[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [German](https://unit42.paloaltonetworks.com/de/2025-cloud-security-alert-trends/) * [English](https://unit42.paloaltonetworks.com/2025-cloud-security-alert-trends/) * [Spanish (Spain)](https://unit42.paloaltonetworks.com/es/2025-cloud-security-alert-trends/) * [Spanish (LATAM)](https://unit42.paloaltonetworks.com/es-la/2025-cloud-security-alert-trends/) * [French](https://unit42.paloaltonetworks.com/fr/2025-cloud-security-alert-trends/) * [Italian](https://unit42.paloaltonetworks.com/it/2025-cloud-security-alert-trends/) * [Japanese](https://unit42.paloaltonetworks.com/ja/2025-cloud-security-alert-trends/) * [Korean](https://unit42.paloaltonetworks.com/ko/2025-cloud-security-alert-trends/) * [Portuguese](https://unit42.paloaltonetworks.com/pt-br/2025-cloud-security-alert-trends/) * [Chinese (Traditional)](https://unit42.paloaltonetworks.com/zh-hant/2025-cloud-security-alert-trends/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Cloud Cybersecurity Research](https://unit42.paloaltonetworks.com/category/cloud-cybersecurity-research/ "Cloud Cybersecurity Research") [Cloud Cybersecurity Research](https://unit42.paloaltonetworks.com/category/cloud-cybersecurity-research/) # Cloud Threats on the Rise: Alert Trends Show Intensified Attacker Focus on IAM, Exfiltration ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 11 min read Related Products [![Cortex icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex](https://unit42.paloaltonetworks.com/product-category/cortex/ "Cortex")[![Cortex Cloud icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex Cloud](https://unit42.paloaltonetworks.com/product-category/cortex-cloud/ "Cortex Cloud")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Nathaniel Quist](https://unit42.paloaltonetworks.com/author/nathaniel-quist/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:March 27, 2025 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Cloud Cybersecurity Research](https://unit42.paloaltonetworks.com/category/cloud-cybersecurity-research/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [API attacks](https://unit42.paloaltonetworks.com/tag/api-attacks/) * [Containers](https://unit42.paloaltonetworks.com/tag/containers/) * [IAM](https://unit42.paloaltonetworks.com/tag/iam/) * [Serverless](https://unit42.paloaltonetworks.com/tag/serverless/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/2025-cloud-security-alert-trends/?pdf=download&lg=en&_wpnonce=64814e76fb "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/2025-cloud-security-alert-trends/?pdf=print&lg=en&_wpnonce=64814e76fb "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Cloud%20Threats%20on%20the%20Rise:%20Alert%20Trends%20Show%20Intensified%20Attacker%20Focus%20on%20IAM,%20Exfiltration&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2F2025-cloud-security-alert-trends%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2F2025-cloud-security-alert-trends%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2F2025-cloud-security-alert-trends%2F&title=Cloud%20Threats%20on%20the%20Rise:%20Alert%20Trends%20Show%20Intensified%20Attacker%20Focus%20on%20IAM,%20Exfiltration "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2F2025-cloud-security-alert-trends%2F&text=Cloud%20Threats%20on%20the%20Rise:%20Alert%20Trends%20Show%20Intensified%20Attacker%20Focus%20on%20IAM,%20Exfiltration "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2F2025-cloud-security-alert-trends%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Cloud%20Threats%20on%20the%20Rise:%20Alert%20Trends%20Show%20Intensified%20Attacker%20Focus%20on%20IAM,%20Exfiltration%20https%3A%2F%2Funit42.paloaltonetworks.com%2F2025-cloud-security-alert-trends%2F "Share in Mastodon") ## Executive Summary The attacks against cloud-hosted infrastructure are increasing, and the proof is in the analysis of security alert trends. Recent research reveals that organizations saw nearly five times as many daily cloud-based alerts at the end of 2024 compared to the start of the year. This means attackers have significantly intensified their focus on targeting and breaching cloud infrastructure. These alerts aren't simply noise. We've seen the greatest increases in high severity alerts, meaning indicators of attacks are successfully targeting critical cloud resources as explained in Table 1. |--------------------------------------|---------------------------------------------------------------------------------------------------------------------| | **Cloud Resource** | **Why It's Critical** | | Identity and access management (IAM) | Leaked credentials can open the door to an organization's