Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

COVID-19 Themed Malware Within Cloud Environments

Summary: Unit 42 researchers identified more than 446 COVID-19 themed malware samples that communicated with 20 unique IP addresses and domain indicators of compromise, then queried Prisma Cloud for connections to those indicators between March 1 and April 7, 2020, finding 453,074 unique network connections across 27 cloud environments. Researchers could not view the network traffic or obtain the malware samples themselves, so compromise of the 27 organizations is unconfirmed, but seven non-CDN IP addresses with a documented malicious history were seen as destinations from those environments.

Bottom line: Seven IP addresses tied to known malware infrastructure were actively receiving traffic from 27 cloud environments, and the researchers could only see connection metadata, not content, so the organizations involved may not know whether anything malicious actually crossed.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026