Summary
This overview highlights recent threat intelligence observed by Unit 42. Common adversary activities focus on strategic intelligence collection and financial extortion. We observed these activities alongside a cross-cutting adoption of artificial intelligence tools across multiple threat disciplines. Here, we share observations and behaviors associated with these activities. For in-depth access to Unit 42 threat intelligence insights, explore our Threat Intelligence Services offerings. State-sponsored and advanced persistent threat (APT) campaigns focused on covertly acquiring strategic intelligence, intellectual property or geopolitical data.
- Widespread reliance on living-off-the-land (LotL) binaries and built-in administration tools to evade endpoint defenses
- Exploitation of zero-day vulnerabilities alongside targeted spear phishing for initial intrusion
- Covert credential harvesting and low-and-slow data staging designed to sustain long-term operational persistence Organized syndicates and affiliates sought monetary gain through systemic data compromise, extortion and fraudulent transactions.
- Multi-extortion models combining exfiltration with ransomware deployment or public exposure threats
- Access acquisition facilitated by infostealer logs, exposed credentials and unpatched perimeter assets
- Business email compromise (BEC) and payment diversion schemes executing fraudulent wire transfers Threat actors are integrating generative AI and large language models (LLMs) into their offensive workflows. This notable emerging trend cuts across multiple operational motivations.
- Generation of highly refined, context-tailored social engineering lures and synthetic personas at scale
- Utilization of LLMs to assist in rapid scripting, payload debugging and code obfuscation
- Application of automated reconnaissance and multimodal tools (such as deepfakes) to support executive impersonation and access operations These highlights summarize recent in-depth threat intelligence bulletins published for Unit 42 Threat Intelligence Services customers. Unit 42 Threat Intelligence Services provide organizations with direct access to elite frontline threat expertise, enabling security teams to prioritize real risks and sharpen detection capabilities. These human-led services combine world-class intelligence with direct access to the analysts behind it, offering tailored context and guidance aligned to a customer’s specific environment.