[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/)  
[![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/)  
Menu

* [Tools](https://unit42.paloaltonetworks.com/tools/)
* [ATOMs](https://unit42.paloaltonetworks.com/atoms/)
* [Security Consulting](https://www.paloaltonetworks.com/unit42)
* [About Us](https://unit42.paloaltonetworks.com/about-unit-42/)
* [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html)  
  English
* [English](https://unit42.paloaltonetworks.com/blackcat-ransomware-releases-new-utility-munchkin/)
* [Japanese](https://unit42.paloaltonetworks.com/ja/blackcat-ransomware-releases-new-utility-munchkin/)
* [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research")
* [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research")
* [Ransomware](https://unit42.paloaltonetworks.com/category/ransomware/ "Ransomware")  
  [Ransomware](https://unit42.paloaltonetworks.com/category/ransomware/)

# BlackCat Climbs the Summit With a New Tactic

![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 9 min read  
Related Products  
[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Next-Generation Firewall icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response")

* ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg)  
  By:
  
  * [Unit 42](https://unit42.paloaltonetworks.com/author/unit42/)

* ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg)  
  Published:October 18, 2023

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg)  
  Categories:
  
  * [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/)
  * [Ransomware](https://unit42.paloaltonetworks.com/category/ransomware/)
  * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/)

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg)  
  Tags:
  
  * [ALPHV](https://unit42.paloaltonetworks.com/tag/alphv/)
  * [Ambitious Scorpius](https://unit42.paloaltonetworks.com/tag/ambitious-scorpius/)
  * [BlackCat ransomware](https://unit42.paloaltonetworks.com/tag/blackcat-ransomware/)

* [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/blackcat-ransomware-releases-new-utility-munchkin/?pdf=download&lg=en&_wpnonce=c280d701ab "Click here to download")

* [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/blackcat-ransomware-releases-new-utility-munchkin/?pdf=print&lg=en&_wpnonce=c280d701ab "Click here to print")

Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg)

* ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg)
* [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=BlackCat%20Climbs%20the%20Summit%20With%20a%20New%20Tactic&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fblackcat-ransomware-releases-new-utility-munchkin%2F "Share in email")
* [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fblackcat-ransomware-releases-new-utility-munchkin%2F "Share in Facebook")
* [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fblackcat-ransomware-releases-new-utility-munchkin%2F&title=BlackCat%20Climbs%20the%20Summit%20With%20a%20New%20Tactic "Share in LinkedIn")
* [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fblackcat-ransomware-releases-new-utility-munchkin%2F&text=BlackCat%20Climbs%20the%20Summit%20With%20a%20New%20Tactic "Share in Twitter")
* [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fblackcat-ransomware-releases-new-utility-munchkin%2F&ts=markdown "Share in Reddit")
* [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=BlackCat%20Climbs%20the%20Summit%20With%20a%20New%20Tactic%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fblackcat-ransomware-releases-new-utility-munchkin%2F "Share in Mastodon")

## Executive Summary

BlackCat operators recently announced new updates to their tooling, including a utility called Munchkin that allows attackers to propagate the BlackCat payload to remote machines and shares on a victim organization network. For the past two years, the BlackCat ransomware operators have continued to evolve and iterate their tooling as part of their ransomware-as-a-service (RaaS) business model.

As part of a recent investigation, Unit 42 researchers have acquired an instance of Munchkin that is unique, in that it is loaded in a customized Alpine virtual machine (VM). This new tactic of leveraging a customized VM to deploy malware has been gaining traction in recent months, allowing ransomware threat actors to use VMs to circumvent security solutions in deploying their malware payloads.

This publication details how this new utility works and sheds further light on the continued tactics used by BlackCat threat actors. In doing so, it is our sincere hope to motivate further effort by the information security industry to better defend against this evolving threat.

Palo Alto Networks customers receive protections against this specific threat through appropriate identification of the provided indicators as malicious.

| **Related Unit 42 Topics** | [**BlackCat Ransomware**](https://unit42.paloaltonetworks.com/tag/blackcat-ransomware/) |
|----------------------------|-----------------------------------------------------------------------------------------|

## Overview of BlackCat

The [BlackCat ransomware](https://unit42.paloaltonetworks.com/blackcat-ransomware/) threat was first made public when it surfaced in November 2021. This threat gained notoriety due to the sophistication employed within their malware, along with unique approaches such as the use of the Rust programming language.

BlackCat, similar to other ransomware threat actors, employs a RaaS business model. This model allows affiliates to leverage their tooling, in turn providing a portion of the profits to the operators. Based on historical reports, affiliates keep roughly 80-90% of the ransom payment, with the remainder being sent to the operators.

The BlackCat organization, including its affiliates, has historically focused on targeting victims in the United States. However, this focus has greatly broadened over time with increased popularity, and BlackCat has more recently been observed targeting victims worldwide across numerous industries and verticals.

