[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/2025-ransomware-extortion-trends/) * [Japanese](https://unit42.paloaltonetworks.com/ja/2025-ransomware-extortion-trends/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Trend Reports](https://unit42.paloaltonetworks.com/category/trend-reports/ "Trend Reports") * [Ransomware](https://unit42.paloaltonetworks.com/category/ransomware/ "Ransomware") [Ransomware](https://unit42.paloaltonetworks.com/category/ransomware/) # Extortion and Ransomware Trends January-March 2025 ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 9 min read Related Products [![Advanced DNS Security icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced DNS Security](https://unit42.paloaltonetworks.com/product-category/advanced-dns-security/ "Advanced DNS Security")[![Advanced Threat Prevention icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced Threat Prevention](https://unit42.paloaltonetworks.com/product-category/advanced-threat-prevention/ "Advanced Threat Prevention")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Cortex icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex](https://unit42.paloaltonetworks.com/product-category/cortex/ "Cortex")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Cortex Xpanse icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex Xpanse](https://unit42.paloaltonetworks.com/product-category/cortex-xpanse/ "Cortex Xpanse")[![Next-Generation Firewall icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response")[![Unit 42 Ransomware Readiness Assessment icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Ransomware Readiness Assessment](https://unit42.paloaltonetworks.com/product-category/ransomware-readiness-assessment/ "Unit 42 Ransomware Readiness Assessment") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Unit 42](https://unit42.paloaltonetworks.com/author/unit42/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:April 23, 2025 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Business Email Compromise](https://unit42.paloaltonetworks.com/category/business-email-compromise/) * [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/) * [Ransomware](https://unit42.paloaltonetworks.com/category/ransomware/) * [Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * [Trend Reports](https://unit42.paloaltonetworks.com/category/trend-reports/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [AI](https://unit42.paloaltonetworks.com/tag/ai/) * [Akira ransomware](https://unit42.paloaltonetworks.com/tag/akira-ransomware/) * [BianLian](https://unit42.paloaltonetworks.com/tag/bianlian/) * [Bitter Scorpius](https://unit42.paloaltonetworks.com/tag/bitter-scorpius/) * [Bling Libra](https://unit42.paloaltonetworks.com/tag/bling-libra/) * [CL0P](https://unit42.paloaltonetworks.com/tag/cl0p/) * [DPRK](https://unit42.paloaltonetworks.com/tag/dprk/) * [Fiddling Scorpius](https://unit42.paloaltonetworks.com/tag/fiddling-scorpius/) * [INC ransomware](https://unit42.paloaltonetworks.com/tag/inc-ransomware/) * [Jumpy Pisces](https://unit42.paloaltonetworks.com/tag/jumpy-pisces/) * [Lynx ransomware](https://unit42.paloaltonetworks.com/tag/lynx-ransomware/) * [Medusa ransomware](https://unit42.paloaltonetworks.com/tag/medusa-ransomware/) * [Muddled Libra](https://unit42.paloaltonetworks.com/tag/muddled-libra/) * [Qilin](https://unit42.paloaltonetworks.com/tag/qilin/) * [RansomHub](https://unit42.paloaltonetworks.com/tag/ransomhub/) * [ShinyHunters](https://unit42.paloaltonetworks.com/tag/shinyhunters/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/2025-ransomware-extortion-trends/?pdf=download&lg=en&_wpnonce=7c3dfffa8c "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/2025-ransomware-extortion-trends/?pdf=print&lg=en&_wpnonce=7c3dfffa8c "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Extortion%20and%20Ransomware%20Trends%20January-March%202025&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2F2025-ransomware-extortion-trends%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2F2025-ransomware-extortion-trends%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2F2025-ransomware-extortion-trends%2F&title=Extortion%20and%20Ransomware%20Trends%20January-March%202025 "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2F2025-ransomware-extortion-trends%2F&text=Extortion%20and%20Ransomware%20Trends%20January-March%202025 "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2F2025-ransomware-extortion-trends%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Extortion%20and%20Ransomware%20Trends%20January-March%202025%20https%3A%2F%2Funit42.paloaltonetworks.com%2F2025-ransomware-extortion-trends%2F "Share in Mastodon") ## Executive Summary Unit 42 regularly monitors the cyberthreat landscape, including trends in extortion and ransomware. Ransomware actors continue to evolve to increase the effectiveness of their attacks and the likelihood that organizations will pay what is demanded. In our 2025 Unit 42 Global Incident Response Report, we found that 86% of incidents involved business disruption, spanning operational downtime, reputational damage or both. In this survey of recent trends, we share qualitative observations based on incident response cases and the broader threat landscape. These include: * Threat actors claiming compromises that can't be substantiated * Nation-state actors working with ransomware actors * Use of tools to disable endpoint security sensors * Attacks on more types of systems, including cloud * Insider threats leading to extortion We also share insights about public reports of ransomware compromises posted on threat actors' leak sites. This includes: * The most active ransomware leak sites * Activity by month * Activity by country * Industries most affected by ransomware Palo Alto Networks customers are better protected from ransomware threats through our [Network Security](https://www.paloaltonetworks.com/network-security) solutions and [Cortex](https://www.paloaltonetworks.com/cortex) line of products. Unit 42 can help organizations proactively prepare to mitigate the threat of ransomware through our [Ransomware Readiness Assessment](https://www.paloaltonetworks.com/resources/datasheets/ransomware-readiness-assessment). If you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html). | **Related Unit 42 Topics** | [**Ransomware**](https://unit42.paloaltonetworks.com/category/ransomware/), **[Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/)** | |----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------| ## Incident Response Trends: Ransomware and Extortion Highlights Unit 42 responds to many ransomware and extortion incidents every year. As organizations are becoming more security-savvy, they are catching attacks in the early stages. This means we have seen a rise in investigations that stop at network intrusion, before attackers have a chance to succeed at their other objectives. However, we still see a large number of successful ransomware and extortion attacks. We have also seen threat actors becoming more aggressive to gain victims' attention and command consistent and higher payments. For more details about these observations, please see our [2025 Global Incident Response Report](https://www.paloaltonetworks.com/resources/research/unit-42-incident-response-report). Here are some of our key recent observations of ransomware and extortion campaigns. ### Attackers Lie Unit 42 has tracked various extortion campaigns where the attackers exaggerated threats of leaking data (often using old or fake data) to pressure victims into making payments. In a [March 2025 campaign](https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2025-03-04-group-likely-impersonating-BIanLian.md), scammers physically mailed threatening letters to executives claiming to be a known ransomware group preparing to leak sensitive data. An example of one of the letters used in the campaign is in Figure 1. ![Envelope supposedly addressed from BianLian Group in Boston, MA, with a postal stamp from Boston dated 25 February 2025, marked "TIME SENSITIVE - READ IMMEDIATELY. The addressee information has been redacted.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/04/word-image-435265-139588-1.png) Figure 1. Envelope for fake BianLian ransom note. Source: [Bleeping Computer](https://www.bleepingcomputer.com/news/security/fake-bianlian-ransom-notes-mailed-to-us-ceos-in-postal-mail-scam/#:~:text=The%20letters%20are%20being%20mailed%20to%20the%20CEO%20of%20the%20companies%20at%20their%20corporate%20mailing%20address%C2%A0and%20show%20that%20they%20were%20processed%20through%20a%20postal%20facility%20in%20Boston%2C%20with%20the%20envelope%20marked%2C%20%22Time%20Sensitive%20Read%20Immediately.%22). However, the letters' recipients had no other evidence of a breach. These letters claimed to be the threat actor we track as Bitter Scorpius, publicly known as BianLian. However, we currently have no evidence confirming this is actually BianLian (moreover, the [FBI assessed this to be a scam](https://www.ic3.gov/PSA/2025/PSA250306-2)). We also saw multiple cases of a threat actor posing as a rebrand of the notorious Babuk group. This threat actor used data from older, already resolved extortion campaigns to [attempt to re-extort](https://analyst1.com/babuk-impersonators-leverage-a-brand-name-previously-stolen-data-to-engage-in-re-extortions/) more than 60 victims. ### Nation-state Actors Are Working With Ransomware Actors In October 2024, Unit 42 published [observations of a nation-state actor directly collaborating with a ransomware group](https://unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/). We identified Jumpy Pisces, a North Korean state-sponsored threat group associated with the Reconnaissance General Bureau of the Korean People's Army, as a key player in a ransomware incident. This change marked our first observed instance of the group using existing ransomware infrastructure. It was potentially acting as an initial access broker (IAB) or an affiliate