Rob Downs, Author at Palo Alto Networks Blog

Unit 42

In this second part of Unit 42’s Cybercrime Underground blog series, we dive into the cybercrime forum ecosystem and focus on observed cybercriminal roles, as well as prevalent tools and services bought …

Unit 42

This post is the first in a series by Unit 42 covering the cybercrime underground. Cybercrime persists as an epidemic that continues to worsen every year, with associated impacts and losses steadily …

Threat Prevention, Unit 42

Ransomware persists as one of the top crimeware threats thus far into 2016. While the use of document-based macros for ransomware distribution remains relatively uncommon, a new family calling itself "Locky" has …

Malware, Threat Prevention, Unit 42

Introduction The Sofacy group, also known as APT28 and Sednit, is a fairly well known cyber espionage group believed to have ties to Russia. Their targets have spanned all across the world, …

Cybersecurity, Threat Prevention, Unit 42

In part three of the Adversaries and Their Motivations blog series, we’ll explore the following top-level actor motivations: Cyber Warfare, Cyber Terrorism, and Cyber Mischief. Even Fuzzier Boundaries The high-level actor motivations …

Dec 03, 2015

By Rob Downs

Malware, Threat Prevention, Unit 42

Follow-On to VBA-Initiated Infostealer Campaign: Exploring Related Malware ...

In late October, we began examination of a VBA-initiated Infostealer campaign. This blog post follows up on additional information we gathered on related malware and associated actors. Pivot On Initial Predator Pain …

Dec 03, 2014

By Rob Downs and Vicky Ray

Threat Advisories - Advisories, Unit 42

New Release: Decrypting NetWire C2 Traffic

On July 22, Palo Alto Networks threat intelligence team, Unit 42, released our first report on the evolution of “Silver Spaniel” 419 scammers. Of particular note is how these actors use a …

Aug 04, 2014

By Phil Da Silva, Rob Downs and Ryan Olson

Threat Advisories - Advisories, Threat Prevention, Unit 42

Backoff and Citadel Abuse Remote Access Tools

Recent events continue to highlight the abuse of remote access applications in the enterprise. Last Tuesday, Trusteer reported that a new variant of Citadel, which has long relied on VNC to give …

Aug 04, 2014

By Rob Downs and Ryan Olson

Threat Advisory/Analysis, Threat Prevention, Unit 42

Attacks on East Asia using Google Code for Command and Control

Recently, FireEye published a blog titled “Operation Poisoned Hurricane” which detailed the use of PlugX malware variants signed with legitimate certificates that used Google Code project pages for command and control (C2). …

Aug 15, 2014

By Jen Miller-Osborn and Rob Downs

Malware, Unit 42

Pivot on Google Code C2 Reveals Additional Malware

Last week, we reported on attacks observed against East Asia that used Google Code for command and control (C2). As follow-on to that work, we pivoted on the C2 indicators of compromise …

Aug 21, 2014

By Rob Downs and Ryan Olson

Rob Downs

Unit 42

Exploring the Cybercrime Underground: Part 2 – The Forum Ecosystem

Unit 42

Exploring the Cybercrime Underground: Part 1 – An Introduction

Threat Prevention, Unit 42

Locky: New Ransomware Mimics Dridex-Style Distribution

Malware, Threat Prevention, Unit 42

A Look Into Fysbis: Sofacy’s Linux Backdoor

Cybersecurity, Threat Prevention, Unit 42

Adversaries and Their Motivations (Part 3)

Malware, Threat Prevention, Unit 42

Follow-On to VBA-Initiated Infostealer Campaign: Exploring Related Malware ...

Threat Advisories - Advisories, Unit 42

New Release: Decrypting NetWire C2 Traffic

Threat Advisories - Advisories, Threat Prevention, Unit 42

Backoff and Citadel Abuse Remote Access Tools

Threat Advisory/Analysis, Threat Prevention, Unit 42

Attacks on East Asia using Google Code for Command and Control

Malware, Unit 42

Pivot on Google Code C2 Reveals Additional Malware

Get the latest news, invites to events, and threat alerts

Popular Resources

Legal Notices

Popular Links