{"id":104003,"date":"2019-12-23T13:00:38","date_gmt":"2019-12-23T21:00:38","guid":{"rendered":"https:\/\/www.paloaltonetworks.com\/blog\/?p=104003"},"modified":"2020-01-28T13:28:11","modified_gmt":"2020-01-28T21:28:11","slug":"network-threat-intelligence-research","status":"publish","type":"post","link":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/2019\/12\/network-threat-intelligence-research\/","title":{"rendered":"A Few of Unit 42\u2019s Greatest Contributions to Threat Intelligence Research"},"content":{"rendered":"<p><span style=\"font-weight: 400;\">In 2015, Unit 42, the global threat intelligence division at Palo Alto Networks, discovered that more than 39 iOS apps were infected with xCodeGhost, the first compiler malware in OSX. By targeting the compilers used to create legitimate apps, xCodeGhost is able to use infected apps to collect information from devices and upload that data to command and control (C2) servers. After finding xCodeGhost in popular apps including WeChat and Didi, Unit 42 shared their samples, threat intelligence and research with Apple, Amazon and Baido to stop the attacks or mitigate the security threat.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">This is just one example of the work of <\/span><a href=\"https:\/\/unit42.paloaltonetworks.com\/\"><span style=\"font-weight: 400;\">Unit 42<\/span><\/a><span style=\"font-weight: 400;\">, whose mission is to research and document the details of adversaries\u2019 playbooks and quickly share them with systems, people and organizations who can use them to prevent successful cyberattacks.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">In our rapidly evolving digital age, cybercriminals find new software vulnerabilities and attack vectors everyday. They\u2019re also often willing to freely share their tools and techniques with other criminals so information spreads rapidly. This presents a major challenge for cybersecurity experts, who are constantly trying to keep pace with the rapidly growing volume and sophistication of attacks, and makes work like that of Unit 42 especially vital. Believing that threat intelligence should be accessible to all, Unit 42 disseminates their findings freely and globally so defenders everywhere can gain visibility into threats to better defend their businesses against them.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">To highlight some of the most significant contributions Unit 42 has made to threat research, we\u2019ve compiled them into the <\/span><a href=\"https:\/\/start.paloaltonetworks.com\/unit-42-greatest-hits.html\"><span style=\"font-weight: 400;\">Unit 42 Greatest Hits Interactive<\/span><\/a><span style=\"font-weight: 400;\">. There, you can learn more about xCodeGhost and other threat intelligence research. From discoveries like <\/span><a href=\"https:\/\/unit42.paloaltonetworks.com\/keyraider-ios-malware-steals-over-225000-apple-accounts-to-create-free-app-utopia\/\"><span style=\"font-weight: 400;\">KeyRaider<\/span><\/a><span style=\"font-weight: 400;\">, a computer malware that stole login credentials from more than 225,000 Apple devices, to <\/span><a href=\"https:\/\/unit42.paloaltonetworks.com\/behind-the-scenes-with-oilrig\/\"><span style=\"font-weight: 400;\">OilRig<\/span><\/a><span style=\"font-weight: 400;\">, which became the first ever <\/span><a href=\"https:\/\/pan-unit42.github.io\/playbook_viewer\/?pb=oilrig\" rel=\"nofollow,noopener\" ><span style=\"font-weight: 400;\">adversary playbook<\/span><\/a><span style=\"font-weight: 400;\">, Unit 42 has had a profound impact on threat intelligence and research in the cybersecurity landscape.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Download our <\/span><a href=\"https:\/\/start.paloaltonetworks.com\/unit-42-greatest-hits.html\"><span style=\"font-weight: 400;\">Unit 42 Greatest Hits Interactive<\/span><\/a><span style=\"font-weight: 400;\"> to find:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Major cyberthreats and how they operate.<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Tools and tactics Unit 42 uses to discover new threats.<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Essential news and resources related to common cyberthreats.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">Experts in hunting and collecting unknown threats, the Unit 42 team has been internationally recognized for key research on threats and campaigns and is frequently sought out by enterprises and government agencies around the world. They were even recently recognized by Microsoft with multiple awards for contributions to vulnerability research, including <\/span><a href=\"https:\/\/www.paloaltonetworks.com\/blog\/2019\/08\/unit-42-named-top-zero-day-vulnerability-contributor-microsoft\/\"><span style=\"font-weight: 400;\">first place for the discovery of Zero Day vulnerabilities<\/span><\/a><span style=\"font-weight: 400;\">.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">To see an engaging digital exhibition of Unit 42\u2019s discoveries and how they\u2019re combating large-scale threats, check out the <\/span><a href=\"https:\/\/start.paloaltonetworks.com\/unit-42-greatest-hits.html\"><span style=\"font-weight: 400;\">Unit 42 Greatest Hits Interactive. <\/span><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Our interactive digital eBook compiles some of the most significant contributions Unit 42 made to the threat intelligence research world in 2019.<\/p>\n","protected":false},"author":133,"featured_media":104036,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[6765],"tags":[6443,122,1408,74,3627,922,47],"coauthors":[1222],"class_list":["post-104003","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-secure-the-enterprise","tag-adversary-playbooks","tag-cyberthreats","tag-keyraider","tag-malware","tag-oilrig","tag-threat-intelligence","tag-zero-day"],"jetpack_featured_media_url":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-content\/uploads\/2019\/12\/Trends-r3d1.png","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/104003","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/users\/133"}],"replies":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/comments?post=104003"}],"version-history":[{"count":7,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/104003\/revisions"}],"predecessor-version":[{"id":105699,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/104003\/revisions\/105699"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/media\/104036"}],"wp:attachment":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/media?parent=104003"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/categories?post=104003"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/tags?post=104003"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/coauthors?post=104003"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}