Finding Gozi: Unit 42 Wireshark Quiz, March 2023
Summary: Unit 42 published a March 2023 Wireshark quiz built on real packet capture from a Gozi (ISFB/Ursnif) infection in an Active Directory environment, with the malware family described as targeting Italy in a March 6, 2023 tweet. Participants download the pcap from Unit 42's GitHub repository using the password 'infected' and are asked to identify who was infected and to compare indicators against previously reported Gozi activity, with answers due in a separate blog post on March 27.
Bottom line: Gozi has generated distinct post-infection traffic patterns across several years in the threat landscape, and the quiz frames the exercise around a threat hunt that surfaced the same activity inside an organization at approximately 02:07 UTC on March 7, 2023 - the detection question is whether your SOC could name the infected host from a pcap.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026