cloud infrastructure. | | Storage | Can contain sensitive organizational or customer data. | | Virtual machines | Often connected to additional internal services, offering lateral movement opportunities to attackers. | | Containers | Container host exploitation can allow attackers to run malicious containers. | | Serverless | Serverless functions are designed for singular automated purposes. Remote command line executions should not occur. | Table 1. Criticality of certain cloud resources. Of particular note, attackers frequently targeted serverless IAM tokens resulting in remote command-line usage. These are significant because they can be used to gain access to an organization's larger cloud environment. As part of the increase of cloud alerts, there were three times as many remote command-line access events utilizing identity access and management (IAM) tokens, and credentials that are used by cloud serverless functions. We also identified other upward trends in alerting: * An 116% increase in IAM-based "impossible travel event" alerts (i.e., login events from distant geographic areas within a narrow time window) * A 60% increase in IAM application programming interface (API) requests from outside regions for compute resources (cloud virtual machine) * A peak 45% increase in the number of cloud snapshot exports during November 2024 * A 305% increase in the number of suspicious downloads of multiple cloud storage objects Identity is the defense perimeter of cloud infrastructure. Attackers target IAM tokens and credentials as they hold the keys to the cloud kingdom, allowing attackers to move laterally, escalate their permissions and perform additional malicious operations. The rise in the number of access attempts and usage of sensitive IAM service accounts means attackers across the globe have their sights set on cloud resources. Attackers target cloud storage services as they often contain sensitive data. We saw a notable increase in the number of suspicious cloud storage object downloads and image snapshot exports. Suspicious cloud storage object download alerts trigger when a single IAM-based identity downloads a large number of storage objects within a narrow time window. This can signify malicious operations such as ransomware or extortion. Image snapshots are targeted by attackers as snapshots can contain sensitive data regarding cloud infrastructure and IAM credentials that could allow the attacker to escalate permissions and move laterally within a victim cloud environment. These examples illustrate the immediate need to protect cloud environments, not solely with foundational cloud security posture management (CSPM) tools, but in cooperation with tools that detect and prevent malicious runtime operations as they occur. By deploying Cortex Cloud's runtime cloud security tooling --- also called Cloud Detection and Response ([CDR](https://www.paloaltonetworks.com/cyberpedia/what-is-cloud-detection-and-response-cdr)) --- security teams can identify and prevent malicious events within cloud environments. If you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html). | **Related Unit 42 Topics** | [**Cloud Cybersecurity Research**](https://unit42.paloaltonetworks.com/category/cloud-cybersecurity-research/) | |----------------------------|----------------------------------------------------------------------------------------------------------------| ## Cloud Attacks at Scale In a [recent Unit 42 post](https://unit42.paloaltonetworks.com/large-scale-cloud-extortion-operation/), we published details of a ransomware and extortion campaign that directly targeted exposed environment variable files. The campaign's threat actor successfully harvested over 90,000 credentials from 110,000 targeted domains. More worryingly, they also harvested nearly 1,200 cloud IAM credentials. These credentials allowed the threat actor to successfully perform extortion attacks against multiple organizations. This operation highlights an opportunity to discuss the security mechanisms that are in place to protect organizations. Specifically, this allows us to determine how to employ both posture management and runtime monitoring security solutions seamlessly. This allows organizations to build a cloud security defense perimeter that is sufficiently robust, and capable of facing these new waves of attackers. During the investigation for this article, we discovered that the average total number of cloud alerts experienced by an organization increased by 388% in 2024. These alerts originated from both posture management and runtime monitoring detection operations. Although alerts with "informational" severity did account for the