[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/bookworm-to-stately-taurus/) * [Spanish (LATAM)](https://unit42.paloaltonetworks.com/es-la/bookworm-to-stately-taurus/) * [French](https://unit42.paloaltonetworks.com/fr/bookworm-to-stately-taurus/) * [Japanese](https://unit42.paloaltonetworks.com/ja/bookworm-to-stately-taurus/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/ "Threat Actor Groups") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # Bookworm to Stately Taurus Using the Unit 42 Attribution Framework ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 12 min read Related Products [![Advanced DNS Security icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced DNS Security](https://unit42.paloaltonetworks.com/product-category/advanced-dns-security/ "Advanced DNS Security")[![Advanced Threat Prevention icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced Threat Prevention](https://unit42.paloaltonetworks.com/product-category/advanced-threat-prevention/ "Advanced Threat Prevention")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Cortex icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex](https://unit42.paloaltonetworks.com/product-category/cortex/ "Cortex")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Cortex XSIAM icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XSIAM](https://unit42.paloaltonetworks.com/product-category/cortex-xsiam/ "Cortex XSIAM")[![Next-Generation Firewall icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Kyle Wilhoit](https://unit42.paloaltonetworks.com/author/kyle-wilhoit/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:September 24, 2025 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Bookworm](https://unit42.paloaltonetworks.com/tag/bookworm/) * [Stately Taurus](https://unit42.paloaltonetworks.com/tag/stately-taurus/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/bookworm-to-stately-taurus/?pdf=download&lg=en&_wpnonce=0e33cfdd78 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/bookworm-to-stately-taurus/?pdf=print&lg=en&_wpnonce=0e33cfdd78 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Bookworm%20to%20Stately%20Taurus%20Using%20the%20Unit%2042%20Attribution%20Framework&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fbookworm-to-stately-taurus%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fbookworm-to-stately-taurus%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fbookworm-to-stately-taurus%2F&title=Bookworm%20to%20Stately%20Taurus%20Using%20the%20Unit%2042%20Attribution%20Framework "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fbookworm-to-stately-taurus%2F&text=Bookworm%20to%20Stately%20Taurus%20Using%20the%20Unit%2042%20Attribution%20Framework "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fbookworm-to-stately-taurus%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Bookworm%20to%20Stately%20Taurus%20Using%20the%20Unit%2042%20Attribution%20Framework%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fbookworm-to-stately-taurus%2F "Share in Mastodon") ## Executive Summary In the complex landscape of threat intelligence and research, understanding the tools used by threat actors is just as critical as identifying the actors themselves. How do we link specific malware to its operators? We present a case study that demonstrates the process using the Unit 42 Attribution Framework to analyze well-known malware and its ties to a formally named threat group. We examine [Bookworm](https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/), a notable malware family used by [Stately Taurus](https://unit42.paloaltonetworks.com/tag/stately-taurus/), a Chinese advanced persistent threat (APT) group active since at least 2012. This group conducts cyberespionage campaigns targeting government and commercial entities across Europe and Asia. The case study illustrates how the Unit 42 Attribution Framework helps us dissect and confirm the operational link between this specific malware and its consistent usage by Stately Taurus. We provide a transparent look into the analytical process, illustrating how we moved from analyzing the malware's code to understanding the adversary's broader operations. We explore the methodologies we use to analyze Bookworm's characteristics and examine its use in Stately Taurus campaigns. We finally demonstrate how our structured framework enhances the precision and confidence in attributing not just activity, but the actor's tradecraft. This deep dive highlights the iterative nature of attribution and how confirming malware family associations strengthens our overall intelligence picture. Palo Alto Networks customers are better protected from Bookworm malware through the following products: * [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) and [XSIAM](https://www.paloaltonetworks.com/resources/infographics/xsiam-product-tour) * [Cloud-Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) for the [Next-Generation