[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/)  
[![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/)  
Menu

* [Tools](https://unit42.paloaltonetworks.com/tools/)
* [ATOMs](https://unit42.paloaltonetworks.com/atoms/)
* [Security Consulting](https://www.paloaltonetworks.com/unit42)
* [About Us](https://unit42.paloaltonetworks.com/about-unit-42/)
* [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html)  
  English
* [English](https://unit42.paloaltonetworks.com/china-chopper-webshell/)
* [Japanese](https://unit42.paloaltonetworks.com/ja/china-chopper-webshell/)
* [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research")
* [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research")
* [Vulnerabilities](https://unit42.paloaltonetworks.com/category/vulnerabilities/ "Vulnerabilities")  
  [Vulnerabilities](https://unit42.paloaltonetworks.com/category/vulnerabilities/)

# Analyzing Attacks Against Microsoft Exchange Server With China Chopper Webshells

![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 10 min read  
Related Products  
[![Advanced Threat Prevention icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced Threat Prevention](https://unit42.paloaltonetworks.com/product-category/advanced-threat-prevention/ "Advanced Threat Prevention")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Cortex XSOAR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XSOAR](https://unit42.paloaltonetworks.com/product-category/cortex-xsoar/ "Cortex XSOAR")[![Next-Generation Firewall icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall")

* ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg)  
  By:
  
  * [Jeff White](https://unit42.paloaltonetworks.com/author/jeff-white/)

* ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg)  
  Published:March 8, 2021

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg)  
  Categories:
  
  * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/)
  * [Vulnerabilities](https://unit42.paloaltonetworks.com/category/vulnerabilities/)

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg)  
  Tags:
  
  * [China Chopper](https://unit42.paloaltonetworks.com/tag/china-chopper/)
  * [CVE-2021-27065](https://unit42.paloaltonetworks.com/tag/cve-2021-27065/)
  * [Hafnium](https://unit42.paloaltonetworks.com/tag/hafnium/)
  * [Microsoft Exchange Server](https://unit42.paloaltonetworks.com/tag/microsoft-exchange-server/)

* [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/china-chopper-webshell/?pdf=download&lg=en&_wpnonce=279fa6c5e6 "Click here to download")

* [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/china-chopper-webshell/?pdf=print&lg=en&_wpnonce=279fa6c5e6 "Click here to print")

Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg)

* ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg)
* [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Analyzing%20Attacks%20Against%20Microsoft%20Exchange%20Server%20With%20China%20Chopper%20Webshells&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fchina-chopper-webshell%2F "Share in email")
* [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fchina-chopper-webshell%2F "Share in Facebook")
* [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fchina-chopper-webshell%2F&title=Analyzing%20Attacks%20Against%20Microsoft%20Exchange%20Server%20With%20China%20Chopper%20Webshells "Share in LinkedIn")
* [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fchina-chopper-webshell%2F&text=Analyzing%20Attacks%20Against%20Microsoft%20Exchange%20Server%20With%20China%20Chopper%20Webshells "Share in Twitter")
* [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fchina-chopper-webshell%2F&ts=markdown "Share in Reddit")
* [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Analyzing%20Attacks%20Against%20Microsoft%20Exchange%20Server%20With%20China%20Chopper%20Webshells%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fchina-chopper-webshell%2F "Share in Mastodon")

## Executive Summary

Microsoft recently released patches for a number of zero-day Microsoft Exchange Server vulnerabilities that are actively being [exploited in the wild by HAFNIUM](https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/), a suspected state-sponsored group operating out of China. We provide an overview of the [China Chopper webshell](https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-china-chopper.pdf), a backdoor which has been observed being dropped in these attacks. We also analyze incidental artifacts, such as metadata, created by the attacks themselves, which allow us to collect information and better understand the nature and methodology of the attackers.

For information on how Palo Alto Networks protects its customers from these threats, please refer to our [Threat Assessment: Active Exploitation of Four Zero-Day Vulnerabilities in Microsoft Exchange Server.](https://unit42.paloaltonetworks.com/microsoft-exchange-server-vulnerabilities/)

## The Role of the China Chopper Webshell

By leveraging [CVE-2021-27065](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27065), a post-authentication arbitrary file write vulnerability, an attacker is able to effectively inject code into an ASPX page for Exchange Offline Address Book (OAB). When this page is compiled with the injected webshell, the attacker can send other code and gain further access. The China Chopper webshell is a lightweight, one-line script that is observed being dropped in these attacks by the use of the PowerShell Set-OabVirtualDirectory cmdlet. This one-line webshell is relatively simple from the server perspective and has been observed in attacks since at least 2013, when [FireEye reported on it](https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html).

