Playbook of the Week: Swallow Traffic to Malicious Domains with DNS Sinkholes
Automatically redirect traffic away from malicious domains using DNS sinkholes
Palo Alto Networks
botnet
Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux an...
Unit 42 researchers discover Xbash, a new malware family tied to the Iron Group targeting Linux and Microsoft Servers
Multi-exploit IoT/Linux Botnets Mirai and Gafgyt Target Apache Struts, Soni...
Unit 42 has uncovered new variants of the well-known IoT botnets Mirai and Gafgyt.
Unit 42 Finds New Mirai and Gafgyt IoT/Linux Botnet Campaigns
Unit 42 documents the emergence of three malware campaigns built on publicly available source code for the Mirai and Gafgyt malware families that incorporate multiple known exploit...
IoT Malware Evolves to Harvest Bots by Exploiting a Zero-day Home Router Vu...
Unit 42 researchers outline the evolution of Satori, a malware family targeting zero-day vulnerabilities in IoT devices
New IoT/Linux Malware Targets DVRs, Forms Botnet
Unit 42 researchers have identified a new variant of the IoT/Linux botnet “Tsunami”, which we are calling “Amnesia”.
Andromeda Botnet Targets Italy in Recent Spam Campaigns
Over the past month, Palo Alto Networks has observed two spam campaigns targeting users residing in Italy. The spam emails attempt to install the pervasive Andromeda malware onto victim machines. This malware h...
Locky: New Ransomware Mimics Dridex-Style Distribution
Ransomware persists as one of the top crimeware threats thus far into 2016. While the use of document-based macros for ransomware distribution remains relatively uncommon, a new family calling itself "Locky" ha...
Filmkan: Mysterious Turkish Botnet Grows Through Facebook
On January 31, a security researcher named Mohammad Faghani posted an analysis of malware that was being distributed through Facebook posts. Based on the number of “likes” the malw...
Kuluoz Trends – October 2014
The Asprox/Kuluoz malware family has a special place in our hearts at Palo Alto Networks. This botnet-related Trojan malware has evolved from its 2007 roots into a simple and yet robust mass e-mail phishing threat that is the origin of a significant percentage of Intern...
IRC on Non-Standard Ports
Johannes B. Ullrich from SANS wrote about a user that made an interesting find in their network (you can read Johannes note here). In short, the user wrote an IDS signature to look for the NICK and USER commands that signify the start of an IRC session, and lo and behol...
How Palo Alto Network’s Next-Generation Firewalls Protect Against Torpig At...
In this blog, I talk about how our next-generation firewalls protect against botnets such as Torpig. There are 3 parts to a botnet attack:
Subscribe to the Blog!
Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more.
By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement. Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder.