Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

From Dark Gate to AsyncRAT: Malware Detected and Shared As Unit 42 Timely Threat Intelligence

Summary: Unit 42 recapped the malware families it shared through social channels from October through December 2023, including repeated sightings of DarkGate and IcedID and multiple Pikabot campaigns run by the cybercrime group TA577. The 93 timely threat intelligence posts published in 2023 generated more than 1.6 million impressions, and Unit 42's first public post on JinxLoader led Proofpoint's Emerging Threats Labs to build a new signature for its traffic patterns.

Bottom line: TA577 appears across the roundup distributing Pikabot, IcedID and Cobalt Strike, and in one IcedID case hands-on-keyboard activity began roughly 95 minutes after initial infection. Unit 42 also recorded over 300 detections of Citrix CVE-2023-3519 exploitation from a single domain, jscloud[.]biz.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026