The key detail here is that the China Chopper webshell is injected into a pre-existing OAB ASPX page that contains configuration information unrelated to the webshell. It's been reported that there are [thousands of compromises](https://krebsonsecurity.com/2021/03/at-least-30000-u-s-organizations-newly-hacked-via-holes-in-microsofts-email-software/), and any on-premises Exchange Server that is exposed to the internet should assume it's been scanned numerous times. Knowing this, and knowing that thousands of companies this week have begun the laborious chore of responding to these attacks within their infrastructure, it didn't take long before these OAB files started popping up on VirusTotal (VT).

To identify the specific OAB configuration files we're interested in, I created a small YARA rule to identify some of the observed templates for the China Chopper webshell as they exist within OAB configurations.  
rule webshell\_chinachopper\_oab { meta: author = "Jeff White (Palo Alto Networks) @noottrak" date = "02MAR2021" hash01 = "e8ea17cd1de6d3389c792cce8c0ff1927a6386f0ef32ab0b097763de1f86ffc8" hash02 = "34f9944a85ffba58f3fa60c5dc32da1ce6743dae261e1820ef6c419808757112" hash03 = "55fbfab29f9d2c26f81f1ff901af838110d7f76acc81f14b791a8903aa8b8425" hash04 = "6e75bbcdd22ec9df1c7796e381a83f88e3ae82f5698c6b31b64d8f11e9cfd867" strings: // Detect OAB file $OAB01 = "ExternalUrl" ascii // Contains webshell $OAB02 = "InternalUrl" ascii $OAB03 = "ExchangeVersion" ascii $OAB04 = "WhenChangedUTC" ascii // Detect injected Url variants $HTTP01 = "http://f/" ascii nocase $HTTP02 = "http://g/" ascii nocase $HTTP03 = "http://p/" ascii nocase // Detect ChinaChopper variants $websh01 = "\<script language=\\"JScript\\"" ascii nocase $websh02 = "\<script language=\\"c#\\"" ascii nocase $websh03 = "\<script runat=\\"server\\"" ascii nocase // Detect webshell anchors $cc01 = "Request" ascii nocase $cc02 = "Page\_Load" ascii nocase // Detect injected pattern, no webshell $non = /http:\\/\\/\[a-z\]\\/\[a-z0-9\]+/ condition: (all of ($OAB\*) and 1 of ($HTTP\*) and 1 of ($websh\*) and all of ($cc\*)) or (all of ($OAB\*) and $non) }

|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 | rule webshell\_chinachopper\_oab { meta: author = "Jeff White (Palo Alto Networks) @noottrak" date = "02MAR2021" hash01 = "e8ea17cd1de6d3389c792cce8c0ff1927a6386f0ef32ab0b097763de1f86ffc8" hash02 = "34f9944a85ffba58f3fa60c5dc32da1ce6743dae261e1820ef6c419808757112" hash03 = "55fbfab29f9d2c26f81f1ff901af838110d7f76acc81f14b791a8903aa8b8425" hash04 = "6e75bbcdd22ec9df1c7796e381a83f88e3ae82f5698c6b31b64d8f11e9cfd867" strings: // Detect OAB file $OAB01 = "ExternalUrl" ascii // Contains webshell $OAB02 = "InternalUrl" ascii $OAB03 = "ExchangeVersion" ascii $OAB04 = "WhenChangedUTC" ascii // Detect injected Url variants $HTTP01 = "http://f/" ascii nocase $HTTP02 = "http://g/" ascii nocase $HTTP03 = "http://p/" ascii nocase // Detect ChinaChopper variants $websh01 = "\<script language=\\"JScript\\"" ascii nocase $websh02 = "\<script language=\\"c#\\"" ascii nocase $websh03 = "\<script runat=\\"server\\"" ascii nocase // Detect webshell anchors $cc01 = "Request" ascii nocase $cc02 = "Page\_Load" ascii nocase // Detect injected pattern, no webshell $non = /http:\\/\\/\[a-z\]\\/\[a-z0-9\]+/ condition: (all of ($OAB\*) and 1 of ($HTTP\*) and 1 of ($websh\*) and all of ($cc\*)) or (all of ($OAB\*) and $non) } |

For reference, this is how the China Chopper webshell typically manifests itself within the OAB configurations -- specifically in the ExternalUrl field.

![ExternalURL](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/03/china-chopper-01.png)

Additional variants will be discussed throughout the document, but this is the most prevalent.

As of March 4, 2021, there are 81 unique matching samples uploaded to VT.

As FireEye documented in their [2013 analysis of this webshell](https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html), China Chopper is technically split into two parts: a client and a server. When the client engages with the server, in most variants, it provides a "key" to act as authentication before executing whatever code the attacker supplies.