Firewall](https://www.paloaltonetworks.com/network-security/next-generation-firewall), including [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire), [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention), [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering/administration) and [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) If you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html). | **Related Unit 42 Topics** | [**Stately Taurus**](https://unit42.paloaltonetworks.com/tag/stately-taurus/), **[Bookworm](https://unit42.paloaltonetworks.com/tag/bookworm/)** | |----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------| ## A Quick Look Back: The Unit 42 Attribution Framework Before we dive into the specifics of Bookworm and Stately Taurus, it's beneficial to briefly revisit the core tenets of the [Unit 42 Attribution Framework](https://unit42.paloaltonetworks.com/unit-42-attribution-framework/). We developed this framework to introduce a systematic, evidence-based approach to the often-complex world of threat actor attribution. It moves beyond subjective assessments, providing a rigorous methodology to connect observed malicious activity to specific groups or individuals. For the purpose of this case study, it's important to remember that our framework evaluates multiple dimensions of threat data including: * Analyzing tactics, techniques and procedures (TTPs) * Examining tooling and malware characteristics * Examining operational security (OPSEC) practices * Mapping network infrastructure * Analyzing victimology * Meticulously analyzing timelines We then assess each piece of evidence using the [Admiralty System](https://www.sans.org/blog/enhance-your-cyber-threat-intelligence-with-the-admiralty-system), which assigns scores for reliability and credibility, ensuring that we build our conclusions on a robust foundation. We track and store all this information and data in our attribution table, which helps calculate a cumulative score to determine attribution confidence. Additionally, the framework integrates the [Diamond Model of Intrusion Analysis](https://apps.dtic.mil/sti/citations/ADA586960) as a critical tool for mapping and correlating activities, particularly when building confidence to move from initial observations to definitive attribution claims. The model helps analysts organize raw data about an attack into four key categories: * Adversary: The attacker * Capability: The tools and techniques they used (like malware) * Infrastructure: The systems they used to launch the attack (like servers or IP addresses) * Victim: The target of the attack In essence, the framework allows us to accumulate and weigh diverse intelligence data, leading to high-confidence attribution and a deeper understanding of adversary operations --- precisely what we'll demonstrate with Bookworm. ## Understanding Bookworm: A Brief Profile To fully appreciate the links between the [Bookworm malware](https://unit42.paloaltonetworks.com/tag/bookworm/) family and Stately Taurus, it's essential to first establish a basic understanding of the Bookworm malware family itself. First observed in 2015, Bookworm functions primarily as an advanced remote access Trojan (RAT), granting its operators extensive control over compromised systems. Its capabilities typically include: * Executing arbitrary commands * Manipulating files (upload/download) * Exfiltrating data * Establishing persistent access Bookworm is known for its unique modular architecture, allowing its core functionality to be expanded by loading additional modules directly from its command-and-control (C2) server. This modularity makes static analysis more challenging, as the Leader module relies on other DLLs to provide specific functionality. What makes many of our analyzed Bookworm samples particularly noteworthy from an attribution standpoint are some of their distinct technical characteristics and observed operational patterns. For instance, our analysis has frequently uncovered specific program database (PDB) paths embedded within Bookworm samples. A notable example includes the path: * C:\\Users\\hack\\Documents\\WhiteFile\\LTDIS13n\\Release\\LTDIS13n.pdb Developers often inadvertently leave in these paths during compilation. They serve as attribution indicators, acting as unique fingerprints that can potentially link different malware variants or even different malware families developed by the same actor. We identified this specific PDB path in samples of ToneShell, another custom tool that has been associated with Stately Taurus. Bookworm samples exhibit various methods for C2 communication, often leveraging legitimate-looking domains or compromised infrastructure to blend in with network traffic. A technique observed in recent Bookworm variants, mirroring ToneShell, involves packaging shellcode as universally unique identifier (UUID) strings. The malware then decodes these ASCII or Base64-encoded UUIDs into binary data and executes via legitimate API functions. Initial Bookworm analysis from 2015 