All news with #palo alto networks tag

🔒 New Kubernetes clusters are probed and often attacked within minutes, with honeypots run by Palo Alto Networks, Wiz and Aqua Security showing initial compromise attempts in roughly twenty minutes and repeated automated scans against container ports. The platform's permissive defaults and complex model make standard cloud controls insufficient. Organizations should adopt Kubernetes-specific controls: harden and automate RBAC, isolate workloads with network and namespace policies, store secrets in dedicated key management services, perform regular audits, and train developers on platform-specific threats and secure CI/CD practices.

🤖 Palo Alto Networks has rolled out a major Cortex release that embeds context-aware, agentic AI throughout the security operations lifecycle, promising faster detection, investigation and response. An expanded AI-ready data foundation, Cortex XDL 2.0, and new purpose-built agents — including Case Investigation, Cloud Posture and Automation Engineer — aim to slash response times and automate complex playbooks. The launch also introduces the standalone Cortex Agentix orchestration platform and signals intent to acquire Koi to strengthen endpoint protection for AI-driven threats.

🔧 Palo Alto Networks, ServiceNow, and Bell Canada have built a ServiceNow application that automates the full lifecycle of Prisma SASE, creating a direct bridge between security operations and service management. The Prisma SASE app accelerates deployment from months to hours by automating Day 0–Day N tasks—provisioning, ZTNA connector setup, and mobile user workflows—while eliminating swivel-chair operations by syncing incidents into a single ServiceNow interface. ServiceNow’s Service Bridge enables cross-instance support for MSPs and the app supports direct CSP ticket creation, reducing MTTR and operational overhead.

🔍 Recent joint research from Palo Alto Networks, Siemens and the Idaho National Laboratory shows that most OT-impacting attacks originate in IT and manifest at the IT–OT edge. Analysts found attackers dwell an average of 185 days in precursor phases, producing detectable signals like credential abuse, reconnaissance and protocol misuse. The paper recommends edge-focused telemetry and an OT SOC-driven active defense to detect and disrupt threats before operational impact.

🔒 Palo Alto Networks' Unit 42 finds that AI and growing system complexity have drastically shortened the time between initial compromise and harmful outcomes, with some intrusions progressing to data exfiltration in 72 minutes versus nearly five hours in 2024. The team analyzed 750 incidents across 50 countries and highlights persistent operational gaps—weak authentication, limited real-time visibility, and misconfigurations—that attackers repeatedly exploit. The report flags identity issues in 90% of cases and widespread excessive cloud permissions, and it argues that modern, purpose-built managed SOC services such as XSIAM 2.0 are being positioned to respond at machine speed.

🚨 Palo Alto Networks' Unit 42 reports that cyberattacks are accelerating: the fastest incidents moved from initial access to data exfiltration in 72 minutes, down from nearly five hours in 2024, and AI is compressing reconnaissance, phishing, scripting and execution timelines. Yet most breaches traced to basic failures such as weak authentication, limited real‑time visibility, and misconfigurations. Identity and trust issues featured in 90% of incidents, and Unit 42 found excessive permissions across 99% of 680,000 cloud identities. In response, Palo Alto launched Unit 42 Managed XSIAM 2.0 to provide end‑to‑end onboarding, threat hunting and faster automated response.

🔐 Unit 42 investigates the rising misuse of QR codes for phishing, in‑app deep‑link exploitation, and direct distribution of malicious Android APKs. Their telemetry shows an average of over 11,000 malicious QR-code detections per day, driven by tactics that mask destinations and exploit mobile app behavior. The report highlights QR shorteners, custom deep links, and APK hosting as key evasive techniques and recommends user education plus deployment of decoding and filtering controls such as Advanced URL Filtering and Prisma Browser to improve visibility and block threats.

🔒 Palo Alto Networks has completed its $25 billion acquisition of Israel-based CyberArk, integrating privileged access management into its core platform strategy. The deal aims to extend privileged controls across human, machine, and AI identities to reduce standing privileges, limit lateral movement, and accelerate breach response. Palo Alto will continue offering standalone CyberArk while pursuing deeper integration, though analysts warn of transition friction and potential licensing or vendor lock-in.

🔐 CyberArk is joining Palo Alto Networks to elevate identity security as a core platform pillar for cloud, automation and AI-driven environments. The post argues identity is now the primary attack vector: machine identities outnumber humans by more than 80:1 and 87% of organizations experienced multiple identity-centric breaches in the past year. It calls for continuous visibility, dynamic privilege controls and unified governance to secure human, machine and AI agents and reduce opportunities for lateral movement.

🕵️‍♂️ Palo Alto Networks' Unit 42 reports a state-sponsored threat actor tracked as TGR-STA-1030/UNC6619 has run global-scale "Shadow Campaigns," compromising at least 70 government and critical infrastructure organizations across 37 countries and conducting reconnaissance tied to 155 countries. The actor has been active since at least January 2024 and is assessed to operate from Asia. Initial access combined tailored phishing lures hosted on Mega.nz with exploitation of known flaws in SAP Solution Manager, Microsoft Exchange, D-Link, and Windows to deploy loaders such as Diaoyu. Victim environments were instrumented with Cobalt Strike, webshells, tunneling tools, and a bespoke Linux eBPF rootkit named ShadowGuard to hide activity and evade detection.