of Fiddling Scorpius, which distributes Play ransomware. Since that time, we have seen additional artifacts of North Korean actors (already notorious for large money theft) continuing to cooperate with ransomware groups, signaling a new trend in the cybercriminal threat landscape. In March 2025, a North Korean hacking group tracked as [Moonstone Sleet reportedly deployed Qilin ransomware payloads](https://www.bleepingcomputer.com/news/security/microsoft-north-korean-hackers-now-deploying-qilin-ransomware/) in a limited number of attacks. ### Ransomware Actors Are Using Tools to Disable Endpoint Security Sensors Ransomware actors continue to evolve their capabilities, and we've recently observed them using tools known as "EDR killers." These tools are designed specifically to terminate defensive software, making it easier for attackers to encrypt vast amounts of data before anyone notices. Their success has sparked interest in the affiliate community, leading to rapid adoption. The integration of these tools has become more common, making them a favored asset in an affiliate's toolkit. In one extortion incident that Unit 42 investigated, we observed an attacker unsuccessfully attempt to use an AV/EDR bypass tool to get around Cortex XDR. [In this particular case, our incident responders were able to turn the tables](https://unit42.paloaltonetworks.com/edr-bypass-extortion-attempt-thwarted/) by using the threat actors' attempts to gain a certain level of access to their rogue systems. In the process, we gained visibility into the threat actor's tooling, targeting and persona. The attack chain from this incident is presented in Figure 2. ![Diagram illustrating the cyber attack lifecycle with six stages: Initial Access via Atera, Lateral Movement featuring PsExec, Internal Discovery/Credential Access and Defense Evasion, Threat Actor Extortion Email with a blackmail email icon, Rogue Machines Connected as depicted with multiple devices, and Exfiltration showing data extraction. Includes Palo Alto Networks and Unit 42 logos.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/04/word-image-440214-139588-2.png) Figure 2. High-level chain of events in the attack investigated by Unit 42. Outside of this ideal outcome, organizations should be on the lookout for EDR killers. ### Ransomware Actors Are Attacking More Types of Systems, Including Cloud Extortion attacks continue to evolve to impact more data in victim networks. Actors are now targeting critical servers and applications, including those running on virtualized infrastructure and in the cloud. We are also seeing more ransomware payloads that can be ported to run on more than just Windows -- Linux, hypervisors (ESXi) and even macOS. Cybercriminals such as Bling Libra (distributors of ShinyHunters ransomware) and Muddled Libra [gain access to cloud environments](https://www.paloaltonetworks.com/engage/unit42-2025-global-incident-response-report/2025-unit-42-global-incident-response-report) by exploiting misconfigurations and finding exposed credentials. ### Insider Threats Can Lead to Extortion Since 2023, Unit 42 has tracked [North Korea state-sponsored threat actors who gain unauthorized remote employment with worldwide organizations](https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/). These actors often use fake [AI-enhanced identities](https://unit42.paloaltonetworks.com/north-korean-synthetic-identity-creation/) to infiltrate organizations. Circumventing sanctions to work and gain money is one part of the scheme. Alongside that are security and legal risks, including [the possibility of extortion \[PDF\]](https://assets.publishing.service.gov.uk/media/66e2ec410d913026165c3d91/OFSI_Advisory_on_North_Korean_IT_Workers.pdf). After being discovered on company networks, North Korean IT workers have [extorted victims by holding stolen proprietary data and code hostage](https://www.ic3.gov/PSA/2025/PSA250123) until the companies meet ransom demands. In some instances, North Korean IT workers have publicly released victim companies' proprietary code. North Korean IT workers have copied company code repositories, such as GitHub, to their own user profiles and personal cloud accounts. While not uncommon among software developers, this activity represents a large-scale risk of theft of company code. In multiple instances, the conspirators supplemented their employment earnings by stealing sensitive company information, such as proprietary source code, and [then threatening to leak such information unless the employer made an extortion payment](https://www.justice.gov/archives/opa/pr/fourteen-north-korean-nationals-indicted-carrying-out-multi-year-fraudulent-information). ## Reported Ransomware Compromises: Charts and Stats Unit 42 monitors public reports of ransomware compromises posted on threat actors' leak sites. The charts and insights below are based on our observations from January-March 2025. They cover the ransomware groups that created the highest numbers of public posts about compromises, as well as information on reported compromises by month, country and industry. However, no collection of publicly reported compromises ever reflects all compromises. In addition, the data shared below does not reflect all leak site posts. We've included only data that has been vetted according to established analytic standards. It's also always important to note that threat actor groups may not report compromises honestly. ![Bar chart showing reported compromises by ransomware name. RansomHub leads with 254 incidents, followed by CL0P with 210, and Akira with 147. Other ransomware types like Qilin, Play, Lynx, Funksec, Cactus, Medusa, and Inc. range between 72 and 53 incidents. Includes Palo Alto Networks and Unit 42 logos.