primarily noted DLL sideloading for payload execution. However, newer variants have adopted this UUID technique. While the source code for this UUID method is publicly available, its consistent application across Bookworm and ToneShell payloads offers another technical commonality that is important to pay attention to. Understanding these technical characteristics of Bookworm provides the baseline for the attribution analysis that follows, where we will directly link these features to the activities of Stately Taurus. ## The Link: Bookworm and Stately Taurus through the Framework's Lenses Having established Bookworm's technical blueprint, we can apply the Unit 42 Attribution Framework to demonstrate the operational ties between the malware family and Stately Taurus. Broadly speaking, we are performing attribution based on the following: * Threat actor TTPs, tooling and capabilities * OPSEC consistency * Network infrastructure overlaps * Victimology and targeting * Activity time frames We will examine each in greater detail in the following sections. ### Tactics, Techniques and Procedures (Diamond Model Alignment: Capability) Tracking threat actor TTPs is an important aspect of attribution. In this case, the modus operandi observed in Bookworm usage frequently aligns with Stately Taurus's well-documented TTPs. For instance, initial access often involves highly tailored spear-phishing campaigns using enticing decoy documents, a hallmark of Stately Taurus's approach. Post-compromise, Bookworm exhibits behaviors consistent with Stately Taurus's broader playbook, including establishing persistence as well as collecting and exfiltrating sensitive information. The group's focus on covert data collection and espionage is reflected directly in Bookworm's design and usage, particularly as seen in prior attack campaigns against a Southeast Asian government [using Bookworm](https://unit42.paloaltonetworks.com/attack-campaign-on-the-government-of-thailand-delivers-bookworm-trojan/). Mapping this activity to MITRE ATT\&CK techniques is a useful mechanism for tracking over time and can also be used during the attribution process. For example, attackers have delivered both Bookworm and ToneShell via spear phishing ([T0865](https://attack.mitre.org/techniques/T0865/)) and executed it via DLL sideloading ([T1574.001](https://attack.mitre.org/techniques/T1574/001/)). These techniques should be considered during attribution with a very low weight due to the likelihood of multiple different actors using the same techniques. ### Tooling and Capabilities (Diamond Model Alignment: Capability) Beyond Bookworm itself, the presence of other distinct tools within compromised environments reinforces the Stately Taurus link. ToneShell is a tool that Unit 42 and other researchers have observed Stately Taurus exclusively using (the Capability (Tools) entry in the attribution table below). We've also observed the use of publicly available tools like Impacket in Bookworm-related incidents. This mirrors Stately Taurus's known tendency to incorporate legitimate or open-source tools into their attack chains for lateral movement and reconnaissance (The Capability (Tools) entry in the attribution table). ### Operational Security (OPSEC) Consistency (Diamond Model Alignment: Adversary) Stately Taurus is advanced but exhibits certain OPSEC patterns that prove valuable for attribution. The previously shared PDB path (C:\\Users\\hack\\Documents\\WhiteFile\\LTDIS13n\\Release\\LTDIS13n.pdb) found in both Bookworm and ToneShell samples is a prime example of an OPSEC consistency (the Malware Artifact (unique) entry in the attribution table) finding that could be valuable for attribution. The discovery of these samples being compiled just eight weeks apart (ToneShell on Sep. 1, 2022, and Bookworm on Oct. 26, 2022) strongly suggests the involvement of the same developer. Such unique build artifacts and close compile times provide an internal fingerprint of the Stately Taurus development environment. ToneShell and Bookworm are both custom tools that share specific shellcode loading techniques, such as the aforementioned UUID method, which is another indicator of a shared development methodology. ### Network Infrastructure (Diamond Model Alignment: Infrastructure) One of the most robust elements of attribution lies in shared infrastructure. It's crucial to recognize that different types of infrastructure carry varying analytical weight. For instance, while an IPv4 address can provide a temporary link, its attributional value is generally lower compared to a typically more persistent URL or domain. IP addresses are commonly rotated quickly as part of an actor's operational security. This makes them more transient indicators from an attribution perspective. Domains, especially those consistently used, often require greater investment and planning. This makes them stronger, more stable markers for attribution purposes. Despite these nuances, our investigations revealed direct and significant overlaps in C2 infrastructure between Bookworm and ToneShell. For example, we observed specific IP addresses such as 103.27.202\[.