🔎 Unit 42 demonstrates a practical method to map cloud alert events to MITRE ATT&CK tactics and techniques and use the resulting alert patterns as operational fingerprints for known threat actors. The study examined alerts from cloud providers, containers, cloud-hosted applications, and SaaS across 22 industries between June 2024 and June 2025. Comparing cybercrime actor Muddled Libra and nation-state group Silk Typhoon, researchers found distinct, identifiable alert fingerprints and recommend proactive monitoring and mitigation, including Cortex Cloud runtime detection.

🔒 Palo Alto Networks Unit 42 reports an Asia-origin, state-backed actor tracked as TGR-STA-1030 breached at least 70 government and critical-infrastructure organizations across 37 countries and scanned infrastructure tied to 155 countries in late 2025. Active since January 2024, the group used MEGA-hosted phishing ZIPs to deliver a guarded loader, Diaoyu Loader, which requires a zero-byte pic1.png and checks for select AV processes before pulling images from GitHub to stage a Cobalt Strike payload. It also exploited N-day flaws, deployed web shells, tunnelers and an eBPF Linux rootkit ShadowGuard, maintaining prolonged access for intelligence collection.

🔎 Palo Alto Networks has identified a new Asia-based cyberespionage group, tracked as TGR-STA-1030 (UNC6619), that has compromised 70 government and critical-infrastructure organizations across 37 countries over the past year. The actor employs phishing, N-day exploits, and a multifaceted toolset including a custom loader named Diaoyu, Cobalt Strike implants, multiple web shells, and a bespoke eBPF-based Linux rootkit called ShadowGuard. Researchers report the group conducts extensive scanning and targeted reconnaissance tied to regional events, operates on GMT+8 hours, and shows indicators consistent with nation-state activity.

🔒 Glean and Prisma AIRS have integrated to provide real-time AI threat protection that neutralizes prompt injections, blocks toxic or biased outputs, and inspects generated code and URLs for malicious patterns. The integration enforces organizational policy across chats and agent interactions and immediately blocks risky requests while notifying users. Deployment is designed to be frictionless—enable protection in three clicks by pasting a Prisma AIRS runtime API key into the Glean admin console.

🚀 Palo Alto Networks has reworked its NextWave partner program and unified it with a value exchange framework to simplify engagement, reward impact and accelerate growth in 2026. The update emphasizes predictability, repeatability and profitability, expanding enablement, labs, demos, quoting APIs and targeted rebates. Partners gain clearer paths for specialization, delivery and managed services while customers benefit from more consistent, integrated AI-driven security outcomes.

🔒 Palo Alto Networks has partnered with the RAF Association to modernize its cybersecurity with a secure-by-design, zero trust architecture. The engagement consolidates legacy controls into a unified platform using Prisma SASE, Cortex XDR and Strata Cloud Manager with AIOps to improve visibility, automate operations and protect sensitive beneficiary data. The initiative prioritizes operational resilience and scalable, cost‑efficient support.

🔒 Palo Alto Networks unveiled Quantum-Safe Security to help organizations transition to post-quantum cryptography without disrupting operations. It provides continuous, real-time cryptographic visibility by collecting telemetry from PAN-OS NGFW, Prisma Access and third-party tools to catalog certificates, algorithms, key exchanges and libraries. The solution prioritizes harvest now, decrypt later risks, guides staged remediation including hybrid algorithms and real-time encryption translation for legacy systems, and automates governance and compliance. Integration with SIEM, EDR and other systems supports gradual migration across complex environments.

🔐 Palo Alto Networks announced Quantum-Safe Security, a continuous solution to discover, assess and remediate enterprise cryptographic risk as organizations migrate to post-quantum standards. The offering ingests telemetry from PAN-OS NGFW, Prisma Access and third-party systems to build a real-time Cryptographic Bill of Materials (CBOM), prioritize harvest-now, decrypt-later exposure, and automate remediation—including cipher translation at the network edge. General availability is expected on January 30, 2026.

🚀 The author uses the Alien films to illustrate modern SOC challenges, arguing that threats enter unseen, tools create noise, and visibility gaps are lethal. The post highlights Unit 42 findings on faster exfiltration and critiques legacy SIEMs, advocating for a unified data foundation and AI-driven platforms like Cortex XSIAM. It recommends automation to accelerate response while preserving human expertise.

⚠️ Unit 42 details a technique where seemingly benign webpages call trusted LLM APIs from the browser to generate malicious JavaScript dynamically and execute it at runtime. Carefully engineered prompts can bypass model safety guardrails and return credential-harvesting code that assembles in-browser into personalized phishing pages. Because payloads are served via trusted domains and differ per visit, this approach defeats many static and network-based detectors, making runtime behavioral analysis the most effective mitigation.