Palo Alto Networks

PlugX

HenBox: Inside the Coop

Summary

On March 13, 2018, we published a blog describing a new Android malware family we discovered and called “HenBox” based on metadata found in most of th...

Unit 42

Apr 26, 2018

By Alex Hinchliffe, Mike Harbison, Jen Miller-Osborn and Tom Lancaster

Palo Alto Networks

Products and Services

Partners

Unit 42

HenBox: The Chickens Come Home to Roost

Unit 42 recently discovered a new Android malware family we named “HenBox” masquerading as a variety of legitimate Android apps. We chose the name “HenBox” based on metadata found in most of the malicious apps...

Mar 13, 2018

By Alex Hinchliffe, Mike Harbison, Jen Miller-Osborn and Tom Lancaster

Unit 42

Paranoid PlugX

The PlugX malware has a long and extensive history of being used in intrusions as part of targeted attacks. PlugX is still popular today and its longevity is remarkable. The malware itself is well documented, with multiple excellent papers covering most aspects of its functionality. Some of the best...

Jun 27, 2017

By Tom Lancaster and Esmid Idrizovic

Cybersecurity, Threat Prevention, Unit 42

Tracking Elirks Variants in Japan: Similarities to Previous Attacks

A recent, well-publicized attack on a Japanese business involved two malware families, PlugX and Elirks, that were found during the investigation. Plu...

Jun 23, 2016

By Kaoru Hayashi

Malware, Unit 42

BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger

In late 2014, ESET presented an attack campaign that had been observed over a period of time targeting Russia and other Russian speaking nations, dubbed “Roaming Tiger”. The attack...

Dec 22, 2015

By Bryan Lee and Josh Grunzweig

Malware, Threat Prevention, Unit 42

Bookworm Trojan: A Model of Modular Architecture

Recently, while researching attacks on targets in Thailand, Unit 42 discovered a tool that initially appeared to be a variant of the well-known PlugX RAT based on similar observed behavior such as the usage of...

Nov 10, 2015

By Robert Falcone, Mike Scott and Juan Cortes

Events, News of the Week

Palo Alto Networks News of the Week – May 2

Here is all of the top Palo Alto Networks news from this past week.

May 02, 2015

By Chad Berndtson

Malware, Threat Prevention, Unit 42

PlugX Uses Legitimate Samsung Application for DLL Side-Loading

While threat actors using the PlugX Trojan typically leverage legitimate executables to load their malicious DLLs through a technique called DLL side-...

May 01, 2015

By Robert Falcone

Malware, Threat Advisory/Analysis, Threat Prevention, Unit 42

Unit 42 Identifies New DragonOK Backdoor Malware Deployed Against Japanese ...

Palo Alto Networks Unit 42 used the AutoFocus threat intelligence service to identify a series of phishing attacks against Japanese organizations. Usi...

Apr 14, 2015

By Jen Miller-Osborn and Josh Grunzweig

Threat Advisory/Analysis, Threat Prevention, Unit 42

Attacks on East Asia using Google Code for Command and Control

Recently, FireEye published a blog titled “Operation Poisoned Hurricane” which detailed the use of PlugX malware variants signed with legitimate certi...

Aug 15, 2014

By Jen Miller-Osborn and Rob Downs

Load more blogs