Skip To Main Content
Doel Santos on Muck Rack

Doel Santos

As seen in: Palo Alto Networks
Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work. Claim your profile

Get in touch with Doel

Contact Doel, search articles and posts on X, monitor coverage, and track replies from one place.

Learn more about Muck Rack

Actions

Share this page

Is this you?

As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile

Articles

Kimwolf v7: An Evolution of the Kimwolf Botnet

|
By Asher Davila, Chris Navarrete, Doel Santos
| Palo Alto Networks
Content Warning We are providing a content warning because the following article contains usage of a racial slur by a threat actor, which Unit 42 does not condone in any instance. We have partially redacted the racial slur, but preserved some references to it in order to provide researchers with the ability to identify it and check IoCs as needed. Executive Summary We identified a new version (v7) of the Kimwolf Android/internet-of-things (IoT) botnet.
Open in Who Shared View Duplicates (3) Issue with article?

TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development

|
By Chris Navarrete, Asher Davila, Doel Santos
| Palo Alto Networks
Executive Summary We identified a previously undocumented modular internet-of-things (IoT) botnet framework named TuxBot v3 Evolution. The malware authors leveraged an LLM to assist in their code development, yielding mixed results. While the AI complied with their request to generate botnet code, it included a safety disclaimer that the developer failed to remove before shipping.
Open in Who Shared Issue with article?

Converging Interests: Analysis of Threat Clusters Targeting a Southeast Asian Government

|
By Doel Santos, Hiroaki Hara
| Palo Alto Networks
Executive Summary Unit 42 researchers uncovered a series of cyberespionage campaigns targeting a government organization in Southeast Asia. Our initial investigation began with tracking Stately Taurus activity between June 1–Aug. 15, 2025. This activity involves USB-propagated malware called USBFect (aka HIUPAN), which deploys a PUBLOAD backdoor. Our investigation led to the discovery of two additional, distinct activity clusters we’re tracking as CL-STA-1048 and CL-STA-1049.
Open in Who Shared Issue with article?
See all 17 articles