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/04/chart-4.png) Figure 3. Most active ransomware leak sites from January-March 2025. RansomHub is the most prolific type of ransomware among public reports on leak sites from January-March 2025, as seen in Figure 3. Unit 42 tracks the group that distributes RansomHub as Spoiled Scorpius. In our [ransomware retrospective published in August 2024](https://unit42.paloaltonetworks.com/unit-42-ransomware-leak-site-data-analysis/), we listed RansomHub as an emerging ransomware to watch. While extremely active since it started in 2024, we expect a drop in RansomHub activity during the next quarter due to [operational issues this group has endured in April 2025](https://www.guidepointsecurity.com/blog/ransomsnub-ransomhubs-affiliate-confusion/) ![Bar chart showing the number of reported compromises for January, February, and March. January has 370 compromises, February has 578, and March has 549. The chart includes logos for Palo Alto Networks and Unit 42.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/04/chart-5.png) Figure 4. Leak site posts from all ransomware families per month. Ransomware activity tends to fluctuate seasonally, making it important, for example, to compare activity to the same quarter of the previous year, rather than the most recent quarter. This helps account for changes that can occur due to travel seasons, annual holidays and other recurring events. Following this pattern, we observed similar fluctuations in leak site data in 2025, as seen in Figure 4, compared to leak site data during the previous period of January-March 2024. In particular, in both 2024 and 2025, we saw a rise of activity from January to February, followed by a slight dip in March. ![Bar chart displaying the number of reported compromises by country. The United States leads significantly with 822 incidents, followed by Canada with 88 and the United Kingdom with 58. Other countries listed are Germany, Brazil, France, India, Italy, Australia, and Spain, all ranging between 40 and 25 incidents. The chart includes logos for Palo Alto Networks and Unit 42.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/04/chart-6.png) Figure 5. Ransomware activity categorized by the country in which the victim organization is headquartered. While the vast majority of organizations publicly impacted by ransomware in January-March 2025 are headquartered in the United States, as seen in Figure 5, this may not paint the full picture of the impact of ransomware attacks. Since many large organizations have offices in countries besides where they are headquartered, a ransomware attack could affect organizations, employees or customers in multiple parts of the world. With that caveat, we have consistently seen the United States at the top of this list for the years we've tracked leak sites. After the United States, commonly impacted organizations are headquartered in Canada, the United Kingdom and Germany, though the specific order can change. ![Bar chart showing the number of cyber incidents by industry. Industries include Manufacturing with 230 incidents, Wholesale \& Retail with 170, Professional Services with 144, High Technology with 132, Healthcare with 123, Construction with 113, Transportation \& Logistics with 90, Financial Services with 81, Agriculture with 53, and Education with 52. The chart includes logos for Palo Alto Networks and Unit 42.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/04/chart-7.png) Figure 6. Leak site posts January-March 2025 per industry. Many ransomware attacks are opportunistic, with threat actors focusing on organizations they can compromise and where they will make the most money. That said, interesting patterns can emerge in affected industries. For example, in the first half of 2024, the healthcare industry was the second most impacted, driven in part by prominent compromises of organizations in that vertical. However, when looking at data over the past several years, healthcare more commonly occupies the fifth or sixth most impacted spot, as seen above in Figure 6. For the past several years, manufacturing has topped the list of most impacted industries. This may be in part due to features of the industry, such as the common use of specialized