Robert Falcone

---

Reports, Threat Prevention, Unit 42

Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists

Executive Summary Over the past seven months, Unit 42 has been investigating a series of attacks we attribute to a group we have code named “Scarlet Mimic.” The attacks began over four …

Jan 24, 2016

By Robert Falcone and Jen Miller-Osborn

---

Unit 42

PSA: Conference Invite used as a Lure by Operation Lotus Blossom Actors

Actors related to the Operation Lotus Blossom campaign continue their attack campaigns in the Asia Pacific region. It appears that these threat actors have begun using Palo Alto Networks upcoming Cyber Security …

Oct 28, 2016

By Robert Falcone

---

Unit 42

‘DealersChoice’ is Sofacy’s Flash Player Exploit Platform

Unit 42 has reported on various Sofacy group attacks over the last year, most recently with a post on Komplex, an OS X variant of a tool commonly used by the Sofacy …

Oct 17, 2016

By Robert Falcone and Bryan Lee

---

Unit 42

OilRig Malware Campaign Updates Toolset and Expands Targets

Since our first published analysis of the OilRig campaign in May 2016 , we have continued to monitor this group for new activity. In recent weeks we've discovered that the group have …

Oct 04, 2016

By Josh Grunzweig and Robert Falcone

---

Unit 42

Sofacy’s ‘Komplex’ OS X Trojan

Unit 42 researchers identified a new OS X Trojan associated with the Sofacy group that we are now tracking with the 'Komplex' tag using the Palo Alto Networks AutoFocus threat intelligence platform. …

Sep 26, 2016

By Dani Creus, Tyler Halfpop and Robert Falcone

---