Right arrow
Pictorial representation of Stately Taurus' updated TTPs. Illustration of a bull's head and the Taurus constellation inside a stylized orange moon, set against the profile of a much larger bull's head. Shooting stars are on the dark background.
category iconThreat Actor Groups

Chinese APT Abuses VSCode to Target Government in Asia
Pictorial representation of malware such as WikiLoader. Red and blue digital data flowing from microchips on a circuit board, representing high-tech computing.
category iconThreat Research

Spoofed GlobalProtect Used to Deliver Unique WikiLoader Variant
A visual representation of top level domain tracking. Close-up view of a modern data center with rows of illuminated server racks.
category iconThreat Research

TLD Tracker: Exploring Newly Released Top-Level Domains

Access the latest threat research

View all research Right Arrow
A pictorial representation of deepfake scams. A digital fingerprint integrated into a blue circuit board with glowing lights, illustrating concepts of cybersecurity and technology.
category iconDNS

The Emerging Dynamics of Deepfake Scam Campaigns on the Web
Read now
A pictorial representation of using autoencoders to detect malicious DNS traffic. Three transparent blocks with glowing letters "D," "N," and "S" on a circuit board background with blue and purple lighting.
category iconDNS

Autoencoder Is All You Need: Profiling and Detecting Malicious DNS Traffic
Read now
Pictorial representation of an extortion operation in the cloud. Vibrant digital artwork depicting a futuristic cityscape with glowing neon roads weaving through clouds, set against a backdrop of skyscrapers and a vivid sky.
category iconCloud Cybersecurity Research

Leaked Environment Variables Allow Large-Scale Extortion Operation in Cloud Environments
Read now

Understand high profile cyberthreats and vulnerabilities

View high profile threats Right Arrow
Abstract illustration of a network sppread like a spiderweb, connecting covering the globe and symbolizing data or communication links.
category iconVulnerabilities

Threat Brief: CVE-2024-6387 OpenSSH RegreSSHion Vulnerability
Read now
A digital illustration of a world map focused on Europe and parts of Asia, highlighted with glowing connections and nodes representing global connectivity.
category iconVulnerabilities

Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400 (Updated May 20)
Read now
Futuristic illustration with glowing neon lights and advanced technology motifs, depicting cloud computing and data flow through interconnected networks. The scene is highlighted by hovering digital clouds and dynamic, illuminated linear structures, set in a dramatic, blue and orange color scheme.
category iconCloud Cybersecurity Research

Muddled Libra’s Evolution to the Cloud
Read now
Close-up side profile of a Black woman wearing glasses, focused intently on something out of frame.
category iconCloud Cybersecurity Research

Threat Brief: Vulnerability in XZ Utils Data Compression Library Impacting Multiple Linux Distributions (CVE-2024-3094)
Read now
A digital illustration of glowing blockchain links superimposed on a background of binary code, representing cybersecurity and digital transactions in the context of modern financial technologies.
category iconMalware

Threat Group Assessment: Muddled Libra (Updated)
Read now
Abstract illustration of a digital network connecting various points on a map of the United States, symbolizing data or communication links.
category iconVulnerabilities

Threat Brief: ConnectWise ScreenConnect Vulnerabilities (CVE-2024-1708 and CVE-2024-1709)
Read now

Watch, listen and learn about cybersecurity topics

View All Right Arrow

Follow the activities of threat actor groups tracked by Unit 42

All threat actor posts Right Arrow
A pictorial representation of ShinyHunters ransomware. An image showing a laptop with security and financial graphics displayed on the screen, surrounded by stacks of coins and a credit card, set against a dark background illuminated by neon lights.
category iconRansomware

Bling Libra’s Tactical Evolution: The Threat Actor Group Behind ShinyHunters Ransomware
Read now
Pictorial representation of APT Fighting Ursa. The silhouette of a bear and the Ursa constellation inside an orange abstract planet. Abstract, stylized cosmic setting with vibrant blue and purple claw marks, representing space and distant planetary bodies.
category iconNation-State Cyberattacks

Fighting Ursa Luring Targets With Car for Sale
Read now
Constellation image representing the constellation schema used by Palo Alto Networks Unit 42 to track nation-state and cybercrime threat actor groups
category iconNation-State Cyberattacks

Threat Actor Groups Tracked by Palo Alto Networks Unit 42
Read now
A digital image depicting a skull formed by binary code, composed of ones and zeros, in shades of blue against a black background. The binary numbers appear to float and overlay each other, creating a visually striking and thematic technological motif.
category iconMalware

Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia
Read now
Futuristic illustration with glowing neon lights and advanced technology motifs, depicting cloud computing and data flow through interconnected networks. The scene is highlighted by hovering digital clouds and dynamic, illuminated linear structures, set in a dramatic, blue and orange color scheme.
category iconCloud Cybersecurity Research

Muddled Libra’s Evolution to the Cloud
Read now
Digital security concept with a visual depiction of a lock icon and various cybersecurity-related words such as "password," "attack" and "danger" illuminated in a blue digital interface that includes a world map.
category iconNation-State Cyberattacks

ASEAN Entities in the Spotlight: Chinese APT Group Targeting
Read now

Explore in-depth cybersecurity trend reports

View All Right Arrow
Report

Updated: 2024 Unit 42 Incident Response Report

Access our survey of incident data from more than 250 organizations and 600 incidents, updated for summer 2024. You’ll better understand the threats you face, including:

Initial access

  • Attackers exploited software vulnerabilities to gain access 36% more often in 2023 than previous years… and that trend is continuing in 2024.

Data theft tactics

  • In 93% of incidents Unit 42 responded to, threat actors took data indiscriminately rather than searching for specific data.

Plus updated spotlights on attackers, artificial intelligence, predictions (and how we’re doing against them), and more.

 

Get the report
Cover of the 2024 Unit 42 Incident Response Report
Pictorial representation of attack surface management. Close-up of a person wearing glasses with computer code reflections on the lenses.
category iconSecurity Technology

Unit 42 Attack Surface Threat Research: Over 23% of Internet-Connected Exposures Involve Critical IT and Security Infrastructure
Read now
Pictorial representation of ransomware activity in the first half of 2024. A digitial illustration of a lock made up of nodes glowing against a background of bokeh points.
category iconRansomware

Ransomware Review: First Half of 2024
Read now
category iconCloud Cybersecurity Research

Attack Paths Into VMs in the Cloud
Read now
Zoomed in Unit 42 logo.
category iconCybercrime

2024 Unit 42 Incident Response Report: Navigating the Shift in Cybersecurity Threat Tactics
Read now

Default Heading

Read the article Right Arrow