\]68 and 103.27.202\[.\]87 resolving C2 domains for *both* Bookworm (e.g., update.fjke5oe\[.\]com, www.hbsanews\[.\]com) and ToneShell (e.g., www.uvfr4ep\[.\]com) (the Infrastructure (IPv4) entries in the attribution table). This shared infrastructure, particularly when involving custom tools known to be exclusive to Stately Taurus like ToneShell, demonstrates compelling evidence of a unified operational control. Also, we observed certain URL paths (e.g., /v11/2/windowsupdate/redir/v6-winsp1-wuredir) used by PUBLOAD samples (another Stately Taurus-associated malware) in Bookworm-related campaigns, indicating cross-tool infrastructure reuse (the Infrastructure (URL) entries in the attribution table). It's important to note that the URL path was meant to mimic a legitimate Windows Update URL, but they misspelled it, increasing its weight in infrastructure overlaps. ### Victimology and Targeting (Diamond Model Alignment: Victim) The victimology associated with Bookworm strongly aligns with Stately Taurus's targeting objectives. Our telemetry indicates that Bookworm has impacted governments in Southeast Asia and multiple organizations globally. This aligns with previous Stately Taurus campaigns, which have a well-documented history of focusing on government entities and critical infrastructure across Southeast Asia. Based on the overlaps observed in recent activity, we have now confidently associated previously unattributed attacks on governments and [organizations in Southeast Asia](https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/) to Stately Taurus, as far back as nine years ago. ### Timeline Analysis (Diamond Model Alignment: Adversary) The operational timelines of Bookworm campaigns fit within the known activity periods of Stately Taurus activity. We first observed Bookworm attacking targets in a Southeast Asian government in July 2015. The malware's evolution, including changes in how its shellcode loads additional modules, has allowed attackers to package it in different form factors, with variants observed from 2015-2021 and 2022. This deployment and adaptation of Bookworm, running in parallel with other Stately Taurus operations, showcases its long-term role in the actor's arsenal. It also points to a sustained, long-term commitment to its development and use by the group. ## Evidence Scoring and Confidence Level in the Attribution Table The collection and analysis of evidence, as detailed in the previous sections, forms the backbone of the Unit 42 Attribution Framework. However, merely listing evidence is insufficient. Its true value is unlocked through a structured assessment of its reliability and credibility through our attribution table, which is shown in Figure 1 below. This is precisely where the Admiralty System, as discussed [in our previous article](https://unit42.paloaltonetworks.com/unit-42-attribution-framework/), demonstrates a core component of the Unit 42 Attribution Framework. It provides a standardized method for evaluating each piece of data, allowing us to build a comprehensive picture of confidence. As a reminder, the Admiralty System assigns a two-character code to each evidentiary item: a letter (A-F) for **source reliability** and a number (1-6) for **information credibility**. * **Source reliability (A-F):** This assesses the trustworthiness of the source itself. An A denotes a completely reliable source with a proven history, while an F indicates an unreliable or unjudged source. Internal telemetry from Palo Alto Networks (PANW), for instance, typically starts with a high reliability score (e.g., A) due to its direct and controlled nature. Public research, depending on the reputation of the reporting entity and the depth of their analysis, might receive a C or B. This can be analyst adjusted based on preference. * **Information credibility (1-6):** This evaluates the truthfulness and consistency of the information provided. A 1 means the information is confirmed by other independent sources and is logical, whereas a 6 means its truth cannot be judged. Let's look at how the scores from our attribution table are interpreted when applying the Admiralty System to the analysis pertaining to Stately Taurus. Figure 1 below shows an example attribution table. ![Spreadsheet for Bookworm malware. showing various types of cybersecurity threats, categorized by domain model, type, source of attribution, value, analysis, overlap, supported sources, and manual availability. It includes columns for vectors, capability, infrastructure, and malware, with information on governmental organizations and public research. Some of the information is redacted.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/09/word-image-279225-158711-1.png) Figure 1. Bookworm attribution table. * **A5 (Victim - Organization)** : For the entry on the victim organization, the score of A5 indicates an A (completely reliable) source, which is our internal Palo Alto Networks telemetry. However, the information credibility is a 5 (improbable). This might seem counterintuitive. However, it reflects that while the source is impeccable, the specific *details* of an *ongoing, singular* victim engagement might be hard to fully confirm across all facets. It might also be a general observation that is highly probable but not yet fully confirmed by multiple, independent lines of evidence at the highest level. It establishes a strong lead based on trusted internal data but acknowledges room for further corroboration. * **A2 (Capability - Malware Artifact (unique))** : The shared PDB path (C:\\Users\\hack\\Documents\\WhiteFile\\LTDIS13n\\Release\\LTDIS13n.pdb) between Bookworm and ToneShell receives an A2. This signifies an A (completely reliable) internal source (PANW) and 2 (probably true) information. The consistency of this unique artifact across different malware samples, especially when paired with close compile times, makes the conclusion of a shared development environment highly probable. * **A4 (Infrastructure - IPv4):** For the IP addresses 103.27.202\[.\]68 and 103.27.202\[.\]87 resolving both Bookworm and ToneShell C2s, both receive an A4. This means an A (completely reliable) internal source (PANW), but the information is 4 (doubtfully true) in terms of its long-term persistence or exclusivity. This tells us that while internal Unit 42 data confirms the resolution, IP addresses are commonly rotated quickly as part of actor activity. Therefore, without additional corroborating evidence of their sustained or unique use, we often assign them a default credibility score of 4 (this can be changed based on valid analyst justification). It's still strong due to the reliable source but indicates a need for continued monitoring and fresh intelligence to maintain its relevance. * **C3 (Infrastructure - URL):** The URLs used by PUBLOAD samples associated with Stately Taurus, referenced by public research, score C3. This implies a C (fairly reliable) source (public research, like lab52.io or csirt-cti.net) and 3 (possibly true) information. Public reports are generally reliable but require Unit 42 validation and cross-referencing to elevate the credibility, hence "possibly true" rather than "probably true" without additional internal corroboration. * **A5 (Capability - Tools (Public)):** The observation that ToneShell and Bookworm payloads use UUIDs, leveraging publicly available source code, receives an A5. Again, an A (completely reliable) internal source. However, the information about the UUID *usage by these specific malware families* is 5 (improbable) to be unique or definitive enough on its own for strong attribution, as the underlying technique is public. This highlights the framework's nuance: a tool being public doesn't diminish source reliability, but it can affect the *credibility* of that specific tool as a *unique* attribution point. * **A5 (Capability - Tools (Public)):** Similarly, the Impacket sample seen in a Bookworm incident, also from an internal PANW source, gets an A5. While Impacket is a common tool, its consistent appearance in Stately Taurus's specific operational context is important, but its general availability makes it "improbable" as a standalone, high-credibility indicator without other corroborating evidence. The true strength of the Admiralty System, however, lies not in any single score, but in its cumulative effect and associated calculations in the attribution table. Individual pieces of evidence or data may carry varying levels of certainty. But it's the volume and consistent pattern of high-scoring evidence across multiple categories (i.e., TTPs, tooling, OPSEC, infrastructure, victimology) that allow us to confidently attribute Bookworm's usage to Stately Taurus. Using a proprietary formula in the attribution table that aggregates the weighted Admiralty scores from the attribution table, we calculate an overall confidence score for the attribution claim. This helps us create estimative language that is accurate and based on technical facts. Our confidence ranges are defined as follows: * **Low confidence:** 0-8 * **Moderate confidence:** 8-32 * **High confidence:** 32 + For this specific case study, the evidence presented in our attribution table yields a score of 58.4. This definitively places the attribution of Bookworm's operations to Stately Taurus within the high-confidence range. The presence of multiple A2, A4 and A5 scores, particularly when cross-referenced and corroborated by external C3 scores, builds a sufficient body of evidence. This systematic scoring process ensures transparency, reduces bias and provides a clear audit trail for our attribution conclusions, moving us beyond mere conjecture. ## Conclusion This case study on Bookworm and Stately Taurus demonstrates the power and precision of the Unit 42 Attribution Framework. We've traced how a systematic, evidence-based approach allowed us to move beyond mere observations to definitively link the Bookworm malware family to the operations of Stately Taurus. Through the analysis of: * Shared PDB paths * Consistent tooling (like ToneShell) * Overlapping infrastructure * Historical victimology in Southeast Asia * Synchronized timelines Each piece of evidence, scored with the Admiralty System, contributed to a high-confidence attribution of 58.4. This level of detailed and confirmed attribution is not merely an academic exercise. It carries profound implications for the broader cybersecurity research and threat intelligence community. By openly sharing our methodology and its practical application, we aim to: * **Improve collaboration and consistency:** Providing a common language and framework for analysts across different organizations, fostering more consistent and less ambiguous threat reporting. * **Enhance analytical rigor:** Offering a model for thorough, evidence-based analysis, elevating the overall quality and defensibility of attribution claims. * **Facilitate proactive research:** Enabling fellow researchers to build upon established links, focusing their efforts on deeper dives into actor capabilities, evolving TTPs, and emerging campaigns. * **Strengthen collective intelligence:** Contributing to a more accurate, unified and actionable global understanding of threat actor operations, benefiting all defenders. The enduring activity of Stately Taurus, coupled with the continued evolution of malware like Bookworm, underscores the necessity of continuous monitoring and a systematic attribution methodology. As adversaries adapt, so too must our intelligence gathering and analysis, and crucially, our ability to communicate these findings with clarity and confidence. ### Palo Alto Networks Protection and Mitigation Palo Alto Networks customers are better protected from Bookworm malware through the following products: * [Advanced WildFire](https://www.paloaltonetworks.com/products/secure-the-network/wildfire) cloud-delivered malware analysis service accurately identifies the known samples as malicious. * [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering/administration) and [Advanced DNS Security](https://docs.paloaltonetworks.com/dns-security) identify known URLs and domains associated with Bookworm activity as malicious * The [Next-Generation Firewall](https://docs.paloaltonetworks.com/ngfw) with the [Advanced Threat Prevention](https://docs.paloaltonetworks.com/advanced-threat-prevention/administration) security subscription can help block the attacks with best practices. Advanced Threat Prevention has an inbuilt machine learning-based detection that can detect exploits in real time. * [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) and [XSIAM](https://docs-cortex.paloaltonetworks.com/p/XSIAM) are designed to prevent the execution of known malware, and also prevent the execution of unknown malware using Behavioral Threat Protection and machine learning based on the Local Analysis module. If you think you may have been compromised or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call: * North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) * UK: +44.20.3743.3660 * Europe and Middle East: +31.20.299.3130 * Asia: +65.6983.8730 * Japan: +81.50.1790.0200 * Australia: +61.2.4062.7950 * India: 000 800 050 45107 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org). ## Additional Resources * [Introducing Unit 42's Attribution Framework](https://unit42.paloaltonetworks.com/unit-42-attribution-framework/) -- Unit 42, Palo Alto Networks Back to top ### Tags * [Bookworm](https://unit42.paloaltonetworks.com/tag/bookworm/ "Bookworm") * [Stately Taurus](https://unit42.paloaltonetworks.com/tag/stately-taurus/ "Stately Taurus") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Operation Rewrite: Chinese-Speaking Threat Actors Deploy BadIIS in a Wide Scale SEO Poisoning Campaign](https://unit42.paloaltonetworks.com/operation-rewrite-seo-poisoning-campaign/ "Operation Rewrite: Chinese-Speaking Threat Actors Deploy BadIIS in a Wide Scale SEO Poisoning Campaign") ### Table of Contents * ### Related Articles * [Converging Interests: Analysis of Threat Clusters Targeting a Southeast Asian Government](https://unit42.paloaltonetworks.com/espionage-campaigns-target-se-asian-government-org/ "article - table of contents") * [Threat Actor Groups Tracked by Palo Alto Networks Unit 42 (Updated Aug. 1, 2025)](https://unit42.paloaltonetworks.com/threat-actor-groups-tracked-by-palo-alto-networks-unit-42/ "article - table of contents") * [Introducing Unit 42's Attribution Framework](https://unit42.paloaltonetworks.com/unit-42-attribution-framework/ "article - table of contents") ## Related Malware Resources ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/) * [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API") * [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway") * [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)