majority of alerts, it is extremely important to highlight that the most significant change was in the number of high severity alerts. This classification of alert saw an increase of 235% during 2024. Medium and low severity alerts also increased by 21% and 10%, respectively. ### What These Trending Alerts Signify The changes we observed in the number of alerts align with our [2024 State of Cloud-Native Security Report,](https://www.paloaltonetworks.com/state-of-cloud-native-security) which found that 71% of organizations attribute increased vulnerability exposures to accelerated deployments. Furthermore, 45% of those organizations report a rise in advanced persistent threat (APT) attacks over the last year. A case in point is Microsoft's recent research on [Storm-2077](https://www.microsoft.com/en-us/security/blog/2024/11/22/microsoft-shares-latest-intelligence-on-north-korean-and-chinese-threat-actors-at-cyberwarcon/), a China-based cloud threat actor group (CTAG) that employs complex cloud IAM credential harvesting techniques to obtain and to maintain access to victim cloud environments. It quickly becomes apparent that both cloud posture management and runtime security monitoring must function as a single unit to perform adequate protection from the next phase of threats in cloud environments. The [Background section](#post-138739-_xlurxz18uhof) below provides additional information on posture management and runtime monitoring detections. A key mission for cloud defenders is to design and deploy a cloud security platform that will improve detection capabilities. This allows administrators not only to detect misconfigurations and vulnerabilities, but also to collect and analyze the runtime events within cloud environments. Such a platform provides defenders with better visibility and enables quicker response time when dealing with alerts. While the ability to identify and detect malicious or suspicious cloud events has increased across the industry, so has the complexity of threat actors' offensive cloud operations. For example, in January 2024, the average cloud environment saw only two alerts for the remote command-line usage of a serverless function IAM token. This stayed consistent throughout the year. However, by December 2024, the average cloud environment saw more than 200 of those same alerts -- a worrying signal of increased activity. As shared in the [Leaked Environment Variables](https://unit42.paloaltonetworks.com/large-scale-cloud-extortion-operation/) article, this runtime operation is exactly what occurred during that malicious extortion event. Further evidence supporting this trend includes the following: * An 116% rise in impossible travel alerts relating to cloud identities * A 60% increase in the number of [compute workload](https://www.paloaltonetworks.com/cyberpedia/what-is-workload) API calls occurring from outside of that instance's cloud region * A 45% increase in the number cloud snapshot exports * A 305% increase in the number of suspicious downloads of multiple cloud storage objects Both of these alert findings strongly indicate that the prime objective of CTAGs is targeting, collecting and using a cloud IAM token or credential. This also indicates that attackers will use these tokens or credentials for potentially malicious operations. ## Background Cloud security posture management ([CSPM](https://www.paloaltonetworks.com/cyberpedia/what-is-cloud-security-posture-management)) tools form the foundation of cloud security. Their operations center on guardrail control monitoring to ensure that cloud environments maintain secure configurations and are free from vulnerabilities and misconfigurations. Posture management monitoring is traditionally based on time-specific security scanning of a cloud environment's resources and configurations. Alerts are triggered when a new or modified cloud resource appears to pose potential security risks. For example, an alert will be triggered if an IAM policy is overly permissive and allows access to other cloud resources. It will also be triggered if a cloud compute instance or serverless function contains vulnerabilities or misconfigurations. Posture management scanning operations are performed on a routine schedule, often hourly or daily. Some CSPM security tools allow for the monitoring of cloud platform auditing logs as well, which can assist in detecting suspicious activity as it occurs within a cloud service platform (CSP). It is critical that organizations configure their CSPM platform to collect the audit logs from their third-party cloud-based software-as-a-service (SaaS) applications to ensure visibility. CDR tools provide runtime monitoring