software that is difficult to update, combined with the immediate financial impact of downtime. ## Conclusion Unit 42 continues to monitor ransomware threats, through incident response cases, observation of dark web leak sites and other sources of telemetry. Ransomware remains a significant and evolving threat, especially as threat actors continue to evolve more ways of gaining access. The involvement of nation-state groups, combined with low barriers to entry for ransomware affiliates, means that cybercriminals at all skill levels may get involved with ransomware. Organizations should stay aware of trends in ransomware and employ a defense-in-depth strategy for protection. While it is important to maintain backups, organizations should be prepared for ransomware actors to apply other forms of pressure (such as reputational pressure) to force a ransom payment even if the organization has not lost access to data. For more about Unit 42's recent observations of ransomware trends, please read the [2025 Global Incident Response Report](https://www.paloaltonetworks.com/engage/unit42-2025-global-incident-response-report/2025-unit-42-global-incident-response-report). ### Palo Alto Networks Protection and Mitigation Palo Alto Networks customers are better protected from ransomware threats through [Network Security](https://www.paloaltonetworks.com/network-security) solutions and the [Cortex](https://www.paloaltonetworks.com/cortex) line of products. The [Next-Generation Firewall](https://www.paloaltonetworks.com/network-security/next-generation-firewall) with [Cloud-Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) includes the following capabilities: * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) and [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) can[block malicious URLs](https://unit42.paloaltonetworks.com/url-delivered-ransomware/) and domains associated with ransomware. * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) can block ransomware threats at both the network and application layers, including port scans, buffer overflows and remote code execution. Our Cortex protections include [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse), which detects vulnerable services exposed directly to the internet that might be exploitable and infected by ransomware. Through [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) and [XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam), all known ransomware samples are prevented by the XDR agent out of the box using the following [endpoint protection modules](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Endpoint-Protection-Modules): * The Anti-Ransomware module helps prevent encryption behaviors on systems running Microsoft Windows or macOS. * The Local Analysis module helps detect ransomware binaries on Windows, macOS and Linux. * XDR also includes protection capabilities like Behavioral Threat Protection (BTP) which helps prevent ransomware activity on Windows, macOS and Linux. * Palo Alto Networks' [Cloud Security Agent](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Pairing-Prisma-Cloud-Compute-with-Cortex-XDR) (CSA) leverages XSIAM to provide cloud based detection and monitoring capabilities to both Cortex and Prisma Cloud cloud agents. Our [cloud-based security solutions](https://www.paloaltonetworks.com/prisma/cloud) also help protect virtual machines running in cloud environments. We frequently update machine learning models and analysis techniques in [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) with information discovered from our day-to-day research on ransomware. Unit 42 can help organizations proactively prepare to mitigate the threat of ransomware through our [Ransomware Readiness Assessment](https://www.paloaltonetworks.com/resources/datasheets/ransomware-readiness-assessment). If you think you may have been compromised or have an urgent matter, get in touch with the[Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call: * North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) * UK: +44.20.3743.3660 * Europe and Middle East: +31.20.299.3130 * Asia: +65.6983.8730 * Japan: +81.50.1790.0200 * Australia: +61.2.4062.7950 * India: 00080005045107 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org). ## Additional Resources * [2025 Unit 42 Global Incident Response Report](https://www.paloaltonetworks.com/engage/unit42-2025-global-incident-response-report/2025-unit-42-global-incident-response-report) -- Unit 42, Palo Alto Networks * [Ransomware Review: First Half of 2024](https://unit42.paloaltonetworks.com/unit-42-ransomware-leak-site-data-analysis/) -- Unit 42, Palo Alto Networks Back to top ### Tags * [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI") * [Akira ransomware](https://unit42.paloaltonetworks.com/tag/akira-ransomware/ "Akira ransomware") * [BianLian](https://unit42.paloaltonetworks.com/tag/bianlian/ "BianLian") * [Bitter Scorpius](https://unit42.paloaltonetworks.com/tag/bitter-scorpius/ "Bitter Scorpius") * [Bling