1.167 casos · pág. 46/59
In April 2026, Kaspersky GERT responded to an incident at a Middle East manufacturing organization where the actor gained domain admin-equivalent control of Active Directory. The actor created and linked a malicious GPO named PAYLOAD at the domain root. It pushed ransom notes, a wallpaper and lock screen, a logon banner and a local admini…
Kaspersky researchers describe a new MacSync macOS infostealer variant, first seen in the wild in September 2026, that replaces the earlier AppleScript-based droppers with FAT Mach-O binaries written in Objective-C and Swift. MacSync is sold as malware-as-a-service, so delivery varies by operator. In this campaign it spread through malici…
Unit 42 published research showing that an attacker with root access on a compromised Kubernetes node can misuse SPIFFE/SPIRE workload attestation to impersonate co-located workloads and harvest their SVIDs. The attacker spoofs the Linux cgroup information the SPIRE agent uses to identify callers, so the agent issues a victim workload's i…
Unit 42 (Palo Alto Networks) published research on a behavioral clustering model that maps cloud identities to functional roles from audit log activity. The model covered more than 40,000 identities across 125 cloud environments over two months. It groups identities such as administrators, backup services, security tooling and DevOps by t…
Unit 42 analyzed an Atomic macOS (AMOS) stealer infection generated in a lab on Aug. 5, 2026, starting from a fake "macOS toolkit" instruction page hosted at getmacouscloud.com. The page tells victims to paste a command into Terminal, a ClickFix-style copy/paste technique, which downloads a Zsh script and then installs a Mach-O AMOS paylo…
Unit 42 (Palo Alto Networks) describes how adversaries move beyond the initial foothold and pivot across the enterprise, exploiting the visibility gaps left by disconnected security tools. The 2026 Unit 42 Global Incident Response Report found that 43% of attacks involved activity across four or more attack surfaces, and some cases spanne…
Unit 42 researchers found that in default AWS AgentCore Harness deployments, prompt injection can steer the agent's built-in shell tool to exfiltrate plaintext credentials resolved from AgentCore Identity. The shell tool is enabled by default and runs as root, in the same UID as the harness runtime (PID 1, python3.10 -m loopy.server). Tha…
Unit 42 analyzed how AWS neutralizes publicly exposed IAM access keys by automatically attaching the AWSCompromisedKeyQuarantine managed policy, and how that policy has changed since its release on Aug. 11, 2020. The mechanism relies on the GitHub secret scanning partner program, which alerts AWS when long-term keys appear in public repos…
Unit 42 (Palo Alto Networks) consultants describe three misconceptions they see repeatedly in customer casework. The first is that more security tools always mean better protection. The second is that small and mid-sized organizations are safe from major threat actors. The third is that security controls and GRC exist only to check compli…
Unit 42 (Palo Alto Networks) released OperTraitor, an open-source, LLM-powered tool that ingests RBAC configurations from installed Kubernetes operators and the OperatorHub catalog. It compares an operator's documented function with its granted privileges and assigns a 1-10 risk score. The research found abandoned, overly permissive opera…
Unit 42 attributes with high confidence to an Iranian state-aligned actor, tracked as CL-STA-1178, a campaign called Blinder Tunnel. In March 2026 it targeted an individual in Iraq's critical infrastructure sector, after infrastructure staging that began as early as November 2025. The actor impersonated the Dubai Airports IT department an…
Unit 42 reports that threat actors are moving supply chain malware C2 from hardcoded endpoints to Web3 mechanisms, so an entire botnet or worm infrastructure can be re-pointed with a single blockchain transaction. The ChainDrop npm worm (Shai-Hulud family, 400+ npm packages) and the PolinRider campaign (npm, Go modules, Packagist) target …
Unit 42 investigated a months-long intrusion against a European bank, which began with unauthorized VPN-based access through a third-party-managed external gateway appliance that did not enforce strict authentication. Using compromised credentials, the attacker ran noisy, high-volume internal reconnaissance and brute-force campaigns again…
Unit 42 detailed a multi-stage intrusion in September 2024 against a telecommunications managed service provider, tracked as CL-STA-0954 (aka UNC5820). The attackers gained initial access by exploiting CVE-2024-47575 (FortiJump) on a central FortiManager and exfiltrated an archive with running configurations, credentials and private keys …
Unit 42 Threat Intelligence published its overview of the top five initial access threat vectors observed in September 2026. Adversary activity relied heavily on external edge exploitation and identity compromise, with public-facing infrastructure and legitimate credential abuse as the primary footholds for intrusion campaigns. Social eng…
Dropbox confirmed that roughly 5,000 customer accounts were accessed between 4 and 21 August after attackers abused a legacy login integration between Dropbox and Lenovo ID, Lenovo's identity system. Lenovo ID did not verify that a person registering an account actually controlled the email address used. Because Dropbox implicitly trusted…
Reportedly, the US Army, Air Force, Navy and Special Operations Command have disabled mobile advertising IDs on government-issued phones and computers. The move follows concerns that commercially available location data has been used to target American forces in the Middle East. It became public after Senator Ron Wyden released letters, h…
CRPx0 is a cybercrime operation that began as a scam and then pivoted into a full ransomware and cryptocurrency business. The source is a short Fortra blog teaser by Graham Cluley that points to a fuller article. The teaser gives no victim names, sectors, technical details, IOCs, CVEs, TTPs or attribution beyond the operation's name. Defe…
Kenneth Carter, 44, of Portland, Oregon, a former AT&T retail store employee, was sentenced to 16 months in federal prison for acting as the inside man for a SIM-swap gang. According to his plea agreement, the scheme ran from May 2018 to November 2019 and involved at least three co-conspirators. Carter used privileged store access to move…
Episode 484 of the Smashing Security podcast, hosted by Graham Cluley with guest Danny Palmer, covers several security stories. The lead item is audio fingerprinting: a user named Matt found that an open AliExpress page, playing silent audio at zero volume, kept his multipoint Bluetooth headphones from switching to his phone. The episode …
