Blog
Cloud Security
Cortex Cloud Security Research

Cortex Cloud Security Research

Cloud Threats on the Rise: Alert Trends Show Intensified Attacker Focus on IAM, Exfiltration

Cloud Threats on the Rise: Alert Trends Show Intensified Attacker Focus on IAM, Exfiltration

On Dec. 13, the cyber community became aware of one of the most significant cybersecurity events of our time, impacting both commercial and government organizations around the world. The event was a supply chain attack on SolarWinds OrionⓇ software conducted by suspected nation-state operators that we are tracking as SolarStorm....

Cloud Cybersecurity Research

Threat Research

Mar 27, 2025

By Nathaniel Quist

Cloud Cybersecurity Research, High Profile Threats, GitHub, supply chain

GitHub Actions Supply Chain Attack: A Targeted Attack on Coinbase Expanded ...

Updated March 20: The recent compromise of the GitHub action tj-actions/changed-files and additional actions within the reviewdog organization has cap...

Mar 20, 2025

By Omer Gil, Aviad Hahami, Asi Greenholts, Yaron Avital

Business Email Compromise, Cloud Cybersecurity Research, Threat Research, Amazon Simple Email Service, AWS, IAM, JavaGhost, phishing

JavaGhost’s Persistent Phishing Attacks From the Cloud

Unit 42 researchers have observed phishing activity that we track as TGR-UNK-0011. We assess with high confidence that t...

Feb 28, 2025

By Margaret Kelley

Malware, Threat Actor Groups, Bookworm, DLL Sideloading, Stately Taurus, ToneShell

Stately Taurus Activity in Southeast Asia Links to Bookworm Malware

This article reviews nine vulnerabilities we recently discovered in two utilities called cuobjdump and nvdisasm, both from NVIDIA's Compute Unified De...

Feb 20, 2025

By Robert Falcone

Malware, Threat Actor Groups, Threat Research, China, CL-STA-0048, Cobalt Strike, data exfiltration, Mimikatz, PlugX, web shells

CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asi...

We identified a cluster of activity that we track as CL-STA-0048. This cluster targeted hi...

Jan 29, 2025

By Lior Rochberger, Yoav Zemah

Cybercrime, Malware, Threat Actor Groups, Threat Research, Active Directory, AdFind, ALPHV, Ambitious Scorpius, Blackcat, BloodHound

LDAP Enumeration: Unveiling the Double-Edged Sword of Active Directory

Unit 42 researchers have discovered new security vulnerabilities in the Azure Data Factory...

Dec 17, 2024

By Stav Setty, Shachar Roitman, Tom Fakterman

Cloud Cybersecurity Research, Threat Research, Apache Airflow, Containers, Kubernetes, Microsoft Azure, Microsoft Azure Data Factory

Dirty DAG: New Vulnerabilities in Azure Data Factory’s Apache Airflow Integ...

Unit 42 spent six months researching the China-based cybercrime group Rocke, which is the...

Dec 16, 2024

By Ofir Balassiano, David Orlovsky

Cybercrime, High Profile Threats, Ransomware, Threat Actor Groups, BlackSuit ransomware, construction, Education, Extortion, Ignoble Scorpius, leaksite

Threat Assessment: Ignoble Scorpius, Distributors of BlackSuit Ransomware

Unit 42 researchers have observed an increase in BlackSuit r...

Nov 20, 2024

By Unit 42

Business Email Compromise, Threat Actor Groups, Threat Research, BeaverTail, CL-STA-0237, Contagious Interview, DPRK, Fake IT Worker, InvisibleFerret, Lazarus

Fake North Korean IT Worker Linked to BeaverTail Video Conference App Phish...

Unit 42 researchers identified a North Korean IT worker acti...

Nov 14, 2024

By Unit 42

Cloud Cybersecurity Research, Threat Research, data exfiltration, Google Cloud, Kubernetes, LLM, poisoned model, privilege escalation, Vertex AI

ModeLeak: Privilege Escalation to LLM Model Exfiltration in Vertex AI

In the race to gain a competitive edge, organizations are increasingly training artificial...

Nov 12, 2024

By Ofir Balassiano, Ofir Shaty

Cybercrime, Threat Actor Groups, Threat Research, C++, CL-CRI-0941, CVE-2017-11317, CVE-2019-18935, GodPotato, Python, Remote Code Execution

Silent Skimmer Gets Loud (Again)

This article introduces a simple and straightforward technique for jailbreaking that we call Deceptive Delight. Deceptive Delight is a multi-turn tech...

Nov 07, 2024

By Veronika Senderovych, Chema Garcia, Zack Fink

Nation-State Cyberattacks, Ransomware, Threat Actor Groups, Threat Research, Cobalt Strike, DPRK, DTrack, Fiddling Scorpius, Infostealer, Jumpy Pisces

Jumpy Pisces Engages in Play Ransomware

Unit 42 has identified Jumpy Pisces, a North Korean state-sponsored threat group associated with the Reconnaissance Gene...

Oct 30, 2024

By Unit 42

Malware, Threat Actor Groups, Threat Research, Advanced Persistent Threat, BeaverTail, CL-STA-240, Contagious Interview, DPRK, InvisibleFerret, North Korea

Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to ...

Unit 42 has tracked activity from threat actors associated w...

Oct 09, 2024

By Unit 42

Malware, Threat Actor Groups, APT43, DPRK, FPSpy, G0086, Keylogger, Kimsuky, KLogExe, MITRE

Unraveling Sparkling Pisces’s Tool Set: KLogEXE and FPSpy

Unit 42 researchers discovered two malware samples used by the Sparkling Pisces (aka Kimsuky) threat group. This includes an undocumented keylogger, c...

Sep 26, 2024

By Daniel Frank, Lior Rochberger

Malware, Threat Actor Groups, AppleJeus, Citrine Sleet, Cryptocurrency, Gleaming Pisces, Linux, macOS, North Korea, PondRAT

Gleaming Pisces Poisoned Python Packages Campaign Delivers PondRAT Linux an...

Unit 42 researchers have been tracking the activity of an ongoing poisoned Python packages...

Sep 18, 2024

By Yoav Zemah

Cybercrime, High Profile Threats, Ransomware, Threat Actor Groups, Threat Research, ALPHV, Ambitious Scorpius, Bashful Scorpius, BlackCat ransomware, Cicada3301

Threat Assessment: Repellent Scorpius, Distributors of Cicada3301 Ransomwar...

Repellent Scorpius is a new ransomware-as-a-service (RaaS) g...

Sep 10, 2024

By Navin Thomas, Jerome Tujague

Cybercrime, High Profile Threats, Malware, Nation-State Cyberattacks, Threat Actor Groups, Advanced Persistent Threat, Alluring Pisces, Andariel, Bluenoroff, Citrine Sleet

Threat Assessment: North Korean Threat Groups

Lazarus has been used in public reporting as an umbrella term for threat actors from the D...

Sep 09, 2024

By Unit 42

Load more

Load more

Get the latest news, invites to events, and threat alerts