detections by collecting, identifying and even preventing operations that occur during a particular event. By collecting the logs from cloud compute instances, CSP logging resources and third-party cloud SaaS applications, CDR security tools can identify, alert on and prevent malicious cloud events. Examples of these operations include the execution of an API request against a cloud platform or cloud application such as: * Creating new cloud users or service accounts * Attaching IAM policies to new or established IAM users or roles * Establishing network connections from a Tor exit node or VPN host In contrast to posture management tools, runtime monitoring tools continuously monitor the cloud environment and often require a dedicated agent to maintain visibility of the cloud resources. When an agent is installed, cloud runtime monitoring security tools allow for the detection --- and even prevention --- of malicious cloud operations as they occur. ## High Severity Alert Trends We have observed a clear increase in the number of alerts in 2024, correlating with the rise in attacks on cloud environments. High severity cloud alerts increased by 235% throughout 2024. The largest single-month spike (281%) occurred in May, and we noted the most substantial increase in these alerts (204%, 247% and 122%) in August, October and December, as shown in Figure 1. ![Line graph showing monthly fluctuation rates by percentage ranging from -100% to 200% with peaks in April, July, October, and December, and troughs in February, June, and September. Palo Alto Networks | UNIT 42 logo lockup at the bottom.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/03/chart-5.png) Figure 1. High severity alert trends for 2024. ### Top 10 High Alerts A closer look at the top 10 most frequent daily high severity alerts reveals a high number of alerts pertaining solely to runtime-focused events. These alerts are triggered by a singular event or a sequence of connected events. This necessitated near real-time analysis or, in some instances, real-time analysis for detection. Table 2 below shows that the remote command-line usage of the serverless IAM tokens is an event that requires real-time log analysis to detect and potentially to prevent. Conversely, the most frequent high severity alert, "cloud storage delete protection disabled," can be detected and mitigated with a CSPM tool. |----------------------------------------------------------------------------------|--------------------------------|-------------------------| | **Alert Name** | **Runtime or Posture Control** | **Average Daily Count** | | Remote command line usage of serverless token | Runtime | 24.68 | | An identity performed a suspicious download of multiple cloud storage objects | Runtime | 21.09 | | Cloud Storage Delete Protection Disabled | Posture and Runtime | 20.19 | | Abnormal Allocation of compute resources in a high number of regions | Posture and Runtime | 11.11 | | A Kubernetes node service account was used outside the cluster from non-cloud IP | Posture | 11 | | Abnormal Suspicious allocation of compute resources in multiple regions | Posture and Runtime | 10 | | Multiple cloud snapshots export | Runtime | 9.33 | | Remote command line usage of serverless role | Runtime | 7.79 | | Unusual allocation of multiple cloud compute resources | Posture and Runtime | 7.73 | | Abnormal Unusual allocation of compute resources in multiple regions | Posture and Runtime | 6.42 | Table 2. High severity alerting by average occurrence. To ensure the protection of cloud storage objects within a storage container whose delete protection has been disabled, we highly recommend deploying a CDR tool. These tools can detect and prevent any cloud storage objects from being deleted as a result of a "protection disabled" event. Other notable high severity alerts include multiple cloud snapshot exports and suspicious usage of a service account IAM. Both of these are key indicators of malicious activity within a cloud environment. Examples of malicious operations that could trigger several of these alerts are cloud-focused extortion or ransomware events. These types of events can only be leveraged by first disabling cloud storage protections, such as delete protection and automatic backups. Once these protections are removed, malicious actors can delete or exfiltrate cloud storage container objects, increasing the likelihood of a successful extortion operation. Some of these high severity alerts could also be triggered by the compromise of exposed or vulnerable serverless or compute instance resources. Specifically in terms of the remote command-line usage of a serverless IAM token, serverless functions are designed to operate autonomously and independently. Remote or unauthorized usage of a serverless function's IAM token indicates compromise and potential lateral movement within the cloud environment. The same type of event could indicate the malicious usage of a service account IAM token. Given that service account IAM tokens are typically intended for a single purpose, any abnormal usage of that token should be considered suspicious. ## Medium Severity Alert Trends Unlike the end-of-year high severity alert spike, we saw a sustained spike in medium severity alerts mid-2024. This spike included an initial 186% and subsequent 24% increase, before a downward trend through December, as Figure 2 shows. ![Line graph showing monthly fluctuation rates by percentage ranging from 0% to 3% with a trough in January through March and rising in April where it peaks in May-June, then falls to slightly lower through the rest of the year. Palo Alto Networks | UNIT 42 logo lockup at the bottom.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/03/chart-6.png) Figure 2. Medium severity alert trends for 2024. ### Top 10 Medium Alerts The top 10 medium severity alerts, shown in Table 3 below, differ from the top 10 high severity alerts listed in Table 2 above. The key difference is that for all but one of the top 10 medium severity alerts, the events can only be detected by performing some form of runtime protection analytics. The "unusual high-volume data transfer" event can be triggered using traditional CSPM detections of cloud resources. However, like the high severity "cloud storage delete protection disabled" event discussed above, a CDR tool would be better able to detect this unusual volume transfer event as it was occurring. It could also identify the types of files and their cloud storage file or directory locations. These details provide security teams with the most desired resources to perform their jobs: time, and knowledge. |-----------------------------------------------------------------------------------------------------|--------------------------------|-------------------------| | **Alert Name** | **Runtime or Posture Control** | **Average Daily Count** | | An IAM identity attempted multiple actions on resources that were denied | Runtime | 80 | | A compute-attached identity executed API calls outside the instance's region | Runtime | 36.32 | | Attempted cloud application access from unusual tenant | Runtime | 21.69 | | An identity performed a suspicious download of multiple cloud storage objects from multiple buckets | Runtime | 18.66 | | Impossible travel by a cloud compute identity | Runtime | 18.65 | | Unusual storage high-volume data transfer | Runtime | 15 | | Kubernetes service account activity outside the cluster from non-cloud IP | Runtime | 12.15 | | A cloud application performed multiple actions that were denied | Runtime | 12.02 | | Multiple cloud snapshots export | Runtime | 10 | | Suspicious identity downloaded multiple objects from a backup storage bucket | Runtime | 9.68 | Table 3. Medium severity alerting by average occurrence. Several of the alerts listed in Table 3 could indicate that malicious actors are targeting cloud resources such as Kubernetes service accounts outside of the cluster or from a non-cloud IP address. These two alerts in particular might indicate that the Kubernetes cluster authentication tokens have been compromised, as service account IAM tokens are designed for a singular purpose. Any operation using these credentials from outside of the cluster --- or outside of the known cloud environment --- should be considered suspicious activity and should be mitigated. Another alert that is important to highlight is exporting multiple cloud snapshots. While there can be a legitimate use case for this type of event --- such as th​​e deployment of snapshots or an external backup --- threat actors also export snapshots. Cloud snapshots can contain sensitive information, making them a common target of malicious operations. ## What Organizations Can Do There are several steps that organizations can implement to better protect themselves against malicious cloud operations: * Implement effective CDR runtime monitoring * Deploy a CDR cloud security for all of your cloud environments * Ensure that all mission-critical cloud endpoints have runtime enabled agents to detect compute and container runtime operations * Ensure runtime cloud audit log monitoring is available from your CSP providers * Ensure that your integrated cloud SaaS applications collect: * Identity providers (IdP) * CI/CD integrations * Source code repositories * Ticketing platforms * Place limits on CSP regions