In the above China Chopper example, the key is " NO9BxmCXw0JE ". This provides us with a relatively unique identifier to compare to the other files. But why stop there?

## OAB Artifacts

The OAB configuration contains a wealth of information such as when the file was created, when it was last modified, the Exchange version and numerous other server-specific related data points. These allow us to take a deeper look at the attacks from a new perspective and gain a better understanding of the attack campaigns involved.

On March 2, 2021, Volexity published their blog, "[Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities](https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/)," which provided the first in-depth look at the attacks on Exchange Servers. However, we know that on Jan. 5, 2021, Twitter user [@orange\_8361 (Orange Tsai)](https://twitter.com/orange_8361) [tweeted](https://twitter.com/orange_8361/status/1346401788811825153?s=20) that they had reported a pre-authenticated remote code execution (RCE) chain to a vendor. Microsoft credited this user in the slew of CVEs released to address the vulnerabilities. These two dates give us a frame of reference for analysis, as they mark the time from when Microsoft was notified to the first public disclosure of the attacks observed in the wild.

Looking at the keys used overall in the China Chopper webshells, the list below provides a count of each unique value. Of note is a C# variant of this webshell that does not have a similar key, two variants that do not include a webshell at all but include a possible key and one that is a Base64 encoded string of non-ASCII bytes.  
29 NO9BxmCXw0JE 11 Ananas 8 klk123456 7 orange 6 No Key - f34fji34r209ur29ur92ru 4 p 4 gttkomomo 2 No Key - dsfg 1 rxDg52fHL9GW 1 q3v98mBat1zj 1 passnew 1 o 1 fpm\_admin 1 Q4IDLjknOZJr 1 FhsrvqjnYASe 1 EiH4yV2WGYgc 1 No Key - C# 1 3d55db3b2f88ae47b24ae7796f0cd916

|-------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 | 29 NO9BxmCXw0JE 11 Ananas 8 klk123456 7 orange 6 No Key - f34fji34r209ur29ur92ru 4 p 4 gttkomomo 2 No Key - dsfg 1 rxDg52fHL9GW 1 q3v98mBat1zj 1 passnew 1 o 1 fpm\_admin 1 Q4IDLjknOZJr 1 FhsrvqjnYASe 1 EiH4yV2WGYgc 1 No Key - C# 1 3d55db3b2f88ae47b24ae7796f0cd916 |

As noted, two "keys" did not contain a webshell at all, " f34fji34r209ur29ur92ru " and " dsfg ". Instead, we observed an injection of a value, which appears similar in nature to a key, but is missing the actual webshell code required to carry out further code execution. An example can be seen below and compared to the webshell above.

![ExternalURL2](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/03/china-chopper-02.png)

When looking at some of the temporal data points, specifically the DateModified time of the OAB files, you will see that the usage of these "keys" predates all the other key usage by almost a full day. Since there is no webshell, these may have been test runs. In fact, they show overlap with other keys that later compromise the same server with full webshells.

|--------------------|------------------------|-----------------------|
| **DateModified**   | **WebShellKey**        | **OriginatingServer** |
| 2/27/2021 13:45:30 | f34fji34r209ur29ur92ru | NS1\[...\]net         |
| 2/27/2021 16:20:49 | f34fji34r209ur29ur92ru | DC1\[...\]LOC         |
| 2/27/2021 19:11:07 | f34fji34r209ur29ur92ru | FIT\[...\]cal         |
| 2/28/2021 0:04:23  | f34fji34r209ur29ur92ru | V-T\[...\]com         |
| 2/28/2021 1:41:07  | f34fji34r209ur29ur92ru | DC-\[...\]net         |
| 2/28/2021 3:51:56  | f34fji34r209ur29ur92ru | MBD\[...\]org         |
| 2/28/2021 10:15:00 | NO9BxmCXw0JE           | DC\[...\]net          |
| 2/28/2021 10:33:14 | NO9BxmCXw0JE           | FIT\[...\]cal         |
| 2/28/2021 10:36:44 | orange                 | JTA\[...\]cal         |

The NO9\* key from above is the most prevalent thus far, judging by what's currently available on VT. It has also been displayed in most of the research that has come out on this topic. This key shares a pattern with five other keys in the list. These are considered related due to their timing and unique usage of an exactly 12-character randomized alphanumeric string with mixed capitalization.  
NO9BxmCXw0JE rxDg52fHL9GW q3v98mBat1zj Q4IDLjknOZJr FhsrvqjnYASe EiH4yV2WGYgc

|-------------------------|-------------------------------------------------------------------------------|
| 1 2 3 4 5 6 7 8 9 10 11 | NO9BxmCXw0JE rxDg52fHL9GW q3v98mBat1zj Q4IDLjknOZJr FhsrvqjnYASe EiH4yV2WGYgc |

Within this grouping, only the NO9\* and EiH\* keys were observed in the OAB files with dates prior to the March 2 Volexity blog. It is also interesting to observe the clustering of dates and times when these unique OAB files documented their modification times, as highlighted in the table below.

|---------------------|-----------------|-----------------------|
| **DateModified**    | **WebShellKey** | **OriginatingServer** |
| 2/28/2021 10:15:00  | NO9BxmCXw0JE    | DC-\[...\]net         |
| 2/28/2021 10:33:14  | NO9BxmCXw0JE    | FIT\[...\]cal         |
| 2/28/2021 10:44:24  | NO9BxmCXw0JE    | NS1\[...\]net         |
| 2/28/2021 11:01:52  | NO9BxmCXw0JE    | DC2\[...\]LOC         |
| 2/28/2021 11:03:12  | EiH4yV2WGYgc    | DFC\[...\]com         |
| 2/28/2021 12:44:40  | NO9BxmCXw0JE    | WP-\[...\]cal         |
| 2/28/2021 16:46:21  | NO9BxmCXw0JE    | tcs\[...\]cal         |
| 3/1/2021 6:29:17    | NO9BxmCXw0JE    | mar\[...\]cal         |
| 3/1/2021 7:40:44    | NO9BxmCXw0JE    | cow\[...\]cal         |
| 3/1/2021 12:01:14   | NO9BxmCXw0JE    | MM1\[...\]pvt         |
| 3/1/2021 12:16:38   | NO9BxmCXw0JE    | NCR\[...\]cal         |
| 3/1/2021 13:46:04   | NO9BxmCXw0JE    | a-p\[...\]com         |
| 3/1/2021 3:39:49 PM | NO9BxmCXw0JE    | grr\[...\]cal         |
| 3/1/2021 16:25:57   | NO9BxmCXw0JE    | DC2\[...\]LOC         |
| 3/1/2021 16:42:10   | NO9BxmCXw0JE    | VCC\[...\]org         |
| 3/1/2021 19:28:28   | NO9BxmCXw0JE    | NS1\[...\]net         |
| 3/1/2021 21:32:42   | NO9BxmCXw0JE    | DC0\[...\]cal         |
| 3/1/2021 21:53:34   | NO9BxmCXw0JE    | thi\[...\]cal         |

On Feb. 28, 2021, and March 1, 2021, there are two distinct clusters of events -- before public news about the vulnerabilities is released. Looking at the UTC timing of the events shows some compromises happening just minutes apart using both the NO9\* and EiH\* keys, further corroborating their relation to each other. The timing is also noteworthy because it shows very rapid deployment of these webshells throughout the day and night, indicating an automated approach to targeting. As more samples appear, a better picture of the timeline will emerge.

Continuing to dig down into the data points for the six keys, we can extrapolate the targets based on their OriginatingServer values and deduce a wide range of businesses from investment banking, small car dealerships, water conservatories, industrial automation, law firms, hospitality and so on. The apparent randomness of targeted industries supports the idea that this is automated scanning that took advantage of opportunistic targets versus a coordinated effort to target specific industries or businesses.

One last piece of evidence in support of the idea of automated scanning: There are multiple OAB files with the same configurations but different modification times, thus creating unique hashes. Looking at two servers from the OriginatingServer data points, it can be noted below how they are compromised again at a later date with the exact same webshell and key, implying that systems the attackers have compromised already are not checked during their scanning and exploitation process.

|--------------------|-----------------|-----------------------|
| **DateModified**   | **WebShellKey** | **OriginatingServer** |
| 3/1/2021 21:32:42  | NO9BxmCXw0JE    | DC0\[...\]cal         |
| 3/2/2021 16:57:12  | NO9BxmCXw0JE    | DC0\[...\]cal         |
| 2/28/2021 11:01:52 | NO9BxmCXw0JE    | DC2\[...\]LOC         |
| 3/1/2021 16:25:57  | NO9BxmCXw0JE    | DC2\[...\]LOC         |

Pivoting to the keys, which did not match the previously discussed pattern, we can see they start compromising the same servers as the other group of keys -- but only after all of the research, CVEs, and proofs-of-concept (PoCs) started to pop up, leading us to believe these are different clusters of actors behind the attacks.

|--------------------|-----------------|-----------------------|
| **DateModified**   | **WebShellKey** | **OriginatingServer** |
| 3/1/2021 6:29:17   | NO9BxmCXw0JE    | mar\[...\]cal         |
| 3/2/2021 7:03:15   | NO9BxmCXw0JE    | mar\[...\]cal         |
| 3/3/2021 15:19:46  | Ananas          | mar\[...\]cal         |
| 2/28/2021 10:44:24 | NO9BxmCXw0JE    | NS1\[...\]net         |
| 3/1/2021 19:28:28  | NO9BxmCXw0JE    | NS1\[...\]net         |
| 3/3/2021 6:46:16   | Q4IDLjknOZJr    | NS1\[...\]net         |
| 3/3/2021 6:52:08   | klk123456       | NS1\[...\]net         |

Before moving on to the next section, let's turn our attention to three curious keys that were observed prior to the Volexity publication that do not match the pattern observed for the NO9\* key but have very similar timing. This, along with other data points, seems to indicate these were used as testing or non-automated manual attacks.

The first is the key "orange". The first compromise observed with it in these publicly available OAB files is minutes before and after two surrounding compromises by the NO9\* key on Feb. 28. This key also falls into the cluster of events on March 1, two hours before the previously discussed attacks.

28FEB2021

|--------------------|-----------------|-----------------------|
| **DateModified**   | **WebShellKey** | **OriginatingServer** |
| 2/28/2021 10:33:14 | NO9BxmCXw0JE    | FIT\[...\]cal         |
| 2/28/2021 10:36:44 | orange          | JTA\[...\]cal         |
| 2/28/2021 10:44:24 | NO9BxmCXw0JE    | NS1\[...\]net         |

01MAR2021

|------------------|-----------------|-----------------------|
| **DateModified** | **WebShellKey** | **OriginatingServer** |
| 3/1/2021 4:25:25 | orange          | Exc\[...\]CAL         |
| 3/1/2021 6:29:17 | NO9BxmCXw0JE    | mar\[...\]cal         |
| 3/1/2021 7:40:44 | NO9BxmCXw0JE    | cow\[...\]cal         |

The second and third keys are simply "o" and "p". Besides standing out due to their shortness, they also use a different structure in their webshell and appear to have targeted a medical facility and something related to the Vietnamese government, both prior to any publication about the vulnerabilities.

The [Microsoft blog on HAFNIUM](https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/) displays a webshell dropped by HAFNIUM that also uses a parameter value of "p", although it is a different structure. A screenshot of the webshell displayed there is transcribed below, along with an example of the one observed in an OAB file.

![](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/03/china-chopper-03.png)

Notable similarities exist in the Request.Form parameter value, "p", and the usage of a single-letter character for the other values; however, this in and of itself does not necessarily confirm a HAFNIUM connection.

Looking at the "o" and "p" keys found in the OAB files, they can be seen targeting the same systems days apart.

|--------------------|-----------------|-----------------------|
| **DateModified**   | **WebShellKey** | **OriginatingServer** |
| 2/28/2021 11:57:01 | o               | ad2\[...\].vn         |
| 3/3/2021 7:58:20   | p               | ad2\[...\].vn         |

Furthermore, we can observe compromises by the cluster of six patterned keys and "o" key happening fairly close in time to one another, alluding to a possible connection between them.

|-----------------------|-----------------|-----------------------|
| **DateModified**      | **WebShellKey** | **OriginatingServer** |
| 2/28/2021 11:03:12 AM | EiH4yV2WGYgc    | DFC\[...\]com         |
| 2/28/2021 11:57:01 AM | o               | ad2\[...\].vn         |
| 2/28/2021 12:44:40 PM | NO9BxmCXw0JE    | WP-\[...\]cal         |

Two more keys stand out in terms of volume. Like the other keys that have been discussed, both "klk123456" and "Ananas" were observed in overlapping compromises, indicating automated scanning or using some type of list that has already been correlated from a scanning service.

|-------------------|-----------------|-----------------------|
| **DateModified**  | **WebShellKey** | **OriginatingServer** |
| 3/3/2021 4:34:20  | klk123456       | Bed\[...\]com         |
| 3/3/2021 6:52:08  | klk123456       | NS1\[...\]net         |
| 3/3/2021 6:55:34  | klk123456       | Fil\[...\]cal         |
| 3/3/2021 7:26:29  | klk123456       | mna\[...\]com         |
| 3/3/2021 7:35:48  | Ananas          | ric\[...\]org         |
| 3/3/2021 7:45:40  | Ananas          | ADA\[...\]cal         |
| 3/3/2021 7:47:15  | klk123456       | PSL\[...\]cal         |
| 3/3/2021 10:43:51 | klk123456       | CHG\[...\]SYS         |
| 3/3/2021 11:02:09 | klk123456       | TRD\[...\]com         |
| 3/3/2021 14:35:40 | Ananas          | jus\[...\].nl         |
| 3/3/2021 14:50:18 | Ananas          | asi\[...\]com         |
| 3/3/2021 14:51:13 | Ananas          | Bed\[...\]com         |
| 3/3/2021 15:19:46 | Ananas          | mar\[...\]cal         |
| 3/3/2021 16:16:21 | Ananas          | V-T\[...\]com         |
| 3/3/2021 16:40:03 | Ananas          | FHM\[...\]org         |

These clusters of events are likely related to threat actors who were able to weaponize the public information extremely quickly and get a head start on attacking Exchange Servers before other actors could.

All the compromises with the other keys appear unrelated and occur after the patches, research and PoC code had become easily accessible.

## Variations in the China Chopper Webshell

Recall the most prevalent China Chopper shell as observed in the OAB file.

![ExternalURL 5](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/03/china-chopper-04.png)

A Twitter user, [@mickeyftnt](https://twitter.com/mickeyftnt), notified me that they found a variant using a different pattern from the "http://f/" that I had been watching stream into VT. This variant used "http://g/" and contained a space after the eval method call. Microsoft states the [ExternalUrl](https://docs.microsoft.com/en-us/powershell/module/exchange/set-oabvirtualdirectory?view=exchange-ps) parameter "specifies the URL that's used to connect to the virtual directory from outside the firewall," so we can assume that, in a legitimate file, this is a resolvable domain but may require the "http" precursor to be accepted as a value for the injection to work. While this piece of the URL is moot and does not affect the operation, the use of "http://f/" is observed across the board in almost every one of the attacks. As such, the "http://g/" variable piqued my interest as another likely artifact worth taking note of, even though no additional patterns have been noticed outside what's been discussed here already.

![ExternalURL 6](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/03/china-chopper-05.png)

Another Twitter user, [@krausedw](https://twitter.com/krausedw), brought some samples to my attention that included breaking up the "unsafe" word in an attempt to bypass certain security measures and a C# sample that calls out the script language explicitly.

**JScript unsafe**

![ExternalURL 7](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/03/china-chopper-06.png)

**C#**

![Ext](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/03/china-chopper-07.png)

Finally, there are variants that use Base64 strings as the key.

**Base64**

![E](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/03/china-chopper-08.png)

## Conclusion

By leveraging the artifacts found within the OAB configurations, we are able to piece together a narrative around the activity based on analysis from just a small set of samples. It seems clear that there are numerous clusters of groups leveraging these vulnerabilities, the groups are using mass scanning or services that allow them to independently target the same systems, and finally there are multiple variations of the code being dropped, which may be indicative of iterations to the attack. As more information and files become available, this analysis may have to be revisited, but for now, there are a sufficient number of connections that allow us to understand the how, the when and the frequency of attacks, along with clustering of events.

## Additional Resources

* [Threat Assessment: Active Exploitation of Four Zero-Day Vulnerabilities in Microsoft Exchange Server](https://unit42.paloaltonetworks.com/microsoft-exchange-server-vulnerabilities/)
* [Hunting for the Recent Attacks Targeting Microsoft Exchange](https://blog.paloaltonetworks.com/security-operations/attacks-targeting-microsoft-exchange/)
* [HAFNIUM targeting Exchange Servers with 0-day exploits](https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/)
* [Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities](https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/)
* [Mass Exploitation of Exchange Server Zero-Day CVEs: What You Need to Know](https://blog.rapid7.com/2021/03/03/mass-exploitation-of-exchange-server-zero-day-cves-what-you-need-to-know/)
  Back to top

### Tags

* [China Chopper](https://unit42.paloaltonetworks.com/tag/china-chopper/ "China Chopper")
* [CVE-2021-27065](https://unit42.paloaltonetworks.com/tag/cve-2021-27065/ "CVE-2021-27065")
* [Hafnium](https://unit42.paloaltonetworks.com/tag/hafnium/ "Hafnium")
* [Microsoft Exchange Server](https://unit42.paloaltonetworks.com/tag/microsoft-exchange-server/ "Microsoft Exchange Server")  
  [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Overview of dnsmasq Vulnerabilities: The Dangers of DNS Cache Poisoning](https://unit42.paloaltonetworks.com/overview-of-dnsmasq-vulnerabilities-the-dangers-of-dns-cache-poisoning/ "Overview of dnsmasq Vulnerabilities: The Dangers of DNS Cache Poisoning")

### Table of Contents

* 

### Related Articles

* [Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government](https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ "article - table of contents")
* [Unit 42 Researchers Discover Multiple Espionage Operations Targeting Southeast Asian Government](https://unit42.paloaltonetworks.com/analysis-of-three-attack-clusters-in-se-asia/ "article - table of contents")
* [Manic Menagerie 2.0: The Evolution of a Highly Motivated Threat Actor](https://unit42.paloaltonetworks.com/manic-menagerie-targets-web-hosting-and-it/ "article - table of contents")

