# Threat Research Published articles for Threat Research. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection DevFeed: [Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection]() Original publisher: [Read original article]() Author: Osher Jacob Published: 2026-09-14T10:00:01Z Content type: article Language: en Sources: [Unit 42]() Topics: [AWS CloudTrail](), [Cloud](), [threat detection](), [Threat Research](), [SIEM, Security, Observability](), [Machine learning](), [Algorithms](), [SQL](), [IAM](), [identity and access management](), [Amazon Web Services]() Tags: [algorithms](), [amazon-web-services-aws](), [analysis](), [aws-cloudtrail](), [cloud](), [cloud-cybersecurity-research](), [cloud-detection](), [devops](), [iam](), [identity-and-access-management](), [logs](), [machine-learning](), [post](), [sql](), [threat-detection](), [threat-research]() ### AI overview This article presents a behavioral clustering model for mapping cloud identities to functional roles using activity patterns from audit logs. It applies unsupervised machine learning with UMAP and HDBSCAN to data from more than 40,000 identities across 125 cloud environments, and shows how the resulting map can support automated threat detection. The article also explains how lightweight heuristics extracted from the map can classify identities at scale using standard SQL, reducing the need for continuous resource-intensive machine learning pipelines. ### Source excerpt We designed a behavioral clustering model to map cloud identity roles from audit logs, enabling continuous threat detection using standard SQL queries. The post Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection appeared first on Unit 42. ## The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE DevFeed: [The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE]() Original publisher: [Read original article]() Author: Eviatar Garzi Published: 2026-09-10T10:00:43Z Content type: article Language: en Sources: [Unit 42]() Topics: [Kubernetes]() Tags: [api](), [containers](), [cryptographic](), [identity](), [json](), [kubernetes](), [linux](), [malware](), [node](), [open-source](), [research](), [secrets](), [spiffe](), [spire](), [spoof](), [spoofing](), [threat-research](), [tool]() ### AI overview Research on a post-exploitation technique in which root access to a Kubernetes node can let an attacker spoof cgroup metadata used by SPIRE workload attestation, impersonate co-located workloads, and obtain SVIDs. ### Source excerpt Learn how root access on a compromised K8s node allows attackers to utilize SPIFFE/SPIRE metadata to spoof and harvest co-located workload identities. The post The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE appeared first on Unit 42. ## Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure DevFeed: [Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure]() Original publisher: [Read original article]() Author: Rem Dudas Published: 2026-09-09T10:00:55Z Content type: article Language: en Sources: [Unit 42]() Topics: [ARKTunnel](), [backdoor]() Tags: [arktunnel](), [backdoor](), [c2](), [cl-cri-1171](), [cybercrime](), [docro-hijacker](), [gaming](), [malware](), [pay-per-install](), [payload](), [remote-access-trojan](), [threat-research](), [youtube]() ### AI overview An investigation of the CL-CRI-1171 cybercrime campaign describes how YouTube gaming lures and SEO poisoning delivered malware through a custom loader. It covers Docro Hijacker, ARKTunnel, and the Insomnia remote access Trojan. ### Source excerpt An investigation into how cybercriminals used YouTube gaming lures and SEO poisoning to deliver multi-payload malware to enterprise networks. The post Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure appeared first on Unit 42. ## Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America DevFeed: [Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America]() Original publisher: [Read original article]() Author: Reese Lewis and Sara McBroom Published: 2026-09-03T10:00:58Z Content type: article Language: en Sources: [Unit 42]() Topics: [Language models](), [AI Chat](), [Incident response]() Tags: [agentic-ai](), [ai](), [chatgpt](), [cl-cri-1131](), [cl-cri-1163](), [claude-code](), [data](), [financial-sector](), [go](), [large-language-models-llms](), [malware](), [nextchat](), [operations](), [phishing](), [shipping-and-transportation](), [socks5](), [socktz](), [threat-research]() ### AI overview The article examines two ongoing intrusion and data-exfiltration campaigns targeting organizations in Latin America. It describes attackers using commercial large language models, proxy infrastructure, phishing, remote-access malware, and operational tooling. ### Source excerpt Explore how attackers targeting Latin American entities use AI for data exfiltration and how basic OpSec errors allow defenders to disrupt operations. The post Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America appeared first on Unit 