[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/acidbox-rare-malware/) * [Japanese](https://unit42.paloaltonetworks.com/ja/acidbox-rare-malware/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # AcidBox: Rare Malware Repurposing Turla Group Exploit Targeted Russian Organizations ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 12 min read Related Products [![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Dominik Reichel](https://unit42.paloaltonetworks.com/author/dominik-reichel/) * [Esmid Idrizovic](https://unit42.paloaltonetworks.com/author/esmid-idrizovic/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:June 17, 2020 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * [Vulnerabilities](https://unit42.paloaltonetworks.com/category/vulnerabilities/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [AcidBox](https://unit42.paloaltonetworks.com/tag/acidbox/) * [CVE-2008-3431](https://unit42.paloaltonetworks.com/tag/cve-2008-3431/) * [Pensive Ursa](https://unit42.paloaltonetworks.com/tag/pensive-ursa/) * [Turla](https://unit42.paloaltonetworks.com/tag/turla/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/acidbox-rare-malware/?pdf=download&lg=en&_wpnonce=40dbae5d0f "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/acidbox-rare-malware/?pdf=print&lg=en&_wpnonce=40dbae5d0f "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=AcidBox:%20Rare%20Malware%20Repurposing%20Turla%20Group%20Exploit%20Targeted%20Russian%20Organizations&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Facidbox-rare-malware%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Facidbox-rare-malware%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Facidbox-rare-malware%2F&title=AcidBox:%20Rare%20Malware%20Repurposing%20Turla%20Group%20Exploit%20Targeted%20Russian%20Organizations "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Facidbox-rare-malware%2F&text=AcidBox:%20Rare%20Malware%20Repurposing%20Turla%20Group%20Exploit%20Targeted%20Russian%20Organizations "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Facidbox-rare-malware%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=AcidBox:%20Rare%20Malware%20Repurposing%20Turla%20Group%20Exploit%20Targeted%20Russian%20Organizations%20https%3A%2F%2Funit42.paloaltonetworks.com%2Facidbox-rare-malware%2F "Share in Mastodon") ## Executive Summary When the news broke in [2014](https://www.gdatasoftware.com/blog/2014/02/23968-uroburos-highly-complex-espionage-software-with-russian-roots) about a new sophisticated threat actor dubbed the [Turla Group](https://malpedia.caad.fkie.fraunhofer.de/actor/turla_group), which the [Estonian foreign intelligence service](https://www.valisluureamet.ee/pdf/raport-2018-ENG-web.pdf) believes has Russian origins and operates on behalf of the FSB, its kernelmode malware also became the first publicly-described case that abused a third-party device driver to disable [Driver Signature Enforcement]() (DSE). This security mechanism was introduced in Windows Vista to prevent unsigned drivers from loading into kernel space. Turla exploited the signed VirtualBox driver, VBoxDrv.sys v1.6.2, to deactivate DSE and load its unsigned payload drivers afterward. There is some confusion about this exploit, however, as it's often generally referred to as [CVE-2008-3431](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3431). The exploit used by Turla actually abuses two vulnerabilities -- of which, only one was ever fixed in the aforementioned CVE. The other vulnerability was found by Turla and is used in the first version of their exploit, along with CVE-2008-3431. The second version of their exploit, presumably introduced in [2014](https://www.kernelmode.info/forum/viewtopic4989.html?f=16&t=3193&start=50#p26173) of their kernelmode malware, only uses the unpatched vulnerability, which we discuss in greater detail later. In February 2019, Unit 42 found that a yet-to-be-known threat actor -- unbeknownst to the infosec community -- discovered that the second unpatched vulnerability can not only exploit VirtualBox VBoxDrv.sys driver v1.6.2, but also all other versions up to v3.0.0. Furthermore, our research shows that this unknown actor exploited VirtualBox driver version 2.2.0 to target at least two different Russian organizations in 2017, which we are revealing for the first time. We anticipate this was done because the driver version 2.2.0 wasn't known to be vulnerable and thus most likely is not on the radar of security companies being exploited. Since no other victims have been found, we believe this is a very rare malware used in targeted attacks only. The actors used a previously unknown malware family that we have dubbed AcidBox due to the first part being an anagram of the malware's driver device name and the second part taken from VirtualBox. Because of the malware's complexity, rarity, and the fact that it's part of a bigger toolset, we believe it was used by an advanced threat actor for targeted attacks and it's likely that this malware is still being used today if the attacker is still active. However, we anticipate that it was rewritten to a certain extent. Based on the information we have, we don't believe this unknown threat actor is tied to Turla, except for the used exploit. Palo Alto Networks customers are protected from this threat. Our threat prevention platform with WildFire identifies this malware as malicious. AutoFocus customers can track malware activity by using the AcidBox tag. We also created an Adversary Playbook for this attack, which can be found [here](https://pan-unit42.github.io/playbook_viewer/?pb=temp-acidbox). #### The Unknown Threat Actor In February 2019, we discovered a sample of AcidBox (SHA256: eb30a1822bd6f503f8151cb04bfd315a62fa67dbfe1f573e6fcfd74636ecedd5) uploaded to VirusTotal, which contained a string known to be used in Turla's VirtualBox exploit. A deeper analysis of the sample revealed it's the main worker module as part of a sophisticated malware that we couldn't tie to any known threat actor. In collaborating with our colleagues at Dr.Web, we learned that this sample was used in a targeted attack on an unspecified entity in Russia back in 2017. Thankfully, they shared three additional samples of the same malware family. Two of those usermode samples are modules that load the main worker from the Windows registry and one is the kernelmode payload driver embedded in the main worker sample. Moreover, we contacted Kaspersky since the company is headquartered in Russia, which found only one additional sample in their databases that was also the usermode loader version. We also contacted ESET, which didn't find any victims infected with this malware, just like in our own case. For this reason, we conclude it's a very rare malware used in targeted attacks only. What all the samples have in common are the compilation timestamps of May 9, 2017. This date seems legitimate, as the sample found by Kaspersky appeared in June 2017 in their databases. Therefore, we conclude that the campaign which involved this malware took place in 2017. We couldn't find any newer samples and thus it's unknown if AcidBox is still in use or has been further developed. We compared the specific characteristics of the samples to all publicly-known malware, but couldn't find any clear overlaps. There are some very loose similarities to [Remsec](https://securelist.com/faq-the-projectsauron-apt/75533/) malware attributed to ProjectSauron, like: * * DWORD size data marker values * Export function names made of 2/3 words * MS Visual C/C++ compiler used * Various import API functions overlaps * Use of vulnerable 3rd party driver to load own unsigned driver * Zlib compression used * Sensitive data encrypted in the resource section However, based on these facts alone, it's not possible to attribute the samples to the ProjectSauron threat actor. We think it's more likely this is a yet unknown threat actor. #### The VirtualBox Exploit and Turla's Versions The original vulnerability described in CVE-2008-3431 was found by [Core Security](https://www.coresecurity.com/content/virtualbox-privilege-escalation-vulnerability) in 2008 and affected VBoxDrv.sys less or equal version 1.6.2. It was fixed in version 1.6.4 and thus couldn't be exploited anymore. [![](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/06/Figure-1.-Vulnerable-and-patched-VirtualBox-device-dispatch-handler-routines-on-the-left-and-right-respectively.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/06/Figure-1.-Vulnerable-and-patched-VirtualBox-device-dispatch-handler-routines-on-the-left-and-right-respectively.png) Figure 1. Vulnerable and patched VirtualBox device dispatch handler routines on the left and right, respectively The vulnerability is located in the dispatch device control routine called VBoxDrvNtDeviceControl. On versions prior to 1.6.4, you can call the usermode DeviceIoControl API function and send one of the following control codes together with a kernel address you want to overwrite as the input/output buffer: * * SUP\_IOCTL\_FAST\_DO\_RAW\_RUN * SUP\_IOCTL\_FAST\_DO\_HM\_RUN * SUP\_IOCTL\_FAST\_DO\_NOP The kernel address is passed down to the control handler (see Figure 1 left, line 28) without any check or validation and is filled with the return value of supdrvIOCtlFast (see Figure 1 left, line 24). This is where the vulnerability digging from CoreSecurity stops and where Turla continues. In the original exploit, the return value from supdrvIOCtlFast isn't controlled and thus it will be a random value written to your kernel address. Turla's exploit controls the return value by overwriting the function pointer of supdrvIOCtlFast to redirect execution to a small shellcode, which returns the needed value. This was described in great detail in a [couple](https://www.kernelmode.info/forum/viewtopic7377.html?f=16&t=3193&start=10#p22357) of [articles](https://www.virusbulletin.com/virusbulletin/2014/05/anatomy-turla-exploits/) and the complete reverse-engineered exploit code is also [available](https://github.com/hfiref0x/DSEFix). The patched version 1.6.4 (see Figure 1 right) doesn't use the UserBuffer pointer anymore, which could be abused by passing a kernel address. Additionally, it checks if the rc variable is equal or bigger than zero -- which isn't needed for the patch, but more like a sanity check. With this patch, the original vulnerability to overwrite a kernel address was fixed. The other vulnerability that lets you control the function pointer of supdrvIOCtlFast remained unpatched. Of course, that's because it wasn't discovered by Core Security at the time, but only a few years later by the Turla threat actor. While Turla still uses the vulnerable VirtualBox driver v.1.6.2 to date, it only makes use of the unpatched vulnerability. The reason why and how it uses it was [described](https://www.lastline.com/labsblog/turla-apt-group-gives-their-kernel-exploit-a-makeover/) by Lastline, and also the reverse-engineered exploit code is available in a project named [Turla Driver Loader](https://github.com/hfiref0x/TDL). The secret is the exact same exploit, with only a small modification -- which we won't disclose here -- can be used on all VBoxDrv.sys versions up to 3.0.0. This was also figured out by an unknown threat actor. While VirtualBox versions smaller than 4.0 aren't available on the official website anymore, they can still be found on some software download sites. Starting from version 3.0.0, some structures and routines have changed so the exploit does not work anymore. However, it can't be ruled out that in later versions it's still possible to exploit the same vulnerability with some more adjustments. What's also interesting is that not even the Turla authors themself seem to have realized that. They still use the old VBoxDrv.sys v.1.6.2 in their otherwise stealthy exploit. This driver is widely known to be used for malicious or various otherwise dubious purposes, for example, in-game cheats. #### Technical Analysis of AcidBox The malware is a complex modular toolkit of which we have only a part of it. In total, we have found four 64-bit usermode DLLs and an unsigned kernelmode driver (SHA256: 3ef071e0327e7014dd374d96bed023e6c434df6f98cce88a1e7335a667f6749d). Three out of the four usermode samples have identical functionality and are loaders for the main worker module. They only differ in their file descriptions and the embedded and encrypted registry path. These loaders are created as [security support providers](https://docs.microsoft.com/en-us/windows/win32/secauthn/custom-security-packages) (further SSP). A SSP is a DLL that exports at least the function SpLsaModeInitialize and usually provides security mechanisms such as authentication between client/server applications. There are a couple of standard SSPs provided in Windows such as [Kerberos](https://docs.microsoft.com/en-us/windows/win32/secauthn/kerberos-ssp-ap) (kerberos.dll) or [NTLM](https://docs.microsoft.com/en-us/windows/win32/secauthn/msv1-0-authentication-package) (msv1\_0.dll). You can abuse the SSP interface for malware persistency and also for injection purposes. In order to maintain persistency, you have to put your SSP DLL into the Windows system directory and add the name of your DLL to a [certain registry value](https://docs.microsoft.com/en-us/windows/win32/secauthn/registering-ssp-ap-dlls). Upon a system restart, your DLL gets loaded into the Windows lsass.exe process and is executed. If you just want your SSP DLL to be injected into lsass.exe, you can call the API function [AddSecurityPackage](https://docs.microsoft.com/en-us/windows/win32/api/sspi/nf-sspi-addsecuritypackagea) which triggers immediate loading. Of course, you need at least admin privileges for both of these methods. The first case of a malware abusing the SSP interface was mentioned by Matt Graeber in [2014](https://docplayer.net/20839173-Analysis-of-malicious-security-support-provider-dlls.html). Since then, this persistence and injection trick has become [wider known](https://attack.mitre.org/techniques/T1101/), but it's still rarely used in malware. In case of the three AcidBox SSP DLLs, they don't make use of any security related operations, but purely abuse this interface for injection purposes and most likely also for persistence. The three SSPs have different file names that are similar to the standard packages provided in Windows (msv1\_0.dll, pku2u.dll, wdigest.dll): * * msv1\_1.dll (SHA256: b3166c417d49e94f3d9eab9b1e8ab853b58ba59f734f774b5de75ee631a9b66d) * pku.dll (SHA256: 3ad20ca49a979e5ea4a5e154962e7caff17e4ca4f00bec7f3ab89275fcc8f58c) * windigest.dll (SHA256: 003669761229d3e1db0f5a5b333ef62b3dffcc8e27c821ce9018362e0a2df7e9) [![](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/06/Figure-2.-Standard-SSP-DLLs-provided-in-Windows-7-present-in-the-“Security-Packages”-value.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/06/Figure-2.-Standard-SSP-DLLs-provided-in-Windows-7-present-in-the-“Security-Packages”-value.png) Figure 2. Standard SSP DLLs provided in Windows 7 present in the "Security Packages" value For this reason, we conclude the AcidBox SSPs also abuse the interface for persistence. However, as we don't have the component which installs the SSP DLLs, we don't know for sure. What we know is that the SSP interface is used for injection into lsass.exe, as they check at the beginning whether the process path they're loaded into matches the one which is embedded into every sample in the resource section (C:\\WINDOWS\\SYSTEM32\\lsass.exe). This process path is contained in the resource 4097 which we describe later how it is hidden via steganography. The purpose of the AcidBox SSP DLLs is to load the main worker module from a registry value contained in resource 256 of each sample. We don't know how the main worker DLL was stored in the registry, but we believe it was done by the same missing component which installed the SSP DLLs. We also assume that the three SSP DLLs are from three different systems as one of those samples has a different registry key embedded. Also, as these modules are the only visible part on a system -- with the main worker module being loaded remains encrypted in the registry -- they likely differ in some way like their chosen file name. The main worker is stored in the registry encrypted within a data blob that contains various other metadata such as the CRC32 hash of the data blob or magic byte sequences which indicate different types of contained data. After the main worker DLL gets decrypted by a SSP DLL from the registry via simply XORing the data with key 0xCA, it gets prepared to be loaded from memory. It does so by creating a thread for the module and uses the exported function UpdateContext of the main worker as its start address. The main worker module then loads the unsigned malware driver via the VirtualBox exploit and waits for commands from one or more components that we don't have. These commands include the loading of additional payloads from the registry from kernel space via the driver or the installation of new SSP DLLs. The main worker has 2 export functions named InitMainStartup and UpdateContext. The following strings are present in cleartext: %s\\%s %s\\%s{%s} %s\\\[\[%s\]\] %s.dll %s%s%s.dll \\\\.\\PCIXA\_CFGDEV InitEntry InitExit The Magic Word! ntoskrnl.exe ntkrn ntkrp hal.dll ntoskrnl ntkrnlpa.exe %s%s%s Group Count NextInstance Root\\LEGACY\_NULL\\0000 |----------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 | %s\\%s %s\\%s{%s} %s\\\[\[%s\]\] %s.dll %s%s%s.dll \\\\.\\PCIXA\_CFGDEV InitEntry InitExit The Magic Word! ntoskrnl.exe ntkrn ntkrp hal.dll ntoskrnl ntkrnlpa.exe %s%s%s Group Count NextInstance Root\\LEGACY\_NULL\\0000 | The following additional strings are stack obfuscated: SeLoadDriverPrivilege %s\\%c\*.dll System\\CurrentControlSet\\Control\\ NtQueryInformationThread BFE\_Notify\_Event\_ Microsoft\\Cryptography ntdll.dll \\Registry\\Machine\\ SOFTWARE Global %s\\%s Security Packages kernel32.dll SOFTWARE \\Registry\\Machine\\ MachineGuid ntdll.dll |-------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 | SeLoadDriverPrivilege %s\\%c\*.dll System\\CurrentControlSet\\Control\\ NtQueryInformationThread BFE\_Notify\_Event\_ Microsoft\\Cryptography ntdll.dll \\Registry\\Machine\\ SOFTWARE Global %s\\%s Security Packages kernel32.dll SOFTWARE \\Registry\\Machine\\ MachineGuid ntdll.dll | There are also XOR-encoded DLL and function names, which later get dynamically resolved and used: ntdll.RtlGetVersion ntdll.ZwLoadDriver ntdll.ZwUnloadDriver ntdll.ZwQuerySystemInformation kernel32.DeviceIoControl kernel32.GetSystemDirectoryA ntdll.RtlAnsiStringToUnicodeString ntdll.ZwClose ntdll.ZwCreateFile ntdll.ZwQueryInformationFile ntdll.ZwReadFile ntdll.ZwWriteFile kernel32.GetSystemDirectoryA kernel32.GetSystemDirectoryW kernel32.BaseThreadInitThunk kernel32.LZDone advapi32.CryptAcquireContextA advapi32.CryptGenRandom advapi32.CryptReleaseContext ntdll.RtlRbInsertNodeEx ntdll.RtlRbRemoveNode ntdll.RtlAcquireSRWLockExclusive ntdll.RtlReleaseSRWLockExclusive ntdll.RtlEnterCriticalSection ntdll.RtlPcToFileHeader ntdll.RtlGetVersion ntdll.RtlUpcaseUnicodeChar ntdll.RtlAnsiStringToUnicodeString ntdll.LdrLockLoaderLock ntdll.LdrUnlockLoaderLock ntdll.ZwClose ntdll.ZwCreateSection ntdll.ZwMapViewOfSection ntdll.ZwUnmapViewOfSection |----------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 | ntdll.RtlGetVersion ntdll.ZwLoadDriver ntdll.ZwUnloadDriver ntdll.ZwQuerySystemInformation kernel32.DeviceIoControl kernel32.GetSystemDirectoryA ntdll.RtlAnsiStringToUnicodeString ntdll.ZwClose ntdll.ZwCreateFile ntdll.ZwQueryInformationFile ntdll.ZwReadFile ntdll.ZwWriteFile kernel32.GetSystemDirectoryA kernel32.GetSystemDirectoryW kernel32.BaseThreadInitThunk kernel32.LZDone advapi32.CryptAcquireContextA advapi32.CryptGenRandom advapi32.CryptReleaseContext ntdll.RtlRbInsertNodeEx ntdll.RtlRbRemoveNode ntdll.RtlAcquireSRWLockExclusive ntdll.RtlReleaseSRWLockExclusive ntdll.RtlEnterCriticalSection ntdll.RtlPcToFileHeader ntdll.RtlGetVersion ntdll.RtlUpcaseUnicodeChar ntdll.RtlAnsiStringToUnicodeString ntdll.LdrLockLoaderLock ntdll.LdrUnlockLoaderLock ntdll.ZwClose ntdll.ZwCreateSection ntdll.ZwMapViewOfSection ntdll.ZwUnmapViewOfSection | All the functionality is contained in the two export functions, while DllMain does not contain any relevant code. What stands out is the extensive use of custom DWORD-size status codes throughout the code. Decompiled code example with status codes in result variable: ... if ( !a1 || !a2 || !(\_DWORD)v3 ) { result = 0xA0032B02; goto LABEL\_45; } if ( strlen(a1) \<= 1 ) goto LABEL\_65; result = get\_kernel32\_path(a1, \&v43, \&v37, \&v41); if ( result ) goto LABEL\_45; if ( (unsigned int)v3 \< 0x1C ) { LABEL\_65: result = 0xA0032B02; goto LABEL\_45; } pBuffer = allocate\_buffer(v13, (unsigned int)v3, 0i64, v11, 0, 1); buffer = pBuffer; if ( !pBuffer ) { LABEL\_9: result = 0xA0032B04; goto LABEL\_45; } if ( memcpy\_s(pBuffer, v3, a2, v3) ) { LABEL\_11: result = 0xA0032B06; goto LABEL\_45; } ... |----------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 | ... if ( !a1 || !a2 || !(\_DWORD)v3 ) { result = 0xA0032B02; goto LABEL\_45; } if ( strlen(a1) \<= 1 ) goto LABEL\_65; result = get\_kernel32\_path(a1, \&v43, \&v37, \&v41); if ( result ) goto LABEL\_45; if ( (unsigned int)v3 \< 0x1C ) { LABEL\_65: result = 0xA0032B02; goto LABEL\_45; } pBuffer = allocate\_buffer(v13, (unsigned int)v3, 0i64, v11, 0, 1); buffer = pBuffer; if ( !pBuffer ) { LABEL\_9: result = 0xA0032B04; goto LABEL\_45; } if ( memcpy\_s(pBuffer, v3, a2, v3) ) { LABEL\_11: result = 0xA0032B06; goto LABEL\_45; } ... | The main worker sample contains five icon resources with valid icons named 16, 256, 4097, 8193 and 12289. The names indicate different icon resolutions, but the icons only differ in the encrypted data appended to them which can be considered as a form of steganography. This data is encrypted with a custom algorithm and additionally zlib compressed. The same method is used within the SSP DLLs. A Python script for decryption and decompression can be found in the Appendix. After decryption, the data blob has the following structure: struct data\_blob { DWORD marker; // Marker bytes (0x9A65659A) DWORD crc32; // CRC32 value of decrypted or zlib uncompressed bytes DWORD size; // Size of decrypted or zlib uncompressed bytes DWORD option; // Information if data is encrypted or zlib compressed; 0x1 = encrypted, 0x2 = zlib compressed char data\[\]; // Encrypted or zlib compressed data }; |-------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 | struct data\_blob { DWORD marker; // Marker bytes (0x9A65659A) DWORD crc32; // CRC32 value of decrypted or zlib uncompressed bytes DWORD size; // Size of decrypted or zlib uncompressed bytes DWORD option; // Information if data is encrypted or zlib compressed; 0x1 = encrypted, 0x2 = zlib compressed char data\[\]; // Encrypted or zlib compressed data }; | The decrypted data is as follows. Resource 16: System\\CurrentControlSet\\Control\\Class\\{4D36E97D-E325-11CE-BFC1-08002B E10318}\\0003\\DriverData |-----|------------------------------------------------------------------------------------------------------| | 1 2 | System\\CurrentControlSet\\Control\\Class\\{4D36E97D-E325-11CE-BFC1-08002B E10318}\\0003\\DriverData | Resource 256: System\\CurrentControlSet\\Control\\Class\\{4D36E96A-E325-11CE-BFC1-08002B E10318}\\0000\\DriverData |-----|------------------------------------------------------------------------------------------------------| | 1 2 | System\\CurrentControlSet\\Control\\Class\\{4D36E96A-E325-11CE-BFC1-08002B E10318}\\0000\\DriverData | Resources 16 and 256 are the Windows registry keys that contain the decryption key for the embedded driver in resource 8193 and additional payloads that are likely going to be injected by the AcidBox driver. Resource 4097: C:\\WINDOWS\\SYSTEM32\\lsass.exe |---|----------------------------------| | 1 | C:\\WINDOWS\\SYSTEM32\\lsass.exe | This resource contains the path of the process each sample uses to verify it is being loaded into the correct process. Resource 8193 contains the unsigned kernelmode payload driver, which is also encrypted with RSA. The driver is realized as a kernelmode DLL with two export functions InitEntry and InitExit. It contains the following cleartext strings: ntoskrnl.exe ntkrn ntkrp hal.dll ntoskrnl ntkrnlpa.exe csrss.exe PsCreateSystemThread \\Device\\VBoxDrv \\DosDevices\\PCIXA\_CFGDEV \\Windows\\ApiPort \\Sessions\\%u\\Windows\\ApiPort \\Sessions\\xxxxxxxx\\Windows\\ApiPort \\Device\\PCIXA\_CFG \\DosDevices\\PCIXA\_CFGDEV |-------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 | ntoskrnl.exe ntkrn ntkrp hal.dll ntoskrnl ntkrnlpa.exe csrss.exe PsCreateSystemThread \\Device\\VBoxDrv \\DosDevices\\PCIXA\_CFGDEV \\Windows\\ApiPort \\Sessions\\%u\\Windows\\ApiPort \\Sessions\\xxxxxxxx\\Windows\\ApiPort \\Device\\PCIXA\_CFG \\DosDevices\\PCIXA\_CFGDEV | Resource 12289 contains the VirtualBox VBoxDrv.sys driver v2.2.0.0 signed by Sun Microsystems, which we previously described is also vulnerable. [![Signed vulnerable VBoxDrv.sys driver version 2.2.0.0 of AcidBox](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/06/Figure-3.-Signed-vulnerable-VBoxDrv.sys-driver-version-2.2.0.0.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/06/Figure-3.-Signed-vulnerable-VBoxDrv.sys-driver-version-2.2.0.0.png) Figure 3. Signed vulnerable VBoxDrv.sys driver version 2.2.0.0 #### A Little Forensic Tidbit in the PE header While studying the samples, PE header characteristics -- an often overseen forensic indicator -- caught our attention. This little known fact can be found in the export directory and can be helpful for attributing malware samples. All of the AcidBox samples contain gaps between the single exported function entries: [![Directories of AcidBox samples](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/06/Figure-4.-Export-directories-of-AcidBox-samples-with-gaps-between-the-export-function-entries.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/06/Figure-4.-Export-directories-of-AcidBox-samples-with-gaps-between-the-export-function-entries.png) Figure 4. Export directories of AcidBox samples with gaps between the export function entries Every AcidBox sample has a NumberOfFunctions value in the export directory that is bigger than the NumberOfNames value. This isn't something unusual, as not every exported function has to have a name too. Unnamed functions can be also called by their [ordinal](https://docs.microsoft.com/en-us/cpp/build/exporting-functions-from-a-dll-by-ordinal-rather-than-by-name?view=vs-2019) values. What is uncommon, however, is that the function entries which are unnamed are also zeroed out, thus not used. This is the result when you use your own [DEF file](https://docs.microsoft.com/en-us/cpp/build/exporting-from-a-dll-using-def-files?view=vs-2019) instead of [\_\_declspec(dllexport)](https://docs.microsoft.com/en-us/cpp/build/exporting-from-a-dll-using-declspec-dllexport?view=vs-2019) to describe the attributes of your DLL file. When you use a DEF file, you can choose which ordinal your export function will have. This is not possible with \_\_declspec(dllexport) as the Visual Studio compiler always counts your functions starting from one. Using a DEF file instead of \_\_declspec(dllexport) has some advantages. You are able to export functions by ordinals and you can also [redirect functions](https://docs.microsoft.com/en-us/cpp/build/reference/exports?view=vs-2019) among other things. The disadvantage is that you have to maintain an additional file within your project. In the case of the AcidBox samples, we can conclude a couple of things. First, the author uses a DEF file, although he doesn't make use of its advantages. This could indicate it's a habit of the author to use DEF files. Second, the function ordinals seem to be chosen in steps of two integers. A possible explanation could be that the unused ordinals were once used for functions too. And last, if we assume the author really has chosen to make two integer steps, then in the usermode DLLs, one export function was removed. We can see that ordinal 3 is unused, leaving a bigger gap than one integer. All this information can be useful for malware attribution. ## Conclusion A new advanced malware, dubbed AcidBox, was used by an unknown threat actor in 2017 that went undetected until now. It uses a known VirtualBox exploit to disable Driver Signature Enforcement in Windows, but with a new twist: While it's publicly known that VirtualBox driver VBoxDrv.sys v1.6.2 is vulnerable and used by Turla, this new malware uses the same exploit but with a slightly newer VirtualBox version. Sometimes, you are still able to find a technically interesting Windows malware that uses a new technique. This has become quite a rarity in today's threat landscape where everything is either a copy of a copy of a copy or technically underwhelming. While AcidBox doesn't use any fundamentally new methods, it breaks the myth that only VirtualBox VBoxDrv.sys 1.6.2 can be used for Turla's exploit. Appending sensitive data as an overlay in icon resources, abusing the SSP interface for persistence and injection and payload storage in the Windows registry puts it into the category of interesting malware. The samples we dubbed AcidBox are only part of a bigger toolkit which we, unfortunately, could not identify. However, we provide two Yara rules for detection and threat hunting. Additionally, if you happen to find an additional sample, or are even infected, you can use the provided Python script to extract the sensitive data appended to the icon resources. All of these can be found[here](https://github.com/pan-unit42/iocs/tree/master/AcidBox) at Unit 42's GitHub repository. If you have any further information about this threat, don't hesitate to contact us. Palo Alto Networks customers are protected from this malware. Our threat prevention platform with WildFire identifies this malware as malicious. AutoFocus customers can investigate this activity with the tag [AcidBox](https://autofocus.paloaltonetworks.com/#/tag/Unit42.AcidBox). We would like to thank Dr.Web, Kaspersky, ESET and [hFireF0X](https://twitter.com/hfiref0x) for their collaboration. #### IOCs ##### **Files in Windows system32 directory** msv1\_1.dll pku.dll windigest.dll ##### **Mutexes** Global\\BFE\_Event\_{xxxxxxxxxxxx--xxxx-xxxxxxxx-xxxxxxxx} Global\\{xxxxxxxxxxxx--xxxx-xxxxxxxx-xxxxxxxx} The malware takes the MachineGuid stored in the registry and reshuffles the single characters alternating from the end to the beginning and vice versa in steps of two. For example, the MachineGuid string a9982d3e-c859-4702-c761-df7eea468ade gets transferred into e9a86daeecf5--67c2-07419d87-e34289da and appended to the above templates. ##### **Windows Registry** HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\Class\\{4D36E97D-E325-11CE-BFC1-08002BE10318}\\0003\\DriverData (REG\_BINARY type) HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\Class\\{4D36E96A-E325-11CE-BFC1-08002BE10318}\\0000\\DriverData (REG\_BINARY type) HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\Class\\{4D36E969-E325-11CE-BFC1-08002BE10318}\\0000\\DriverData (REG\_BINARY type) ##### **Sample Hashes** Main worker DLL: eb30a1822bd6f503f8151cb04bfd315a62fa67dbfe1f573e6fcfd74636ecedd5 Kernelmode driver: 3ef071e0327e7014dd374d96bed023e6c434df6f98cce88a1e7335a667f6749d SSP DLL modules: 003669761229d3e1db0f5a5b333ef62b3dffcc8e27c821ce9018362e0a2df7e9 b3166c417d49e94f3d9eab9b1e8ab853b58ba59f734f774b5de75ee631a9b66d 3ad20ca49a979e5ea4a5e154962e7caff17e4ca4f00bec7f3ab89275fcc8f58c Benign VirtualBox VBoxDrv.sys driver v2.2.0 (signed by "Sun Microsystems, Inc."): 78827fa00ea48d96ac9af8d1c1e317d02ce11793e7f7f6e4c7aac7b5d7dd490f Back to top ### Tags * [AcidBox](https://unit42.paloaltonetworks.com/tag/acidbox/ "AcidBox") * [CVE-2008-3431](https://unit42.paloaltonetworks.com/tag/cve-2008-3431/ "CVE-2008-3431") * [Pensive Ursa](https://unit42.paloaltonetworks.com/tag/pensive-ursa/ "Pensive Ursa") * [Turla](https://unit42.paloaltonetworks.com/tag/turla/ "Turla") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: 6 New Vulnerabilities Found on D-Link Home Routers](https://unit42.paloaltonetworks.com/6-new-d-link-vulnerabilities-found-on-home-routers/ "6 New Vulnerabilities Found on D-Link Home Routers") ### Table of Contents * ### Related Articles * [Threat Actor Groups Tracked by Palo Alto Networks Unit 42 (Updated Aug. 1, 2025)](https://unit42.paloaltonetworks.com/threat-actor-groups-tracked-by-palo-alto-networks-unit-42/ "article - table of contents") * [Over the Kazuar's Nest: Cracking Down on a Freshly Hatched Backdoor Used by Pensive Ursa (Aka Turla)](https://unit42.paloaltonetworks.com/pensive-ursa-uses-upgraded-kazuar-backdoor/ "article - table of contents") * [Threat Group Assessment: Turla (aka Pensive Ursa)](https://unit42.paloaltonetworks.com/turla-pensive-ursa-threat-assessment/ "article - table of contents") ## Related Resources ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/) * [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API") * [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway") * [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)