CVE-2024-7971, a vulnerability which could allow threat actors to gain remote code execution in the sandboxed Chromium renderer process, is being exploited in the wild. Microsoft just released a report identifying a North Korean actor exploiting this vulnerability. The group highlighted in the report, known as Citrine Sleet by Microsoft and Gleaming Pisces by Palo Alto Networks, is a suspected North Korea state-sponsored threat actor known for targeting organizations for financial gain. They exhibit a high degree of capability and preparation, demonstrating a deep understanding of the cryptocurrency industry and employing social engineering tactics to gain their victims' trust before deploying malicious payloads. Patches for CVE-202-7971 were made available on 21 Aug. Take action if you haven’t already! ▪️ Microsoft Threat Intelligence Report: https://bit.ly/3yZXZ1k ▪️ Google Chrome release update: https://bit.ly/3z0G0b1 ▪️ NIST entry: https://bit.ly/3Z7qgxE
Palo Alto Networks Unit 42
Computer and Network Security
SANTA CLARA, CA 73,434 followers
Unit 42 Threat Intelligence & Incident Response. Intelligence Driven. Response Ready.
About us
Palo Alto Networks Unit 42 brings together world-renowned threat researchers with an elite team of incident responders and security consultants to create an intelligence-driven, response-ready organization passionate about helping customers more proactively manage cyber risk. With a deeply rooted reputation for delivering world-class threat intelligence, Unit 42 provides industry-leading incident response and cyber risk management services to security leaders around the globe.
- Website
-
http://paloaltonetworks.com/unit42
External link for Palo Alto Networks Unit 42
- Industry
- Computer and Network Security
- Company size
- 5,001-10,000 employees
- Headquarters
- SANTA CLARA, CA
- Type
- Public Company
- Founded
- 2005
- Specialties
- Incident Response, Risk Management, Operational Threat Intelligence, and Network Security
Locations
-
Primary
3000 Tannery Way
SANTA CLARA, CA 95054, US
Employees at Palo Alto Networks Unit 42
Updates
-
WikiLoader (aka WailingCrab) has evolved. This article details the malware's new anti-analysis and evasion techniques in campaigns targeting users looking for updates to Palo Alto Networks GlobalProtect VPN. Through SEO poisoning and a spoof of legitimate products, we cover how financially motivated threat actors use this rentable loader and discuss why a possible shift from phishing to SEO poisoning occurred. https://bit.ly/3X6uK51
-
-
Threat actors don’t need hall passes 🎟️ Schools are increasingly targets of cybersecurity attacks. In this episode of Threat Vector, Technical Managing Director at Palo Alto Networks Unit 42 Mike Spisak discusses how to protect educational digital environments. Learn essential strategies including: 🏰How to strengthen defenses and stay ahead of cyber threats, adopt proactive security measures, and why fostering a cyber-aware culture is crucial in every learning environment. 🎧Tune in: https://bit.ly/3X1d4HQ Class, dismissed. 🎓
-
Unit 42’s latest research provides a comprehensive review of detection mechanisms for #deepfake #scams. We discuss the efficacy of current models and explore potential advancements in anomaly detection algorithms. https://bit.ly/3z4MmGk
-
-
2024-08-28 (Wednesday): More #Lumma #Stealer (#LummaStealer) from pages instructing potential victims to copy/paste #PowerShell script in a Run window. Recent examples of these human captcha style pages available at https://bit.ly/4cJk0zq #Unit42ThreatIntel #TimelyThreatIntel
-
-
In this article, we delve into a cloud-based extortion campaign orchestrated by Bling Libra, the group implementing ShinyHunters ransomware. Our findings reveal an exploitation of improperly secured AWS credentials, leading to unauthorized access and data manipulation. This case study serves as an interesting study for cloud security analysts and researchers to reassess their security measures and incident response strategies. We provide a detailed analysis of the attack vectors, the importance of robust IAM policies, and the effectiveness of continuous monitoring and logging. https://bit.ly/3SUe8MD
-
-
2024-08-26 (Monday): #malspam pushing #GuLoader for #Remcos #RAT (#RemcosRAT). Steals login credentials and runs #keylogger. Indicators available at https://bit.ly/3YXYGTl #TimelyThreatIntel #Unit42ThreatIntel #Wireshark #InfectionTraffic
-
-
DNS traffic patterns offer a new perspective on threats like domain squatting and internet scams. Discover how Unit 42 researchers tackle C2 server traffic and dynamic DNS abuse. This machine learning-powered system identifies and blocks suspicious activities, and case studies reveal the effectiveness of using an #autoencoder in real-world threat scenarios. https://bit.ly/3MehhmA
-
-
Fans of the new action RPG "Black Myth: Wukong" are being targeted through malicious domains. #Phishing, crypto #scams and illegal gambling linked to Wukong-themed domains are on the rise. More info at https://bit.ly/4dRll8c #Wukong #BlackMythWukong #TimelyThreatIntel
-
-
In response to a ransomware attack that severely disrupted government operations, Unit 42 promptly sprang into action. The #IncidentResponse experts determined the extent of the damage, identified the threat actor, and implemented a plan to recover, restoring critical services and helping rebuild citizen trust. https://bit.ly/4caO4Dw