The BlackCat tool set has continued to evolve over the years. Original versions provided an embedded JSON configuration with no obfuscation or encryption applied.

Over time, threat operators updated the malware family to obfuscate this underlying configuration. They also required a unique command-line parameter to execute the malware. In doing so, BlackCat prevented those within the security community from gaining insight into the underlying payloads in the event this command-line parameter was unavailable.

The malware family has continued to evolve, with threat operators employing further capabilities and obfuscation mechanisms. In recent months, BlackCat has released a new tool named "Munchkin."

This tooling provided a Linux-based operating system (OS) running Sphynx (the latest BlackCat variant). Threat operators can use this utility to run BlackCat on remote machines, or to deploy it to encrypt remote Server Message Block (SMB)/Common Internet File Shares (CIFS).
![Image 1 is a diagram of how the Munchkin utility works. Virtualbox is installed on the victim host, and loads the custom ISO/virtual machine. From that point, the remote SMB shares are encrypted, and copies of BlackCat ransomware are also pushed to remote machines.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/10/1965-F1-BlackCat.png) Figure 1. Diagram of Munchkin tool process.

The use of virtual machines to run malware is a growing trend within the ransomware community. Other ransomware organizations have been [reported to leverage this new tactic](https://tech.hindustantimes.com/tech/news/a-new-ransomware-uses-virtual-machine-to-dodge-security-71590409211492.html) as well.

The benefits of this approach include circumventing any security controls or protections set on the host OS, such as antivirus software. As these solutions often do not have the introspection within the embedded virtualized OS, malware will frequently bypass any checks that are present.

As part of a recent investigation, Unit 42 researchers were able to acquire a copy of this VM utility. As such, we can provide insights into how it works.

## Climbing the Summit

The Munchkin utility is delivered as an ISO file, which is loaded in a newly installed instance of the VirtualBox virtualization product. This ISO file represents a customized implementation of the [Alpine OS](https://www.alpinelinux.org/about/), which threat operators likely chose due to its small footprint. Upon running the operating system, the following commands are executed at boot:  
echo -n "root:\[password\]" | chpasswd tmux new-session -A -s controller \\; send -t controller "/app/controller \&\& poweroff" ENTER \\; detach -s controller eject

|-------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 | echo -n "root:\[password\]" | chpasswd tmux new-session -A -s controller \\; send -t controller "/app/controller \&\& poweroff" ENTER \\; detach -s controller eject |

In doing so, the malware initially changes the root password of the VM to one chosen by the threat actors. It subsequently generates a new terminal session via the built-in tmux utility, which is used to execute the malware binary named controller. After the malware completes execution, it powers the VM off.

The controller malware is hosted within the /app directory, along with other related files. In addition, other related and notable files are included within the VM OS, as noted in Table 1 below.

|-------------------------------|-------------------------------------------------------------------------------|
| **File Path**                 | **Description**                                                               |
| /app/controller               | Munchkin malware utility.                                                     |
| /app/config                   | Serialized configuration file used by Munchkin.                               |
| /app/payload                  | Template BlackCat malware sample, which is customized by Munchkin at runtime. |
| /scripts/smb\_common.py        | Python helper utility for SMB-related operations.                             |
| /scripts/smb\_copy\_and\_exec.py | Python script used to copy a file via SMB and subsequently run it.            |
| /scripts/smb\_exec.py          | Python script used to execute a remote file.                                  |

*Table 1. File path and description of the files included within the VM OS.*

In addition to the files noted above, a large number of Python scripts are present within the /usr/bin directly, which the BlackCat operators can use in subsequent updates within the VM.

* DumpNTLMInfo.py
* Get-GPPPassword.py
* GetADUsers.py
* GetNPUsers.py
* GetUserSPNs.py
* addcomputer.py
* atexec.py
* changepasswd.py
* dcomexec.py
* dpapi.py
* esentutl.py
* exchanger.py
* findDelegation.py
* flask
* futurize
* getArch.py
* getPac.py
* getST.py
* getTGT.py
* goldenPac.py
* karmaSMB.py
* keylistattack.py
* kintercept.py
* ldapdomaindump
* ldd2bloodhound
* ldd2pretty
* lookupsid.py
* machine\_role.py
* mimikatz.py
* mqtt\_check.py
* mssqlclient.py
* mssqlinstance.py
* net.py
* netview.py
* nmapAnswerMachine.py
* normalizer
* ntfs-read.py
* ntlmrelayx.py
* pasteurize
* ping.py
* ping6.py
* pip
* pip3
* pip3.11
* psexec.py
* raiseChild.py
* rbcd.py
* rdp\_check.py
* reg.py
* registry-read.py
* rpcdump.py
* rpcmap.py
* sambaPipe.py
* samrdump.py
* secretsdump.py
* services.py
* smbclient.py
* smbexec.py
* smbpasswd.py
* smbrelayx.py
* smbserver.py
* sniff.py
* sniffer.py
* split.py
* ticketConverter.py
* ticketer.py
* tstool.py
* wmiexec.py
* wmipersist.py
* wmiquery.py

Attackers can use many of the Python scripts above for lateral movement, password dumping and further execution of malware on the victim network.

The controller malware is written in the Rust programming language in a manner very similar to the BlackCat malware family. Upon execution, the controller will initially decrypt numerous strings using a unique single-byte XOR operation.
![Image 2 is a comparison of two screenshots of code. The screenshot on the left is the original. The screenshot on the right is the runtime code that is decrypted.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/10/word-image-130681-2.png) Figure 2. String decryption at runtime.

After the strings are decrypted, the threat will perform basic checks to ensure that the expected configuration and payload files reside within the /app directory. The threat will then deserialize and parse the /app/config file. In the event any of these files are not present or if they are unable to be parsed, the malware will exit with an error message.

The /app/config file contains a wealth of information including the following, which the controller malware sample subsequently uses:

* Access Token
* Task identifiers
* Victim credentials (including usernames, passwords and domains)
* BlackCat victim URLs
* Blocklisted file types and paths
* Hosts and shares to target for encryption

After the configuration is parsed, the controller creates and mounts the /payloads/ directory, which it uses to host subsequently created instances of BlackCat. The controller uses the previously noted /app/payload as a template for creating customized BlackCat samples. Within the template file, there are specific markers that the controller looks for and uses when it modifies this file.
![Image 3 is a comparison of two BlackCat samples. On the left is the BlackCat template file. many of the lines are highlighted in blue. On the right is the sample after modification. Many of the lines are highlighted in red.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/10/word-image-130681-3.png) Figure 3. Creation of a new BlackCat sample based on template and configuration.

The created files are based on the provided configuration. However, they are named as follows, with incremental values:

* /payloads/0
* /payloads/1

After these payloads have been created, the malware proceeds to iterate through the provided configuration with the intent of infecting any SMB/CIFS drives that are specified. These attempts are outlined in various outputs written to STDOUT, an example of which is shown below.

(Note: The actual IP addresses and share names have been redacted in the output below.)  
05:21:40 \[INFO\] Loading Config 05:21:40 \[INFO\] Initializing System 05:21:40 \[INFO\] Initializing Array 05:21:40 \[INFO\] Pass #1 05:21:40 \[INFO\] Executing tasks 05:21:40 \[INFO\] Task \[ip\_address\] 05:21:40 \[INFO\] Encode Shares \[ip\_address\] -\> \[share\_path\] 05:21:40 \[INFO\] Scanning \[ip\_address\] 05:21:40 \[INFO\] Task \[ip\_address\] 05:21:40 \[INFO\] Encode Shares \[ip\_address\] -\> \[share\_path\] 05:21:40 \[INFO\] Scanning \[ip\_address\] 05:21:40 \[INFO\] Task \[ip\_address\] 05:21:40 \[INFO\] Encode Shares \[ip\_address\] -\> \[share\_path\] 05:21:40 \[INFO\] Scanning \[ip\_address\] 05:21:40 \[INFO\] Task \[ip\_address\] \[TRUNCATED\] 05:21:40 \[INFO\] Pass #2 05:21:40 \[INFO\] Executing tasks 05:21:40 \[INFO\] Task \[ip\_address\] 05:21:40 \[INFO\] Encode Shares \[ip\_address\] -\> \[share\_path\] 05:21:40 \[INFO\] Scanning \[ip\_address\] 05:21:40 \[INFO\] Task \[ip\_address\] 05:21:40 \[INFO\] Encode Shares \[ip\_address\] -\> \[share\_path\] 05:21:40 \[INFO\] Scanning \[ip\_address\] 05:21:40 \[INFO\] Task \[ip\_address\] 05:21:40 \[INFO\] Encode Shares \[ip\_address\] -\> \[share\_path\] \[TRUNCATED\] 05:21:40 \[INFO\] Done!

|----------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 | 05:21:40 \[INFO\] Loading Config 05:21:40 \[INFO\] Initializing System 05:21:40 \[INFO\] Initializing Array 05:21:40 \[INFO\] Pass #1 05:21:40 \[INFO\] Executing tasks 05:21:40 \[INFO\] Task \[ip\_address\] 05:21:40 \[INFO\] Encode Shares \[ip\_address\] -\> \[share\_path\] 05:21:40 \[INFO\] Scanning \[ip\_address\] 05:21:40 \[INFO\] Task \[ip\_address\] 05:21:40 \[INFO\] Encode Shares \[ip\_address\] -\> \[share\_path\] 05:21:40 \[INFO\] Scanning \[ip\_address\] 05:21:40 \[INFO\] Task \[ip\_address\] 05:21:40 \[INFO\] Encode Shares \[ip\_address\] -\> \[share\_path\] 05:21:40 \[INFO\] Scanning \[ip\_address\] 05:21:40 \[INFO\] Task \[ip\_address\] \[TRUNCATED\] 05:21:40 \[INFO\] Pass #2 05:21:40 \[INFO\] Executing tasks 05:21:40 \[INFO\] Task \[ip\_address\] 05:21:40 \[INFO\] Encode Shares \[ip\_address\] -\> \[share\_path\] 05:21:40 \[INFO\] Scanning \[ip\_address\] 05:21:40 \[INFO\] Task \[ip\_address\] 05:21:40 \[INFO\] Encode Shares \[ip\_address\] -\> \[share\_path\] 05:21:40 \[INFO\] Scanning \[ip\_address\] 05:21:40 \[INFO\] Task \[ip\_address\] 05:21:40 \[INFO\] Encode Shares \[ip\_address\] -\> \[share\_path\] \[TRUNCATED\] 05:21:40 \[INFO\] Done! |

After the malware executes fully, the VM powers off and performs no further actions.

We found the following message embedded within the malware sample itself. It is not used; it was presumably included at a certain stage of development but was later removed from use.  
ATTENTION: At the time there is NO CONFIG ENCRYPTION, meaning chat access token is NOT ENCRYPTED in the ISO. Leaking the ISO will result in chat access token leak! It's highly recommended to EJECT and DELETE the ISO right after system boot. DO NOT LEAVE THE ISO ON TARGET SYSTEMS! Usage: Controller is launched at boot time in tmux session named "controller". It will execute all the tasks and exit. If you've set "shutdown" option at config time it will also shutdown the machine after finishing tasks. If "shutdown" option is not set you can relaunch Controller by running "/app/controller". Monitoring: Monitor progress by running "tmux a" with either terminal or ssh connection.

|----------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 | ATTENTION: At the time there is NO CONFIG ENCRYPTION, meaning chat access token is NOT ENCRYPTED in the ISO. Leaking the ISO will result in chat access token leak! It's highly recommended to EJECT and DELETE the ISO right after system boot. DO NOT LEAVE THE ISO ON TARGET SYSTEMS! Usage: Controller is launched at boot time in tmux session named "controller". It will execute all the tasks and exit. If you've set "shutdown" option at config time it will also shutdown the machine after finishing tasks. If "shutdown" option is not set you can relaunch Controller by running "/app/controller". Monitoring: Monitor progress by running "tmux a" with either terminal or ssh connection. |

This message appears to be a message from the BlackCat creators to their affiliates urging them to remove this file from a compromised environment. It would seem that the affiliate in question failed to heed this advice.

## Conclusion

Malware authors, especially those behind the BlackCat ransomware threat, continue to iterate and evolve their techniques and tactics. This is fully apparent in their recent release of Munchkin, which they've developed and provided to their affiliates.

This tool follows a continued trend of leveraging VMs in an attempt to thwart security controls present on a host and to stay ahead of the security community in defending against these threats.

Palo Alto Networks customers receive protection from the threats discussed above through the following products:

* [Next-Generation Firewalls](https://docs.paloaltonetworks.com/ngfw) with [cloud-delivered security services](https://docs.paloaltonetworks.com/cdss) including [WildFire](https://docs.paloaltonetworks.com/wildfire) detect the files mentioned within this report as malicious.

If you think you might have been compromised or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call:

* North America Toll-Free: 866.486.4842 (866.4.UNIT42)
* EMEA: +31.20.299.3130
* APAC: +65.6983.8730
* Japan: +81.50.1790.0200

Palo Alto Networks has shared these findings, including file samples and indicators of compromise, with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org).

## Indicators of Compromise

### /app/controller - Munchkin Binary

* 1a4082c161eafde7e367e0ea2c98543c06dce667b547881455d1984037a90e7d

### /app/payload - BlackCat Stub

* b4dd6e689b80cfcdd74b0995250d63d76ab789f1315af7fe326122540cddfad2

### /scripts/smb\_common.py - Python SMB Classes

* 41c0b2258c632ee122fb52bf2f644c7fb595a5beaec71527e2ebce7183644db2

### /scripts/smb\_copy\_and\_exec.py - Python SMB Copy/Exec Script

* 2e808fc1b2bd960909385575fa9227928ca25c8665d3ce5ad986b03679dace90

### /app/payload - BlackCat Stub

* b4dd6e689b80cfcdd74b0995250d63d76ab789f1315af7fe326122540cddfad2

### YARA Rules

rule u42\_crime\_nix\_munchkin { meta: author = "Unit 42 Threat Intelligence" date = "2023-10-12" description = "Identifies a scanning utility leveraged by the BlackCat operators that is used to propagate the malware payload to additional hosts via SMB." hash = "1a4082c161eafde7e367e0ea2c98543c06dce667b547881455d1984037a90e7d" reference = "https://unit42.paloaltonetworks.com/blackcat-ransomware/" strings: $str0 = "At the time there is NO CONFIG ENCRYPTION, meaning chat access token is NOT ENCRYPTED in the ISO." xor(1-255) $str1 = "Leaking the ISO will result in chat access token leak!" xor(1-255) $str2 = "It's highly recommended to EJECT and DELETE the ISO right after system boot." xor(1-255) $str3 = "DO NOT LEAVE THE ISO ON TARGET SYSTEMS!" xor(1-255) $str4 = "Controller is launched at boot time in tmux session named \\"controller\\"." xor(1-255) $str5 = "It will execute all the tasks and exit." xor(1-255) $str6 = "If you've set \\"shutdown\\" option at config time it will also shutdown the machine after finishing tasks." xor(1-255) $str7 = "If \\"shutdown\\" option is not set you can relaunch Controller by running \\"/app/controller" xor(1-255) $str8 = "Monitor progress by running \\"tmux a\\" with either terminal or ssh connection" xor(1-255) $str9 = "controller::smb" xor(1-255) $str10 = ": Failed, either no credentials or no ADMIN$ share found" xor(1-255) $str11 = "bin/controller/src/program.rs" xor(1-255) $str12 = "/scripts/smb\_exec.py" xor(1-255) $str13 = "No payload configs provided!" xor(1-255) $str14 = "Can't deserialize config" xor(1-255) $str15 = "controller::program" xor(1-255) condition: any of them }

|----------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 | rule u42\_crime\_nix\_munchkin { meta: author = "Unit 42 Threat Intelligence" date = "2023-10-12" description = "Identifies a scanning utility leveraged by the BlackCat operators that is used to propagate the malware payload to additional hosts via SMB." hash = "1a4082c161eafde7e367e0ea2c98543c06dce667b547881455d1984037a90e7d" reference = "https://unit42.paloaltonetworks.com/blackcat-ransomware/" strings: $str0 = "At the time there is NO CONFIG ENCRYPTION, meaning chat access token is NOT ENCRYPTED in the ISO." xor(1-255) $str1 = "Leaking the ISO will result in chat access token leak!" xor(1-255) $str2 = "It's highly recommended to EJECT and DELETE the ISO right after system boot." xor(1-255) $str3 = "DO NOT LEAVE THE ISO ON TARGET SYSTEMS!" xor(1-255) $str4 = "Controller is launched at boot time in tmux session named \\"controller\\"." xor(1-255) $str5 = "It will execute all the tasks and exit." xor(1-255) $str6 = "If you've set \\"shutdown\\" option at config time it will also shutdown the machine after finishing tasks." xor(1-255) $str7 = "If \\"shutdown\\" option is not set you can relaunch Controller by running \\"/app/controller" xor(1-255) $str8 = "Monitor progress by running \\"tmux a\\" with either terminal or ssh connection" xor(1-255) $str9 = "controller::smb" xor(1-255) $str10 = ": Failed, either no credentials or no ADMIN$ share found" xor(1-255) $str11 = "bin/controller/src/program.rs" xor(1-255) $str12 = "/scripts/smb\_exec.py" xor(1-255) $str13 = "No payload configs provided!" xor(1-255) $str14 = "Can't deserialize config" xor(1-255) $str15 = "controller::program" xor(1-255) condition: any of them } |

rule u42\_crime\_win\_blackcat { meta: author = "Unit 42 Threat Intelligence" date = "2023-10-12" description = "Identifies the BlackCat ransomware malware family, which is written in the Rust programming language." hash = "b4dd6e689b80cfcdd74b0995250d63d76ab789f1315af7fe326122540cddfad2" reference = "https://unit42.paloaltonetworks.com/blackcat-ransomware/" strings: $str0 = "paths\_file" xor(1-255) $str1 = "override\_credentials" xor(1-255) $str2 = "disable\_recursion" xor(1-255) $str3 = "disable\_network" xor(1-255) $str4 = "disable\_elevate\_to\_system" xor(1-255) $str5 = "disable\_self\_propagation" xor(1-255) $str6 = "self\_destruct" xor(1-255) $str7 = "The following required argument was not provided: Path to resource to be processed." xor(1-255) $str8 = "Resource is one of:" xor(1-255) $str9 = "Path to local or remote File" xor(1-255) $str10 = "Path to local or remote Directory" xor(1-255) $str11 = "Path to remote server, i.e. \\"\\\\10.0.0.1\\"" xor(1-255) $str12 = "If no paths provided:" xor(1-255) $str13 = "A full scan in all available resources will be performed." xor(1-255) $str14 = "(you can provide multiple, single or no paths, i.e.: \\"-p /home -p /opt\\")" xor(1-255) $str15 = "Override config credentials:\\n\\nFormat:\\n\\nusername:password\\n\\n" xor(1-255) $str16 = "If Resource is a directory and this option is defined, only direct children of that directory will be processed" xor(1-255) $str17 = "disable-recursion" xor(1-255) $str18 = "DISABLE\_NETWORK" xor(1-255) $str19 = "Disable automatic network discovery" xor(1-255) $str20 = "disable-network" xor(1-255) $str21 = "DISABLE\_ELEVATE\_TO\_SYSTEM" xor(1-255) $str22 = "Do not attempt to elevalte access token to system" xor(1-255) $str23 = "disable-elevate-to-system" xor(1-255) $str24 = "DISABLE\_SELF\_PROPAGATION" xor(1-255) $str25 = "Disable network self propagation" xor(1-255) $str26 = "Network propagation is disabled by default in case you provided \<" xor(1-255) $str27 = "Attach to parent console instead of allocating new one" xor(1-255) $str28 = "If no command provided an interactive client will be launched, otherwise client will send provided command and exit." xor(1-255) condition: 3 of them }

|-------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 | rule u42\_crime\_win\_blackcat { meta: author = "Unit 42 Threat Intelligence" date = "2023-10-12" description = "Identifies the BlackCat ransomware malware family, which is written in the Rust programming language." hash = "b4dd6e689b80cfcdd74b0995250d63d76ab789f1315af7fe326122540cddfad2" reference = "https://unit42.paloaltonetworks.com/blackcat-ransomware/" strings: $str0 = "paths\_file" xor(1-255) $str1 = "override\_credentials" xor(1-255) $str2 = "disable\_recursion" xor(1-255) $str3 = "disable\_network" xor(1-255) $str4 = "disable\_elevate\_to\_system" xor(1-255) $str5 = "disable\_self\_propagation" xor(1-255) $str6 = "self\_destruct" xor(1-255) $str7 = "The following required argument was not provided: Path to resource to be processed." xor(1-255) $str8 = "Resource is one of:" xor(1-255) $str9 = "Path to local or remote File" xor(1-255) $str10 = "Path to local or remote Directory" xor(1-255) $str11 = "Path to remote server, i.e. \\"\\\\10.0.0.1\\"" xor(1-255) $str12 = "If no paths provided:" xor(1-255) $str13 = "A full scan in all available resources will be performed." xor(1-255) $str14 = "(you can provide multiple, single or no paths, i.e.: \\"-p /home -p /opt\\")" xor(1-255) $str15 = "Override config credentials:\\n\\nFormat:\\n\\nusername:password\\n\\n" xor(1-255) $str16 = "If Resource is a directory and this option is defined, only direct children of that directory will be processed" xor(1-255) $str17 = "disable-recursion" xor(1-255) $str18 = "DISABLE\_NETWORK" xor(1-255) $str19 = "Disable automatic network discovery" xor(1-255) $str20 = "disable-network" xor(1-255) $str21 = "DISABLE\_ELEVATE\_TO\_SYSTEM" xor(1-255) $str22 = "Do not attempt to elevalte access token to system" xor(1-255) $str23 = "disable-elevate-to-system" xor(1-255) $str24 = "DISABLE\_SELF\_PROPAGATION" xor(1-255) $str25 = "Disable network self propagation" xor(1-255) $str26 = "Network propagation is disabled by default in case you provided \<" xor(1-255) $str27 = "Attach to parent console instead of allocating new one" xor(1-255) $str28 = "If no command provided an interactive client will be launched, otherwise client will send provided command and exit." xor(1-255) condition: 3 of them } |

## Additional Resources

* [Threat Assessment: BlackCat Ransomware](https://unit42.paloaltonetworks.com/blackcat-ransomware/) -- Unit 42, Palo Alto Networks
* [BlackCat (ALPHV) ransomware levels up for stealth, speed and exfiltration](https://securityintelligence.com/posts/blackcat-ransomware-levels-up-stealth-speed-exfiltration/) -- IBM X-Force

Back to top

### Tags

* [ALPHV](https://unit42.paloaltonetworks.com/tag/alphv/ "ALPHV")
* [Ambitious Scorpius](https://unit42.paloaltonetworks.com/tag/ambitious-scorpius/ "Ambitious Scorpius")
* [BlackCat ransomware](https://unit42.paloaltonetworks.com/tag/blackcat-ransomware/ "BlackCat ransomware")  
  [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Blocking Dedicated Attacking Hosts Is Not Enough: In-Depth Analysis of a Worldwide Linux XorDDoS Campaign](https://unit42.paloaltonetworks.com/new-linux-xorddos-trojan-campaign-delivers-malware/ "Blocking Dedicated Attacking Hosts Is Not Enough: In-Depth Analysis of a Worldwide Linux XorDDoS Campaign")

### Table of Contents

* 

### Related Articles

* [Threat Actor Groups Tracked by Palo Alto Networks Unit 42 (Updated Aug. 1, 2025)](https://unit42.paloaltonetworks.com/threat-actor-groups-tracked-by-palo-alto-networks-unit-42/ "article - table of contents")
* [Muddled Libra Threat Assessment: Further-Reaching, Faster, More Impactful](https://unit42.paloaltonetworks.com/muddled-libra/ "article - table of contents")
* [Threat Group Assessment: Muddled Libra (Updated May 16, 2025)](https://unit42.paloaltonetworks.com/threat-group-assessment-muddled-libra-2024/ "article - table of contents")

## Related Resources

![Pictorial representation of Russian global webmail espionage campaign. A digital illustration of a world map in a network style, highlighting continents with glowing lines and connectivity points in a red and blue theme.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/06_Nation-State-cyberattacks_1920x900-1-786x368.jpg)  
[![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) July 23, 2026 [#### Russian Global Webmail Espionage](https://unit42.paloaltonetworks.com/russian-webmail-espionage/)

* [CL-STA-1114](https://unit42.paloaltonetworks.com/tag/cl-sta-1114/ "CL-STA-1114")

* [JavaScript](https://unit42.paloaltonetworks.com/tag/javascript/ "JavaScript")

* [Javascript injection](https://unit42.paloaltonetworks.com/tag/javascript-injection/ "javascript injection")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/russian-webmail-espionage/ "Russian Global Webmail Espionage")  
  ![Pictorial representation of a woman standing in a server room holding a laptop that projects a digital code overlay.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/06_Security-Technology_Category_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) May 28, 2026 [#### 2026 World Cup: Discussing The World's Biggest Game's Attack Surface](https://unit42.paloaltonetworks.com/fifa-world-cup-attack-surface/)

* [Fiddling Scorpius](https://unit42.paloaltonetworks.com/tag/fiddling-scorpius/ "Fiddling Scorpius")

* [Fighting Ursa](https://unit42.paloaltonetworks.com/tag/fighting-ursa/ "Fighting Ursa")

* [Muddled Libra](https://unit42.paloaltonetworks.com/tag/muddled-libra/ "Muddled Libra")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/fifa-world-cup-attack-surface/ "2026 World Cup: Discussing The World’s Biggest Game’s Attack Surface")  
  ![Pictoral representation of a man holding a cellphone with a bokeh skyline in the background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/05_Listicle_Category_1505x922-718x440.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) May 27, 2026 [#### Out of the Crypt: The Evolving Cyber Extortion Economy](https://unit42.paloaltonetworks.com/cyber-extortion-economy/)

* [Bling Libra](https://unit42.paloaltonetworks.com/tag/bling-libra/ "Bling Libra")

* [Extortion](https://unit42.paloaltonetworks.com/tag/extortion/ "Extortion")

* [Frontier AI](https://unit42.paloaltonetworks.com/tag/frontier-ai/ "Frontier AI")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/cyber-extortion-economy/ "Out of the Crypt: The Evolving Cyber Extortion Economy")  
  ![Pictorial representation of Iran cyber attacks. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/12_Security-Technology_Category_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) April 17, 2026 [#### Threat Brief: Escalation of Cyber Risk Related to Iran (Updated April 17)](https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/)

* [APK](https://unit42.paloaltonetworks.com/tag/apk/ "APK")

* [DDoS attacks](https://unit42.paloaltonetworks.com/tag/ddos-attacks/ "DDoS attacks")

* [GenAI](https://unit42.paloaltonetworks.com/tag/genai/ "GenAI")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/ "Threat Brief: Escalation of Cyber Risk Related to Iran (Updated April 17)")  
  ![Pictorial representation of the APT Boggy Serpens. An illustrated blue snake is highlighted by a red circle against a night sky. The constellation serpens.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/Boggy-Serpens-1920x900-1-786x368.png)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) March 16, 2026 [#### Boggy Serpens Threat Assessment](https://unit42.paloaltonetworks.com/boggy-serpens-threat-assessment/)

* [Advanced Persistent Threat](https://unit42.paloaltonetworks.com/tag/advanced-persistent-threat/ "Advanced Persistent Threat")

* [Boggy Serpens](https://unit42.paloaltonetworks.com/tag/boggy-serpens/ "Boggy Serpens")

* [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/boggy-serpens-threat-assessment/ "Boggy Serpens Threat Assessment")  
  ![Pictorial representation of Muddled Libra, aka Scattered Spider. A vibrant illustration of the Libra zodiac sign, featuring a stylized balance scale overlaid with a prominent Libra symbol. The background is a starry night sky with shades of purple and blue, suggesting a cosmic theme.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/03-1-Muddle-Libra-1920x900-1-786x368.png)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/threat-actor-groups.svg)Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/) February 10, 2026 [#### A Peek Into Muddled Libra's Operational Playbook](https://unit42.paloaltonetworks.com/muddled-libra-ops-playbook/)

* [Muddled Libra](https://unit42.paloaltonetworks.com/tag/muddled-libra/ "Muddled Libra")

* [PowerShell](https://unit42.paloaltonetworks.com/tag/powershell/ "PowerShell")

* [Scattered Spider](https://unit42.paloaltonetworks.com/tag/scattered-spider/ "Scattered Spider")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/muddled-libra-ops-playbook/ "A Peek Into Muddled Libra’s Operational Playbook")  
  ![Pictorial representation of a group of individuals discussing an idea with a whiteboard.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/02_Listicle_Overview_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) February 3, 2026 [#### Why Smart People Fall For Phishing Attacks](https://unit42.paloaltonetworks.com/psychology-of-phishing/)

* [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI")

* [Phishing](https://unit42.paloaltonetworks.com/tag/phishing/ "phishing")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/psychology-of-phishing/ "Why Smart People Fall For Phishing Attacks")  
  ![Pictorial representation of threat groups from Russia. The silhouette of a bear and the Ursa constellation inside an orange abstract planet. Abstract, stylized cosmic setting with vibrant blue and purple shapes, representing space and distant planetary bodies.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/01/Ursa-Russia-B-1920x900-1-786x368.png)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) January 29, 2026 [#### Understanding the Russian Cyberthreat to the 2026 Winter Olympics](https://unit42.paloaltonetworks.com/russian-cyberthreat-2026-winter-olympics/)

* [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI")

* [IoT](https://unit42.paloaltonetworks.com/tag/iot/ "IoT")

* [Russia](https://unit42.paloaltonetworks.com/tag/russia/ "Russia")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/russian-cyberthreat-2026-winter-olympics/ "Understanding the Russian Cyberthreat to the 2026 Winter Olympics")  
  ![Pictorial representation of RaaS RansomHouse. Digital representation of cybersecurity concept with a padlock superimposed over computer circuit boards, symbolizing data protection and encryption technologies.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/12/06_Ransomware_Category_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) December 17, 2025 [#### From Linear to Complex: An Upgrade in RansomHouse Encryption](https://unit42.paloaltonetworks.com/ransomhouse-encryption-upgrade/)

* [ESXi](https://unit42.paloaltonetworks.com/tag/esxi/ "ESXi")

* [Jolly Scorpius](https://unit42.paloaltonetworks.com/tag/jolly-scorpius/ "Jolly Scorpius")

* [RansomHouse](https://unit42.paloaltonetworks.com/tag/ransomhouse/ "RansomHouse")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ransomhouse-encryption-upgrade/ "From Linear to Complex: An Upgrade in RansomHouse Encryption")  
  ![Pictorial representation of 01flip ransomware written in Rust. Digital artwork of a pixelated U.S. dollar bill disintegrating into small blocks against a blue data matrix background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/12/05_Ransomware_Category_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) December 10, 2025 [#### 01flip: Multi-Platform Ransomware Written in Rust](https://unit42.paloaltonetworks.com/new-ransomware-01flip-written-in-rust/)

* [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin")

* [CL-CRI-103](https://unit42.paloaltonetworks.com/tag/cl-cri-103/ "CL-CRI-103")

* [Cryptocurrency](https://unit42.paloaltonetworks.com/tag/cryptocurrency/ "Cryptocurrency")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/new-ransomware-01flip-written-in-rust/ "01flip: Multi-Platform Ransomware Written in Rust")

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)  
  ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]()  
  ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png)  
  ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42

## Peace of mind comes from staying ahead of threats. Subscribe today.

Your Email

Subscribe for email updates to all Unit 42 threat research.  
By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement")

This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.

Invalid captcha!
Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg)  
{#footer} Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security)

* [Secure AI by Design](https://www.paloaltonetworks.com/ai-security)

* [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase)

* [Prisma SASE](https://www.paloaltonetworks.com/sase)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam)

* [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira)

* [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management)

* [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management)

* [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager)

* [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance)

* [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management)

* [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic)

* [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management)

* [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance)

* [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery)

* [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42)

* [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess)

* [Incident Response](https://www.paloaltonetworks.com/unit42/respond)

* [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform)

* [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners)  
  Company

* [About Us](https://www.paloaltonetworks.com/about-us)

* [Careers](https://jobs.paloaltonetworks.com/en/)

* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales)

* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility)

* [Customers](https://www.paloaltonetworks.com/customers)

* [Investor Relations](https://investors.paloaltonetworks.com/)

* [Location](https://www.paloaltonetworks.com/about-us/locations)

* [Newsroom](https://www.paloaltonetworks.com/company/newsroom)  
  Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/)

* [Communities](https://www.paloaltonetworks.com/communities)

* [Content Library](https://www.paloaltonetworks.com/resources)

* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia)

* [Event Center](https://events.paloaltonetworks.com/)

* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)

* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z)

* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications)

* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure)

* [Sitemap](https://www.paloaltonetworks.com/sitemap)

* [Tech Docs](https://docs.paloaltonetworks.com/)

* [Unit 42](https://unit42.paloaltonetworks.com/)

* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)

* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy)

* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center)

* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use)

* [Documents](https://www.paloaltonetworks.com/legal)

Copyright © 2026 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* EN  
  Select your language  
  ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg)

### Default Heading

Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg)  
Seekbar

![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg)  
![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg)  
Volume
![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)