Palo Alto Networks

Threat Advisory/Analysis

Inside TDrop2: Technical Analysis of new Dark Seoul Malware

Palo Alto Networks recently identified a new campaign targeting the transportation sector in Europe with ties to the Dark Seoul and Operation Troy campaigns that took place in 2013. This new campaign used updated instances of the Tdrop malware family discovered in the Operation Troy campaign. For more information on the new campaign discovered by Unit 42, please refer to our recent blog post.

In this attack, attackers embedded the TDrop2 malware inside a legitimate video software package hos...

Cybersecurity

Threat Advisory/Analysis

Unit 42

Nov 23, 2015

By Josh Grunzweig

Palo Alto Networks

Products and Services

Partners

Malware, Threat Advisory/Analysis, Threat Prevention, Unit 42

Updated PClock Ransomware Still Comes Up Short

In recent years, ransomware families are often glamorized as being some of the most dangerous types of malware. They’ve certainly caused a wealth of damage to end users with some o...

Sep 29, 2015

By Josh Grunzweig

Malware, Threat Advisory/Analysis, Threat Prevention, Unit 42

Unit 42 Identifies New DragonOK Backdoor Malware Deployed Against Japanese ...

Palo Alto Networks Unit 42 used the AutoFocus threat intelligence service to identify a series of phishing attacks against Japanese organizations. Usi...

Apr 14, 2015

By Jen Miller-Osborn and Josh Grunzweig

Announcement, Cybersecurity, Ignite, Threat Advisories - Advisories, Threat Advisory/Analysis, Vertical

Palo Alto Networks AutoFocus: Actionable Cyber Threat Intelligence Like You...

Trying to find advanced, targeted attacks can be an exercise in frustration, akin to finding a needle in a haystack. Wit...

Mar 31, 2015

By Scott Simkin

Malware, Mobility, Threat Advisory/Analysis, Threat Prevention

How Android Installer Hijacking Works

Earlier today we published details of a widespread vulnerability in Google's Android OS that we describe as "Android Installer Hijacking." We have worked with Google and also Samsung and Amazon to patch devices...

Mar 24, 2015

By Palo Alto Networks

Malware, Mobility, Threat Advisory/Analysis, Threat Prevention, Unit 42

Android Installer Hijacking Vulnerability Could Expose Android Users to Mal...

We discovered a widespread vulnerability in Google’s Android OS we are calling “Android Installer Hijacking,” estimated to impact 49.5 percent of all...

Mar 24, 2015

By Zhi Xu

Endpoint, Financial Services, Threat Advisory/Analysis

Sophisticated? Palo Alto Networks Traps Would Have Prevented the Carbanak C...

A recent report from Kaspersky Lab disclosed a gargantuan cyberattack, dubbed Carbanak, targeting banks worldwide. According to the report, threat act...

Feb 17, 2015

By Palo Alto Networks

Malware, Threat Advisory/Analysis, Threat Prevention, Unit 42

Filmkan: Mysterious Turkish Botnet Grows Through Facebook

On January 31, a security researcher named Mohammad Faghani posted an analysis of malware that was being distributed through Facebook posts. Based on the number of “likes” the malw...

Feb 05, 2015

By Ryan Olson

Cybersecurity, Malware, Threat Advisory/Analysis, Unit 42

Analysis: CryptoWall 3.0, Dyre and I2P

For a moment, put yourself in the shoes of a cyber criminal. You’ve collected an array of tools (malware), built up your infrastructure (command and control (C2) servers) and you have a process to make money off your hard work. You wake up...

Feb 01, 2015

By Ryan Olson

Endpoint, Malware, Threat Advisory/Analysis, Threat Prevention, Unit 42

Newest CTB-Locker Campaign Bypasses Legacy Security Products

CTB-Locker is a well-known ransomware Trojan used by crimeware groups to encrypt files on the victim's endpoints and demand ransom payment to decrypt...

Jan 28, 2015

By Tomer Bar

Endpoint, Threat Advisory/Analysis

Proactive Prevention Revisited: 'Cloud Atlas' and 'Inception Framework' Cam...

In this post we will discuss two recently disclosed cyber espionage campaigns. By strange coincidence, both were independently named after labyrinthia...

Dec 18, 2014

By Palo Alto Networks

Malware, Threat Advisory/Analysis, Threat Prevention, Unit 42

Tracking New Ransomware CryptoWall 2.0

The latest development in the ransomware world is CryptoWall 2.0, a new version of this malware family that uses the Tor network for command and control.

Oct 22, 2014

By Ryan Olson

Threat Advisory/Analysis, Threat Prevention, Unit 42

Stolen Email Accounts of World’s Top Universities Selling on China’s Larges...

Recently, we found email accounts from top universities across the world being sold on Taobao, the largest consumer-to-consumer (C2C) e-commerce platf...

Sep 04, 2014

By Claud Xiao and Rob Downs

Application Advisory/Analysis, Cybersecurity, Malware, Threat Advisory/Analysis, Threat Prevention, Unit 42

Bad Certificate Management in Google Play Store

Following a recent study of apps in the Google Play Store, let’s discuss several security risks caused by the bad certificate management practiced in...

Aug 28, 2014

By Zhi Xu and Jen Miller-Osborn

Cybersecurity, Malware, Threat Advisories - Advisories, Threat Advisory/Analysis, Threat Prevention, Unit 42

Examining the CHS Breach and Heartbleed Exploitation

Yesterday, TrustedSec, a security consultancy based on Ohio, wrote that the recent breach at Community Health Systems (CHS) was the result of exploita...

Aug 20, 2014

By Ryan Olson

Threat Advisory/Analysis, Unit 42

Insecure Internal Storage in Android

Today, Palo Alto Networks researcher Claud Xiao is delivering a presentation titled “Insecure Internal Storage in Android” at the Hacks in Taiwan Conference (HITCON).

Aug 18, 2014

By Claud Xiao and Ryan Olson

Threat Advisory/Analysis, Threat Prevention, Unit 42

Attacks on East Asia using Google Code for Command and Control

Recently, FireEye published a blog titled “Operation Poisoned Hurricane” which detailed the use of PlugX malware variants signed with legitimate certi...

Aug 15, 2014

By Jen Miller-Osborn and Rob Downs

Malware, Threat Advisories - Advisories, Threat Advisory/Analysis, Threat Prevention, Unit 42

Hunting the Mutex

Mutex analysis is an often overlooked and useful tool for malware author fingerprinting, family classification, and even discovery. Far from the hypothesized "huge amount of variability" in mutex names, likely...

Aug 14, 2014

By Palo Alto Networks

Cybersecurity, Threat Advisory/Analysis, Threat Prevention, Unit 42

Palo Alto Networks Identifies 21 New Critical Vulnerabilities in Internet E...

Today, Microsoft patched 59 Internet Explorer vulnerabilities, 21 of them discovered by Palo Alto Networks researchers. Palo Alto Networks is committe...

Jun 10, 2014

By Ryan Olson

Cybersecurity, Threat Advisory/Analysis, Threat Prevention, Unit 42

How To Defend Against Advanced IE Exploitation

In February, Microsoft awarded $100,000 to Yu Yang (@Tombkeeper) for reporting a new mitigation bypass technique as part of Microsoft’s Bounty Program. Yu later demonstrated his re...

Jun 06, 2014

By IPS Team

Cybersecurity, Threat Advisories - Advisories, Threat Advisory/Analysis, Unit 42

The Latest Kuluoz Spam Campaign Kicks Off

At 06:47 PST on May 20 Palo Alto Networks WildFire detected the start of the latest Kuluoz spam campaign. The total number of e-mails detected quickly rose to over 30,000 per hour...

May 20, 2014

By Ryan Olson

Load more blogs