Unit 42 highlights the need for a comprehensive security strategy that spans every IT zone. Explore the full details here.
The post Essential Data Sources for Detection Beyond the Endpoint appeared first on Unit 42.
Unit 42 research reports that TGR-STA-1030 remains an active threat, particularly in Central and South America.
The post TGR-STA-1030: New Activity in Central and South America appeared first on Unit 42.
What are the next steps for security leaders in this new age of frontier AI? We answer the top 10 questions customers are asking.
The post Frontier AI and the Future of Defense: Your Top Questions Answered appeared first on Unit 42.
Unit 42 finds frontier AI models enhance vulnerability discovery, acting as full-spectrum security researchers. They enable autonomous zero-day discovery and faster N-day patching.
The post Fracturing Software Security With Frontier AI Models appeared first on Unit 42.
The evolution of Iranian cyber operations in broad context: from custom wiper malware to misuse of legitimate admin tools and more.
The post Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization appeared first on Unit 42.
We are observing an increase of wiper attacks by the Iran-linked Handala Hack group (aka Void Manticore) through phishing and misuse of Microsoft Intune.
The post Insights: Increased Risk of Wiper Attacks appeared first on Unit 42.
The CVSS Blind Spot For years, CVSS scores have been the default metric for vulnerability severity. But severity does not equal risk. A CVSS 9.8 vulnerability that is never exploited is less dangerous than a CVSS 6.5 actively used in ransomware campaigns. Yet many organizations still chase the highest scores first, wasting time and leaving real threats exposed. KEV lists help, but they are reactive and often lag behind active exploitation. Attackers move faster than static scoring systems. If your prioritization strategy starts and ends with CVSS, you are playing catch-up. If vulnerability management feels overwhelming, the numbers explain why. […]
The post How Threat Intelligence and Multi-Source Data Drive Smarter Vulnerability Prioritization appeared first on Check Point Blog.
A Practical Q&A Guide for Leaders Navigating NIST, Zero Trust, and AI Governance Q1. Why does national cyber security feel more urgent than ever? Answer: Cyber security is no longer something that happens quietly in server rooms or security operations centers. It now affects fuel availability, hospital operations, elections, financial markets, and public trust. What has changed is not just the volume of cyber attacks, but their intent. Adversaries are no longer satisfied with stealing data. They are embedding themselves into systems, waiting patiently, and positioning for disruption at moments of national stress. Cloud platforms, AI systems, and operational technology have dramatically expanded the attack […]
The post National Cyber Resilience in the AI Era appeared first on Check Point Blog.
Unit 42 research reveals most OT attacks begin in IT. Learn how edge-driven defense stops threats early and turns dwell time into advantage.
The post Bring the Fight to the Edge: Turning Time Into an Advantage in OT Security appeared first on Unit 42.
Why do successful phishing attacks target our psychology rather than just our software? Discover Unit 42’s latest insights on defeating social engineering and securing your digital life.
The post Why Smart People Fall For Phishing Attacks appeared first on Unit 42.
Russia's current isolation from the Olympics may lead to increased cyberthreats targeting the 2026 Winter Games. We discuss the potential threat picture.
The post Understanding the Russian Cyberthreat to the 2026 Winter Olympics appeared first on Unit 42.
Unit 42 celebrates 9 years of the Cyber Threat Alliance, tracing its journey from a bold idea to a global leader in collaborative cyber defense.
The post Happy 9th Anniversary, CTA: A Celebration of Collaboration in Cyber Defense appeared first on Unit 42.
Unit 42 breaks down a payroll attack fueled by social engineering. Learn how the breach happened and how to protect your organization from similar threats.
The post Anatomy of an Attack: The Payroll Pirates and the Power of Social Engineering appeared first on Unit 42.
AI-generated code looks flawless until it isn't. Unit 42 breaks down how to expose these invisible flaws before they turn into your next breach.
The post Securing Vibe Coding Tools: Scaling Productivity Without Scaling Risk appeared first on Unit 42.
Cybersecurity thrives on diverse skills, not just coding and engineering. From writers to designers, there’s a place for you in this field.
The post Who Does Cybersecurity Need? You! appeared first on Unit 42.
Cyber hygiene is just as vital as personal hygiene. Unit 42 shares tips for people of all experience levels to keep their digital lives secure.
The post Stay Secure: Why Cyber Hygiene Should Be Part of Your Personal Hygiene appeared first on Unit 42.
85% of daily work occurs in the browser. Unit 42 outlines key security controls and strategies to make sure yours is secure.
The post The Browser Defense Playbook: Stopping the Attacks That Start on Your Screen appeared first on Unit 42.
Unit 42 shares further updates of cybercrime group Scattered LAPSUS$ Hunters. Secure your organization this holiday season.
The post The Golden Scale: 'Tis the Season for Unwanted Gifts appeared first on Unit 42.
Unit 42 outlines a Howling Scorpius attack delivering Akira ransomware that originated from a fake CAPTCHA and led to a 42-day compromise.
The post Anatomy of an Akira Ransomware Attack: When a Fake CAPTCHA Led to 42 Days of Compromise appeared first on Unit 42.
Staying ahead of emerging threats requires timely, actionable intelligence – but sorting through endless reports can slow even the best teams down.
ThreatConnect’s new playbook-driven capability streamlines this process by automatically gathering and summarizing the latest threat intelligence tailored to your team’s interests, such as recent threat actor activity, vulnerability updates, or other areas of focus. Delivered straight to the inbox of your key stakeholders, it provides instant visibility into the latest and most relevant intelligence, as well as pathways to dive deeper into the intelligence that matters most.
Whether you want to stay up to date in the CTI team, or help notify your internal stakeholders to help fulfil an RFI – this playbook will enable you to quickly pivot to different intelligence topics.
By transforming complex intelligence feeds into clear, targeted updates, this capability enables CTI and SecOps teams to maintain situational awareness, enhance decision-making, and stay one step ahead in a constantly evolving threat landscape.
The Threat Actor Round-up consists of a generic component playbook, which enables the round-up generation, and a timer trigger playbook, which is tailored to focus on Threat Actor-related Intelligence.
Install The Threat Actor Round-up Playbook
Lead Contributor – Emmet Wray (Director, Customer Success Engineering
This can be downloaded via GitHub here
Or by importing it as a Shared Playbook using code: TL4EdEqX
If you need assistance with the installation, please refer to the GitHub README above or contact your Customer Success team.
On a schedule that fits your team’s rhythm, you can automatically deliver timely notifications highlighting the latest intelligence tied to relevant Threat Actor activity—aggregated from all your trusted sources.
Notifications can be tailored to specific audiences or use cases, ensuring the right insights reach the right people—whether that’s a SOC team tracking adversary behavior, a vulnerability team assessing risk, or leadership maintaining situational awareness.
These communications extend the reach of your threat intelligence program beyond the TI-Ops platform, creating meaningful touchpoints with stakeholders across the enterprise. Each update reinforces awareness, drives engagement, and brings users back to the platform content that matters most—keeping threat intelligence visible, relevant, and connected to the mission of defense.
For additional assistance, please contact your Customer Success team or submit a Contact Us form.
The post ThreatConnect Threat Actor Round-up: A Framework for Automated Reporting and Informing Threat Ops appeared first on ThreatConnect.
Login