42. ## An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation DevFeed: [An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation]() Original publisher: [Read original article]() Author: Renzon Cruz, Nicolas Bareil, Eric Semaan and Omar Jbari Published: 2026-09-02T10:00:46Z Content type: article Language: en Sources: [Unit 42]() Topics: [Security Attacks](), [Large Language Model](), [CI/CD]() Tags: [agentic](), [agentic-ai](), [ai](), [ai-agents](), [attacks](), [autonomous](), [breach](), [ci-cd](), [enterprise](), [frontier-ai](), [general](), [insights](), [llm](), [secrets](), [security](), [threat-research]() ### AI overview An investigation of a ransom attack in which a human attacker used AI agents and frontier models to automate intrusion, reconnaissance, credential theft, and CI/CD pipeline abuse against an enterprise network. ### Source excerpt Using autonomous AI agents, an attacker breached an enterprise network in a matter of hours. Understand how to address and defend against agentic attacks. The post An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation appeared first on Unit 42. ## Critical remote code execution in vm2, a widely used Node.js sandbox library DevFeed: [Critical remote code execution in vm2, a widely used Node.js sandbox library]() Original publisher: [Read original article]() Author: Daniel Abeles Published: 2026-09-02T00:00:00Z Content type: news Language: en Sources: [GitLab]() Topics: [vulnerability](), [Node.js](), [configuration](), [Threat Research]() Tags: [ai](), [containers](), [node-js](), [processes](), [sandbox](), [security](), [security-labs](), [threat-research](), [update](), [vulnerability]() ### AI overview GitLab reports a critical vm2 sandbox escape that can enable remote code execution. Version 3.11.7 blocks the reported attack, but the article advises hardening require.root and context settings and avoiding vm2 for truly untrusted code. ### Source excerpt GitLab's Threat Research Group found a critical sandbox escape vulnerability in vm2, one of the most widely adopted Node.js sandboxing libraries. The vulnerability uses a configuration copied straight from vm2's own README. We found the flaw, rated CVSS 3.1: 10.0, critical, using our own AI automated tools. Anyone running vm2 Version 3.11.6 or earlier with require.external turned on should treat this as directly exploitable. Once we found the vulnerability, we verified GitLab does not use vm2. We also reported it privately to vm2 and the maintainer fixed it fast, in vm2 Version 3.11.7. When we tested that fix again, it blocked the exact attack we reported. For anyone relying on vm2, it's worth flagging that there's a broader configuration risk here that goes beyond this one patch, based on the maintainer's own description of the fix. TL;DR Critical vulnerability: GitLab's Threat Research Group discovered a critical sandbox escape (CVSS 3.1: 10.0) in vm2, a widely used Node.js sandboxing library, which allows for remote code execution. The root cause: The vulnerability stems from default configurations found in the library's own "Quick Examples" README, where the sandbox fails to properly isolate itself from the host system, allowing malicious code to gain unrestricted access. Fix limitations: While updating to Version 3.11.7 blocks the specific attack reported, it does not fully resolve the underlying configuration risk; developers remain vulnerable if they continue to use require.external with overly broad require.root settings. Immediate recommendations: Users should update to Version 3.11.7, but must also manually harden their configurations by restricting require.root to only necessary files and setting context: 'sandbox' instead of relying on the default 'host' setting. Long-term advice: Due to vm2's history of recurring sandbox escape bugs, it is recommended to avoid using it for isolating truly untrusted code and instead opt for more robust methods like conta ## Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams DevFeed: [Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams]() Original publisher: [Read original article]() Author: Noam Sala Published: 2026-08-31T10:00:36Z Content type: article Language: en Sources: [Unit 42]() Topics: [Social engineering](), [Malware](), [remote access software](), [Microsoft](), [Cloaked Ursa](), [Entra ID](), [Incident response]() Tags: [attacks](), [cloaked-ursa](), [enterprise](), [entra-id](), [incident-response](), [malware](), [microsoft](), [microsoft-teams](), [payload](), [phishing](), [powershell](), [remote-access-trojan](), [social-engineering](), [spoof](), [threat-research](), [vishing](), [voice]() ### AI overview Spring Ring is a coordinated social engineering campaign that used external Microsoft Teams accounts and voice phishing to impersonate IT help desk staff. The operation targeted more than 150 employees across at least 10 companies and attempted to deliver remote monitoring and management tools or custom malware. A more advanced variant escalated to an NTLM relay attack