 Title: Threat Brief: Salesloft Drift Integration Used To Compromise Salesforce Instances Feedly Summary: This Threat Brief discusses observations on a campaign leveraging Salesloft Drift integration to exfiltrate data via compromised OAuth credentials. The post Threat Brief: Salesloft Drift Integration Used To Compromise Salesforce Instances appeared first on Unit 42.…