New Attacks Linked to C0d0so0 Group
Summary: Unit 42 discovered new attack activity tied to the adversary group C0d0so0, targeting organizations in telecommunications, high tech, education, manufacturing, and legal services, likely delivered via spear-phishing emails or compromised websites used as watering holes. The malware came in two variants - one using HTTP for command and control and one using a custom protocol over port 22 - both side-loaded with legitimate signed executables and using encoded, compressed traffic to evade network controls.
What's compelling: Several targeted hosts were server systems rather than user endpoints, which Unit 42 suggests may be staged as future watering holes - meaning the compromise may be infrastructure your partners and customers later visit, not just your own data at risk.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026