A ransomware attack by Ignoble Scorpius utilized compromised VPN credentials to infiltrate a manufacturing company, leading to significant data exfiltration and the deployment of BlackSuit ransomware across their infrastructure. Unit 42 intervened, expanding the client's security measures and successfully negating a $20 million ransom demand while providing strategic recommendations for future protection against similar threats.

TraderTraitor, a DPRK-affiliated threat actor, targets AWS environments and the cryptocurrency sector primarily for financial gain, executing significant cyber heists through tactics such as supply chain compromise and credential theft. Defenses against such attacks include enabling AWS logging, enforcing multi-factor authentication, and monitoring network traffic to mitigate risks associated with their sophisticated social engineering and cloud service abuse methods.