against an organization's domain controller. ### Source excerpt Learn how the Spring Ring campaign abuses Microsoft Teams and voice phishing to deploy malware and target enterprise domain controllers. The post Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams appeared first on Unit 42. ## The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution DevFeed: [The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution]() Original publisher: [Read original article]() Author: Sara McBroom Published: 2026-08-25T10:00:57Z Content type: article Language: en Sources: [Unit 42]() Topics: [Malware](), [Artificial Intelligence](), [Security](), [Endpoint Security & XDR](), [VirusTotal](), [dataset](), [data](), [ChatGPT](), [ransomware](), [Cryptocurrency]() Tags: [agentic](), [ai](), [analysis](), [article](), [backdoor](), [bitcoin](), [code](), [cryptocurrency](), [data](), [dll-hijacking](), [malware](), [ransomware](), [research](), [sandbox](), [security](), [threat-research](), [virustotal]() ### AI overview Unit 42 analyzes 405 malware samples incorporating AI through mechanisms such as brand impersonation, LLM-generated code, and agentic execution loops. The research finds that most samples remain proof-of-concept or sandbox activity, while existing behavioral detection, cloud sandboxing, and endpoint analytics can detect the threats that reach operational environments. ### Source excerpt Explore Unit 42 research on AI-enabled malware. Learn how existing behavioral detection and endpoint analytics stop AI-authored code before execution. The post The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution appeared first on Unit 42. ## Identity Abuse Through Trusted Communication Channels DevFeed: [Identity Abuse Through Trusted Communication Channels]() Original publisher: [Read original article]() Author: Bill Batchelor Published: 2026-08-20T10:00:25Z Content type: article Language: en Sources: [Unit 42]() Topics: [Security](), [Authentication](), [Social engineering](), [Software as a service](), [Incident response]() Tags: [authentication](), [credential-theft](), [identity](), [identity-theft](), [incident-response](), [malware](), [mfa](), [phishing](), [remote-access-software](), [saas](), [security](), [social-engineering](), [threat-research]() ### AI overview Unit 42 examines how attackers abuse trusted enterprise communication and collaboration platforms for identity phishing, impersonation, credential theft, malware delivery and social engineering. The article describes how compromised identities can make malicious activity appear legitimate within authenticated collaboration sessions and offers recommendations for detecting and defending against these attacks. ### Source excerpt Unit 42 details how attackers exploit enterprise collaboration tools for identity phishing and credential theft. Discover key defense strategies. The post Identity Abuse Through Trusted Communication Channels appeared first on Unit 42. ## Kimwolf v7: An Evolution of the Kimwolf Botnet DevFeed: [Kimwolf v7: An Evolution of the Kimwolf Botnet]() Original publisher: [Read original article]() Author: Asher Davila, Chris Navarrete and Doel Santos Published: 2026-08-11T10:00:16Z Content type: article Language: en Sources: [Unit 42]() Topics: [Kimwolf v7](), [Android](), [DDoS](), [Internet of things](), [C2](), [Ethereum Name Service (ENS)](), [Malware](), [Cybercrime](), [Ethereum](), [Blockchain](), [Routing (disambiguation)](), [Threat Hunting & Intel]() Tags: [android](), [android-apk](), [blockchain](), [c2](), [ddos](), [devices](), [ethereum](), [http](), [iot-botnets](), [kimwolf-v7](), [linux](), [malware](), [network](), [networks](), [resilience](), [routing](), [rpc](), [spoofing](), [threat-research]() ### AI overview Kimwolf v7 is an Android and IoT botnet variant that adds HTTP/2-based DDoS flooding with browser fingerprinting, Ethereum Name Service resolution for C2 addresses, and Tor-backed routing to improve infrastructure resilience. The article also describes its targeting of Android TV devices and exploitation of unauthenticated ADB instances. ### Source excerpt Discover how Kimwolf v7 targets Android IoT devices with HTTP/2 DDoS fingerprinting, Ethereum ENS C2 resolution and Tor backup routing. The post Kimwolf v7: An Evolution of the Kimwolf Botnet appeared first on Unit 42. ## The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications DevFeed: [The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications]() Original publisher: [Read original article]() Author: Chris Navarrete, Sai Sathvik Ruppa and Haozhe Zhang Published: 2026-08-10T22:00:02Z Content type: article Language: en Sources: [Unit 42]() Topics: [Aeternum](), [C++](), [Firewall]() Tags: [aeternum](), [analysis](), [blockchain](), [c-plus-plus](), [c2](), [infection-chain](), [json](), [malware](), [python](), [rpc](), [telegram](), [threat-research](), [xmrig](), [xor]() ### AI overview An analysis of the Aeternum botnet loader, which uses Polygon