Cyber Security Intelligence
Real-time aggregation of the most critical cybersecurity news, vulnerabilities, and threat warnings.
Latest Intel Feed
The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software
Executive Summary Frontier AI is fundamentally shifting the dynamics of cybersecurity — accelerating both how vulnerabilities are discovered and how quickly they can be exploited. Our vulnerability research team built...
Token Jacking: Cybercriminals Could Be Stealing Your AI Resources
Executive Summary It’s three a.m., do you know what your AI agent is doing? Unit 42 has responded to a growing number of AI token jacking cases resulting in staggering financial losses. The financial loss comes from...
ChainDrop: Inside a Self-Propagating npm Worm
Executive Summary A self-propagating npm worm nicknamed ChainDrop infected over 400 packages that are collectively downloaded hundreds of millions of times each week. This includes malicious versions of widely used...
Inside the Modern SOC: The Identity Front Door
The Identity Gap: Why Trust Has Become the New Attack Surface In The 72-Minute Race , we explored how attackers are compressing the time between initial access and business impact. But as attacks continue to accelerate,...
The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications
Executive Summary Aeternum is a recently discovered C++ botnet loader that shifts its command-and-control (C2) infrastructure entirely to the public Polygon blockchain. Instead of relying on centralized servers or...
Kimwolf v7: An Evolution of the Kimwolf Botnet
Content Warning We are providing a content warning because the following article contains usage of a racial slur by a threat actor, which Unit 42 does not condone in any instance. We have partially redacted the racial...
Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18)
Executive Summary Identity has effectively become the new perimeter, where cybercriminals are increasingly choosing to log in rather than break in. To accomplish this, attackers frequently gather previously leaked...
University of Texas forced to take systems offline in San Antonio after cyberattack
Image: Weston via Unsplash/USTA University of Texas forced to take systems offline in San Antonio after cyberattack One of the largest universities in Texas is facing a wide range of disruptions following a cyberattack...
Berlin cuts two state ministries off government network after security breach
/berlin-cuts-two-state-ministries-off-government-breach Berlin cuts two state ministries off government network after security breach Two Berlin state ministries have been cut off from the city government’s IT network...
More than 200 victims of Medusa ransomware identified over the last year, CISA says
Image: Unsplash/Photomosh More than 200 victims of Medusa ransomware identified over the last year, CISA says Federal cybersecurity agencies warned on Tuesday that troves of new victims of the Medusa ransomware gang...
US charges Iranians for sprawling hacking campaign on government agencies, universities
Image: sina drakhshani / Unsplash US charges Iranians for sprawling hacking campaign on government agencies, universities The Justice Department accused hackers connected to Iran’s military of breaching employee email...
Latvian officials resign after cyberattack exposes data on 1.2 million people
Latvia's Road Traffic Safety Directorate, which handles vehicle registration and driver's licenses, announced a significant data breach affecting its systems. Credit: Maris Greidans / Flickr Latvian officials resign...