Palo Alto Networks

Trojan

Sofacy Attacks Multiple Government Entities

The Sofacy group (AKA APT28, Fancy Bear, STRONTIUM, Sednit, Tsar Team, Pawn Storm) is a well-known adversary that remains highly active in the new calendar year of 2018. Unit 42 actively monitors this group due to their persistent nature globally across all industry verticals. Recently, we discovered a campaign launched at vario...

Unit 42

Feb 28, 2018

By Bryan Lee, Mike Harbison and Robert Falcone

Palo Alto Networks

Products and Services

Partners

Unit 42

Malspam Targeting Brazil Continues to Evolve

Figure 1: Banload samples we've seen during the first six months of 2017.Figure 1: Banload samples we've seen during the first six months of 2017.

Jul 21, 2017

By Brad Duncan

Unit 42

Cardinal RAT Active for Over Two Years

Palo Alto Networks has discovered a previously unknown remote access Trojan (RAT) that has been active for over two years. It has a very low volume in this two-year period, totaling roughly 27 total samples. The malware is delivered via an innovative and unique techniqu...

Apr 20, 2017

By Josh Grunzweig

Unit 42

2016 Updates to Shifu Banking Trojan

Shifu is a Banking Trojan first discovered in 2015. Shifu is based on the Shiz source code which incorporated techniques used by Zeus. Attackers use Shifu to steal credentials for online banking websites around the world, starting in Russia but later including the UK, I...

Jan 06, 2017

By Dominik Reichel

Unit 42

Sofacy’s ‘Komplex’ OS X Trojan

Unit 42 researchers identified a new OS X Trojan associated with the Sofacy group that we are now tracking with the 'Komplex' tag using the Palo Alto Networks AutoFocus threat intelligence platform.

Sep 26, 2016

By Dani Creus, Tyler Halfpop and Robert Falcone

Unit 42

DualToy: New Windows Trojan Sideloads Risky Apps to Android and iOS Devices

Over the past two years, we’ve observed many cases of Microsoft Windows and Apple iOS malware designed to attack mobile devices. This attack vector is increasingly popular with mal...

Sep 13, 2016

By Claud Xiao

Threat Prevention, Unit 42

Fresh Baked HOMEKit-made Cookles – With a DarkHotel Overlap

Threat actors tend to reuse certain tools, a trend we observed during recent Unit 42 research published on MNKit. In this post, we will discuss a fresh toolkit, which on the surfac...

Aug 12, 2016

By Bryan Lee and Robert Falcone

Events, News of the Week

Palo Alto Networks News of the Week – July 30, 2016

Unit 42 had a busy week! Researchers Robert Falcone and Jen Miller-Osborn observed a 9002 Trojan delivered using a combination of shortened links and a shared file hosted on Google Drive.

Jul 30, 2016

By Anna Lough

Malware, Threat Prevention, Unit 42

SpyNote Android Trojan Builder Leaked

Our team recently discovered a new Android Trojan called SpyNote which facilitates remote spying. The builder, which creates new versions of the malware, recently leaked on several malware discussion forums. SpyNote is similar to OmniRat an...

Jul 28, 2016

By Jacob Soo

Unit 42

Attack Delivers ‘9002’ Trojan Through Google Drive

Unit 42 recently observed a 9002 Trojan delivered using a combination of shortened links and a shared file hosted on Google Drive. The delivery method also uses an actor-controlled server hosting a custom redir...

Jul 26, 2016

By Robert Falcone and Jen Miller-Osborn

Threat Prevention, Uncategorized, Unit 42

Technical Walkthrough: Office Test Persistence Method Used In Recent Sofacy...

As mentioned in our previous blog, we observed the Sofacy group using a new persistence mechanism that we call “Office Test” to load their Trojan each...

Jul 20, 2016

By Robert Falcone

Malware, Threat Prevention, Unit 42

Investigating the LuminosityLink Remote Access Trojan Configuration

In recent weeks, I’ve spent time investigating the LuminosityLink Remote Access Trojan’s (RAT) embedded configuration. For those unaware, LuminosityLi...

Jul 08, 2016

By Josh Grunzweig

Unit 42

New Sofacy Attacks Against US Government Agency

The Sofacy group, also known as APT28, is a well-known threat group that frequently conducts cyber espionage campaigns. Recently, Unit 42 identified a spear phishing e-mail from the Sofacy group that targeted t...

Jun 14, 2016

By Robert Falcone and Bryan Lee

Threat Prevention, Unit 42

ProjectM: Link Found Between Pakistani Actor and Operation Transparent Trib...

Be the first to receive the latest news, cyber threat intelligence and research from Unit 42. Subscribe Now.

Mar 25, 2016

By Robert Falcone and Simon Conant

Unit 42

AceDeceiver: First iOS Trojan Exploiting Apple DRM Design Flaws to Infect A...

We’ve discovered a new family of iOS malware that successfully infected non-jailbroken devices we’ve named “AceDeceiver”.

Mar 16, 2016

By Claud Xiao

Malware, Threat Prevention, Unit 42

New Malware 'Rover' Targets Indian Ambassador to Afghanistan

On December 24, 2015, Unit 42 identified a targeted attack, delivered via email, on a high profile Indian diplomat, an Ambassador to Afghanistan. The...

Feb 29, 2016

By Vicky Ray and Kaoru Hayashi

Financial Services, Malware, Threat Prevention, Unit 42

New Android Trojan “Xbot” Phishes Credit Cards and Bank Accounts, Encrypts ...

We recently discovered 22 Android apps that belong to a new Trojan family we’re calling “Xbot”. This Trojan, which is still under development and regu...

Feb 18, 2016

By Cong Zheng, Claud Xiao and Zhi Xu

Events, News of the Week

Palo Alto Networks News of the Week – February 6

In a new study released this week, Palo Alto Networks partnered with the Ponemon Institute to understand not only what motivates cyberattackers but also how we can turn the tables on them by taking away their f...

Feb 06, 2016

By Anna Lough

Malware, Threat Prevention, Unit 42

NetTraveler Spear-Phishing Email Targets Diplomat of Uzbekistan

Unit 42 recently identified a targeted attack against an individual working for the Foreign Ministry of Uzbekistan in China. A spear-phishing email wa...

Jan 21, 2016

By Vicky Ray and Robert Falcone

Malware, Mobility, Threat Prevention, Unit 42

iOS Trojan “TinyV” Attacks Jailbroken Devices

In October 2015, we discovered a malicious payload file targeting Apple iOS devices. After investigating, we believe the payload belongs to a new iOS Trojan family that we’re calling “TinyV”. In December 2015,...

Dec 15, 2015

By Claud Xiao

Malware, Threat Prevention, Unit 42

Bookworm Trojan: A Model of Modular Architecture

Recently, while researching attacks on targets in Thailand, Unit 42 discovered a tool that initially appeared to be a variant of the well-known PlugX RAT based on similar observed behavior such as the usage of...

Nov 10, 2015

By Robert Falcone, Mike Scott and Juan Cortes

Load more blogs