TLDR Tech / InfoSec
Novel Technique to Detect Cloud Threat Actor Operations
Unit 42 researchers introduced a novel detection method that fingerprints cloud threat actors by linking their known MITRE ATT&CK techniques to specific alert patterns. This approach successfully distinguished Muddled Libra (Scattered Spider) and Silk Typhoon operations across 22 industries from June 2024 to June 2025, with only three shared alert signatures out of around 120, highlighting their differing tactics. Industry alert spikes correlated with publicly reported campaigns, such as a 25% rise in transportation sector alerts during Muddled Libra's aviation attacks, enabling defenders to identify threats early by investigating actor-related alerts over a 30-day window.
Read the full story