in which compute and serverless functions are allowed to operate * It is common practice for threat actors to create cloud resources within foreign CSP regions to perform a basic form of operation obfuscation * Identify and prevent IAM service accounts from performing operations outside of their intended functions * Following least-privilege architecture design for IAM credentials can greatly assist in combating lateral movement and privilege escalation operations if an IAM credential is compromised * Ensure that cloud storage versioning and encryption are in place for all cloud storage containers * Versioning and encryption are free configurations for every cloud storage container from each of the three major cloud service providers * These two features also significantly increase the difficulties that threat actors will encounter when trying to steal your valuable, sensitive information If in doubt, remember that CDR runtime monitoring defenses **must** be present to effectively combat the majority of threats faced by cloud environments. ## Conclusion CDR runtime monitoring is a critical aspect of maintaining a secure-cloud, hybrid-cloud and multi-cloud environment. As the trending high and medium severity alert data discussed in this article demonstrate, there was a 388% increase in the average number of alerts that cloud environments witnessed during 2024. A significant number of these alerts are the direct result of the detection of runtime operations, which cannot be detected with posture management (CSPM) tools alone. CDR tools provide cloud runtime detection capabilities, enabling the detection of malicious events occurring on cloud compute instances, container hosts or serverless functions. Given the increasing threats targeting cloud environments, the only real defense for these environments is to require cloud-based agents for publicly exposed and critical cloud endpoints, CSP audit logging and cloud third-party SaaS applications. Using a CDR analytics tool allows defenders to collect, detect and prevent the execution of malicious operations that can affect any of these resources. The combination of runtime monitoring, analysis and response for cloud resource event logging is essential to ensure that malicious operations are not allowed to function within cloud environments. If you think you may have been compromised or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html), or call: * North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) * UK: +44.20.3743.3660 * Europe and Middle East: +31.20.299.3130 * Asia: +65.6983.8730 * Japan: +81.50.1790.0200 * Australia: +61.2.4062.7950 * India: 00080005045107 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org). ## References * [Leaked Environment Variables Allow Large-Scale Extortion Operation in Cloud Environments](https://unit42.paloaltonetworks.com/large-scale-cloud-extortion-operation/) -- Unit 42, Palo Alto Networks * [2024 State of Cloud Native Security Report](https://www.paloaltonetworks.com/state-of-cloud-native-security) -- Palo Alto Networks * [Microsoft shares latest intelligence on North Korean and Chinese threat actors at CYBERWARCON](https://www.microsoft.com/en-us/security/blog/2024/11/22/microsoft-shares-latest-intelligence-on-north-korean-and-chinese-threat-actors-at-cyberwarcon/) -- Threat Intelligence blog, Microsoft * [What Is CSPM? | Cloud Security Posture Management Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-cloud-security-posture-management) -- Cyberpedia, Palo Alto Networks * [What Is CDR (Cloud Detection and Response)?](https://www.paloaltonetworks.com/cyberpedia/what-is-cloud-detection-and-response-cdr) -- Cyberpedia, Palo Alto Networks * [Definition of Identity and Access Management (IAM)](https://www.gartner.com/en/information-technology/glossary/identity-and-access-management-iam) -- Gartner Information Technology Glossary Back to top ### Tags * [API attacks](https://unit42.paloaltonetworks.com/tag/api-attacks/ "API attacks") * [Containers](https://unit42.paloaltonetworks.com/tag/containers/ "Containers") * [IAM](https://unit42.paloaltonetworks.com/tag/iam/ "IAM") * [Serverless](https://unit42.paloaltonetworks.com/tag/serverless/ "serverless") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: GitHub Actions Supply Chain Attack: A Targeted Attack on Coinbase Expanded to the Widespread tj-actions/changed-files Incident: Threat Assessment (Updated 4/2)](https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/ "GitHub Actions Supply Chain Attack: A Targeted Attack on Coinbase Expanded to the Widespread tj-actions/changed-files Incident: Threat Assessment (Updated 4/2)") ### Table of Contents * ### Related