## Related Vulnerabilities Resources

![Pictorial representation of a group of people interacting with a dynamic 3D holographic display of colorful, undulating data waves on a table.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/09/11_Myth-Busting_Overview_1920x900-786x368.jpg)  
[![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) August 4, 2026 [#### The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software](https://unit42.paloaltonetworks.com/frontier-ai-vulnerability-burst/)

* [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI")

* [Frontier AI](https://unit42.paloaltonetworks.com/tag/frontier-ai/ "Frontier AI")

* [Vulnerability Exploitation](https://unit42.paloaltonetworks.com/tag/vulnerability-exploitation/ "Vulnerability Exploitation")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/frontier-ai-vulnerability-burst/ "The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software")  
  ![Pictorial representation of AI-enabled autonomous cyberattacks. A digital illustration depicting abstract, interconnected data streams in vibrant colors on a dark blue background](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/AdobeStock_992950050-3-782x440.jpeg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) July 30, 2026 [#### Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks](https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/)

* [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT")

* [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code")

* [CVEs](https://unit42.paloaltonetworks.com/tag/cves/ "CVEs")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/ "Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks")  
  ![Pictorial representation of three zero-day vulnerabilities in Siemens ROX II OT switches. Digital illustration of a global network featuring interconnected lines and nodes over a map of the world, highlighted with neon lights and digital elements.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/03_Vulnerabilities_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) July 17, 2026 [#### Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy](https://unit42.paloaltonetworks.com/siemens-rox-ii-zero-day-vulnerabilities/)

* [Command injection](https://unit42.paloaltonetworks.com/tag/command-injection/ "Command injection")

* [CVE-2025-40947](https://unit42.paloaltonetworks.com/tag/cve-2025-40947/ "CVE-2025-40947")

* [CVE-2025-40948](https://unit42.paloaltonetworks.com/tag/cve-2025-40948/ "CVE-2025-40948")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/siemens-rox-ii-zero-day-vulnerabilities/ "Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy")  
  ![Pictorial representation of PAN-OS CVE-2026-0257. A vibrant city skyline at night, with tall skyscrapers and glowing digital beams extending into the sky, suggesting advanced technology and connectivity.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/07_Vulnerabilities_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) June 9, 2026 [#### Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257](https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/)

* [CVE-2026-0257](https://unit42.paloaltonetworks.com/tag/cve-2026-0257/ "CVE-2026-0257")

* [Vulnerability](https://unit42.paloaltonetworks.com/tag/vulnerability/ "vulnerability")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/ "Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257")  
  ![Pictorial representation of CVE-2026-30300. Digital illustration of a map of North America with interconnected glowing lines and dots symbolizing network connections across the continent.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/06_Vulnerabilities_1920x900-3-1-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) May 6, 2026 [#### Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution](https://unit42.paloaltonetworks.com/captive-portal-zero-day/)

* [CVE-2026-0300](https://unit42.paloaltonetworks.com/tag/cve-2026-0300/ "CVE-2026-0300")

* [EarthWorm](https://unit42.paloaltonetworks.com/tag/earthworm/ "EarthWorm")

* [PAN-OS](https://unit42.paloaltonetworks.com/tag/pan-os/ "PAN-OS")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/captive-portal-zero-day/ "Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution")  
  ![Pictorial representation of a severe Linux vulnerability. Close-up of a woman wearing glasses and focusing intently on a computer screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/05_Vulnerabilities_1920x900-2-1-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) May 5, 2026 [#### Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years](https://unit42.paloaltonetworks.com/cve-2026-31431-copy-fail/)

* [Containers](https://unit42.paloaltonetworks.com/tag/containers/ "Containers")

* [CVE-2026-31431](https://unit42.paloaltonetworks.com/tag/cve-2026-31431/ "CVE-2026-31431")

* [Kubernetes](https://unit42.paloaltonetworks.com/tag/kubernetes/ "Kubernetes")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/cve-2026-31431-copy-fail/ "Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years")  
  ![Pictorial representation of CVE-2023-33538. Abstract image of a glowing red Wi-Fi symbol on a circuit board, with intricate patterns and a futuristic appearance.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/04/04_Vulnerabilities_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) April 16, 2026 [#### A Deep Dive Into Attempted Exploitation of CVE-2023-33538](https://unit42.paloaltonetworks.com/exploitation-of-cve-2023-33538/)

* [Botnet](https://unit42.paloaltonetworks.com/tag/botnet/ "botnet")

