Cortex Cloud Security Research
Cloud Cybersecurity Research, Malware, Threat Research, endpoint, Linux Malware, Machine Learning, PowerShell, Remote Access Trojan, VBScript, Winnti
The Evolution of Linux Binaries in Targeted Cloud Operations
On January 31, a security researcher named Mohammad Faghani posted an analysis of malware...
Lost in Resolution: Azure OpenAI's DNS Resolution Issue
In late 2024, Unit 42 researchers discovered an issue with Azure OpenAI’s Domain Name System (DNS) resolution logic that could have enabled cross-tenant data leaks and meddler-in-t...
High Profile Threats, Malware, Threat Actor Groups, 0ktapus, ALPHV, app-ID, BlackCat ransomware, MITRE, Muddled Libra, phishing
Threat Group Assessment: Muddled Libra (Updated May 16, 2025)
We’ve added an additional section to this article that describes the evolution of Muddled...
Business Email Compromise, Cybercrime, Ransomware, Threat Actor Groups, Threat Research, Trend Reports, AI, Akira ransomware, BianLian, Bitter Scorpius
Extortion and Ransomware Trends January-March 2025
This article examines obfuscation techniques used in popular malware families, and offers...
Cybercrime, Malware, Threat Actor Groups, Cryptocurrency, DPRK, GitHub, Infostealer, JavaScript Malware, Slow Pisces, social engineering
Slow Pisces Targets Developers With Coding Challenges and Introduces New Cu...
Recently, we discovered several new malware samples with unique characteristics that made...
OH-MY-DC: OIDC Misconfigurations in CI/CD
Recently, Unit 42 identified the NOKKI malware family that was used in attacks containing politically-motivated lures targeting Russian and Cambodian speaking individuals or organizations. As part of this resea...
Cloud Threats on the Rise: Alert Trends Show Intensified Attacker Focus on ...
The attacks against cloud-hosted infrastructure are increasing, and the proof is in the analysis of security alert trends. Recent research reveals tha...
GitHub Actions Supply Chain Attack: A Targeted Attack on Coinbase Expanded ...
Update April 2: Recent investigations have revealed preliminary steps in the tj-actions and reviewdog compromise that were not known until now. We hav...
Business Email Compromise, Cloud Cybersecurity Research, Threat Research, Amazon Simple Email Service, AWS, IAM, JavaGhost, phishing
JavaGhost’s Persistent Phishing Attacks From the Cloud
Unit 42 researchers have observed phishing activity that we track as TGR-UNK-0011. We assess with high confidence that t...
Stately Taurus Activity in Southeast Asia Links to Bookworm Malware
This article reviews nine vulnerabilities we recently discovered in two utilities called cuobjdump and nvdisasm, both from NVIDIA's Compute Unified De...
Malware, Threat Actor Groups, Threat Research, China, CL-STA-0048, Cobalt Strike, data exfiltration, Mimikatz, PlugX, web shells
CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asi...
We identified a cluster of activity that we track as CL-STA-0048. This cluster targeted hi...
Cybercrime, Malware, Threat Actor Groups, Threat Research, Active Directory, AdFind, ALPHV, Ambitious Scorpius, Blackcat, BloodHound
LDAP Enumeration: Unveiling the Double-Edged Sword of Active Directory
Unit 42 researchers have discovered new security vulnerabilities in the Azure Data Factory...
Cloud Cybersecurity Research, Threat Research, Apache Airflow, Containers, Kubernetes, Microsoft Azure, Microsoft Azure Data Factory
Dirty DAG: New Vulnerabilities in Azure Data Factory’s Apache Airflow Integ...
Unit 42 spent six months researching the China-based cybercrime group Rocke, which is the...
Cybercrime, High Profile Threats, Ransomware, Threat Actor Groups, BlackSuit ransomware, construction, Education, Extortion, Ignoble Scorpius, leaksite
Threat Assessment: Ignoble Scorpius, Distributors of BlackSuit Ransomware
Unit 42 researchers have observed an increase in BlackSuit r...
Business Email Compromise, Threat Actor Groups, Threat Research, BeaverTail, CL-STA-0237, Contagious Interview, DPRK, Fake IT Worker, InvisibleFerret, Lazarus
Fake North Korean IT Worker Linked to BeaverTail Video Conference App Phish...
Unit 42 researchers identified a North Korean IT worker acti...
Cloud Cybersecurity Research, Threat Research, data exfiltration, Google Cloud, Kubernetes, LLM, poisoned model, privilege escalation, Vertex AI
ModeLeak: Privilege Escalation to LLM Model Exfiltration in Vertex AI
In the race to gain a competitive edge, organizations are increasingly training artificial...