Cyber Security Intelligence
Real-time aggregation of the most critical cybersecurity news, vulnerabilities, and threat warnings.
Latest Intel Feed
The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version
Executive Summary After months of dormancy, the attackers behind the XCSSET malware released version 40 (v40), targeting the macOS ecosystem. This version’s advanced architecture hides its core logic in memory space,...
Pass the Passkey: A Novel Attack Surface in Passwordless Authentication
Executive Summary This article analyzes new attack classes against passwordless authentication, focusing on Google’s synced passkey ecosystem and the Cloud Authenticator used by desktop clients. The attacks demonstrate...
Almost Half of Malware Samples Communicate Direct to IP
Executive Summary Malware samples often bypass DNS entirely, communicating directly to IP addresses instead. Our analysis of 4 million dynamic analysis reports indicates that almost half (45.32%) of malware samples with...
The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications
Executive Summary Aeternum is a recently discovered C++ botnet loader that shifts its command-and-control (C2) infrastructure entirely to the public Polygon blockchain. Instead of relying on centralized servers or...
Kimwolf v7: An Evolution of the Kimwolf Botnet
Content Warning We are providing a content warning because the following article contains usage of a racial slur by a threat actor, which Unit 42 does not condone in any instance. We have partially redacted the racial...
More than 200 victims of Medusa ransomware identified over the last year, CISA says
Image: Unsplash/Photomosh More than 200 victims of Medusa ransomware identified over the last year, CISA says Federal cybersecurity agencies warned on Tuesday that troves of new victims of the Medusa ransomware gang...
FBI Seizes NetNut Proxy Platform, Popa Botnet
The Federal Bureau of Investigation (FBI) said today it worked with industry partners to seize hundreds of domains associated with NetNut , a sprawling residential proxy service operated by the publicly-traded Israeli...
Microsoft Patches a Record 570 Security Flaws
Microsoft Corp. today released software updates to plug at least 570 security holes in its Windows operating systems and other software, almost triple the number of vulnerabilities the software giant fixed in its...
Linux Botnet Evooo1Bot Expands Mirai Capabilities Well Beyond DDoS
Yet another Mirai-derived botnet is on the loose, targeting Linux systems by exploiting flaws in various Internet-facing devices to combine distributed denial of service (DDoS) attacks with a broader set of malicious...
'Turf War' Between Claude Agents Leads to Self-Replicating Malware
It turns out that AI agents don't always play nice together. In the latest episode of agentic AI producing unexpected results , Anthropic recently observed "a multiagent turf war" between three instances of the same...
'Ransom Busters': Ransomware Actor Poses as Incident-Recovery Service
A ransomware affiliate is approaching victims of the attacks it may have helped carry out, in an interesting technique that actually undermines its own business model. According to the GuidePoint Research and...
Silent 'TwinLoot' Cyber Threat Operates Entirely From Microsoft's Cloud
A Python-based malware framework is taking the concept of living off the land (LOTL) to a whole new level by operating its entire command-and-control (C2) from inside Microsoft Azure and 365 services, researchers have...