Research reports

Unit 42 - Latest Cyber Security Research

Critical infrastructure is changing. Security must change with it. As industrial systems become more connected, converge with IT, and adopt AI and automation, cyber risk increasingly extends beyond data to affect physical operations. Understanding how these…

Unit 42 - Latest Cyber Security Research

Critical infrastructure is changing. Security must change with it. As industrial systems become more connected, converge with IT, and adopt AI and automation, cyber risk increasingly extends beyond data to affect physical operations. Understanding how these…

Unit 42 - Latest Cyber Security Research

Critical infrastructure is changing. Security must change with it. As industrial systems become more connected, converge with IT, and adopt AI and automation, cyber risk increasingly extends beyond data to affect physical operations. Understanding how these…

Unit 42 - Latest Cyber Security Research

Critical infrastructure is changing. Security must change with it. As industrial systems become more connected, converge with IT, and adopt AI and automation, cyber risk increasingly extends beyond data to affect physical operations. Understanding how these…

Unit 42 - Latest Cyber Security Research

Critical infrastructure is changing. Security must change with it. As industrial systems become more connected, converge with IT, and adopt AI and automation, cyber risk increasingly extends beyond data to affect physical operations. Understanding how these…

Unit 42 - Latest Cyber Security Research

Critical infrastructure is changing. Security must change with it. As industrial systems become more connected, converge with IT, and adopt AI and automation, cyber risk increasingly extends beyond data to affect physical operations. Understanding how these…

Unit 42 - Latest Cyber Security Research

Critical infrastructure is changing. Security must change with it. As industrial systems become more connected, converge with IT, and adopt AI and automation, cyber risk increasingly extends beyond data to affect physical operations. Understanding how these…

Unit 42 - Latest Cyber Security Research

Critical infrastructure is changing. Security must change with it. As industrial systems become more connected, converge with IT, and adopt AI and automation, cyber risk increasingly extends beyond data to affect physical operations. Understanding how these…

Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation

In April 2026, Unit 42 researchers identified a financially motivated campaign delivering Vidar stealer and the XMRig cryptocurrency miner to consumer and small- and medium-sized business victims worldwide. Attackers lure victims via malvertising to pages for…

MalwareInfostealers

Data From Chinese Security Services Company i-Soon Linked to Previous Chinese APT Campaigns

On Feb. 16, 2024, someone uploaded data to GitHub that included possible internal company communications, sales-related materials and product manuals belonging to the Chinese IT security services company i-Soon, also known as Anxun Information Technology. The…

State-sponsored

UNIT 42 PLAYBOOK VIEWER

No excerpt available.

Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure

Between late February and March 2026, threat group TeamPCP conducted a highly calculated, escalating sequence of supply chain threats. It systematically compromised widely trusted open-source security tools, including the vulnerability scanners Trivy and KICS…

Supply chain

The Golden Scale: Bling Libra and the Evolving Extortion Economy

Scattered Lapsus$ Hunters: What Retail and Hospitality Organizations Should Know In recent months, threat actors claiming to be part of a new conglomerate dubbed Scattered Lapsus$ Hunters (aka ​ SP1D3R HUNTERS, SLSH) have asserted responsibility for laying…

Ransomware

CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure

Throughout 2025, we observed a cluster of activity targeting government entities and critical infrastructure in Southeast Asia. Specifically, the activity targeted state-owned enterprises in the energy and government sectors. The Chinese-speaking attackers…

Behind the Clouds: Attackers Targeting Governments in Southeast Asia Implement Novel Covert C2 Communication

Since late 2024, Unit 42 researchers have been tracking a cluster of suspicious activity as CL-STA-1020, targeting governmental entities in Southeast Asia. The threat actors behind this cluster of activity have been collecting sensitive information from…

Malware

An Investigation Into Years of Undetected Operations Targeting High-Value Sectors

Since at least 2020, we have observed a cluster of activity targeting high-value organizations across South, Southeast and East Asia. The attacks focus on critical sectors such as aviation, energy, government, law enforcement, pharmaceutical, technology and…

Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization

Recent cyberattacks attributed to Iranian threat actors extend beyond typical network disruption. Rather than an isolated incident of sabotage, this type of attack sits within a broader context defined by Iran's reliance on asymmetric retaliation and…

Malware

YiSpecter: First iOS Malware That Attacks Non-jailbroken Apple iOS Devices by Abusing Private APIs

We recently identified a new Apple iOS malware and named it YiSpecter. YiSpecter is different from previously seen iOS malware in that it attacks both jailbroken and non-jailbroken iOS devices through unique and harmful malicious behaviors. Specifically, it’s…

MalwareMobile

Evolving Tactics of SLOW#TEMPEST: A Deep Dive Into Advanced Malware Techniques

In late 2024, we discovered a malware variant related to the SLOW#TEMPEST campaign. In this research article, we explore the obfuscation techniques employed by the malware authors. We deep dive into these malware samples and highlight methods and code that…

Malware