[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # Angler Exploit Kit Continues to Evade Detection: Over 90,000 Websites Compromised ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 16 min read * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Yuchen Zhou](https://unit42.paloaltonetworks.com/author/yuchen-zhou/) * [Wei Xu](https://unit42.paloaltonetworks.com/author/wei-xu/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:January 11, 2016 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Angler](https://unit42.paloaltonetworks.com/tag/angler/) * [Angler Exploit Kit](https://unit42.paloaltonetworks.com/tag/angler-exploit-kit/) * [Exploit Kits](https://unit42.paloaltonetworks.com/tag/exploit-kits/) * [JavaScript](https://unit42.paloaltonetworks.com/tag/javascript/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/angler-exploit-kit-continues-to-evade-detection-over-90000-websites-compromised/?pdf=download&lg=en&_wpnonce=dc23a6ba65 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/angler-exploit-kit-continues-to-evade-detection-over-90000-websites-compromised/?pdf=print&lg=en&_wpnonce=dc23a6ba65 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Angler%20Exploit%20Kit%20Continues%20to%20Evade%20Detection:%20Over%2090,000%20Websites%20Compromised&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fangler-exploit-kit-continues-to-evade-detection-over-90000-websites-compromised%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fangler-exploit-kit-continues-to-evade-detection-over-90000-websites-compromised%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fangler-exploit-kit-continues-to-evade-detection-over-90000-websites-compromised%2F&title=Angler%20Exploit%20Kit%20Continues%20to%20Evade%20Detection:%20Over%2090,000%20Websites%20Compromised "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fangler-exploit-kit-continues-to-evade-detection-over-90000-websites-compromised%2F&text=Angler%20Exploit%20Kit%20Continues%20to%20Evade%20Detection:%20Over%2090,000%20Websites%20Compromised "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fangler-exploit-kit-continues-to-evade-detection-over-90000-websites-compromised%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Angler%20Exploit%20Kit%20Continues%20to%20Evade%20Detection:%20Over%2090,000%20Websites%20Compromised%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fangler-exploit-kit-continues-to-evade-detection-over-90000-websites-compromised%2F "Share in Mastodon") Exploit Kits (EK), arguably the most impactful malicious infrastructure on the Internet, constantly evolve to evade detection by security technology. Tremendous effort has been spent on tracking new variations of different EK families. In this report, we look at an EK from an operational point of view. Specifically, we have been tracking the activity of the notorious Angler Exploit Kit and have uncovered traces of what we believe to be a large underground industry behind this EK. Given the numerous existing reports from [Sophos](https://blogs.sophos.com/2015/07/21/a-closer-look-at-the-angler-exploit-kit/), [Malwarebytes](https://blog.malwarebytes.org/malvertising-2/2015/12/malvertising-hits-dailymotion-serves-up-angler-ek/), and [USENIX](https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-kapravelos.pdf) that cover different variants of Angler, we will focus on the new findings in terms of the global operation of Angler in this work. All of the findings are based on the results of our malicious web content detection system. Key findings include: 1. **Detected over 90,000 compromised websites involved in Angler's operation.** Among which, 30 are within Alexa top 100,000 rankings (Top 1 million websites available [here](https://s3.amazonaws.com/alexa-static/top-1m.csv.zip).) We estimate the number of monthly visits to these 30 compromised websites to be over 11 million based on visit counts from [TrafficEstimate.com](https://www.trafficestimate.com/) 2. **Discovered a highly organized operation that periodically updates the malicious content across all of the compromised websites and all of the EK gate sites at the same time.** This indicates a sophisticated and persistent command and control channel between attackers and compromised websites. 3. **Discovered fine-grained control over the distribution of malicious content.** This means the injected scripts can stay invisible for days to evade detection and the compromised websites can choose to target only certain victim IP ranges and certain configurations. This has lead to very low detection rates from the scanners used by VirusTotal (VT). Even weeks after our initial discovery, most of the compromised sites we found were not listed as malicious in VT. 4. **Found potential connections between activities of scanning vulnerable websites and leveraging scanned websites as entry point for the EK.** This suggests an industry chain behind the operation of this EK. ### Overview and Impact Between November 5 (when we started to scan highly vulnerable websites for similar injections) and November 16, we discovered a total of 90,558 unique domains that had been compromised and used by Angler EK. The compromised domains result in a total of 29,531 unique IPs. Among these, 1,457 IPs hosted more than 10 compromised domains. The IP address 184.168.47.225 hosted a total of 422 compromised sites. Some of the compromised sites were very popular with 177 of domains (30 FQDNs) in the Alexa top 100,000 and 40 in the top 10,000. Most of the compromised sites remain undetected by VT. We tested early scanning results (5,235 malicious sites discovered at that time) with VT on November 16 and found that VT only reported 226 sites as malicious. At midnight of November 17 we repeated this experiment and VT still only found 232 sites. This amounts to a less than 5% detection rate. On December 14 we tested our full list (all 90,558) against VT and it only found 2,850 compromised sites -- a 3% detection rate. [![Angler 1](http://blog.paloaltonetworks.com/wp-content/uploads/2016/01/Angler-14-500x249.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/01/Angler-14.png) *Figure 1: Angler EK Compromise Topology* Figure 1 outlines the redirection flow of a full compromise. The victims visit a list of compromised WordPress/Apache hosts and get redirected to the malicious server hosting the EK, either directly or via a middle layer, which is commonly referred to as 'EK gate'. The final malicious payload served could vary, including ransomware such as Cryptowall, and spyware or botnets that connect to a C2 server. A more concrete redirection chain example and its fiddler packet capture are shown in Figures 2 and 3. The redirection from EK gate to the malicious file hosting server can happen within the same domain (shown in red in Figure 2) or cross-domain (shown in blue in Figure 2). [![Angler 2](http://blog.paloaltonetworks.com/wp-content/uploads/2016/01/Angler-2-500x151.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/01/Angler-2.png) *Figure 2: Redirection Chain* [![Angler 3](http://blog.paloaltonetworks.com/wp-content/uploads/2016/01/Angler-3-500x45.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/01/Angler-3.png) *Figure 3: Fiddler packet captured during redirection (excerpt)* Figure 4 shows some of the post-infection traffic we obtained using [Fiddler](https://www.telerik.com/fiddler). In this case the infected VM sent out a C2-like request and received back a long encrypted response. [![Angler 4](http://blog.paloaltonetworks.com/wp-content/uploads/2016/01/Angler-4-500x249.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/01/Angler-4.png) *Figure 4: Post infection traffic* Figures 5 and 6 give an overview of all compromised hosts' IP information. [![Angler 5](http://blog.paloaltonetworks.com/wp-content/uploads/2016/01/Angler-5-500x300.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/01/Angler-5.png) *Figure 5: Compromised host ISP distribution* [![Angler 6](http://blog.paloaltonetworks.com/wp-content/uploads/2016/01/Angler-6-500x238.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/01/Angler-6.png) *Figure 6: Compromised IP country distribution (truncated to show major items)* We can see in the figures that the compromised sites are primarily hosted inside the United States, with a few exceptions in Europe and Asia. Among the systems in the United States, most of the identified sites are hosted on GoDaddy's infrastructure and a few other popular hosting services. ### Angler EK Evasion Techniques In this section, we will highlight some of the featured behaviors of the malicious scripts that attackers injected into the compromised websites. The original version of the injected malicious JavaScript code served on the compromised servers (left side of Figure 1) targets almost **ALL** major versions of the IE browser (version 8-11 confirmed), presumably because these users may also have vulnerable flash versions installed. A more recent variant targets all modern major browsers, including Webkit-based ones such as Chrome and Gecko-based Firefox. In addition to its JavaScript-based anti-detection maneuver, the next hop redirection (EK gate) also selectively serves malicious content based on the victim's geolocation. We further break down some of these behaviors in this section. #### Static/Signature analysis evasion The injected JavaScript code in all of the compromised websites looks similar but is not exactly the same. Figure 7 is an excerpt of the injected code. The obfuscated code is constantly morphing with random variable names. Even the responses between two consecutive requests are different due to the randomness. We are only able to find four meaningful keywords that remained constant in this script: ActiveXObjec*t*, window.sidebar, charAt, and Function. As we will detail in the Organized Evolution section, these keywords will slowly vanish as the EK evolves over time. This polymorphic behavior likely renders many signature-based static analysis methods ineffective. [![Angler 7](http://blog.paloaltonetworks.com/wp-content/uploads/2016/01/Angler-7-500x155.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/01/Angler-7.png) *Figure 7: injected script excerpt* #### Browser emulator evasion We found that the exploit kit code contains multiple layers of behavior cloaking, and in one case uses *ActiveXObject* initialization as shown in Figure 7. The variable zmomfokopbpbbi shown in this example contains a long random-looking string (truncated in line 2). The malicious JavaScript attempts to fingerprint the browser to evade browser emulators and malware detectors which are usually designed to provide valid *ActiveXObject* at all times, or use symbolic/concolic execution which intentionally suppresses errors and forces execution to take the other branch. In other words, a real IE browser will throw an error for the try clause but a detector agent may not. Given that the value of qvqymkykvfzpl is 1 before line 9, the value zkvluyycbrtp will be 0 for real IE browsers and any other browser that does not support *ActiveXObject*, but it will remain to be 1 for certain browser emulators. Looking further down the malicious script (Figure 8) we see that the value of zkvluyycbrtp is again used in many other functions, and the return value of those functions depend on its value. This ultimately determines whether the malicious script will carry out the attack or not. This is one of the many cloaking mechanisms attackers employ that separates the real, intended victim population from browser simulators used by AV vendors for detection. [![Angler 8](http://blog.paloaltonetworks.com/wp-content/uploads/2016/01/Angler-8-500x154.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/01/Angler-8.png) *Figure 8: injected script excerpt (cont.d)* In addition to *ActiveXObject* initialization, the obfuscated code also examines *UserAgent*. This examination is different from a naïve substring search. Particularly, the code searches for the existence of two strings "rv:11" and "MSIE". Combining the user agent examination with a special 'browser quirk' of old IE (version 10.0 or older), the malicious JavaScript ONLY exhibits malicious behavior when the browser is 'truly' Internet Explorer, but not other browser brands (e.g. Firefox/Chrome/other testing browser agents), even if they are 'mimicking' old IE user agents. We show the detailed combination of different configurations and their interactions in Table 1. |---------------------|-----------|-----------------|---------------------------------------------|-----------------------------------------------| | Malicious content trigger condition: zfglugdvsvhpmstz -- hladygwivaoha == 2 ||||| | Potential target | UserAgent | JS Engine | *"zfglugdvsvhpmstz"*(Browser Quirk Testing) | *"hladygwivaoha"* (*UserAgent* pattern match) | | Old IE User | IE 8-10 | JScript/Chakra | 3 | 1 | | New IE User | IE 11 | Chakra | 2 | 0 | | Firefox/Chrome User | FF/Chrome | SpiderMonkey/V8 | 2 | 2 | | Security researcher | IE 8-10 | SpiderMonkey/V8 | 2 | 1 | | Security researcher | IE 11 | SpiderMonkey/V8 | 2 | 0 | *Table 1: Malicious content trigger condition* In this table, we can see that the malware authors target IE users and attempt to avoid security researchers; however, they left out one scenario: a non-IE browser mimicking IE 11. In this scenario the malicious behavior is actually exposed, and this is how we are able to automatically extract a number of next hops redirection (i.e. EK gate URLs) in Table 2. #### IP address filter evasion The successful execution of the abovementioned JavaScript always results in an injection of an iframe pointing to the EK gate. The malicious JavaScript injects an iframe similar to what's shown in Figure 9. [![Angler 9](http://blog.paloaltonetworks.com/wp-content/uploads/2016/01/Angler-9-500x74.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/01/Angler-9.png) *Figure 9: iframe injection by malicious JavaScript* This URL structure resembles others that were previously disclosed by sources like [malware-traffic-analysis.net](https://www.malware-traffic-analysis.net/2015/11/10/index.html); however, as mentioned earlier, the way this iframe is injected is entirely different in this campaign compared to their previous mechanism, which simply injected a flash file (\) into the HTML code. It's not easy to obtain the malicious content of these iframes because when we visit the compromised URLs from an IP addresses that belongs to Palo Alto Networks, the attacker's server either does not respond, or returns an empty 200 response. The same results occurred when we used different browsers with different versions, residential IPs in California, and then an Amazon EC2 instance. On November 16 we used a proxy service to redirect our traffic through IP blocks across the world and found that when we use an IP block from Turkey, the server returned the Angler EK's landing page. The landing page looks similar to previously posted ones, and eventually redirected the victim browser to download a flash file. It is also interesting to note that many domain names hosting the EK gate pages, like *filchnerkunstkring.diversityadvice\[.\]com* or *ullshift-vastreden.avimiller.org*, have legitimate and benign root level domains diversityadvice.com and avimiller.org. We suspect: 1) That the DNS nameserver of these domains are compromised and a rogue DNS record was created to point the malicious subdomain to the attacker's server; and 2) the credential that can unlock registering subdomains has been stolen. Such DNS compromise is also popularly known as**Domain shadowing**. In addition to the EK gate IP filtering, the compromised host seems to serve the malicious redirection scripts using similar IP filtering rules as well. We initiated requests from two clean machines using different outgoing IP addresses and the same user agent at almost the same time. The machine user of one IP address consistently received a malicious page while the other user only received clean HTML. It is particularly worthwhile to note that the attackers perform IP cloaking adaptively; we used one IP address range to scan the web for compromised sites and after approximately two weeks of scanning, the attacker stopped serving malicious content to these IPs. We suspect that the attackers detected abnormal scanning behavior from the IPs and therefore cloaked themselves to avoid detection. #### **Timing-based evasion** It also appeared to us that the injected content turns **on-and-off** inside the duration of our scan. After we discovered this behavior, we picked ten sites and significantly increased their scanning frequency to every ten minutes. Figure 10 shows the vulnerability status of three of these ten sites over the course of 24 hours. The markings of the top portion indicate that the site's malicious code was active during that time slot while the markings on the bottom portion indicate the site was benign, or dormant, during that time slot. It appears to us that nine out of 10 sites share a similar (but not exactly the same) dormant/active pattern, as shown in the orange and blue dots, while the other site (www.grillman\[.\]com.au) shows a somewhat different pattern. We are not exactly sure why the injection exhibits such behavior over time, but our guess is that the malicious code intends to hide itself and put the website owner or security companies under the illusion that the threat has been cleaned up. [![Angler 10](http://blog.paloaltonetworks.com/wp-content/uploads/2016/01/Angler-10-500x223.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/01/Angler-10.png) *Figure 10: Time-based cloaking of compromised hosts -- Pacific Standard Time.* #### User Agent-based evasion In addition to the User Agent checks inside the JavaScript code we described earlier, the servers will also perform their own check of the visiting browsers UA string. We found that unless we used a special user agent string (mimicking IE 8 and 9), we were unable to access the malicious content. This is yet another way that the attackers appear to be attempting to evade detection from web scanners. #### Cookie-based evasion Finally, the compromised site sets the user's cookie the first time the victim visits the site, and never sends the injected code a second time to a browser if it detects the same cookie on subsequent requests. We consider this as one of the many mechanisms to cloak the threat against security researchers that may employ dynamic analysis approaches to visit the compromised sites repetitively. #### Organized Evolution Detection evasion techniques are crucial for a malicious attackers operation, but in time researchers will identify and expose them. To avoid being caught, attackers constantly evolve the compromised sites to further complicate the detection and prevention process. We list some of the more important changes we observed below. ### EK Gate URL evolution Continuous monitoring of the EK gate URLs (result of DNS shadowing) shows that they change frequently, at approximately half-hour to one-hour periods. Our large scale continuous scanning reveals that, at any given time, almost all compromised sites point to the same next-hop domain, but in roughly half an hour to an hour this domain changes completely and **all infected hosts make the change at approximately the same time** . Table 2 shows our scanning result for the source hostnames of the injected *iframe* URLs. Since we cannot get hold of a compromised host and capture the traffic ourselves, we suspect that this synchronized behavior is an indication of **malicious C2 server(s) actively and continuously communicating with the compromised hosts** to activate the switch to new EK gates. |----------------------------|--------------------------------------------------------| | Approximate switching time | src host of injected *iframe* | | START | hxxp://perintprinssinhadezeu1.mirastravels\[.\]net | | 2015-11-13 00:38 AM | hxxp://gren1elintensiirto.bonihutchinson\[.\]com | | 2015-11-13 01:48 AM | hxxp://collatiesmuskambrette.tsm-nj\[.\]com | | 2015-11-13 02:17 AM | hxxp://orneginsanscritista.grownmanbody\[.\]com | | 2015-11-13 02:48 AM | hxxp://syvimpisubnumber.dura-tekllc\[.\]com | | 2015-11-13 03:50 AM | hxxp://qreplies-gabberhouse.curionemotorsports\[.\]com | *Table 2: EK gate domain changes* Although the hostname changes frequently, we are able to confirm using passive DNS data that the IPs these domains resolved to are relatively limited, including 91.239.74.80 and 188.120.235.94. This indicates the attacker is reusing some IP resources behind the subdomain-fluxing mechanism. #### Injected JavaScript evolution Figure 11 illustrates the timeline of the injected JavaScript's evolution. We denote the first version we saw (November 5) as Version 1.0. During our continuous tracking, we found that the EK's malicious JavaScript code evolved into a slightly advanced variant on November 11. In this version (1.1,) the code previously used to detect a Firefox browser is gone, i.e. (+\[*window.sidebar* \]). We suspect this line was removed because it might trigger the traditional signature-based detection as it is always written in plain text. On November 21, another version (1.2) appeared across all of the compromised sites and completely removed *ActiveXObject* initialization in the scripts. Upon observing this evolution we quickly adjusted our detection method to continue tracking the compromised pages. On November 27, the JavaScript changed again, this time to a completely different structure (version 2.0). Instead of concatenating tiny strings together, this version boasts a very long string that it decodes to the iframe injection statement. A particular interesting aspect of this variation is that the injected code targets all major browsers including Firefox and Chrome, with the exception that for IE7, 8 and 9, they do additional checks via browser quirks to see if the declared *userAgent* matches the actual browser behavior. Again, on December 5, we found that the malicious code reverted back to version 1, but with a slight tweak of statement order; it also changed variable zmomfokopbpbbi's initialization in Figure 7 from a static long random string to a concatenation of smaller strings. [![Angler 11](http://blog.paloaltonetworks.com/wp-content/uploads/2016/01/Angler-11-500x77.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/01/Angler-11.png) *Figure 11: Injected JavaScript evolution* In each of the evolutionary steps, almost all compromised sites we had identified presented the update at the same time. **This timing provides further evidence that a C2 channel is likely maintained at all times between the attacker and the compromised hosts**. #### SWF/Binary file evolution Continuous monitoring of the Flash files served by the EK revealed that it changes slightly on a daily basis, and VT has never seen these samples by the time we obtain them. We submitted SWF file distributed on November 16 to VT, and the immediate detection score was 3 with less confident verdicts e.g. 'behaves like Flash Exploit'. On December 3 we requested a rescan on the same file, this time VT gave a score of 11 with many major AV vendors picking up the detection. ### **Infection Vectors** In this section we explore some interesting common properties that the compromised hosts share. We demonstrate how we use this information to discover many more compromised websites. #### Inferred infection vectors Generally speaking, we found that the infections fell into two categories, indicating that there may be two infection vectors used to compromise the websites. 1) For a small portion of sites, the malicious script is injected at the very top of the HTML source code, before the opening of \<*html*\> tag. One example is www.cxda\[.\]gov.cn. We think this is because the compromised host has an Apache or system level vulnerability which was exploited by the attacker. 2) For most of the compromised websites, the malicious script is injected right after the opening of the \<*body* \> element, and all these injections happen on **WordPress-powered websites**. This type of infection also shares another common attribute -- a cookie-setting snippet is installed just before the large malicious JavaScript file to make sure the malicious content is not served twice to a single victim, as described above. #### Extending scans Based on our injection vector inference, we extended our scan from newly registered domains to two additional categories of websites, greatly increasing the number of detections. #### Collocated hosts Since the attacker may exploit the same Apache/web server vulnerability on the same machine, we believe the hosts collocated with the known compromised sites have a higher chance to be compromised as well. Many hosting services host multiple websites on the same host and IP address (i.e. virtual hosting). During our daily scan of newly registered domains, we found a large number of compromised sites served by popular hosting services including GoDaddy, and found that some of them share the same IPs. Using passive DNS data, we are able to retrieve a sizable list of likely-vulnerable sites -- those that are hosted on the same IPs as ones we already detected. The list contains a total of 82,000 unique domains. Of these, approximately 65,000 domains are actively hosting websites and at least 3,880 of them are compromised. #### WordPress sites Based on the high percentage of WordPress websites present in the compromised site list, it is highly likely that the attacker is exploiting one or more WordPress vulnerabilities. However, to compromise these websites the attackers would have to first perform some type of reconnaissance. We theorized that the malware sample behavior collected in Palo Alto Networks WildFire could help us discover more of these infected websites. In WildFire scans, we identified many malware samples actively probing vulnerable WordPress sites by requesting their xmlrpc.php file. This file is linked to several vulnerabilities and hazards that have been previously disclosed. We collected such probing behavior in WildFire history, which amounts to a total of 201K unique domains. We determined that 174K URLs that were still alive and responding, and of these\*\*, our malicious web detection system identified 535 additional compromised sites.\*\* Following the success of this scan, we further obtained a large list of websites using WordPress which contained almost 17 million sites and scanned them using the same system. This revealed over 84,000 compromised WordPress websites in total. ### Infection lifecycle Looking at how many websites are being compromised and how quickly their operators detect and remove the infections helps us better understand the lifecycle of Angler EK infections. First, our daily scan reveals tens to hundreds of new compromised sites that have never previously been detected, as seen in Table 3 and Figure 12. These numbers suggest that this is still a very active threat. |-------|------|------|------|------|-------|-------|-------|-------|-------|-------|-------|-------| | | 11/6 | 11/7 | 11/8 | 11/9 | 11/10 | 11/11 | 11/12 | 11/13 | 11/14 | 11/15 | 11/16 | 11/17 | | Accu. | 214 | 285 | 467 | 472 | 549 | 593 | 704 | 880 | 932 | 1196 | 1211 | 1241 | | Incr. | NA | 71 | 182 | 5 | 77 | 44 | 111 | 176 | 52 | 264 | 15 | 30 | *Table 3: Unique new compromised sites detected every day* [![Angler 12](http://blog.paloaltonetworks.com/wp-content/uploads/2016/01/Angler-12-500x305.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/01/Angler-12.png) *Figure 12: Unique new and total compromised websites each day.* Before we make any statements about how quickly compromised websites are cleaned up, we would like to point out that the numbers discussed here are educated guesses to the upper-bound, due to the fact that the injected scripts may simply just be dormant for a long time. For example, we observed one site, 'seorewolucja\[.\]pl' that was first observed as infected on November 6 and followed the on-and-off infection pattern until 05:30 PST on November 15. Since then the site remained clean of infection for three days, until the morning of November 18 when the injected script appeared again. Although the injected code looks similar before November 15 and after November 18, we cannot be sure if the site owner disinfected their system and it was later re-compromised, or if the infection simply stayed dormant for three days. This demonstrates how long the infection may stay dormant and that we should not make hasty decisions regarding whether a site has been cleaned up and patched appropriately to prevent future infections. To get a rough idea about the cleanup rate and status, for every six hours we rescanned the entire infected population collected through November 16 -- a total of 5,234 unique URLs. We aggregated the scanning result on November 18 and our system found that 5,002 URLs were still infected at least one time in our scanning period, and saw a total of 396 sites that never showed any infection behavior throughout the scans from noon of November 16 to November 18. Even if we consider all of these sites as disinfected, they account for less than 8 percent of the entire infected population. When we checked this number again on November 19, the total number of clean sites dropped to 377. This means that some of the 396 sites that we thought had been cleaned up were simply staying dormant from November 16 to 18. Since many of these sites were discovered in early November and possibly infected even earlier, the scanning results indicate that disinfection is happening very slowly. ### Conclusion Modern exploit kits are becoming harder to catch as they maneuver to avoid detection by security researchers. Particularly, the Angler EK boasts the following features: * **Targeted Exploitation:** This family of JavaScript and iframe injections is targeted at specific configurations and/or geographic and IP distributions. This attacks malicious scripts and servers that use multiple techniques to target IE users and visits from an IP outside of the United States. * **Cloaking against researchers:** The constantly evolving injected scripts are trying their best to identify malware researchers' sandboxes. They hide their malicious behavior from sandbox/emulated environments. The techniques used include browser fingerprinting using browser quirks, as well as IP and *UserAgent* * **Frequent evolution and persistent control:** Large scale tracking of many compromised domains revealed that the attackers have persistent control over the compromised machines. We saw three major version changes in injected scripts as well as hourly switches of the malicious EK gate domains over the course of one month. These actions cannot occur without continuous control of the compromised hosts. This contradicts the common assumption that the hosts are compromised **only** at one point and injected malicious code **once**. * **Growing number of infections:** According to our observation, newly compromised sites appear at a consistent rate of over 100 sites per day (this is a lower bound as we can only scan a limited number of websites per day), while older compromised sites do not seem to be disinfected promptly, if at all. This results in a steady increase of total active compromised sites, and this threat is still a long ways from elimination. Despite these challenges, we also found some consistent behavior patterns and limitations of this attack: * **Suspicious redirections**: Although the redirection script may change, the redirection chain stays relatively stable. The EK is always served from a different WordPress-like domain and a flash file is downloaded soon afterwards. * **Infrastructure reuse**: Exploiting known WordPress vulnerability and weak DNS configuration for DNS shadowing may be easy for the attackers, however, changing the exploit kit's hosting server is relatively hard. This requires the attacker to physically control a new machine or move an existing machine. At least for now, we have never seen the attacker serve the actual EK file on a compromised machine, possibly to avoid bandwidth spikes/AV detection of the compromised sites. We will continue to track down the compromised sites, learn more about modern exploit kits and offer maximum protection for our customers. Get a list of the [compromised domains](https://raw.githubusercontent.com/pan-unit42/iocs/master/angler/compromised_domains) analyzed in this research. Back to top ### Tags * [Angler](https://unit42.paloaltonetworks.com/tag/angler/ "Angler") * [Angler Exploit Kit](https://unit42.paloaltonetworks.com/tag/angler-exploit-kit/ "Angler Exploit Kit") * [Exploit Kits](https://unit42.paloaltonetworks.com/tag/exploit-kits/ "Exploit Kits") * [JavaScript](https://unit42.paloaltonetworks.com/tag/javascript/ "JavaScript") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Using IDAPython to Make Your Life Easier: Part 4](https://unit42.paloaltonetworks.com/using-idapython-to-make-your-life-easier-part-4/ "Using IDAPython to Make Your Life Easier: Part 4") ### Related Articles * [Russian Global Webmail Espionage](https://unit42.paloaltonetworks.com/russian-webmail-espionage/ "article - table of contents") * [Threat Brief: Widespread Impact of the Axios Supply Chain Attack](https://unit42.paloaltonetworks.com/axios-supply-chain-attack/ "article - table of contents") * [The Next Frontier of Runtime Assembly Attacks: Leveraging LLMs to Generate Phishing JavaScript in Real Time](https://unit42.paloaltonetworks.com/real-time-malicious-javascript-through-llms/ "article - table of contents") ## Related Malware Resources ![Pictorial representation of a magnifying glass illuminating a glowing orange circular digital circuit interface on a dark, high-tech background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Myth-Busting_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) September 16, 2026 [#### Atomic macOS (AMOS) Stealer Activity](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/) * [MacOS](https://unit42.paloaltonetworks.com/tag/macos/ "macOS") * [Threat intelligence](https://unit42.paloaltonetworks.com/tag/threat-intelligence/ "threat intelligence") * [Unit 42](https://unit42.paloaltonetworks.com/tag/unit-42/ "Unit 42") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/ "Atomic macOS (AMOS) Stealer Activity") ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/content/pan/en_US/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)