Draft:Unit 42
This draft appears to contain text generated by a large language model (such as ChatGPT). You cannot use LLMs to generate, draft, or rewrite article content.
Please delete the portions which were LLM-generated, and summarize in your own words a range of independent, reliable, published sources that discuss the subject. If you have used an LLM but you believe that your use is covered by one of the two exceptions (basic copyediting and translation between two languages in which you are fully fluent), please provide a transcript of the prompt(s) you used while writing your draft (see the how-to guide). Reviewers can make mistakes. If you have not received any LLM assistance, you may seek a second opinion at the AfC Help Desk. See the advice page on large language models for more information.
Where to get help
How to improve a draft
You can also browse Wikipedia:Featured articles and Wikipedia:Good articles to find examples of Wikipedia's best writing on topics similar to your proposed article. Improving your odds of a speedy review To improve your odds of a faster review, tag your draft with relevant WikiProject tags using the button below. This will let reviewers know a new draft has been submitted in their area of interest. For instance, if you wrote about a female astronomer, you would want to add the Biography, Astronomy, and Women scientists tags. Editor resources
|  |
Submission declined on 21 September 2026 by Helpful Raccoon (talk). This draft appears to contain text generated by a large language model (such as ChatGPT). You cannot use LLMs to generate, draft, or rewrite article content.
Please delete the portions which were LLM-generated, and summarize in your own words a range of independent, reliable, published sources that discuss the subject. If you have used an LLM but you believe that your use is covered by one of the two exceptions (basic copyediting and translation between two languages in which you are fully fluent), please provide a transcript of the prompt(s) you used while writing your draft (see the how-to guide). Reviewers can make mistakes. If you have not received any LLM assistance, you may seek a second opinion at the AfC Help Desk. See the advice page on large language models for more information.This draft's references do not show that the subject meets Wikipedia's criteria for inclusion for organizations and companies. The draft requires multiple published secondary sources that:
Declined by Helpful Raccoon 24 days ago.
| |
Comment: Sources that just summarize/repeat their research are not significant coverage about the organization itself. Helpful Raccoon (talk) 02:00, 21 September 2026 (UTC)
- Comment: In accordance with the Wikimedia Foundation's Terms of Use, I disclose that I have been paid by my employer for my contributions to this article. ThePlay82 (talk) 16:29, 17 September 2026 (UTC)
Unit 42 is the threat intelligence, incident response, and cybersecurity consulting organization of Palo Alto Networks. Unit 42 originated in 2014 as Palo Alto Networks' threat intelligence team and later expanded into incident response and security consulting following their acquisition of The Crypsis Group in 2020.[1]
Unit 42 researchers investigate cybercrime, cyberespionage, malware, vulnerabilities, and other cybersecurity threats. Its researchers have also participated in investigations with technology companies and government agencies.[2]
History and organization
[edit]Unit 42 was established in 2014 as a threat intelligence organization within Palo Alto Networks. Ryan Olson, who had previously worked in threat intelligence at iDefense, was recruited to lead the group.
Rick Howard, who was Palo Alto Networks' chief security officer when Unit 42 was established, described the groups original purpose as creating a public-facing intelligence organization that could analyze threat activity across the company's security data. Olson said that access to telemetry from Palo Alto Networks products provided the new organization with data about active cyberattacks that was not available through traditional open-source threat intelligence.[3]
Contemporary reporting documented the organization during its first year. In November 2014, "Dark Reading" identified Olson as Intelligence Director of Palo Alto Networks' Unit 42, while reporting on the team's analysis of WireLurker, malware targeting Apple's OS X and iOS platforms.[4]
The team's role subsequently expanded beyond publishing threat research. Olson later said that Unit 42 developed a broader responsibility for evaluating major threats across Palo Alto Networks products and determining whether existing security products were sufficient enough to provide protection against them.[3]
Crypsis acquisition and expansion
[edit]In August 2020, Palo Alto Networks announced an agreement to acquire the Crypsis Group, and incidence response, risk management, and digital forensics consulting firm.
