#unit-42 — Public Fediverse posts

Threat Actors Exploit Blind Spots Beyond Endpoint Defenses

Attackers are now moving at an alarming pace, taking data four times faster than in 2025, and exploiting the blind spots that an over-reliance on endpoint defenses creates. They're striking across multiple surfaces, from cloud services to remote users, to evade detection and get in and out quickly.

https://osintsights.com/threat-actors-exploit-blind-spots-beyond-endpoint-defenses?utm_source=mastodon&utm_medium=social

#EndpointDefenses #BlindSpots #Exfiltration #IncidentResponse #Unit42

TeamPCP Infiltrates Security Infrastructure with Multi-Stage Supply Chain Attack

When security tools meant to safeguard networks become the entry point for attacks, trust is shattered - and that's exactly what's happening with TeamPCP's multi-stage supply chain attacks on security infrastructure. This sinister tactic lets threat actors turn protectors into launchpads for wider compromise.

https://osintsights.com/teampcp-infiltrates-security-infrastructure-with-multi-stage-supply-chain-attack

#Teampcp #SupplyChainAttack #SecurityInfrastructure #Unit42 #VectRansomware

Unit 42 Uncovers Axios Supply Chain Attack's Far-Reaching Consequences

When a trusted software pathway is compromised, the consequences can be far-reaching - as Unit 42's recent analysis of the Axios supply chain attack starkly reveals, threatening digital trust and resilience. The team's detailed examination exposes the attack's full chain, from initial dropper to forensic cleanup.

https://osintsights.com/unit-42-uncovers-axios-supply-chain-attacks-far-reaching-consequences

#Axios #Unit42 #SupplyChainAttack #DigitalTrust #CyberResilience

Unit 42 Research Exposes Risks in Amazon Bedrock's Multi-Agent AI Systems

Unit 42's latest research reveals a hidden threat: multi-agent AI systems on Amazon Bedrock can be vulnerable to new and alarming risks, including prompt injection attacks that practitioners can't afford to ignore. Learn how to safeguard your AI applications from these emerging threats.

https://osintsights.com/unit-42-research-exposes-risks-in-amazon-bedrocks-multi-agent-ai-systems

#AmazonBedrock #MultiagentAiSystems #Unit42 #AiSecurity #PromptInjection

Kubernetes Environments Under Siege as Attacks Escalate

Kubernetes environments are under attack like never before, with threat actors exploiting identities and critical vulnerabilities to compromise cloud infrastructure - so what can organizations do to protect themselves? The warning signs are clear: it's time to take action against escalating Kubernetes attacks.

https://osintsights.com/kubernetes-environments-under-siege-as-attacks-escalate

#Kubernetes #CloudSecurity #Unit42 #IdentityExploitation #VulnerabilityExploitation

Unit 42: Identity gaps and AI speed increase enterprise risks https://techhq.com/news/unit-42-identity-gaps-and-ai-speed-increase-enterprise-risks/ #unit42 #paloaltonetworks #cybersecurity #threatintel #ciso #enterprise #infosec #ai #technology

Unit 42: Identity gaps and AI speed increase enterprise risks https://techhq.com/news/unit-42-identity-gaps-and-ai-speed-increase-enterprise-risks/ #unit42 #paloaltonetworks #cybersecurity #threatintel #ciso #enterprise #infosec #ai #technology

Milano-Cortina 2026, la sfida invisibile: la sicurezza informatica sotto i riflettori: Milano-Cortina 2026 non sara’ solo una vetrina globale per lo sport invernale. Accanto alla competizione atletica, si profila un’altra sfida, meno visibile ma...
#cybersecurity #Unit42 #PaloAltoNetworks #UmbertoPirovano #intelligenzaartificiale http://dlvr.it/TQZs33

From ransomware to fake ticket scams, a new report warns that hackers are ready to exploit the Milano Cortina games. https://jpmellojr.blogspot.com/2026/01/hackers-going-for-gold-at-winter.html #PaloAltoNetworks #WinterOlympics #MilanoCortina2026 #Unit42 #scams #cybercrime

Surprising - NOT! We knew this was bound to happen, or should we indicate that Cyber Hackers just want to be more productive - like everyone else, and AI is a good place to explore!

Unit 42 @ Palo Alto Networks reports how underground hacking forums advertise and sell custom, jail broken, and open-source AI hacking tools. Cyber bad guys are accessing sophisticated underground markets for custom LLMs (many subscription-based) designed to assist with lower-level hacking tasks. https://cyberscoop.com/malicious-llm-tools-cybercrime-wormgpt-kawaiigpt/

#AI #CyberSecurity #CyberCrime #Darkweb #CyberHackers #Hackers #CyberAttacks #KawaiiGPT #WormGPT #Unit42 #CustomLLM #JailBreakLLM #Security #Productivity

Surprising - NOT! We knew this was bound to happen, or should we indicate that Cyber Hackers just want to be more productive - like everyone else, and AI is a good place to explore!

Unit 42 @ Palo Alto Networks reports how underground hacking forums advertise and sell custom, jail broken, and open-source AI hacking tools. Cyber bad guys are accessing sophisticated underground markets for custom LLMs (many subscription-based) designed to assist with lower-level hacking tasks. https://cyberscoop.com/malicious-llm-tools-cybercrime-wormgpt-kawaiigpt/

#AI #CyberSecurity #CyberCrime #Darkweb #CyberHackers #Hackers #CyberAttacks #KawaiiGPT #WormGPT #Unit42 #CustomLLM #JailBreakLLM #Security #Productivity

🎯 AI
===================

Executive summary: Unit 42 documents a class of purpose-built malicious LLMs, notably WormGPT and KawaiiGPT, which are intentionally stripped of ethical constraints and marketed to criminal customers. These models combine high linguistic fidelity with code-generation fluency to accelerate social engineering and malware development.

Technical details:
• Models are reported to be either trained without safety layers or fine‑tuned to bypass standard content filters. Marketing occurs in underground forums and Telegram channels.
• Core advertised capabilities include generation of tailored phishing emails, creation of polymorphic malware snippets, and orchestration/automation of reconnaissance workflows.
• The paired strengths of linguistic precision and programmatic code output enable rapid production of convincing lures and working payloads with minimal human expertise.

Analysis:
• The observed effect is a compression of the attacker development lifecycle: tasks that previously required multiple specialists (social engineering writers, malware coders, recon analysts) can be largely automated by a single model-driven workflow.
• This drives a “scale over skill” dynamic: less-skilled actors can execute higher-quality campaigns at volume, increasing potential for credential harvesting, data exfiltration, and follow-on intrusion activities.

Detection (as reported):
• Unit 42 positions these models as offensive tools rather than simple jailbroken public models; the article does not publish IoCs or sample payloads but highlights distribution via Telegram and underground forums.

Mitigation (as reported):
• Unit 42 offers AI Security Assessment and Incident Response services to help organizations evaluate risk and respond to compromises; readers are directed to Unit 42 Incident Response when urgent matters arise.

Limitations and open questions:
• The report does not include sample model outputs, hashes, or specific infrastructure indicators, limiting immediate operational detection tuning.
• The broader prevalence and integration of such models into larger criminal toolchains remain areas noted for further monitoring.

🔹 LLM #AIsecurity #malware #phishing #Unit42

🔗 Source: https://unit42.paloaltonetworks.com/dilemma-of-ai-malicious-llms/

Another day, another #malware attack on #smartphones. Researchers at #Unit42, ,the threat intelligence arm of #PaloAltoNetworks , have revealed a sophisticated #spyware known as “Landfall” targeting #SamsungGalaxy phones. The researchers say this campaign leveraged a zero-day exploit in Samsung #Android software to steal a raft of personal data, and it was active for almost a year. Thankfully, the underlying #vulnerability has now been patched
#privacy #security

https://arstechnica.com/gadgets/2025/11/commercial-spyware-landfall-ran-rampant-on-samsung-phones-for-almost-a-year/

Another day, another #malware attack on #smartphones. Researchers at #Unit42, ,the threat intelligence arm of #PaloAltoNetworks , have revealed a sophisticated #spyware known as “Landfall” targeting #SamsungGalaxy phones. The researchers say this campaign leveraged a zero-day exploit in Samsung #Android software to steal a raft of personal data, and it was active for almost a year. Thankfully, the underlying #vulnerability has now been patched
#privacy #security

https://arstechnica.com/gadgets/2025/11/commercial-spyware-landfall-ran-rampant-on-samsung-phones-for-almost-a-year/

LANDFALL: New Commercial-Grade Android Spyware in Exploit Chain Targeting Samsung Devices // Nouveau logiciel espion Android de niveau commercial dans une chaîne d’exploitation visant les appareils Samsung

https://unit42.paloaltonetworks.com/landfall-is-new-commercial-grade-android-spyware/

@cyberfr

#Unit42 #Landfall #Android

LANDFALL: New Commercial-Grade Android Spyware in Exploit Chain Targeting Samsung Devices // Nouveau logiciel espion Android de niveau commercial dans une chaîne d’exploitation visant les appareils Samsung

https://unit42.paloaltonetworks.com/landfall-is-new-commercial-grade-android-spyware/

@cyberfr

#Unit42 #Landfall #Android

Rok na celowniku. Oprogramowanie „Landfall” przez rok szpiegowało telefony Samsunga

To brzmi jak scenariusz filmu szpiegowskiego, ale wydarzyło się naprawdę. Analitycy z Unit 42, specjalnej jednostki ds. cyberbezpieczeństwa w Palo Alto Networks, ujawnili istnienie wysoce zaawansowanego oprogramowania szpiegowskiego o nazwie „Landfall”.

Atak był wymierzony w smartfony Samsung Galaxy i był aktywny przez prawie rok, zanim luka została załatana. Oprogramowanie pozwalało na kradzież praktycznie wszystkich danych z telefonu, a także na zdalne aktywowanie kamery i mikrofonu w celu szpiegowania użytkownika.

Atak typu zero-click, czyli broń w obrazku

Najbardziej niepokojący w ataku „Landfall” jest jego mechanizm. Był to atak typu zero-click, co oznacza, że do infekcji nie była wymagana absolutnie żadna interakcja ze strony użytkownika – nie trzeba było klikać w żaden link ani niczego instalować.

Jak to działało?

• Dostawa: atakujący przesyłali ofierze (prawdopodobnie przez komunikator typu WhatsApp) specjalnie spreparowany plik graficzny.
• Przynęta: „bronią” nie był zwykły JPG, lecz zmodyfikowany plik DNG – jest to format typu „raw” (surowy obraz) bazujący na formacie TIFF.
• Pułapka: wewnątrz tego pliku DNG hakerzy osadzili ukryte archiwum ZIP zawierające złośliwy kod.
• Luka: problem leżał w bibliotece przetwarzania obrazu w oprogramowaniu Samsunga.

Gdy telefon próbował przetworzyć ten plik (np. by wyświetlić jego miniaturkę w galerii lub komunikatorze), system operacyjny rozpakowywał ukryty plik ZIP i uruchamiał złośliwe oprogramowanie szpiegowskie.

Po zainfekowaniu, „Landfall” modyfikował polityki SELinux (mechanizm bezpieczeństwa w Androidzie), aby zakopać się głęboko w systemie, uzyskać szerokie uprawnienia i uniknąć wykrycia.

Kto był celem?

Analitycy z Unit 42 uspokajają, że nie był to atak masowy. Wszystko wskazuje na to, że „Landfall” był używany do precyzyjnie wymierzonych działań szpiegowskich, głównie na Bliskim Wschodzie (wskazano na Irak, Iran, Turcję i Maroko).

W kodzie złośliwego oprogramowania znaleziono bezpośrednie odniesienia do konkretnych modeli Samsunga, w tym Galaxy S22, Galaxy S23, Galaxy S24, Galaxy Z Flip 4 oraz Galaxy Z Fold 4. Chociaż nie zidentyfikowano autorów ataku, jego złożoność i metody działania przypominają narzędzia tworzone przez komercyjne firmy zajmujące się cyberwywiadem, takie jak osławiona NSO Group (twórcy Pegasusa).

Sprawdź, czy jesteś bezpieczny

Luka (zarejestrowana jako CVE-2025-21042) była obecna w oprogramowaniu Samsunga opartym na Androidzie od 13 do 15. Producent wydał krytyczną poprawkę bezpieczeństwa w kwietniu 2025 roku.

Analitycy z Unit 42 wstrzymywali się z publikacją szczegółów ataku do teraz, aby dać użytkownikom czas na aktualizację. Teraz, gdy metoda jest publiczna, kluczowe jest, aby każdy posiadacz telefonu Samsung upewnił się, że ma zainstalowane wszystkie aktualizacje systemu, a w szczególności łatkę bezpieczeństwa z kwietnia 2025 lub nowszą.

#Android #CVE202521042 #DNG #GalaxyS23 #GalaxyS24_ #Landfall #lukaBezpieczeństwa #news #oprogramowanieSzpiegowskie #Samsung #spyware #Unit42 #zeroClick

Rok na celowniku. Oprogramowanie „Landfall” przez rok szpiegowało telefony Samsunga

To brzmi jak scenariusz filmu szpiegowskiego, ale wydarzyło się naprawdę. Analitycy z Unit 42, specjalnej jednostki ds. cyberbezpieczeństwa w Palo Alto Networks, ujawnili istnienie wysoce zaawansowanego oprogramowania szpiegowskiego o nazwie „Landfall”.

Atak był wymierzony w smartfony Samsung Galaxy i był aktywny przez prawie rok, zanim luka została załatana. Oprogramowanie pozwalało na kradzież praktycznie wszystkich danych z telefonu, a także na zdalne aktywowanie kamery i mikrofonu w celu szpiegowania użytkownika.

Atak typu zero-click, czyli broń w obrazku

Najbardziej niepokojący w ataku „Landfall” jest jego mechanizm. Był to atak typu zero-click, co oznacza, że do infekcji nie była wymagana absolutnie żadna interakcja ze strony użytkownika – nie trzeba było klikać w żaden link ani niczego instalować.

Jak to działało?

• Dostawa: atakujący przesyłali ofierze (prawdopodobnie przez komunikator typu WhatsApp) specjalnie spreparowany plik graficzny.
• Przynęta: „bronią” nie był zwykły JPG, lecz zmodyfikowany plik DNG – jest to format typu „raw” (surowy obraz) bazujący na formacie TIFF.
• Pułapka: wewnątrz tego pliku DNG hakerzy osadzili ukryte archiwum ZIP zawierające złośliwy kod.
• Luka: problem leżał w bibliotece przetwarzania obrazu w oprogramowaniu Samsunga.

Gdy telefon próbował przetworzyć ten plik (np. by wyświetlić jego miniaturkę w galerii lub komunikatorze), system operacyjny rozpakowywał ukryty plik ZIP i uruchamiał złośliwe oprogramowanie szpiegowskie.

Po zainfekowaniu, „Landfall” modyfikował polityki SELinux (mechanizm bezpieczeństwa w Androidzie), aby zakopać się głęboko w systemie, uzyskać szerokie uprawnienia i uniknąć wykrycia.

Kto był celem?

Analitycy z Unit 42 uspokajają, że nie był to atak masowy. Wszystko wskazuje na to, że „Landfall” był używany do precyzyjnie wymierzonych działań szpiegowskich, głównie na Bliskim Wschodzie (wskazano na Irak, Iran, Turcję i Maroko).

W kodzie złośliwego oprogramowania znaleziono bezpośrednie odniesienia do konkretnych modeli Samsunga, w tym Galaxy S22, Galaxy S23, Galaxy S24, Galaxy Z Flip 4 oraz Galaxy Z Fold 4. Chociaż nie zidentyfikowano autorów ataku, jego złożoność i metody działania przypominają narzędzia tworzone przez komercyjne firmy zajmujące się cyberwywiadem, takie jak osławiona NSO Group (twórcy Pegasusa).

Sprawdź, czy jesteś bezpieczny

Luka (zarejestrowana jako CVE-2025-21042) była obecna w oprogramowaniu Samsunga opartym na Androidzie od 13 do 15. Producent wydał krytyczną poprawkę bezpieczeństwa w kwietniu 2025 roku.

Analitycy z Unit 42 wstrzymywali się z publikacją szczegółów ataku do teraz, aby dać użytkownikom czas na aktualizację. Teraz, gdy metoda jest publiczna, kluczowe jest, aby każdy posiadacz telefonu Samsung upewnił się, że ma zainstalowane wszystkie aktualizacje systemu, a w szczególności łatkę bezpieczeństwa z kwietnia 2025 lub nowszą.

#Android #CVE202521042 #DNG #GalaxyS23 #GalaxyS24_ #Landfall #lukaBezpieczeństwa #news #oprogramowanieSzpiegowskie #Samsung #spyware #Unit42 #zeroClick

Unit 42 links Airstalk — an MDM-abusing backdoor — to a suspected nation-state supply-chain campaign. Using AirWatch/Workspace ONE APIs for covert C2 and blob exfiltration, it targets browser artifacts and screenshots; some samples show likely-stolen signing certs.
How are you tightening vendor MDM permissions? Comment & follow TechNadu for updates.

#Airstalk #MDM #SupplyChain #Unit42 #CyberSecurity #Infosec #TechNadu #ThreatIntel #EndpointSecurity

Phishers Target Aviation Execs to Scam Customers https://krebsonsecurity.com/2025/07/phishers-target-aviation-execs-to-scam-customers/ #AssociationforFinancialProfessionals #InternetCrimeComplaintCenter #roomservice801@gmail.com #businessemailcompromise #financialfraudkillchain #Target:SmallBusinesses #Ne'er-Do-WellNews #PaloAltoNetworks #ALittleSunshine #SilverTerrier #Breadcrumbs #domaintools #JustyJohn #Unit42 #BEC

Phishers Target Aviation Execs to Scam Customers https://krebsonsecurity.com/2025/07/phishers-target-aviation-execs-to-scam-customers/ #AssociationforFinancialProfessionals #InternetCrimeComplaintCenter #roomservice801@gmail.com #businessemailcompromise #financialfraudkillchain #Target:SmallBusinesses #Ne'er-Do-WellNews #PaloAltoNetworks #ALittleSunshine #SilverTerrier #Breadcrumbs #domaintools #JustyJohn #Unit42 #BEC

Phishers Target Aviation Execs to Scam Customers

https://krebsonsecurity.com/2025/07/phishers-target-aviation-execs-to-scam-customers/

#AssociationforFinancialProfessionals #InternetCrimeComplaintCenter #roomservice801@gmail.com #businessemailcompromise #financialfraudkillchain #Target:SmallBusinesses #Ne'er-Do-WellNews #PaloAltoNetworks #ALittleSunshine #SilverTerrier #Breadcrumbs #domaintools #JustyJohn #Unit42 #BEC

Phishers Target Aviation Execs to Scam Customers

https://krebsonsecurity.com/2025/07/phishers-target-aviation-execs-to-scam-customers/

#AssociationforFinancialProfessionals #InternetCrimeComplaintCenter #roomservice801@gmail.com #businessemailcompromise #financialfraudkillchain #Target:SmallBusinesses #Ne'er-Do-WellNews #PaloAltoNetworks #ALittleSunshine #SilverTerrier #Breadcrumbs #domaintools #JustyJohn #Unit42 #BEC

📬 KI-generierte Malware: Unbegrenzte Möglichkeiten für Kriminelle
#KünstlicheIntelligenz #Malware #ChatGPT #GenerativeKI #KIMalware #LLMs #Unit42 #WormGPT https://sc.tarnkappe.info/a5082e

📬 KI-generierte Malware: Unbegrenzte Möglichkeiten für Kriminelle
#KünstlicheIntelligenz #Malware #ChatGPT #GenerativeKI #KIMalware #LLMs #Unit42 #WormGPT https://sc.tarnkappe.info/a5082e

🚨 Threat Alert! 🚨 Unit 42 reveals a phishing campaign exploiting HubSpot to harvest Microsoft Azure credentials, targeting European companies. With 20,000 users affected, attackers used urgency tactics and fraudulent forms. Stay vigilant! 🔒💻
Learn more about this ongoing threat: https://cyberinsider.com/threat-actors-exploit-hubspot-to-harvest-microsoft-azure-credentials/
#CyberSecurity #Phishing #MicrosoftAzure #HubSpot #Unit42 #newz

🚨 Threat Alert! 🚨 Unit 42 reveals a phishing campaign exploiting HubSpot to harvest Microsoft Azure credentials, targeting European companies. With 20,000 users affected, attackers used urgency tactics and fraudulent forms. Stay vigilant! 🔒💻
Learn more about this ongoing threat: https://cyberinsider.com/threat-actors-exploit-hubspot-to-harvest-microsoft-azure-credentials/
#CyberSecurity #Phishing #MicrosoftAzure #HubSpot #Unit42 #newz

Increasing Awareness of DNS Hijacking: A Growing Cyber Threat – Source: www.techrepublic.com https://ciso2ciso.com/increasing-awareness-of-dns-hijacking-a-growing-cyber-threat-source-www-techrepublic-com/ #DigitalHealthandWellness #rssfeedpostgeneratorecho #SecurityonTechRepublic #maninthemiddleattack #SecurityTechRepublic #CyberSecurityNews #dnscachepoisoning #paloaltonetwork #Cyberattackers #datamanagement #International #CyberThreats #DNShijacking #0CISO2CISO #passivedns #Security #unit42

Increasing Awareness of DNS Hijacking: A Growing Cyber Threat – Source: www.techrepublic.com https://ciso2ciso.com/increasing-awareness-of-dns-hijacking-a-growing-cyber-threat-source-www-techrepublic-com/ #DigitalHealthandWellness #rssfeedpostgeneratorecho #SecurityonTechRepublic #maninthemiddleattack #SecurityTechRepublic #CyberSecurityNews #dnscachepoisoning #paloaltonetwork #Cyberattackers #datamanagement #International #CyberThreats #DNShijacking #0CISO2CISO #passivedns #Security #unit42

Multiple high-profile #opensource projects, including those from #Google, #Microsoft, #AWS, and #RedHat, were found to leak #GitHub authentication tokens through #GitHubActions artifacts in CI/CD.
#PaloAltoNetworks #Unit42 found it affected:
Firebase
OpenSearch Security
Clair
JSON Schemas
TypeScript Repos Automation, TypeScript Bot Test Triggerer, Azure Draft
CycloneDX SBOM (OWASP)
Stockfish
Libevent
Guardian for Apache Kafka
Git Annex
Penrose
Deckhouse
Concrete-ML
https://www.bleepingcomputer.com/news/security/github-actions-artifacts-found-leaking-auth-tokens-in-popular-projects/

Unit 42 researchers uncover critical GitHub Actions vulnerability https://www.developer-tech.com/news/unit-42-researchers-critical-github-actions-vulnerability/ #github #unit42 #security #infosec #hacking #coding #programming #developers #tech #news #technology

Unveiling the Elusive Bifrost RAT's Latest Tactics and Techniques: https://www.reviewspace.info/unveiling-the-elusive-bifrost-rat-latest-tactics-and-techniques

#BifrostRAT #Cybersecurity #Malware #Typosquatting #PaloAltoNetworks #Unit42 #LinuxSecurity #RemoteAccessTrojan #TechnologyNews

Fighting Ursa Aka APT28: Illuminating a Covert Campaign

Early this year, Ukrainian cybersecurity researchers found Fighting Ursa leveraging a zero-day exploit in Microsoft Outlook (now known as CVE-2023-23397). This vulnerability is especially concerning since it doesn’t require user interaction to exploit. Unit 42 researchers have observed this group using CVE-2023-23397 over the past 20 months to target at least 30 organizations within 14 nations that are of likely strategic intelligence value to the Russian government and its military.

Pulse ID: 6572250f298d2a69b238cf72
Pulse Link: https://otx.alienvault.com/pulse/6572250f298d2a69b238cf72
Pulse Author: AlienVault
Created: 2023-12-07 20:03:26

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#OTX #OpenThreatExchange #InfoSec #bot #CyberSecurity #Unit42 #Microsoft #Government #Russia #UK #RAT #Military #ZeroDay #Vulnerability #AlienVault

New Tool Set Found Used Against Organizations in the Middle East, Africa and the US

A new set of tools used by nation-state hackers has been found in a series of attacks targeting organizations across the Middle East, Africa and the US, according to research by Palo Alto Networks Unit 42.

Pulse ID: 65721613cd9948d23dab7078
Pulse Link: https://otx.alienvault.com/pulse/65721613cd9948d23dab7078
Pulse Author: Cyber74Team
Created: 2023-12-07 18:59:31

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#OTX #OpenThreatExchange #InfoSec #bot #CyberSecurity #Unit42 #PaloAlto #MiddleEast #Cyber74Team

Palo Alto's #Unit42 shared new insights regarding #AgentTesla malware operations. And a fresh set of samples along with their Indicators of Compromise (#IOCs) have been made available for further analysis here bit.ly/3ZupKbh6.

🚨 BREAKING: A highly sophisticated P2P worm named "P2PInfect" is wreaking havoc on Redis instances! 🐛💻 It exploits the critical CVE-2022-0543 vulnerability in the Lua Library with a 10.0 severity score on CVSSv3 scale. Once in, it alters firewalls, granting unrestricted access to operators. 😱

P2PInfect establishes a P2P connection via port 60100 to a large C2 botnet, but no evidence of cryptomining yet. 😮 934 out of 307,000 Redis instances have already fallen victim. 😨

What's scarier? P2PInfect is using Rust, favored by ransomware groups for fast encryption and evading detection. 🦾

🔒 Stay safe! Update your Redis and amp up your cybersecurity practices NOW! 🔒

Source: Unit 42 researchers https://www.hackread.com/self-replicating-p2pinfect-worm-redis-instances/

Key points:
- The worm, known as P2PInfect, is written in Rust and targets the popular open-source database software Redis.
- It exploits a critical vulnerability (CVE-2022-0543) in the Lua Library, which has a severity score of 10.0 on the CVSSv3 scale.
- Once inside a Redis instance, the worm alters local firewall settings, blocking legitimate access and granting unrestricted access to the worm operators.
- The worm establishes a P2P connection via port 60100 to a large command and control (C2) botnet. There's no evidence yet of P2PInfect engaging in cryptomining using infected instances.
- The worm's rapid spread has been noted, with 934 out of 307,000 publicly-communicating Redis instances identified as vulnerable.
- The use of Rust by P2PInfect is concerning as many ransomware groups have shifted to Rust for its benefits, such as faster encryption and evading common detection methods.
- Organizations and individuals are urged to update their Redis instances and implement robust cybersecurity practices to safeguard against potential attacks.

A highly sophisticated peer-to-peer (P2P) worm named "P2PInfect" has been identified by researchers from Unit 42. It targets instances of the popular open-source database software Redis, exploiting a critical vulnerability known as CVE-2022-0543 in the Lua Library. This vulnerability has received a maximum severity score of 10.0 on the CVSSv3 severity scale. Once inside a Redis instance, the worm establishes a foothold in cloud container environments, alters firewall settings, and grants the operators unrestricted access. P2PInfect employs sophisticated techniques for persistence, ensuring long-term presence on infected systems. It establishes a P2P connection to a large command and control botnet, raising concerns about potential future mining activities.

P2PInfect's use of the Rust programming language is unique and concerning to cybersecurity experts, as it offers benefits such as faster encryption and evading common detection methods. The worm's rapid spread has been observed, and organizations are urged to update their Redis instances and implement robust cybersecurity practices. The cybersecurity community must remain vigilant against emerging threats like P2PInfect and other advanced malware strains.

#P2PInfect
#CybersecurityAlert
#Redis
#RustLang
#CVE20220543
#CyberThreat
#Botnet
#CyberAttack
#InfoSec
#Unit42

#Unit42 researchers have been tracking a widespread malicious #JavaScript (JS) injection campaign that redirects victims to malicious content such as adware & scam pages. This threat was active throughout 2022 & continued even in 2023.

They detected the injected JS code on more than 51,000 websites, including hundreds of websites in Tranco’s top 1 million website ranking list. The presence of affected websites in #Tranco indicates that this campaign could have impacted a large number of people.