Palo Alto Networks

botnet

Playbook of the Week: Swallow Traffic to Malicious Domains with DNS Sinkholes

What is a DNS Sinkhole?

When you hear about sinkholes, it’s not necessarily a good thing. However, in the cybersecurity realm, DNS sinkholing is a technique used to redirect ...

Playbook of the Week

Aug 31, 2023

By Ido Van Dijk

Palo Alto Networks

Products and Services

Partners

Unit 42

Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux an...

Unit 42 researchers have found a new malware family that is targeting Linux and Microsoft Windows servers. We can tie this malware, which we have named Xbash, to the Iron Group, a...

Sep 17, 2018

By Claud Xiao, Cong Zheng and Xingyu Jin

Unit 42

Multi-exploit IoT/Linux Botnets Mirai and Gafgyt Target Apache Struts, Soni...

Unit 42 has uncovered new variants of the well-known IoT botnets Mirai and Gafgyt. These are the IoT botnets associated with unprecedented Distributed Denial of Service attacks in...

Sep 09, 2018

By Ruchna Nigam

Unit 42

Unit 42 Finds New Mirai and Gafgyt IoT/Linux Botnet Campaigns

The end of May 2018 has marked the emergence of three malware campaigns built on publicly available source code for the Mirai and Gafgyt malware families that incorporate multiple...

Jul 20, 2018

By Ruchna Nigam

Unit 42

IoT Malware Evolves to Harvest Bots by Exploiting a Zero-day Home Router Vu...

In early December 2017, 360 Netlab discovered a new malware family which they named Satori. Satori is a derivative of Mirai and exploits two vulnerabilities: CVE-2014-8361 a code e...

Jan 11, 2018

By Cong Zheng, Claud Xiao and Yanhui Jia

Unit 42

New IoT/Linux Malware Targets DVRs, Forms Botnet

Unit 42 researchers have identified a new variant of the IoT/Linux botnet “Tsunami”, which we are calling “Amnesia”. The Amnesia botnet targets an unpatched remote code execution vulnerability that was publicly...

Apr 06, 2017

By Claud Xiao, Cong Zheng and Yanhui Jia

Malware, Threat Prevention, Unit 42

Andromeda Botnet Targets Italy in Recent Spam Campaigns

Over the past month, Palo Alto Networks has observed two spam campaigns targeting users residing in Italy. The spam emails attempt to install the pervasive Andromeda malware onto victim machines. This malware h...

Jul 18, 2016

By Josh Grunzweig and Brandon Levene

Threat Prevention, Unit 42

Locky: New Ransomware Mimics Dridex-Style Distribution

Ransomware persists as one of the top crimeware threats thus far into 2016. While the use of document-based macros for ransomware distribution remains relatively uncommon, a new family calling itself "Locky" ha...

Feb 16, 2016

By Brandon Levene, Micah Yates and Rob Downs

Malware, Threat Advisory/Analysis, Threat Prevention, Unit 42

Filmkan: Mysterious Turkish Botnet Grows Through Facebook

On January 31, a security researcher named Mohammad Faghani posted an analysis of malware that was being distributed through Facebook posts. Based on the number of “likes” the malw...

Feb 05, 2015

By Ryan Olson

Threat Prevention, Unit 42

Kuluoz Trends – October 2014

The Asprox/Kuluoz malware family has a special place in our hearts at Palo Alto Networks. This botnet-related Trojan malware has evolved from its 2007 roots into a simple and yet robust mass e-mail phishing threat that is the origin of a significant percentage of Intern...

Nov 07, 2014

By Rob Downs and Victor Ocho

Uncategorized

IRC on Non-Standard Ports

Johannes B. Ullrich from SANS wrote about a user that made an interesting find in their network (you can read Johannes note here). In short, the user wrote an IDS signature to look for the NICK and USER commands that signify the start of an IRC session, and lo and behol...

Aug 04, 2011

By Palo Alto Networks

Threat Advisory/Analysis

How Palo Alto Network’s Next-Generation Firewalls Protect Against Torpig At...

In this blog, I talk about how our next-generation firewalls protect against botnets such as Torpig. There are 3 parts to a botnet attack:

Aug 19, 2010

By Anna Lough

Load more blogs