Libra](https://unit42.paloaltonetworks.com/tag/bling-libra/ "Bling Libra") * [CL0P](https://unit42.paloaltonetworks.com/tag/cl0p/ "CL0P") * [DPRK](https://unit42.paloaltonetworks.com/tag/dprk/ "DPRK") * [Fiddling Scorpius](https://unit42.paloaltonetworks.com/tag/fiddling-scorpius/ "Fiddling Scorpius") * [INC ransomware](https://unit42.paloaltonetworks.com/tag/inc-ransomware/ "INC ransomware") * [Jumpy Pisces](https://unit42.paloaltonetworks.com/tag/jumpy-pisces/ "Jumpy Pisces") * [Lynx ransomware](https://unit42.paloaltonetworks.com/tag/lynx-ransomware/ "Lynx ransomware") * [Medusa ransomware](https://unit42.paloaltonetworks.com/tag/medusa-ransomware/ "Medusa ransomware") * [Muddled Libra](https://unit42.paloaltonetworks.com/tag/muddled-libra/ "Muddled Libra") * [Qilin](https://unit42.paloaltonetworks.com/tag/qilin/ "Qilin") * [RansomHub](https://unit42.paloaltonetworks.com/tag/ransomhub/ "RansomHub") * [ShinyHunters](https://unit42.paloaltonetworks.com/tag/shinyhunters/ "ShinyHunters") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: False Face: Unit 42 Demonstrates the Alarming Ease of Synthetic Identity Creation](https://unit42.paloaltonetworks.com/north-korean-synthetic-identity-creation/ "False Face: Unit 42 Demonstrates the Alarming Ease of Synthetic Identity Creation") ### Table of Contents * ### Related Articles * [Inside the Modern SOC: Defending the Cross-Environment Pivot](https://unit42.paloaltonetworks.com/soc-cross-environment-pivot/ "article - table of contents") * [Perturbation Probing: A New Diagnostic for the Fragility of LLM Safety](https://unit42.paloaltonetworks.com/perturbation-probing-llm-safety/ "article - table of contents") * [Inside the Modern SOC: The Identity Front Door](https://unit42.paloaltonetworks.com/soc-identity-front-door/ "article - table of contents") ## Related Resources ![Pictorial representation of Russian global webmail espionage campaign. A digital illustration of a world map in a network style, highlighting continents with glowing lines and connectivity points in a red and blue theme.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/06_Nation-State-cyberattacks_1920x900-1-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) July 23, 2026 [#### Russian Global Webmail Espionage](https://unit42.paloaltonetworks.com/russian-webmail-espionage/) * [CL-STA-1114](https://unit42.paloaltonetworks.com/tag/cl-sta-1114/ "CL-STA-1114") * [JavaScript](https://unit42.paloaltonetworks.com/tag/javascript/ "JavaScript") * [Javascript injection](https://unit42.paloaltonetworks.com/tag/javascript-injection/ "javascript injection") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/russian-webmail-espionage/ "Russian Global Webmail Espionage") ![Pictorial representation of a woman standing in a server room holding a laptop that projects a digital code overlay.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/06_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) May 28, 2026 [#### 2026 World Cup: Discussing The World's Biggest Game's Attack Surface](https://unit42.paloaltonetworks.com/fifa-world-cup-attack-surface/) * [Fiddling Scorpius](https://unit42.paloaltonetworks.com/tag/fiddling-scorpius/ "Fiddling Scorpius") * [Fighting Ursa](https://unit42.paloaltonetworks.com/tag/fighting-ursa/ "Fighting Ursa") * [Muddled Libra](https://unit42.paloaltonetworks.com/tag/muddled-libra/ "Muddled Libra") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/fifa-world-cup-attack-surface/ "2026 World Cup: Discussing The World’s Biggest Game’s Attack Surface") ![Pictoral representation of a man holding a cellphone with a bokeh skyline in the background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/05_Listicle_Category_1505x922-718x440.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) May 27, 2026 [#### Out of the Crypt: The Evolving Cyber Extortion Economy](https://unit42.paloaltonetworks.com/cyber-extortion-economy/) * [Bling Libra](https://unit42.paloaltonetworks.com/tag/bling-libra/ "Bling Libra") * [Extortion](https://unit42.paloaltonetworks.com/tag/extortion/ "Extortion") * [Frontier AI](https://unit42.paloaltonetworks.com/tag/frontier-ai/ "Frontier AI") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/cyber-extortion-economy/ "Out of the Crypt: The Evolving Cyber Extortion Economy") ![Pictorial representation of Iran cyber attacks. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) April 17, 2026 [#### Threat Brief: Escalation of Cyber Risk Related to Iran (Updated April 17)](https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/) * [APK](https://unit42.paloaltonetworks.com/tag/apk/ "APK") * [DDoS attacks](https://unit42.paloaltonetworks.com/tag/ddos-attacks/ "DDoS attacks") * [GenAI](https://unit42.paloaltonetworks.com/tag/genai/ "GenAI") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/ "Threat Brief: Escalation of Cyber Risk Related to Iran (Updated April 17)") ![Pictorial representation of the APT Boggy Serpens. An illustrated blue snake is highlighted by a red circle against a night sky. The constellation serpens.