Articles * [The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration](https://unit42.paloaltonetworks.com/cloud-bucket-hijacking-risks/ "article - table of contents") * [Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years](https://unit42.paloaltonetworks.com/cve-2026-31431-copy-fail/ "article - table of contents") * [Essential Data Sources for Detection Beyond the Endpoint](https://unit42.paloaltonetworks.com/detection-beyond-the-endpoint/ "article - table of contents") ## Related Cloud Cybersecurity Research Resources ![Pictorial representation of bucket hijacking technique for cloud data exfiltration. Digital illustration of Europe map highlighting network connections and nodes, depicted as glowing points and lines on a dark blue background, emphasizing major cities and connectivity across the continent.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/09_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) June 22, 2026 [#### The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration](https://unit42.paloaltonetworks.com/cloud-bucket-hijacking-risks/) * [AWS](https://unit42.paloaltonetworks.com/tag/aws/ "AWS") * [Bucket hijacking](https://unit42.paloaltonetworks.com/tag/bucket-hijacking/ "bucket hijacking") * [Cloud data exfiltration](https://unit42.paloaltonetworks.com/tag/cloud-data-exfiltration/ "cloud data exfiltration") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/cloud-bucket-hijacking-risks/ "The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration") ![Pictorial representation of Vertex AI model uploads. Close-up view of a digital wall displaying various glowing icons, representing a high-tech network interface.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/AdobeStock_1270203474-1-786x354.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) June 16, 2026 [#### Pickle in the Middle -- Hijacking Vertex AI Model Uploads for Cross-Tenant RCE](https://unit42.paloaltonetworks.com/hijacking-vertex-ai-model/) * [Bucket squatting](https://unit42.paloaltonetworks.com/tag/bucket-squatting/ "bucket squatting") * [Google Cloud](https://unit42.paloaltonetworks.com/tag/google-cloud/ "Google Cloud") * [Joblib](https://unit42.paloaltonetworks.com/tag/joblib/ "joblib") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/hijacking-vertex-ai-model/ "Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE") ![Pictorial representation of Cloud Logging services for defense evasion. A vibrant digital illustration depicting a glowing, neon blue cloud symbol positioned over a circuit board landscape. The cloud symbolizes cloud computing technology, and the landscape features intricate electronic circuits with glowing lines and nodes, suggesting high-tech data transfer and connectivity.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/11_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) June 9, 2026 [#### Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility](https://unit42.paloaltonetworks.com/cloud-logging-defense-evasion/) * [AWS CloudTrail](https://unit42.paloaltonetworks.com/tag/aws-cloudtrail/ "AWS CloudTrail") * [Cloud logging](https://unit42.paloaltonetworks.com/tag/cloud-logging/ "cloud logging") * [Defense evasion](https://unit42.paloaltonetworks.com/tag/defense-evasion/ "defense evasion") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/cloud-logging-defense-evasion/ "Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility") ![Pictorial representation of ROADtools framework in the cloud. An Asian man wearing glasses sits in front of a computer screen. Reflecting in the glasses are lines indicating analysis. Bright blue city lights illuminate the rest of the image.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/10_Cloud_cybersecurity_research_Overview_1920x900-1-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) May 22, 2026 [#### Paved With Intent: ROADtools and Nation-State Tactics in the Cloud](https://unit42.paloaltonetworks.com/roadtools-cloud-attacks/) * [Curious Serpens](https://unit42.paloaltonetworks.com/tag/curious-serpens/ "Curious Serpens") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Azure](https://unit42.paloaltonetworks.com/tag/microsoft-azure/ "Microsoft Azure") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/roadtools-cloud-attacks/ "Paved With Intent: ROADtools and Nation-State Tactics in the Cloud") ![Pictorial representation of autonomous AI attack in cloud environments. Digital illustration of a glowing blue brain connected to a network of lines and lights.