/
attack_type:lateral_movement × latest_source_host:unit42.paloaltonetworks.com × limpar

Resultados

2 casos · pág. 1/1

Unit 42: Attackers pivot across cloud, endpoint, identity and SaaS, exploiting visibility gaps between disconnected security tools

Unit 42 (Palo Alto Networks) describes how adversaries move beyond the initial foothold and pivot across the enterprise, exploiting the visibility gaps left by disconnected security tools. The 2026 Unit 42 Global Incident Response Report found that 43% of attacks involved activity across four or more attack surfaces, and some cases spanne…

unit42.paloaltonetworks.com · medium

Unit 42 research: root on a Kubernetes node enables SPIFFE/SPIRE workload identity spoofing via cgroup manipulation (Spooffe tool)

Unit 42 published research showing that an attacker with root access on a compromised Kubernetes node can misuse SPIFFE/SPIRE workload attestation to impersonate co-located workloads and harvest their SVIDs. The attacker spoofs the Linux cgroup information the SPIRE agent uses to identify callers, so the agent issues a victim workload's i…