[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # Blitz Malware: A Tale of Game Cheats and Code Repositories ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 18 min read Related Products [![Advanced DNS Security icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced DNS Security](https://unit42.paloaltonetworks.com/product-category/advanced-dns-security/ "Advanced DNS Security")[![Advanced Threat Prevention icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced Threat Prevention](https://unit42.paloaltonetworks.com/product-category/advanced-threat-prevention/ "Advanced Threat Prevention")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Cortex icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex](https://unit42.paloaltonetworks.com/product-category/cortex/ "Cortex")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Cortex XSIAM icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XSIAM](https://unit42.paloaltonetworks.com/product-category/cortex-xsiam/ "Cortex XSIAM")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Dominik Reichel](https://unit42.paloaltonetworks.com/author/dominik-reichel/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:June 6, 2025 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/) * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Bot](https://unit42.paloaltonetworks.com/tag/bot/) * [Cryptocurrency](https://unit42.paloaltonetworks.com/tag/cryptocurrency/) * [Cryptominers](https://unit42.paloaltonetworks.com/tag/cryptominers/) * [XMRig](https://unit42.paloaltonetworks.com/tag/xmrig/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/blitz-malware-2025/?pdf=download&lg=en&_wpnonce=edee969a51 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/blitz-malware-2025/?pdf=print&lg=en&_wpnonce=edee969a51 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Blitz%20Malware:%20A%20Tale%20of%20Game%20Cheats%20and%20Code%20Repositories&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fblitz-malware-2025%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fblitz-malware-2025%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fblitz-malware-2025%2F&title=Blitz%20Malware:%20A%20Tale%20of%20Game%20Cheats%20and%20Code%20Repositories "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fblitz-malware-2025%2F&text=Blitz%20Malware:%20A%20Tale%20of%20Game%20Cheats%20and%20Code%20Repositories "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fblitz-malware-2025%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Blitz%20Malware:%20A%20Tale%20of%20Game%20Cheats%20and%20Code%20Repositories%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fblitz-malware-2025%2F "Share in Mastodon") ## Executive Summary In 2024, we discovered new Windows-based malware called Blitz. This article provides an in-depth analysis of the malware, examines its distribution and reviews Blitz malware's command and control (C2) infrastructure. We found a new version of Blitz in early 2025, which indicates this malware has been in active development. The most recent version of Blitz was spread through backdoored game cheats. Blitz malware consists of two stages: a downloader and a bot payload. The developer of Blitz has abused the artificial intelligence (AI) code repository Hugging Face Spaces to host files and components of its C2 infrastructure. Our analysis also uncovered a Monero cryptocurrency miner as follow-up malware. The malware developer created a social media presence to promote the distribution of these backdoored game cheats. By early May 2025, the author announced their departure, indicating they might have abandoned Blitz malware. Hugging Face has locked the user account associated with this malware. It has also taken precautions to block the blob ID of the Blitz bot file to prevent it from being added in the future. Palo Alto Networks customers are better protected from the threats discussed in this article through the following products and services: * [Advanced WildFire](https://docs.paloaltonetworks.com/wildfire) * [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering/administration) and [Advanced DNS Security](https://docs.paloaltonetworks.com/dns-security) * [Advanced Threat Prevention](https://docs.paloaltonetworks.com/advanced-threat-prevention/administration) * Cortex [XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) and [XSIAM](https://docs-cortex.paloaltonetworks.com/p/XSIAM) If you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html). | **Related Unit 42 Topics** | [**Cryptocurrency**](https://unit42.paloaltonetworks.com/tag/cryptocurrency/), **[Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/)** | |----------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------| ## What Is Blitz? Blitz is Windows-based malware that consists of two stages: * Stage one is the Blitz downloader * Stage two is the Blitz bot The Blitz bot allows an attacker to control an infected Windows host. Blitz bot performs information-stealing functions like keylogging and screenshot captures. Blitz bot also has a denial-of-service (DoS) function against web servers. Blitz has been distributed in two campaigns. The first campaign spread Blitz through software packages pretending to be cracked installers for legitimate programs. The latest version of Blitz from the second campaign was distributed through game cheat packages named Elysium\_CrackBy@sw1zzx\_dev.zip and Nerest\_CrackBy@sw1zzx\_dev.zip. These ZIP archives contain backdoored Windows executable (EXE) files. Figure 1 shows one of these backdoored game cheats opened on a Windows host. ![Screenshot of a computer screen showing a file manager with a folder named "Downloads" and a selected text file named "Newest\_CrackBy @wizz.txt." A command line tool with executable script code is visible on the right side of the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-680342-142254-1.png) Figure 1. One of the backdoored game cheats running on a Windows host. Running the Windows EXE file from the game cheat package retrieves the Blitz downloader behind the scenes. The Blitz downloader retrieves and installs the Blitz bot in the background. An overview of this most recent Blitz infection chain is shown below in Figure 2. ![Flowchart showing the process of a game cheat execution. A ZIP archive is converted into a backdoored EXE file, which retrieves Blitz downloader. The Blitz downloader then retrieves and runs Blitz bot.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-683948-142254-2.png) Figure 2. Most recent Blitz infection chain. For these infections, Blitz malware abuses Hugging Face Spaces, a code repository specializing in AI applications. Hugging Face's platform for sharing applications is named Spaces. Both the Blitz downloader and the Blitz bot contact a Hugging Face Space during an infection to retrieve malware and receive C2 data. This research article will review the downloader and bot components but let's first look at how these backdoored game cheats are distributed. The person behind Blitz malware appears to be a Russian speaker who uses the moniker sw1zzx on social media platforms. This malware operator is likely the developer of Blitz. For the initial infection vector, sw1zzx has used Telegram to distribute these backdoored game cheats. ## Initial Infection Vector In early 2025, the malware operator sw1zzx began distributing Blitz through backdoored game cheats using a Telegram channel. ### **Telegram Channel** On Feb. 27, 2025, sw1zzx created a Telegram channel named @sw1zzx\_dev to distribute Blitz. The channel was intended to appeal to users of game cheats for the popular mobile multiplayer game [Standoff 2,](https://play.google.com/store/apps/details?id=com.axlebolt.standoff2) which had over 100 million downloads by April 2025. Figure 3 shows the first posts by the malware operator after the Telegram channel's creation. ![Screenshot of a Telegram channel named "sw1zz community" showing a post with a video attachment. The post invites members to join a server and refers to skin downloads. Below the video, there is engagement with numerous likes, comments, and shares, displaying the interactive nature of the channel. Icons for various reactions are also visible beneath the post.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-694726-142254-3.png) Figure 3. The first messages in the malware operator's Telegram channel. In this Telegram channel, the malware operator posted updates about the game cheats in Cyrillic characters and advertised them in videos. Figure 4 shows a screenshot of the posted cheats that were available for download to both channel subscribers and viewers. ![Screenshot collage of Telegram channel featuring multimedia elements and text in Cyrillic characters. There are visible icons for upvoting, downvoting, and commenting alongside various discussions related to software and updates. The red boxes highlight the advertised game cheat ZIP links.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-700895-142254-4.png) Figure 4. Downloadable backdoored game cheats advertised in the malware operator's Telegram channel. The ZIP archives named Nerest\_CrackBy@sw1zzx\_dev.zip and Elysium\_CrackBy@sw1zzx\_dev.zip contain the backdoored cheats along with the real cheats. These were linked to an external file-sharing site. Both cheats are for the game Standoff 2. They primarily differ in which real game cheats they use and the publication time in the Telegram channel. The first backdoored cheat Nerest\_CrackBy@sw1zzx\_dev.zip was published on March 8, 2025, and it was later superseded by the cheat Elysium\_CrackBy@sw1zzx\_dev.zip on April 11, 2025. A third game cheat archive named elysium\_android\_cracked.zip was directly uploaded to the channel on March 26, 2025, by the malware operator. The following section describes the latest versions of two cheats hosted on the external website. ### **Backdoored Game Cheats** As the filenames Nerest\_CrackBy@sw1zzx\_dev.zip and Elysium\_CrackBy@sw1zzx\_dev.zip indicate, the archives are intended to lure victims into downloading what they believe are just cracked versions of commercial cheats. We have found two other Telegram channels, @nerestpc and @elysiumcheat, that offer these commercial cheats. The cheats are designed to run with the game Standoff 2 on the Windows Android emulator [BlueStacks](https://www.bluestacks.com). It is unclear whether the Blitz operator cracked the commercial cheats or obtained them legitimately before backdooring them. #### Backdoored NerestPC Cheat Figure 5 shows the contents of the [archive](https://www.virustotal.com/gui/file/6791562bce76e5b9a49849f36b526e2ba58c2feb22cbd178366c4a1060601c03) Nerest\_CrackBy@sw1zzx\_dev.zip. ![Screenshot collage of the backdoored cheat in a computer folder as an EXE file, pointing to another folder with the actual cheat file named "cheat.bin," highlighted in red.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-711721-142254-5.png) Figure 5. File contents of Nerest\_CrackBy@sw1zzx\_dev.zip. The [backdoored cheat](https://www.virustotal.com/gui/file/a2e9b708c7352205b62c2609d1fe43a034f7eb498daf116fb1f85ba2fb01b08b) Nerest\_CrackBy@sw1zzx\_dev.exe downloads the malware's next stage and loads the actual cheat (cheat\_bin). The tools directory contains the actual cheat, along with multiple other legitimate files required to run it. The backdoored cheat is a console application that has a compilation timestamp of March 8, 2025, 7:43 p.m. (UTC). Executing the cheat changes the code page of the console windows to UTF-8 with the command chcp 65001 \> nul. This prepares for the ASCII characters it writes later to the console screen. The cheat then decrypts various XOR-encrypted API function strings, each with its own 1-byte decryption key. It dynamically resolves these functions and uses them to write the cheat logo to the console window as shown in Figure 6. ![A screenshot of a computer window displaying "Nerest V3 in ASCII art with the error message Failed with code: 137.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-714299-142254-6.png) Figure 6. Backdoored Nerest\_CrackBy@sw1zzx\_dev.exe cheat console window when run in a VM. The backdoored cheat uses an anti-sandbox check before downloading the malware's next stage. Figure 6 shows the fake error (\[ERR\] Failed with code: 137) that is displayed when the check confirms it's running within a virtual machine (VM). The malware author tries to evade suspicion by using the error message in Figure 6 to pretend that something went wrong during execution rather than immediately quitting the program. After displaying this error, the backdoored cheat does not retrieve Blitz malware, and the program terminates. Figure 7 shows the anti-sandbox check measuring the time required to execute 1,000,000 loop iterations. Simultaneously, it also tracks the number of times a secondary thread executes a floating-point instruction (FYL2XP1). ![Screenshot collage showcasing a code editor with two sections of C programming code highlighted. The left section is labeled 'Main thread with CPUID loop' and has assembly language instructions. The right section is labeled 'Second thread with floating point loop' and includes both C and assembly code. An arrow points from the main thread section to the floating point code in the second thread.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-717200-142254-7.png) Figure 7. Decompiled anti-sandbox procedure in backdoored Nerest\_CrackBy@sw1zzx\_dev.exe cheat as shown by [IDA Pro](https://hex-rays.com/ida-pro). The main thread employs the CPUID instruction for [busy-waiting](https://en.wikipedia.org/wiki/Busy_waiting) and synchronization, while the secondary thread repeatedly executes the floating-point instruction. We believe the program uses this method to detect inconsistencies in execution time, which would indicate an analysis environment like a sandbox or virtual machine. By incrementing the global\_count variable shown in Figure 7 with each execution of the floating-point operation, the secondary thread contributes to a final calculation. Finally, it evaluates whether the resultant value is greater than 5.0, serving as a threshold for detecting possible sandbox environments. Telegram posts from the malware operator shown in Figure 8 state an intent to fix the fake error code 137, apparently due to complaints from its users. ![Telegram screenshot collage conversation with multiple messages discussing an error 137 and its impact, highlighted by red boxes around specific texts, with English translations provided on the side. First translation: "In the next days, I want to fix error 137." Second translation: "Fixed error 137, which bothered many."](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-720224-142254-8.png) Figure 8. Telegram operator posts about fake error code 137 from the malware operator. If the environment passes the anti-sandbox check, the backdoored game cheat downloads the Blitz downloader. For this, the backdoored game cheat runs the PowerShell [one-liner](https://learn.microsoft.com/en-us/powershell/scripting/learn/ps101/04-pipelines?view=powershell-7.5#one-liners) shown in Figure 9 using the Windows [system](https://learn.microsoft.com/en-us/cpp/c-language/system-function) function. ![Screenshot of a PowerShell script editing window with code written for web scraping using Internet Explorer. The code includes URL parameters and is focused on retrieving data from Pastebin links.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-723309-142254-9.png) Figure 9. PowerShell one-liner to download the next malware stage as shown by [Visual Studio Code](https://code.visualstudio.com/). The PowerShell code checks for the file ieapfltr.dll in the directory %localappdata%\\Microsoft\\Internet Explorer and compares its SHA256 hash with one it retrieves from pastebin\[.\]com/raw/FSziK5eW. If the file does not exist or the hashes do not match, it downloads a file from pastebin\[.\]com/raw/RzLEd17Z that redirects to paste\[.\]rs/ABNe6 and saves it as ieapfltr.dll. Figure 10 shows the URL requests and their returned content. ![Screenshot showing the SHA-256 hash of Blitz downloader, with a highlighted URL leading to a pastebin site.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-726219-142254-10.png) Figure 10. URL requests and returned content generated by the PowerShell one-liner. After downloading and storing the Blitz downloader as %localappdata%\\Microsoft\\Internet Explorer\\ieapfltr.dll, the backdoored cheat creates a [logon script](https://attack.mitre.org/techniques/T1037/001/) entry in the Windows registry for persistence at HKCU\\Environment named UserInitMprLogonScript, as shown in Figure 11. ![Screenshot of Windows Registry Editor showing entries under HKEY\_CLASSES\_ROOT and HKEY\_CURRENT\_USER paths with the Environment folder selected.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-729840-142254-11.png) Figure 11. Windows registry logon script persistence entry for Blitz first-stage downloader. The backdoored cheat does not explicitly start the Blitz downloader. Instead, the Blitz downloader initially runs when the victim logs in again after logging out or a reboot. This is a more stealthy approach than directly executing the malware immediately after dropping it. Finally, the backdoored cheat shows the cheat's drop-down menu and then continues to run the actual cheating routines, depending on the option chosen. #### Backdoored Elysium Cheat The other [backdoored cheat](https://www.virustotal.com/gui/file/99598079794e4ff65a641828e1403b75362a7f732db4c938b9ded25f789d1793) [contained in](https://www.virustotal.com/gui/file/5225e2bd11a1ca827ab7589fecc5c67478a6a2f7f370b79e5805cd7f18dadf40) Elysium\_CrackBy@sw1zzx\_dev.zip named Elysium\_CrackBy@sw1zzx\_dev.exe has a compilation timestamp of April 12, 2025, 8:36 a.m. (UTC) and is very similar in functionality to the backdoored NerestPC cheat. The backdoored Elysium cheat is essentially another variant of the backdoor used for the NerestPC cheat with updated functionality, more anti-sandbox checks and code that executes the real Elysium cheat. Figure 12 shows the archive's contents. ![Screenshot collage. On the left is a computer folder window with the backdoored cheat EXE highlighted in a red box. A red arrow points to a second window containing various files including executable and DLL files, notably highlighting "libcheat.so" identified as the actual cheat file.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-732675-142254-12.png) Figure 12. File contents of Elysium\_CrackBy@sw1zzx\_dev.zip. When executed, Elysium\_CrackBy@sw1zzx\_dev.exe opens the malware operator's Telegram channel t\[.\]me/sw1zzx\_dev with the default web browser. Another difference from the backdoored NerestPC cheat's behavior is that the Elysium cheat executes more anti-sandbox checks, as shown in the decompiled anti-sandbox routines in Figure 13. ![Image showing three highlighted sections of programming code related to system checks in a computer environment. The first section checks multiple items. A red arrow points to the second window which contains the code for the checks for screen resolution, and the third checks for the presence of ANY.RUN device drivers. Each section is indicated with a red arrow and label.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-735236-142254-13.png) Figure 13. Decompiled anti-sandbox procedures in backdoored Elysium\_CrackBy@sw1zzx\_dev.exe cheat as shown by [IDA Pro](https://hex-rays.com/ida-pro). These anti-sandbox procedures cause the cheat to terminate if it detects one of the following conditions in its environment: * The number of processors is fewer than four * The screen resolution matches specific low values (e.g., 1024x768, 800x600 or 640x480) * The [ANY.RUN](https://any.run/) device driver \\\\?\\\\A3E64E55\_fl exists * [Known sandbox and virtual environment](https://evasions.checkpoint.com/src/Evasions/techniques/registry.html) registry values/keys exist Figure 14 shows the same fake error code 137 as the NerestPC cheat displayed when a condition of the sandbox checks is met. ![Text on a computer screen showing a program named 'Elysium Cheat v0.33.1 CRACKED BY @Swlzzx\_dev' has encountered an error with code 137. Elysium is displayed in ASCII art at the top.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-738828-142254-14.png) Figure 14. Error code in the backdoored Elysium\_CrackBy@sw1zzx\_dev.exe cheat console window if a sandbox or VM environment is found. Next, the backdoored cheat retrieves the Blitz downloader using the same PowerShell one-liner as the backdoored NerestPC cheat shown earlier, in Figure 9. The backdoored Elysium cheat creates the same persistence entry in the Windows registry as the backdoored NerestPC cheat shown earlier in Figure 11, but it also creates a backup persistence method in case this fails. The backdoored cheat creates an additional Windows registry entry at HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run named EdgeUpdatershown in Figure 15. ![Screenshot of the Registry Editor window showing the Run folder under HKEY\_CURRENT\_USER\\Software\\Microsoft\\Windows\\CurrentVersion, listing registry entries related to startup programs.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-741475-142254-15.png) Figure 15. Windows registry Run persistence entry for Blitz first-stage downloader. The remaining functionality of the backdoored Elysium cheat is identical to the backdoored NerestPC cheat, except for the actual cheat procedures, as each is using a different commercial cheat program. When the victim reboots their system, the next stage (ieapfltr.dll) executes after they log in. ## Technical Analysis of Blitz Malware As previously noted, Blitz malware consists of two stages: the Blitz downloader and the Blitz bot. Both stages of Blitz malware use a [REST API](https://www.redhat.com/en/topics/api/what-is-a-rest-api) for C2 communications. This REST API is built with the [FastAPI](https://fastapi.tiangolo.com) framework and uses a Hugging Face Space. The Space also hosts the Blitz bot and an XMRig cryptocurrency miner that we have seen as follow-up malware. ### **Blitz Downloader** The [Blitz downloader](https://www.virustotal.com/gui/file/0e80fe5636336b70b1775e94aaa219e6aa27fcf700f90f8a5dd73a22c898d646) ieapfltr.dll has a compilation timestamp of April 12, 2025, 8:40 a.m. (UTC) and a single exported function Run. When the persistence method executes this function, the downloader decrypts a list of API function strings and dynamically resolves them. It uses these functions for subsequent procedures. Next, it performs the same anti-sandbox checks as the backdoored Elysium cheat noted earlier in Figure 13. Before trying to download the bot payload, the Blitz downloader checks the system's internet connectivity. If it detects no internet connection, it sleeps for a few seconds before checking again. The Blitz downloader will continue checking for internet connectivity in an infinite loop until an internet connection is detected. When the downloader detects an internet connection, it retrieves the bot payload from a Hugging Face Space. It uses an HTTP GET request for the URL hxxps\[:\]//e445a00fffe335d6dac0ac0fe0a5accc-9591beae439b860-b5c7747.hf\[.\]space/6E6D73. This endpoint returns the bot payload from the Hugging Face Space. Finally, the Blitz downloader checks whether the Windows application RuntimeBroker.exe is running, so it can inject the downloaded Blitz bot payload into the process. If RuntimeBroker.exe is not running, the Blitz downloader starts the application and injects the Blitz bot payload into the running process. ### **Blitz Bot** The [Blitz bot payload](https://www.virustotal.com/gui/file/ae2f4c49f73f6d88b193a46cd22551bb31183ae6ee79d84be010d6acf9f2ee57) has a compilation time of April 9, 2025, 9:52 a.m. (UTC). This malware uses "blitz" in several of its function names, which is where we get its name. Blitz bot implements code from the open-source tool [curl](https://github.com/curl/curl-for-win) into its own codebase, and the bot uses this curl capability for almost all of its network functionality. Blitz bot's exported functions have intact function names, providing insights into its functionality. Figure 16 shows the bot's functions exposed using IDA Pro. ![Image displaying a long list of function names with corresponding text segments and start addresses in a software code environment.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-744080-142254-16.png) Figure 16. Blitz bot's exposed function names as shown by [IDA Pro](https://hex-rays.com/ida-pro). As the function names in Figure 16 show, Blitz bot has the following functionality: * Keylogging * Taking screenshots * Downloading/uploading files * Injecting code Each time one of these functions is executed, Blitz bot decrypts a list of API function strings to dynamically resolve them for subsequent usage, much like the Blitz downloader does. Then, Blitz bot also performs the same anti-sandbox checks as the downloader and the backdoored Elysium cheat, noted earlier in Figure 13. After creating a mutex 7611646b02ffd5de6cb3f41d0721f2ba, Blitz bot retrieves the following system information: * Hardware profile globally unique identifier (GUID) string * Current work directory * Username Blitz bot encodes the current work directory value as a Base64 string and converts the victim's Windows user account name to a hexadecimal string. The bot registers this information from an infected host with its C2 infrastructure by making an HTTP POST request to hxxps\[:\]//e445a00fffe335d6dac0ac0fe0a5accc-9591beae439b860-b5c7747.hf\[.\]space/6174727A that forwarded to hxxp\[:\]//176.65.137\[.\]44/6174727A. Blitz bot sends the collected victim data to this endpoint in the format shown in Figure 17. ![Screenshot of a computer terminal displaying an HTTP POST request with JSON content including authentication details and server response headers.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-747050-142254-17.png) Figure 17. Example of an HTTP POST request and response when Blitz bot registers an infected Windows host. As noted in Figure 17, the hardware profile GUID is labeled auth, the Windows account username is labeled name, and the current working directory is labeled cwd. When successful, the C2 server responds by sending back the same hardware profile GUID, which the bot uses in subsequent communications with the C2 infrastructure. Next, the bot checks for any operational issues, such as the registration process failing or the malware operator commanding a manual restart from their control panel by sending an HTTP GET request to hxxps\[:\]//e445a00fffe335d6dac0ac0fe0a5accc-9591beae439b860-b5c7747.hf\[.\]space/67726C64/*\[HardwareProfileGUID\]*. If the C2 server responds with false, no restart is needed. If it responds with true, Blitz bot restarts itself by retrieving the value from the logon script persistence entry (shown in Figure 11) and running it. Afterwards, Blitz bot starts its keylogging function. The keylogging function constantly writes the logged keystrokes, program name and log time into a file %temp%\\RestartManager.log. Blitz bot also downloads an [XMRig cryptocurrency miner](https://www.virustotal.com/gui/file/47ce55095e1f1f97307782dc4903934f66beec3476a45d85e33e48d63e1f2e15) to the victim's system and runs it. However, before retrieving the miner, Blitz bot checks if the infected host is already running an instance of the miner. It does so by checking for the existence of a mutex 9bdcf5f16cb8331241b2997ef88d2a67. If this doesn't exist, it downloads the miner by sending a request to hxxps\[:\]//e445a00fffe335d6dac0ac0fe0a5accc-9591beae439b860-b5c7747.hf\[.\]space/6E6D72. This C2 endpoint returns the Monero (XMR) cryptocurrency miner binary, which the bot injects into explorer.exe. Blitz bot receives commands from the C2 server through periodic HTTP GET requests to hxxps://e445a00fffe335d6dac0ac0fe0a5accc-9591beae439b860-b5c7747.hf\[.\]space/6774/*\[HardwareProfileGUID\]*. Table 1 shows the commands implemented by Blitz bot. |---------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Command** | **Purpose** | | keydump | Upload and then delete the keylogger file %temp%\\RestartManager.log | | screenshot | Create a screenshot (PNG) and store it under %temp%\\*\[RandomName\]* Upload and then delete the file | | cd | Expand the environment-variable strings with the one followed after the command cd and set it as the current directory | | strss | Do an HTTP GET request for a specified URL for a specific number of times (DDoS) | | *\[Unknown\]* | Run a cmd.exe command and send the result via an HTTP POST and the data template {"output": *\[Base64EncodedCmdResult\]* , "cwd": *\[Base64EncodedCurrentWorkDirectory\]* } to the C2 | Table 1. Blitz bot commands. ### **Hugging Face Abuse** As mentioned, Blitz abuses a Hugging Face Space as part of its C2 architecture and for hosting the Blitz bot and XMR cryptocurrency miner payloads. The malware operator created two Spaces, but only one was running in late April 2025. Figure 18 shows a screenshot of the malware operator's Hugging Face account activity as of April 2025. ![Screenshot of a Hugging Face user profile with username displayed and sections for Models, Datasets, and Spaces highlighted in purple. The profile contains a user profile picture, the option to follow, their interests, and other information.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-750863-142254-18.png) Figure 18. Blitz malware operator's Hugging Face account activity in April 2025. The Blitz malware operator developed the C2 communications as a REST API using the Python FastAPI framework. Hugging Face provides a [built-in solution](https://huggingface.co/blog/HemanthSai7/deploy-applications-on-huggingface-spaces) for hosting a FastAPI application. The malware operator abused this option to host the C2 API to communicate with Windows hosts infected with Blitz bot. Figure 19 shows the C2 files along with the payloads hosted on the running Space. ![A screenshot of a Hugging Face Spaces repository showing various files, including "XMRig miner," "Blitz bot," and several marked as C2 files.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-754435-142254-19.png) Figure 19. Blitz' C2 and payload files hosted in Hugging Face Space. Table 2 shows a description of each file. |----------------|----------------------------------------------------------------------------| | **Filename** | **Description** | | .gitattributes | Git attributes file describing various file types and bot payload 64796C71 | | 64796C70.bin | RC4 encrypted XMRig miner payload (Windows DLL) | | 64796C71 | Blitz bot file (Windows DLL) | | Dockerfile | Docker configuration file | | README.md | Standard README file | | data.py | Contains classes to organize victim data and attacker commands | Table 2. Blitz C2 and payload file descriptions. The C2 server API endpoints can be found in main.py where the FastAPI application is implemented that the first-stage downloader and bot communicate with. Figure 20 shows an excerpt of the file entity.py that contains the class Entity. When instantiated, this class represents itself as a bot victim. The C2 uses this class to manage, process and synchronize events through the commands sent from the C2 admin panel. When Blitz infects a victim, it sends a request to hxxps://e445a00fffe335d6dac0ac0fe0a5accc-9591beae439b860-b5c7747.hf\[.\]space/6174727A as previously mentioned. The endpoint then instantiates an object of this Entity class with the collected user information. ![Screenshot of a Python script showing a class definition for an entity with attributes like name, path, and authentication token. The script includes methods for initializing and updating the entity, written using the Asyncio library.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-757989-142254-20.png) Figure 20. Blitz C2 class representing a bot for processing commands. Figure 21 shows an excerpt of the main C2 application in main.py. This file implements the C2 endpoints used for communication between the bots and the C2 admin panel. ![Screenshot of Python code in a text editor related to web development using the FastAPI framework. The code includes functions for API endpoint implementations.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-760596-142254-21.png) Figure 21. Blitz C2 main application with the API endpoint implementations. The first two endpoints /6E6D72 and /6E6D73 return the XMRig cryptocurrency miner and the bot payload upon request. While we can confirm C2 traffic to 176.65.137\[.\]44, like the example shown in Figure 15, we did not find Blitz bot's administration panel. Blitz bot's C2 traffic shows a direct correlation between various C2 API endpoints on the Hugging Face Space with the external C2 server at 176.65.137\[.\]44. This external C2 server might also host the administration panel that commands the bots. ## Victim Distribution Through one of the C2 API endpoints, we could retrieve the full list of all registered bot infections. In late April, Blitz had 289 registered infections in 26 countries. Figure 22 shows the distribution of victims in the top four affected countries. ![Bar chart showing the frequency of occurrences with various entities labeled on the horizontal axis by country, with the most instances in Russia followed by Ukraine and Belarus.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-763463-142254-22.png) Figure 22. Blitz bot infection distribution by top four countries Russia accounts for the highest number of infected systems, followed by Ukraine, Belarus and Kazakhstan. There was also a smaller number of infected systems in Europe, Asia, North Africa and North America. ## Previous Blitz Version We initially discovered Blitz in late 2024 when the operator used an earlier version of this malware. This earlier version also abused a Hugging Face Space for its C2 and to host the bot payload. This version did not host a cryptocurrency coin miner on the Space, only the bot payload. Figure 23 shows the C2 and bot payloads hosted in the Space at hxxps\[:\]//huggingface\[.\]co/spaces/swizxx/blitz.net. ![A screenshot of the Hugging Face Spaces repository interface, displaying several files including 'README.md', 'bot.py', and 'worm.py.' These are highlighted as the C2 files, the Blitz bot, and a fourth C2 file.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-766707-142254-23.png) Figure 23. Previous version of Blitz C2 and payload file hosted in a previous Hugging Face Space. Figure 24 shows excerpts from the main.py in Figure 23, which contains the C2 endpoints. Figure 24 also shows excerpts from bot.py (named entity.py in the later version of Blitz bot), which contains the victim bot class. ![Collage of two screenshots of Python code. On the left is a file named 'main.py', featuring functions. On the right is the bot.py file.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-769378-142254-24.png) Figure 24. Excerpts from a previous version of Blitz C2 files main.py and bot.py as shown by [Visual Studio Code](https://code.visualstudio.com/). As noted in Figure 24, the operator did not obfuscate the endpoint and class in the previous version, unlike the current version. The previous version of Blitz also had a self-described worm function it used to spread through Discord channels. Figure 25 shows an excerpt of the file worm.py that indicates the malware operator had spread Blitz through Discord channels. ![A screenshot showing a section of Python code related to accessing Discord APIs, specifically focusing on fetching user relationships and sending messages through a bot. The code is displayed in a dark-themed code editor.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-772137-142254-25.png) Figure 25. Excerpts from previous version of Blitz C2 file worm.py as shown by [Visual Studio Code](https://code.visualstudio.com/). To communicate with the C2 infrastructure, the malware operator used the Hugging Face URL swizxx-blitz-net.hf\[.\]space. This version of Blitz was often distributed using trojanized installers for legitimate software. We have included a few example hashes of this older version in the Indicators of Compromise section. The [VirusTotal entry for swizxx-blitz-net.hf\[.\]space](https://www.virustotal.com/gui/domain/swizxx-blitz-net.hf.space/relations) contains a more comprehensive list of sample hashes. ## The End? After we released [timely threat intelligence](https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2025-04-25-IOCs-for-Blitz-malware.txt) information about Blitz at the end of April 2025, the malware operator posted an update in their Telegram channel on May 2 as shown in Figure 26. ![Screenshot of the Telegram channel for the sw1zzx community, displaying a conversation thread in Cyrillic characters. The user interface elements like likes, comments, and retweets are visible.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-774720-142254-26.png) Figure 26. Goodbye statement from the malware operator in their Telegram channel. The translation of the first post ([Google Translate](https://translate.google.com)) is as follows: *"Recently, I found out that the Elysium cheat had a Trojan that seriously worsened the PC's security. Some people also reported the possible presence of a miner. Considering that I can't leave all this without attention, I made a program that will clean the PC from these things like RAT/miner, and return the system to a normal state. If you have a Trojan, the console will have a yellow inscription, otherwise green.* *Upd: If someone gave software from this channel to friends, please tell them about it."* The malware operator claimed that any malware associated with the game cheats were spread through the original Elysium cheat rather than through the malware operator's packaged version of it. As an apparent goodwill gesture, the malware author developed a removal tool called cleaner.exe for channel members to remove Blitz from their systems. The second post translates to: *"I also want to inform you that I am leaving. The reason is that most of the cheats simply put the system at risk, and I do not want to continue doing this. In addition, my personal affairs, such as university sessions and other obligations, take up more and more time, and I cannot devote due attention to this area. I am really sorry to leave, but, unfortunately, this is the only right decision in the current situation.* *Thank you all"* This goodbye statement is likely a cover story to disguise the author's exit for other reasons. We analyzed the uploaded [removal tool](https://www.virustotal.com/gui/file/479839ba238821829c04a58b490301d92688135f062a9388f31345c2414ba1b6) cleaner.exe, and we can confirm it is indeed a working Blitz system cleaner. When executed, it removes the Blitz downloader ieapfltr.dll from the %localappdata%\\Microsoft\\Internet Explorer directory. It also tries to remove the registry persistence entries, which only works for the logon script method (see Figure 11), but not for the backup run method (Figure 15). The malware operator made a mistake, deleting the value EdgeUpdate from the registry key HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run rather than the value EdgeUpdater used by Blitz. This is a good reminder that programs created by malware authors often do not undergo rigorous quality testing. Unexpected behavior is likely to occur. Figure 27 shows the console window of the cleaner.exe tool run on a system that had been infected with Blitz. ![Screenshot of a computer program named "cleaner.exe" displaying messages about detecting and resolving a Trojan. It confirms the deletion of two malicious registry keys. A prompt to press any key to continue is visible at the bottom.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-780638-142254-27.png) Figure 27. Blitz removal tool provided by the malware operator. ## Conclusion This threat research article provided a detailed technical analysis of Blitz malware, which consists of two phases: the Blitz downloader and the Blitz bot. We also reviewed its distribution through backdoored game cheats, the abuse of Hugging Face to host C2 infrastructure, and the alleged quitting of the malware author. We highly recommend that people avoid downloading and using cracked software, including cracked game cheats. Engaging with such software not only violates legal and ethical standards, but this activity also exposes your system to significant security risks, including malware like Blitz. ### Palo Alto Networks Protections and Mitigations Palo Alto Networks customers are better protected from Blitz malware through [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire), with its different memory analysis features. [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering/administration) and [Advanced DNS Security](https://docs.paloaltonetworks.com/dns-security) identify known domains and URLs associated with this activity as malicious. The Next-Generation Firewall with the [Advanced Threat Prevention](https://docs.paloaltonetworks.com/advanced-threat-prevention/administration) security subscription can help block the attacks with best practices via the following Threat Prevention signature 87014. Cortex [XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) and [XSIAM](https://docs-cortex.paloaltonetworks.com/p/XSIAM) are designed to: * Prevent the execution of known malicious malware, and also prevent the execution of unknown malware using Behavioral Threat Protection and machine learning based on the Local Analysis module. * Detect post-exploit activity with behavioral analytics, through Cortex XDR Pro. If you think you may have been compromised or have an urgent matter, get in touch with the[Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call: * North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) * UK: +44.20.3743.3660 * Europe and Middle East: +31.20.299.3130 * Asia: +65.6983.8730 * Japan: +81.50.1790.0200 * Australia: +61.2.4062.7950 * India: 00080005045107 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org). ## Indicators of Compromise ### **SHA256 Hashes of Initial Backdoored NerestPC Game Cheats** * 14467edd617486a1a42c6dab287ec4ae21409a5dc8eb46d77b853427b67d16d6 * 1bd55796ec712a98cf30fac404b29fcb2cdaa355cb596edcc12d8fbd918b4138 * 2007069b32bb9a7f87298fe3c1a87443c21f187ab8465c5b4a1505f0e5c7b898 * 3099f41fb60e6f7fe5c1ae2141d4ac5d6f78c763f8cf3e68b2f154cf1a93faa7 * 3c77173659b8049b96ca08fc1b8c6122e8d0cfb365920028dc3d18e95cf32ab2 * 49b50765749c5e95c2010d790a691689b01e3f844636cd0d47e9fcfe346d7f40 * 541a94110a0f9f73722bb9dd7d05b8d1822ad496084d39a777cb39f3b092b6e1 * 54f254344ddff0763208c9739bd774d6f467009faa49d47468a8505c0e60dcfc * 6e8f4286ff63acda3a04fca3af7f9fc0962dc84ce889c0b51e5e5768043cbdad * 7dd49c0128aaec33d33a5897cee0b79e91c935f1530993e5c845e35e03d7ed78 * 84b654b32b478144d9eec3d923d7e387ec3aed83d7640c32a4d1f5e593750b80 * 931b5b2436c1d7f0ab9cfd6202dd18096d94317fdb7b492b63b16b730e2dff24 * 9994bb896944e667b1d1536fa64a235501817540bc6c338790d2f46d58b512c1 * a2e9b708c7352205b62c2609d1fe43a034f7eb498daf116fb1f85ba2fb01b08b * a8d65fcf7c0f46fd761191b959571a7cc52ae8d0860c79595a28ad2a56d50186 ### **SHA256 Hashes of Initial Backdoored Elysium Game Cheats** * 056fb07672dac83ef61c0b8b5bdc5e9f1776fc1d9c18ef6c3806e8fb545af78c * 1697daef685ce47578e44e2d19fa8e01c755de7fa297716b89e764ea046db1a0 * 1d9f12e356367c533ef756ab74d70fc537a580ec5ab904a4d583cebe0b89b4c4 * 23086a1d207166154a1b1451f3174f7c5f5299dd4385d83fd8199833ce34325f * 27d074c6cfb079be8d087a0efa0ec24994972d1033fb4c72a2b479790cb3bb31 * 2a279f345126141019fe836cea88f61e5b0449487a5a411bac53ad8273a3eac1 * 2e543a246f3390bd3f9102af275e4a57f2c057bedad10079f5d2402ad9bd6421 * 3064b4dd3e2c44c986f2c247a888c530b855db8fd7dd6d345cf187d873792fc7 * 35696115cfd23a6d128da932be20a784f2a82ff411eca99c2c33bb2d1bd4026c * 39d8a45108ab3ec5b56aca989f268c434957fa1dc160d0fe654cf0d5910bf4ce * 3aaaab12ad5cc2571bf935ab248419c535577220571f76f84a37db5623956da9 * 3f85d0c73ec6c8e45a24df14759f351aaf456d1eab3afbacc1d8ed95bb062a7b * 450e33d866848c10ed3493bb1edf0a95084b8d69b963fb0aa72ba8d27c3110ab * 46f11cbba1fea180d03b5ac2b68070cbbfa515131957db1d0551209220f7f045 * 4f8031cabbc1f5b7574dbde4a251f8cb15ea8b0f7c151bdbb301dd017fedc944 * 5ca0bc0b16b2107048b804936b8d52f90e3ba3a6bf7916732541cd1b3b6f962f * 5d30045ce82f6e2431d6fd4dccb3ffd565820617d92763993dbbf4ddb9dde938 * 67b3b8b8c63e2fa103143efc67536c0fe6a58f9e004e362c3df686951f59e2e0 * 688754743476df47e612190ef790105efab8c611a5b5e2cbecb3c6b764bb9dd7 * 7b4aa0351f8fb71f0e1ccedc6998fc06945f1a77c7fb15f3448eaa483190a111 * 7dc8f1ab3638fb64b809078856ac7500a1b8aa1bcf6bc74e88af59b7e3a31407 * 839b2b72fc672549e7daefc08d28e74768d0b2b2b12662b799f46340e8bccf80 * 83fc11bebb07f59cc86e2fd4c80936ecc6d1e0a21978ba1a9b09d3639f64844d * 84a1d2bfe9bba6387e3752978aec1c0871fecf7844e23b72e4d6a046f58f4692 * 995740e8cf0b6c44b1e3dbd1e983f3fdaa2dac6bd6db399efabd957794cf3954 * 99598079794e4ff65a641828e1403b75362a7f732db4c938b9ded25f789d1793 * 9a5b4a4770c6d26fcd06dd53fc68dc5ee739fd5ed52530e80b5dfd4314dcbc6d * 9c802ce1c678791b23a04027997d6cfa4ba1b2f0d54d9fb1051d870f05c2a746 * b1d7fb16f057318c1f0727a46df7ad755361311ba22eddd1f5d397ef0e648c42 * b3bfa58ca38918d97ead9a0f7f799b08fbc082f9f844ef765c3acda4711b2888 * b43451cb80a77e30b4db51b371ad410e22a8921cd015cb4362dcdecd7a0fadce * b8c37133dc58e4f46efcac7254dee28c6cca6c9627d0d6ab0741fbce370996c2 * bbaa7bdd67822be567c1ed749c1ea42322bb1b9bc06470977597c7bf385f5aad * c0309ce6f86c5e83d18422a045367f7f9148b8b013093113bf08de4a262c1ee7 * c3520f7fc3452106ce43f17ea7db90d72c7ffed28a0d9431c84900cfdc08cfa7 * c6161b8f85c15f2a88f1dcb5204161ce7c294aa408cba11dabf57a016d8d548f * d7d98f3427bf7fa0f936472e9abaedfc38ea3e1a83a6c3bddec55b177b70e743 * fa0d069156d4913607fed8321ff5f7f4758a51e9ece2d00ccade8cb2e40e3374 * 6a55b7b01a8f7001e0e654f5feddcd0561b3694bcd2a9f9ca3e5f5e33dbbfc11 * 8ed77eb6cd203e20b467d308bf7ee5213cbb2c055c4896b0af04e323bf67b887 * ce1940eb26f0609fc25aaecbf998d01f5a7d5420c91bfe5c4b710d057981850c ### **SHA256 Hashes of First-Stage Downloaders** * 0e80fe5636336b70b1775e94aaa219e6aa27fcf700f90f8a5dd73a22c898d646 * cacc1f36b3817e8b48fabbb4b4bd9d2f1949585c2f5170e3d2d04211861ef2ac * aa5cd0219e8a0bd2e7d6c073f611102d718387750198bff564c20ca7ebada309 * f3b7bbe1079974fd505abaadbcf4dc0517620592eacbbe5f314a76775dd760c2 * cdf192e92d14b9d7e1201c23621c4e0b8ee0673c192bdd734afd97519afef271 * 6441e7000713f96c7ae114ce62378556d01fa29d435a5be0f11a5e80be9a26ed * b1b1ce259fcf5127c3477e278c3696dc7d15db63b673fdcf75e1deb89a0f6fd1 * 5ef29d6d4f72e62e0d5a1d0b85eed70b729cd530c8cb2745c66a25f5b5c7299e * 5fc132b054099a1a65f377a3a22b003a6507107f3095371b44dbf5e098b02295 * b18e21e50f1c346c83c4cba933b6466ada22febaafa25c03ac01122a12164375 * a34a4a7c71de2d4ec4baf56fd143d27eeedebb785a2ba3e0740b92e62efd81ea * bedeafd3680cad581a619fb58aa4f57ed991c4a8dd94df46ef9cbd08a8dd6052 ### **SHA256 Hashes of Blitz Bot Payloads** * ae2f4c49f73f6d88b193a46cd22551bb31183ae6ee79d84be010d6acf9f2ee57 * 88e2d0d59a9751e4ce5223951f5a75b1731b1ee82d18705aba83ba4bd7e8e5c1 ### **SHA256 Hashes of XMRig Coin Miner** * 47ce55095e1f1f97307782dc4903934f66beec3476a45d85e33e48d63e1f2e15 ### **SHA256 Hashes of Previous Blitz Version Files** * abcc59ab11b6828ad76a4064d928b9d627a574848a5a6e060b22cb27cd11b015 * 7891bb5a4656469ada072f0081c5149251b9ad49dfcf64bdb02704edaa73548a * b795cbacd5bf60399a3885e69dc7b2cbc75e8ddae01cee15e3c9fe1a3f953aa9 * c53f86ca9dba6930087b564a9588ecd3a1073b8886bbca387484bef937fb1598 * 2abb14bdf0f7f159c90183679729361102f0b46e5207a36c3f292adf7d0b1dd3 * 1b80f8a985027aac004ef89caf9daa2ebbec7eece4ee442270e1d417092b88ef * 7d082878c654ffdea32f15e258aae09d5375932499411b61e3b9189a2c906504 ### **Mutex Names** * 7611646b02ffd5de6cb3f41d0721f2ba * 9bdcf5f16cb8331241b2997ef88d2a67 ### **Hugging Face Spaces** * huggingface\[.\]co/spaces/e445a00fffe335d6dac0ac0fe0a5accc/9591beae439b860a9cf93b26b2dc97e0 * huggingface\[.\]co/spaces/e445a00fffe335d6dac0ac0fe0a5accc/2c5dd233ee36705a817b323471be2fe5 * huggingface\[.\]co/spaces/swizxx/blitz.net ### **Hugging Face C2 Domains** * e445a00fffe335d6dac0ac0fe0a5accc-9591beae439b860-b5c7747.hf\[.\]space * swizxx-blitz-net.hf\[.\]space ### **Pastebin URLs** * pastebin\[.\]com/raw/FSziK5eW * pastebin\[.\]com/raw/RzLEd17Z ### **Paste URL** * paste\[.\]rs/ABNe6 ### **Catbox URLs** * files.catbox\[.\]moe/tmcbms.dll * files.catbox\[.\]moe/5byj86 ### **Telegram Channel of Malware Operator** * t\[.\]me/sw1zzx\_dev Back to top ### Tags * [Bot](https://unit42.paloaltonetworks.com/tag/bot/ "Bot") * [Cryptocurrency](https://unit42.paloaltonetworks.com/tag/cryptocurrency/ "Cryptocurrency") * [Cryptominers](https://unit42.paloaltonetworks.com/tag/cryptominers/ "Cryptominers") * [XMRig](https://unit42.paloaltonetworks.com/tag/xmrig/ "XMRig") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Lost in Resolution: Azure OpenAI's DNS Resolution Issue](https://unit42.paloaltonetworks.com/azure-openai-dns-resolution/ "Lost in Resolution: Azure OpenAI's DNS Resolution Issue") ### Table of Contents * ### Related Articles * [The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "article - table of contents") * [Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation](https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/ "article - table of contents") * [Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files](https://unit42.paloaltonetworks.com/gremlin-stealer-evolution/ "article - table of contents") ## Related Resources ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/) * [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API") * [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway") * [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)