blockchain smart contracts and public RPC endpoints for decentralized command-and-control. It also examines related Python malware using the Telegram API and a blended threat involving XWorm RAT, XMRig, and data exfiltration. ### Source excerpt Analysis of the Aeternum botnet loader, a threat leveraging Polygon blockchain smart contracts for decentralized C2 infrastructure and payload execution. The post The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications appeared first on Unit 42. ## Token Jacking: Cybercriminals Could Be Stealing Your AI Resources DevFeed: [Token Jacking: Cybercriminals Could Be Stealing Your AI Resources]() Original publisher: [Read original article]() Author: Unit 42 Published: 2026-08-06T10:00:49Z Content type: article Language: en Sources: [Unit 42]() Topics: [token jacking](), [ai security](), [API keys](), [Large language models (LLMs)](), [Authentication](), [transfer stations]() Tags: [ai](), [ai-api](), [ai-gateway](), [ai-security](), [api-keys](), [authentication](), [large-language-models-llms](), [malware](), [npm-packages](), [obfuscation](), [security](), [threat-research](), [token-jacking](), [transfer-stations]() ### AI overview The article explains how criminals steal developers' AI API keys and use the resulting tokens to consume costly language-model resources, causing rapid financial losses. It outlines the role of authentication, automated access keys, token-based billing, and weak billing controls, and recommends security hygiene and AI protection measures. ### Source excerpt Discover how attackers hijack AI tokens to fuel gray market transfer stations by stealing developer API keys. The post Token Jacking: Cybercriminals Could Be Stealing Your AI Resources appeared first on Unit 42. ## How SMBs use threat research and MDR to build a defensive edge DevFeed: [How SMBs use threat research and MDR to build a defensive edge]() Original publisher: [Read original article]() Author: Ben Tudor Published: 2026-03-05T10:00:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Threat Research](), [Cybersecurity](), [SOC](), [Monitoring](), [Business Security]() Tags: [business](), [business-security](), [conferences](), [cybersecurity](), [monitoring](), [operations](), [publications](), [research](), [security](), [small-business](), [soc](), [threat-research]() ### AI overview The article explains how small and midsize businesses can use managed detection and response (MDR) to access proactive threat monitoring, hunting, and expert cybersecurity capabilities without building an elite in-house SOC. It also describes how threat research and intelligence inform MDR workflows, combining advanced technology with human expertise. ### Source excerpt We speak to Director of ESET Threat Research Jean-Ian Boutin about where solutions that blend advanced technology with human expertise provide the most practical value for businesses ## Looking ahead to KubeCon Europe 2023 DevFeed: [Looking ahead to KubeCon Europe 2023]() Original publisher: [Read original article]() Author: Luis Gonzalez Published: 2023-04-14T00:00:00Z Content type: article Language: en Sources: [The incident.io Blog]() Topics: [incident management](), [Incident response](), [Kubernetes](), [Cloud](), [Threat Research]() Tags: [blog](), [cloud-native](), [conference](), [europe](), [incident](), [incident-channel](), [incident-management](), [incident-response](), [k8s](), [kubecon](), [outage](), [post-mortem](), [security](), [slack-incident](), [threat-research]() ### AI overview The article previews incident management and incident response talks planned for KubeCon Europe 2023. It presents a broad approach to incidents, including everyday operational issues as well as security breaches, and highlights cloud-native response practices, cloud breach analysis, and an operational incident caused by misconfiguration. ### Source excerpt With KubeCon Europe fast approaching, we wanted to highlight some incident management talks we find particularly exciting. ## Proofpoint's TA410 Report Shows How Attack Details Can Inform Better Defenses DevFeed: [Proofpoint's TA410 Report Shows How Attack Details Can Inform Better Defenses]() Original publisher: [Read original article]() Author: Adam Published: 2020-06-14T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [Threat Research](), [proofpoint](), [Malware](), [Actor](), [Code](), [execution](), [file]() Tags: [actor](), [attacks](), [code](), [commands](), [defender](), [delivery](), [execution](), [file](), [malware](), [proofpoint](), [report](), [research](), [threat-research]() ### AI overview The article praises Proofpoint's report on TA410 attacks against U.S. utilities for its factual analysis and detailed explanation of the attack chain. It argues that details such as malicious macros, file renaming, cmd use, certutil execution, and delivery infrastructure can help defenders design better protections. ### Source excerpt I want to call out some impressive aspects of a report by Proofpoint.