Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Detecting Patient Zero Web Threats in Real Time With Advanced URL Filtering

Summary: Palo Alto Networks' Unit 42 reports that its inline analyzers and machine learning detected and blocked more than 500,000 patient zero URLs and about 200,000 malicious scanning requests between June and September, with thousands of new patient zero URLs detected per day. The researchers found that 40% of these patient zero detections remained uncaught by VirusTotal vendors even 48 hours after first detection, and that 15,948 malicious cloaked URLs were identified from June to August by crawling with mobile browser profiles, of which 2,601 were caught only through static URL analysis.

Bottom line: Blocklist-based filtering is structurally blind to the first attack, and 40% of the patient zero URLs Unit 42 caught were still undetected by VirusTotal vendors two days later - meaning the first visitor to a fresh malicious URL is the one who absorbs the risk.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related