"TechCrunch" reported that the proposed $265 million acquisition would add incident response expertise to Palo Alto Networks' existing security operations. Crypsis had more than 150 consultants and handled approximately 1,300 incident-response annually at the time the transaction was announced.[5]
CRN described the transaction as Palo Alto Networks' entry into the incident-response services market and reported that Crypsis served more than 1,700 organizations across industries including healthcare, financial services, retail, e-commerce, and energy.[6]
Palo Alto Networks completed the acquisition in September 2020.[7]
In April 2021, Palo Alto Networks combined the former Cypsis security consultants with the existing Unit 42 threat research organization under an expanded Unit 42 organization.[1] The combination broadened Unit 42's activities from threat intelligence and research to include incident response, digital forensics, and cybersecurity consulting.
Threat research and collaboration
[edit]Unit 42 has conducted research into cyberespionage, malware, cloud security, and vulnerabilities, often in partnership with private companies and government organizations.
In 2019, CyberScoop reported on Unit 42's investigation of Rancor, a cyberespionage group that had attempted to compromise a Cambodian government organization. The publication described Unit 42 as Palo Alto Networks research unit and reported that the group had identified previously undocumented malware use in the campaign.[8]
Also in 2019, "The Register" reported on Unit 42 research examining the security configuration of public-facing cloud servers hosted on Amazon Web Services, Microsoft Azure, and Google Cloud Platform. The research identified exposed vulnerabilities, weak authentication configurations, and outdated security protocols among the systems examined.[9]
Unit 42 has also worked directly with other technology companies on investigations. In 2019, "WIRED" reported that Unit 42 and GoDaddy dismantled approximately 15,000 subdomains being used in fraudulent online marketing campaigns. The action followed a two-year investigation led by Palo Alto Networks researcher Jeff White. Unit 42 developed automated methods to identify the malicious subdomains after researchers found recurring patterns in the infrastructure.[2]
Unit 42 research has also been used in government cybersecurity activities. Congressional testimony submitted in 2017 described coordination between Palo Alto Networks and the U.S. Department of Homeland Security after Unit 42 discovered new samples of Disttrack, malware related to the Shamoon attacks. According to the testimony, information was provided to DHS before public release, after which DHS issued information bulletins, updated indicators-of-compromise databases and created EINSTEIN signatures intended to protect federal civilian agencies.[10]
References
[edit]- 1 2 Whitmore, Wendi (2021-04-20). "Unit 42 and Crypsis Combine to Offer Threat Intel, Incident Response". Palo Alto Networks Blog. Retrieved 2026-10-03.
- 1 2 Barrett, Brian (2019-04-25). "GoDaddy Takes Down 15,000 Spammy 'Snake Oil' Subdomains". Wired. ISSN 1059-1028. Retrieved 2026-10-03.
- 1 2 Jones, Kim (September 13, 2021). "Adversary playbooks around the Hash Table, with Rick Howard and Ryan Olson". N2K CyberWire. Retrieved October 3, 2026.
{{cite web}}: CS1 maint: url-status (link) - ↑ "WireLurker: A New Age In Mac OSX, iOS Malware". Dark Reading. Retrieved 2026-10-03.
- ↑ Miller, Ron (2020-08-24). "Palo Alto Networks to buy digital forensics consulting firm for $265M". TechCrunch. Retrieved 2026-10-03.
- ↑ Novinson, Michael. "Palo Alto Networks To Acquire IR Firm The Crypsis Group For $265M | CRN". www.crn.com. Retrieved 2026-10-03.
- ↑ Sep 17; 2020. "Palo Alto Networks Completes Acquisition of The Crypsis Group". Palo Alto Networks. Retrieved 2026-10-03.
{{cite web}}:|last2=has numeric name (help)CS1 maint: numeric names: authors list (link) - ↑ Lyngaas, Sean (2019-12-17). "This China-linked espionage group keeps trying to hack the Cambodian government". CyberScoop. Retrieved 2026-10-03.
- ↑ Francisco, Shaun Nichols in San (2019-08-16). "Fancy a career exposing cloud data leaks? Great news, companies are still largely clueless". theregister. Retrieved 2026-10-03.
- ↑ "Examining the Cyber Threat to Critical Infrastructure and the American Economy" (PDF). U.S. Government Publishing Office (Report). U.S. Government Publishing Office. 2017. pp. 62–63. Retrieved October 3, 2026.
- provide significant coverage: discuss the subject in detail, excluding routine coverage like product launches, staff appointments, or financial reports and listings in databases or listicles;
- are reliable: from reputable outlets with editorial oversight;
- are independent: not connected to the subject, such as press releases, the subject's own website, or sponsored content.
Please add references that meet all three of these criteria. If none exist, the subject is not yet suitable for Wikipedia.