Palo Alto Networks

Malware

Malware Can’t Bear Traps With Bare Metal Analysis

In his recent SecurityWeek column, Scott Simkin calls out the efficacy of malware analysis via sandboxing. Attackers have become acutely aware of the methods security teams use to analyze files for malicious activity, including scanning the environment for code used in known malware analysis tools or observing hardware size for ...

Endpoint

Malware

Apr 12, 2017

By Eila Shargh

Palo Alto Networks

Products and Services

Partners

Malware, Unit 42

Pythons and Unicorns and Hancitor…Oh My! Decoding Binaries Through Emulatio...

This blog post is a continuation of my previous post, VB Dropper and Shellcode for Hancitor Reveal New Techniques Behind Uptick, where we analyzed a new Visual Basic (VB) macro dro...

Aug 30, 2016

By Jeff White

Malware, Threat Prevention, Unit 42

Aveo Malware Family Targets Japanese Speaking Users

(This blog post is also available in Japanese.)Palo Alto Networks has identified a malware family known as ‘Aveo’ that is being used to target Japanese speaking users. The ‘Aveo’ malware name comes from an embe...

Aug 16, 2016

By Josh Grunzweig and Robert Falcone

Malware, Threat Prevention, Unit 42

Orcus – Birth of an unusual plugin builder RAT

Unit 42 has been tracking a new Remote Access Trojan (RAT) being sold for $40 USD since April 2016, known as “Orcus”. Though Orcus has all the typical features of RAT malware, it allows users to build custom pl...

Aug 02, 2016

By Vicky Ray

Malware, Threat Prevention, Unit 42

Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Ba...

By mid-July 2016, the Afraidgate campaign stopped distributing CryptXXX ransomware. It is now distributing the ".zepto" variant of Locky. Afraidgate h...

Jul 29, 2016

By Brad Duncan

Malware, Threat Prevention, Unit 42

SpyNote Android Trojan Builder Leaked

Our team recently discovered a new Android Trojan called SpyNote which facilitates remote spying. The builder, which creates new versions of the malware, recently leaked on several malware discussion forums. SpyNote is similar to OmniRat an...

Jul 28, 2016

By Jacob Soo

Cloud Computing, Malware, Security Platform

Awesome Jerry Explains Common Threats in SaaS: Malware Propagation

Hi everyone! I’m Jerry, and I work in IT. You may have seen my recent video introducing the benefits of using Aperture SaaS security service from Palo...

Jul 28, 2016

By Awesome Jerry

Healthcare, Malware

How to Interpret HHS Guidance on Ransomware as a HIPAA Breach

Until recently, the healthcare industry has been up in arms on whether ransomware infections should be considered reportable Health Insurance Portability and Accountability Act (HI...

Jul 25, 2016

By Matt Mellen

Malware, Threat Prevention, Unit 42

PowerWare Ransomware Spoofing Locky Malware Family

Unit 42 has recently discovered a new variant of PowerWare, also known as PoshCoder, imitating the popular Locky ransomware family. PoshCoder has been encrypting files with PowerShell since 2014, and the new va...

Jul 21, 2016

By Tyler Halfpop and Jacob Soo

Malware, Threat Prevention, Unit 42

Andromeda Botnet Targets Italy in Recent Spam Campaigns

Over the past month, Palo Alto Networks has observed two spam campaigns targeting users residing in Italy. The spam emails attempt to install the pervasive Andromeda malware onto victim machines. This malware h...

Jul 18, 2016

By Josh Grunzweig and Brandon Levene

Firewall, Malware

Why User-Based Controls Are Critical to Your Breach Prevention Strategy

Employees, customers and partners connect to different repositories of information within your network, as well as to the internet, to perform various aspects of their jobs. These...

Jul 13, 2016

By Navneet Singh

Malware, Threat Prevention, Unit 42

How to Track Actors Behind Keyloggers Using Embedded Credentials

This past year Unit 42 has seen a resurgence of keylogger activity and it seems like every week a new research blog comes out talking about one of fou...

Jul 12, 2016

By Jeff White

Malware, Threat Prevention, Unit 42

Investigating the LuminosityLink Remote Access Trojan Configuration

In recent weeks, I’ve spent time investigating the LuminosityLink Remote Access Trojan’s (RAT) embedded configuration. For those unaware, LuminosityLi...

Jul 08, 2016

By Josh Grunzweig

Malware, Threat Prevention, Unit 42

Recent MNKit Exploit Activity Reveals Some Common Threads

Unit 42 recently identified a variant of MNKit-weaponized documents being used to deliver LURK0 Gh0st, NetTraveler, and Saker payloads. The documents were delivered to targets involved with universities, NGOs,...

Jun 30, 2016

By Anthony Kasza

Malware, Threat Prevention, Unit 42

Prince of Persia – Game Over

Unit 42 published a blog at the beginning of May titled "Prince of Persia," in which we described the discovery of a decade-long campaign using a formerly unknown malware family, Infy, that targeted government and industry interests worldwi...

Jun 28, 2016

By Tomer Bar, Lior Efraim and Simon Conant

Malware, Threat Prevention, Unit 42

Extending AutoFocus Threat Intelligence With New Tag Types

In previous posts we have discussed how AutoFocus accelerates the analysis, hunting, and incident response workflows by providing full context for thr...

Jun 17, 2016

By Mike Scott

Malware, Threat Prevention, Unit 42

Understanding Angler Exploit Kit - Part 2: Examining Angler EK

This is the second part of a two-part blog post for understanding Angler exploit kit (EK). The first part covered EKs in general. This blog focuses on...

Jun 07, 2016

By Brad Duncan

Malware, Threat Prevention, Unit 42

Understanding Angler Exploit Kit - Part 1: Exploit Kit Fundamentals

Generally speaking, criminal groups use two methods for widespread distribution of malware. The most common method is malicious spam (malspam). This i...

Jun 03, 2016

By Brad Duncan

Financial Services, Malware, Threat Prevention, Unit 42

The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helmint...

In May 2016, Unit 42 observed targeted attacks primarily focused on financial institutions and technology organizations within Saudi Arabia. Artifacts...

May 26, 2016

By Robert Falcone and Bryan Lee

Malware, Threat Prevention, Unit 42

New Wekby Attacks Use DNS Requests As Command and Control Mechanism

We have observed an attack led by the APT group Wekby targeting a US-based organization in recent weeks. Wekby is a group that has been active for a n...

May 24, 2016

By Josh Grunzweig, Mike Scott and Bryan Lee

Malware, Unit 42

Operation Ke3chang Resurfaces With New TidePool Malware

Little has been published on the threat actors responsible for Operation Ke3chang since the report was released more than two years ago. However, Unit 42 has recently discovered the actors have continued to evo...

May 22, 2016

By Micah Yates, Mike Scott, Brandon Levene, Jen Miller-Osborn and Tom Keigher

Load more blogs