* [Command injection](https://unit42.paloaltonetworks.com/tag/command-injection/ "Command injection")

* [CVE-2023-33538](https://unit42.paloaltonetworks.com/tag/cve-2023-33538/ "CVE-2023-33538")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/exploitation-of-cve-2023-33538/ "A Deep Dive Into Attempted Exploitation of CVE-2023-33538")  
  ![Pictorial representation of BeyondTrust vulnerability CVE-2026-1731. Digital art depicting a stylized mountain range with vibrant blue and red hues. The peaks are accentuated by glowing particles and an abstract, starry backdrop, creating a futuristic landscape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/14_Overview_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) February 19, 2026 [#### VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731)](https://unit42.paloaltonetworks.com/beyondtrust-cve-2026-1731/)

* [Bash](https://unit42.paloaltonetworks.com/tag/bash/ "bash")

* [CVE-2026-1731](https://unit42.paloaltonetworks.com/tag/cve-2026-1731/ "CVE-2026-1731")

* [PowerShell](https://unit42.paloaltonetworks.com/tag/powershell/ "PowerShell")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/beyondtrust-cve-2026-1731/ "VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731)")  
  ![](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/AdobeStock_1020436911-786x440.jpeg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) February 17, 2026 [#### Critical Vulnerabilities in Ivanti EPMM Exploited](https://unit42.paloaltonetworks.com/ivanti-cve-2026-1281-cve-2026-1340/)

* [CVE-2026-1281](https://unit42.paloaltonetworks.com/tag/cve-2026-1281/ "CVE-2026-1281")

* [CVE-2026-1340](https://unit42.paloaltonetworks.com/tag/cve-2026-1340/ "CVE-2026-1340")

* [Ivanti](https://unit42.paloaltonetworks.com/tag/ivanti/ "Ivanti")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ivanti-cve-2026-1281-cve-2026-1340/ "Critical Vulnerabilities in Ivanti EPMM Exploited")  
  ![Pictorial representation of CVE-2025-0921. Digital illustration of a map of North America with interconnected glowing lines and dots symbolizing network connections across the continent.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/01/06_Vulnerabilities_1920x900-2-1-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) January 30, 2026 [#### Privileged File System Vulnerability Present in a SCADA System](https://unit42.paloaltonetworks.com/iconics-suite-cve-2025-0921/)

* [CVE-2025-0921](https://unit42.paloaltonetworks.com/tag/cve-2025-0921/ "CVE-2025-0921")

* [Privilege escalation](https://unit42.paloaltonetworks.com/tag/privilege-escalation/ "privilege escalation")

* [SCADA](https://unit42.paloaltonetworks.com/tag/scada/ "SCADA")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/iconics-suite-cve-2025-0921/ "Privileged File System Vulnerability Present in a SCADA System")

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)  
  ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]()  
  ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png)  
  ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42

## Peace of mind comes from staying ahead of threats. Subscribe today.

Your Email

Subscribe for email updates to all Unit 42 threat research.  
By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement")

This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.

Invalid captcha!
Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg)  
{#footer} Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security)

* [Secure AI by Design](https://www.paloaltonetworks.com/ai-security)

* [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase)

* [Prisma SASE](https://www.paloaltonetworks.com/sase)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam)

* [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira)

* [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management)

* [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management)

* [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager)

* [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance)

* [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management)

* [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic)

* [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management)

* [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance)

* [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery)

* [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42)

* [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense)

* [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses)

* [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy)

* [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence)

* [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond)  
  Company

* [About Us](https://www.paloaltonetworks.com/about-us)

* [Careers](https://jobs.paloaltonetworks.com/en/)

* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales)

* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility)

* [Customers](https://www.paloaltonetworks.com/customers)

* [Investor Relations](https://investors.paloaltonetworks.com/)

* [Location](https://www.paloaltonetworks.com/about-us/locations)

* [Newsroom](https://www.paloaltonetworks.com/company/newsroom)  
  Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/)

* [Communities](https://www.paloaltonetworks.com/communities)

* [Content Library](https://www.paloaltonetworks.com/resources)

* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia)

* [Event Center](https://events.paloaltonetworks.com/)

* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)

* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z)

* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications)

* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure)

* [Sitemap](https://www.paloaltonetworks.com/sitemap)

* [Tech Docs](https://docs.paloaltonetworks.com/)

* [Unit 42](https://unit42.paloaltonetworks.com/)

* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)

* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy)

* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center)

* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use)

* [Documents](https://www.paloaltonetworks.com/legal)

Copyright © 2026 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* EN  
  Select your language  
  ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg)

### Default Heading

Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg)  
Seekbar

![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg)  
![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg)  
Volume
![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)