NL2XQL: Turning Natural Language into Powerful Cybersecurity Querying
NL2XQL transforms natural language into powerful XQL queries, making cybersecurity investigations accessible to all security teams without requiring deep syntax knowledge.
Palo Alto Networks
threat research
2023 Unit 42 Attack Surface Threat Report Highlights the Need for ASM
The 2023 Unit 42 Attack Surface Threat Report highlights the need for attack surface management capabilities.
Cybersecurity Insights: Upcoming Events with the Threat Research Team
Join Palo Alto Networks' Threat Research Team at upcoming global events. Learn about espionage campaigns, web hosting threats, and APTs.
Mitigate Cloud Breaches With a Holistic Approach to Cloud Identity and Acce...
Take a defense in depth approach to protect your cloud identities, credentials and secrets, and secure your cloud environment from breaches.
Cloud Infrastructure Entitlement Management, Cloud Native Application Platform, Cloud Workload Protection Platform, Points of View
Containers, Assemble: What Cloud Threat Actors Don’t Want You to Know
Cloud Threat Actors target cloud environments – learn how your organization can combine cl...
WAAS-Up with Cryptojacking Microservice-Based Web Apps?
Exploring a malicious attempt at cryptojacking a microservice-based web app, and contrasting a few ways Prisma Cloud could have thwarted it.
Cortex XDR Blocks Undiscovered UAC Bypasses
Cortex XDR researchers recently found new UAC (User Account Control) bypasses on a fully patched Windows 10. While the method used is not new, the abused binaries that can be used with that method were previous...
Announcing Cortex XDR Managed Threat Hunting – Community Edition and New XD...
The Community Access edition of Cortex XDR Managed Threat Hunting is a powerful threat hunting service exclusively for our Cortex XDR customers.
Unit 42 Named Top Zero-Day Vulnerability Contributor by Microsoft
Palo Alto Networks is proud that Microsoft has recognized our Unit 42 global threat intelligence team with multiple awards for its contributions to vulnerability research, includin...
OilRig Data Analysis Shows Breadth of Hacking Campaign
Palo Alto Networks Unit 42 threat research team has determined that the OilRig hacking group’s activities are more widespread than previously understood, compromising at least 97 organizations in 27 countries, ...
EMEA Bi-Monthly Threat Reports: Turkey, Saudi Arabia & United Arab Emi...
Unit 42's EMEA bi-monthly threat report.
EMEA Bi-Monthly Threat Reports: United Kingdom, Germany & France
Alex Hinchliffe of Unit 42 examines recent threats targeting the EMEA region.
A New Trend in Android Adware: Abusing Android Plugin Frameworks
Unit 42 researchers uncover aggressive adware abusing third-party DroidPlugin framework on Android.
Targeted Ransomware Attacks Middle Eastern Government Organizations for Pol...
New research from Palo Alto Networks Unit 42: Targeted ransomware attacks Middle Eastern governments for political purposes.
Google Play Apps Infected with Malicious IFrames
Unit 42 researchers discover Google Play apps infected with malicious IFrames.
The Gamaredon Group Toolset Evolution
Unit 42 threat researchers have recently observed a threat group distributing new, custom developed malware. We have labelled this threat group the Gamaredon Group and our research shows that the Gamaredon Group has been active since at least 2013.
Downeks and Quasar RAT Used in Recent Targeted Attacks Against Governments
Downeks and Quasar RAT used in recent targeted attacks against governments. Get the full report from Unit 42.
Threat Brief: Shamoon 2 Wave 3 Attacks
Read the new Unit 42 Threat Brief for the latest update on Shamoon 2.
Farming Malicious Documents to Unravel Ransomware
Unit 42 researcher analyzes new threat technique in this blog post on the farming of malicious documents to unravel ransomware.
Exploring the Cybercrime Underground: Part 3 – Into the RAT Nest
In this third part of Unit 42’s Cybercrime Underground blog series, we’re taking a slightly different approach. In this blog we begin with data from a real attack in the wild, and...
2016 Updates to Shifu Banking Trojan
Shifu is a Banking Trojan first discovered in 2015. Shifu is based on the Shiz source code which incorporated techniques used by Zeus. Attackers use Shifu to steal credentials for online banking websites around the world, starting in Russia but later including the UK, I...
Subscribe to the Blog!
Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more.
By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement. Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder.