Unit 42

3 min read

• academia
• automotive
• aviation
• BlackFile
• Cloud
• Cordial Spider
• CrowdStrike
• cybercrime
• Cybersecurity
• Data theft
• extortion
• financial sector
• Financial services
• hospitality
• legal
• Palo Alto Networks
• ransomware
• Research
• residential proxy network
• retail
• SaaS
• Scattered Spider
• Snarky Spider
• Technology
• The Com
• Threats
• Unit 42

Two new extortion crews are speedrunning the Scattered Spider playbook

Cyber Scoop April 30, 2026

Two new extortion crews are speedrunning the Scattered Spider...

Read More

3 min read

• BlackFile
• cybercrime
• Cybersecurity
• Data theft
• extortion
• Google Threat Intelligence Group
• hospitality
• okta
• Palo Alto Networks
• retail
• RH-ISAC
• The Com
• Threats
• Unit 42

BlackFile actively extorting data-theft victims in retail and hospitality sector

Cyber Scoop April 27, 2026

BlackFile actively extorting data-theft victims in retail and hospitality...

Read More

4 min read

• access management
• AI
• credential theft
• cybercrime
• Cybersecurity
• data breaches
• identity
• incident response
• initial access
• misconfiguration
• Palo Alto Networks
• ransomware
• Research
• Salesloft
• Salesloft Drift
• Social engineering
• stolen credentials
• Technology
• Threats
• Unit 42

Unit 42: Nearly two-thirds of breaches now start with identity abuse

Cyber Scoop February 17, 2026

Unit 42: Nearly two-thirds of breaches now start with...

Read More

11 min read

• Bitdefender
• Coveware
• CrowdStrike
• cybercrime
• Cybersecurity
• encryption
• extortion
• FinCEN
• Flashpoint
• Google
• GroupSense
• hacking
• Halcyon
• Mandiant
• Palo Alto Networks
• ransomware
• ransomware negotiation
• Surefire Cyber
• Threats
• Treasury Department
• Unit 42
• Veeam
• XFIL Cyber

The thin line between saving a company and funding a crime

Cyber Scoop January 21, 2026

The thin line between saving a company and funding...

Read More

3 min read

• Cybersecurity
• greynoise
• HackerOne
• Meta
• Next.js
• open source software
• React2Shell
• Response
• Technology
• Threats
• Unit 42
• Vercel
• VulnCheck
• vulnerability
• vulnerability reporting

Inside Vercel’s sleep-deprived race to contain React2Shell

Cyber Scoop January 8, 2026

Inside Vercel’s sleep-deprived race to contain React2Shell | CyberScoop...

Read More

4 min read

• CISA
• Cloudflare
• cybercrime
• Cybersecurity
• Cybersecurity and Infrastructure Security Agency (CISA)
• Google Threat Intelligence Group
• greynoise
• Microsoft Threat Intelligence
• nation state threats
• Palo Alto Networks
• ransomware
• React2Shell
• Research
• Threats
• Unit 42
• VulnCheck

React2Shell fallout spreads to sensitive targets as public exploits hit all-time high

Cyber Scoop December 17, 2025

React2Shell fallout spreads to sensitive targets as public exploits...

Read More

4 min read

• Amazon Threat Intelligence
• CISA
• cybercrime
• Cybersecurity
• Cybersecurity and Infrastructure Security Agency (CISA)
• Fastly
• greynoise
• hacking
• known exploited vulnerabilities (KEV)
• Malware
• Palo Alto Networks
• ransomware
• Rapid7
• Research
• Shadowserver
• Threats
• Unit 42
• Wiz

Attacks pinned to critical React2Shell defect surge, surpass 50 confirmed victims

Cyber Scoop December 10, 2025

Attacks pinned to critical React2Shell defect surge, surpass 50...

Read More

5 min read

• Amazon Web Services (AWS)
• cybercrime
• Cybersecurity
• greynoise
• hacking
• Meta
• open source
• open source software
• Palo Alto Networks
• React
• Research
• Threats
• Trend Micro
• Unit 42
• VulnCheck
• vulnerabilities
• vulnerability disclosure
• vulnerability reporting
• watchTowr
• Wiz
• Zero Day Initiative

Attackers hit React defect as researchers quibble over proof

Cyber Scoop December 5, 2025

Attackers hit React defect as researchers quibble over proof...

Read More

4 min read

• Cybersecurity
• Cybersecurity and Infrastructure Security Agency (CISA)
• Huntress
• known exploited vulnerabilities (KEV)
• Microsoft
• Palo Alto Networks
• Shadowserver
• Threats
• Unit 42
• vulnerability
• vulnerability disclosure
• Vulnerability Management
• watchTowr
• Windows

Attackers bypass patch in deprecated Windows Server update tool

Cyber Scoop October 27, 2025

Attackers bypass patch in deprecated Windows Server update tool...

Read More

4 min read

• Cybersecurity
• domains
• Exclusive
• Palo Alto Networks
• phishing
• phishing kit
• Research
• Smishing Triad
• SMS
• text message
• Threats
• Unit 42

Researchers track surge in high-level Smishing Triad activity

Cyber Scoop October 23, 2025

Researchers track surge in high-level Smishing Triad activity |...

Read More