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/04/12_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) April 23, 2026 [#### Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System](https://unit42.paloaltonetworks.com/autonomous-ai-cloud-attacks/) * [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI") * [Cloud](https://unit42.paloaltonetworks.com/tag/cloud/ "Cloud") * [Data exfiltration](https://unit42.paloaltonetworks.com/tag/data-exfiltration/ "data exfiltration") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/autonomous-ai-cloud-attacks/ "Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System") ![Pictorial representation of passwordless authentication. Futuristic cityscape with skyscrapers surrounded by glowing, neon-lit pathways and digital clouds. The sky is vibrant with pink and orange hues, giving a surreal, cyberpunk aesthetic.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/02_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) March 23, 2026 [#### Google Cloud Authenticator: The Hidden Mechanisms of Passwordless Authentication](https://unit42.paloaltonetworks.com/passwordless-authentication/) * [Google](https://unit42.paloaltonetworks.com/tag/google/ "Google") * [Google authenticator](https://unit42.paloaltonetworks.com/tag/google-authenticator/ "google authenticator") * [Google Chrome](https://unit42.paloaltonetworks.com/tag/google-chrome/ "Google Chrome") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/passwordless-authentication/ "Google Cloud Authenticator: The Hidden Mechanisms of Passwordless Authentication") ![Close-up of a black woman with glasses examining colorful computer code on a screen. The scene is illuminated by various lights, creating a focused and analytical atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/13_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) February 6, 2026 [#### Novel Technique to Detect Cloud Threat Actor Operations](https://unit42.paloaltonetworks.com/tracking-threat-groups-through-cloud-logging/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [IAM](https://unit42.paloaltonetworks.com/tag/iam/ "IAM") * [MITRE](https://unit42.paloaltonetworks.com/tag/mitre/ "MITRE") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/tracking-threat-groups-through-cloud-logging/ "Novel Technique to Detect Cloud Threat Actor Operations") ![Pictorial representation of Azure OpenAI DNS resolution issue. Futuristic cityscape illustration with luminous structures and floating cloud elements, showcasing advanced technology and a dynamic, digitally enhanced environment.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/02_DNS_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) January 20, 2026 [#### DNS OverDoS: Are Private Endpoints Too Private?](https://unit42.paloaltonetworks.com/dos-attacks-and-azure-private-endpoint/) * [Microsoft Azure](https://unit42.paloaltonetworks.com/tag/microsoft-azure/ "Microsoft Azure") * [Networking](https://unit42.paloaltonetworks.com/tag/networking/ "networking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/dos-attacks-and-azure-private-endpoint/ "DNS OverDoS: Are Private Endpoints Too Private?") ![Pictorial representation of cloud discovery with AzureHound. A digital representation of a cloud composed of blue light particles, superimposed over a blurred background of server racks in a data center.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/10/08_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) October 24, 2025 [#### Cloud Discovery With AzureHound](https://unit42.paloaltonetworks.com/threat-actor-misuse-of-azurehound/) * [Control plane](https://unit42.paloaltonetworks.com/tag/control-plane/ "control plane") * [Curious Serpens](https://unit42.paloaltonetworks.com/tag/curious-serpens/ "Curious Serpens") * [Data plane](https://unit42.paloaltonetworks.com/tag/data-plane/ "data plane") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/threat-actor-misuse-of-azurehound/ "Cloud Discovery With AzureHound") ![Pictorial representation of a gift card fraud campaign. A glowing skull and crossbones on a circuit board.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/10/07_Cybercrime_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) October 22, 2025 [#### Jingle Thief: Inside a Cloud-Based Gift Card Fraud Campaign](https://unit42.paloaltonetworks.com/cloud-based-gift-card-fraud-campaign/) * [CL‑CRI‑1032](https://unit42.paloaltonetworks.com/tag/cl-cri-1032/ "CL‑CRI‑1032") * [Microsoft](https://unit42.paloaltonetworks.com/tag/microsoft/ "Microsoft") * [Phishing](https://unit42.paloaltonetworks.com/tag/phishing/ "phishing") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/cloud-based-gift-card-fraud-campaign/ "Jingle Thief: Inside a Cloud-Based Gift Card Fraud Campaign") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)