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/Boggy-Serpens-1920x900-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) March 16, 2026 [#### Boggy Serpens Threat Assessment](https://unit42.paloaltonetworks.com/boggy-serpens-threat-assessment/) * [Advanced Persistent Threat](https://unit42.paloaltonetworks.com/tag/advanced-persistent-threat/ "Advanced Persistent Threat") * [Boggy Serpens](https://unit42.paloaltonetworks.com/tag/boggy-serpens/ "Boggy Serpens") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/boggy-serpens-threat-assessment/ "Boggy Serpens Threat Assessment") ![Pictorial representation of Muddled Libra, aka Scattered Spider. A vibrant illustration of the Libra zodiac sign, featuring a stylized balance scale overlaid with a prominent Libra symbol. The background is a starry night sky with shades of purple and blue, suggesting a cosmic theme.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/03-1-Muddle-Libra-1920x900-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/threat-actor-groups.svg)Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/) February 10, 2026 [#### A Peek Into Muddled Libra's Operational Playbook](https://unit42.paloaltonetworks.com/muddled-libra-ops-playbook/) * [Muddled Libra](https://unit42.paloaltonetworks.com/tag/muddled-libra/ "Muddled Libra") * [PowerShell](https://unit42.paloaltonetworks.com/tag/powershell/ "PowerShell") * [Scattered Spider](https://unit42.paloaltonetworks.com/tag/scattered-spider/ "Scattered Spider") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/muddled-libra-ops-playbook/ "A Peek Into Muddled Libra’s Operational Playbook") ![Pictorial representation of a group of individuals discussing an idea with a whiteboard.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/02_Listicle_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) February 3, 2026 [#### Why Smart People Fall For Phishing Attacks](https://unit42.paloaltonetworks.com/psychology-of-phishing/) * [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI") * [Phishing](https://unit42.paloaltonetworks.com/tag/phishing/ "phishing") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/psychology-of-phishing/ "Why Smart People Fall For Phishing Attacks") ![Pictorial representation of threat groups from Russia. The silhouette of a bear and the Ursa constellation inside an orange abstract planet. Abstract, stylized cosmic setting with vibrant blue and purple shapes, representing space and distant planetary bodies.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/01/Ursa-Russia-B-1920x900-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) January 29, 2026 [#### Understanding the Russian Cyberthreat to the 2026 Winter Olympics](https://unit42.paloaltonetworks.com/russian-cyberthreat-2026-winter-olympics/) * [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI") * [IoT](https://unit42.paloaltonetworks.com/tag/iot/ "IoT") * [Russia](https://unit42.paloaltonetworks.com/tag/russia/ "Russia") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/russian-cyberthreat-2026-winter-olympics/ "Understanding the Russian Cyberthreat to the 2026 Winter Olympics") ![Pictorial representation of RaaS RansomHouse. Digital representation of cybersecurity concept with a padlock superimposed over computer circuit boards, symbolizing data protection and encryption technologies.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/12/06_Ransomware_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) December 17, 2025 [#### From Linear to Complex: An Upgrade in RansomHouse Encryption](https://unit42.paloaltonetworks.com/ransomhouse-encryption-upgrade/) * [ESXi](https://unit42.paloaltonetworks.com/tag/esxi/ "ESXi") * [Jolly Scorpius](https://unit42.paloaltonetworks.com/tag/jolly-scorpius/ "Jolly Scorpius") * [RansomHouse](https://unit42.paloaltonetworks.com/tag/ransomhouse/ "RansomHouse") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ransomhouse-encryption-upgrade/ "From Linear to Complex: An Upgrade in RansomHouse Encryption") ![Pictorial representation of 01flip ransomware written in Rust. Digital artwork of a pixelated U.S. dollar bill disintegrating into small blocks against a blue data matrix background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/12/05_Ransomware_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) December 10, 2025 [#### 01flip: Multi-Platform Ransomware Written in Rust](https://unit42.paloaltonetworks.com/new-ransomware-01flip-written-in-rust/) * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [CL-CRI-103](https://unit42.paloaltonetworks.com/tag/cl-cri-103/ "CL-CRI-103") * [Cryptocurrency](https://unit42.paloaltonetworks.com/tag/cryptocurrency/ "Cryptocurrency") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/new-ransomware-01flip-written-in-rust/ "01flip: Multi-Platform Ransomware Written in Rust") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/content/pan/en_US/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)