[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Insights](https://unit42.paloaltonetworks.com/category/insights/ "Insights") * [Hospitality Hacks and Retail Reality Checks](https://unit42.paloaltonetworks.com/category/industry-insights-retail-hospitality/ "Hospitality Hacks and Retail Reality Checks") [Hospitality Hacks and Retail Reality Checks](https://unit42.paloaltonetworks.com/category/industry-insights-retail-hospitality/) # Data Is the New Diamond: Latest Moves by Hackers and Defenders ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 4 min read Related Products [![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Matt Brady](https://unit42.paloaltonetworks.com/author/matt-brady/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:September 9, 2025 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Hospitality Hacks and Retail Reality Checks](https://unit42.paloaltonetworks.com/category/industry-insights-retail-hospitality/) * [Insights](https://unit42.paloaltonetworks.com/category/insights/) * [Unit 42](https://unit42.paloaltonetworks.com/category/unit-42/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Bling Libra](https://unit42.paloaltonetworks.com/tag/bling-libra/) * [Extortion](https://unit42.paloaltonetworks.com/tag/extortion/) * [Lapsus$](https://unit42.paloaltonetworks.com/tag/lapsus/) * [Muddled Libra](https://unit42.paloaltonetworks.com/tag/muddled-libra/) * [Salesforce](https://unit42.paloaltonetworks.com/tag/salesforce/) * [Salesloft](https://unit42.paloaltonetworks.com/tag/salesloft/) * [Social engineering](https://unit42.paloaltonetworks.com/tag/social-engineering/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/data-is-the-new-diamond-latest-moves-by-hackers-and-defenders/?pdf=download&lg=en&_wpnonce=279fa6c5e6 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/data-is-the-new-diamond-latest-moves-by-hackers-and-defenders/?pdf=print&lg=en&_wpnonce=279fa6c5e6 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Data%20Is%20the%20New%20Diamond:%20Latest%20Moves%20by%20Hackers%20and%20Defenders&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fdata-is-the-new-diamond-latest-moves-by-hackers-and-defenders%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fdata-is-the-new-diamond-latest-moves-by-hackers-and-defenders%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fdata-is-the-new-diamond-latest-moves-by-hackers-and-defenders%2F&title=Data%20Is%20the%20New%20Diamond:%20Latest%20Moves%20by%20Hackers%20and%20Defenders "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fdata-is-the-new-diamond-latest-moves-by-hackers-and-defenders%2F&text=Data%20Is%20the%20New%20Diamond:%20Latest%20Moves%20by%20Hackers%20and%20Defenders "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fdata-is-the-new-diamond-latest-moves-by-hackers-and-defenders%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Data%20Is%20the%20New%20Diamond:%20Latest%20Moves%20by%20Hackers%20and%20Defenders%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fdata-is-the-new-diamond-latest-moves-by-hackers-and-defenders%2F "Share in Mastodon") There have been several notable developments in recent weeks related to data theft activity from cybercriminals targeting Salesforce instances, including via the Salesloft Drift supply chain attack detailed in a recent Unit 42 [Threat Brief](https://unit42.paloaltonetworks.com/threat-brief-compromised-salesforce-instances/). (To learn more about the history behind these Salesforce attacks and their impact to private sector organizations, please see my previous publication, "[Heists in the Digital Age](https://unit42.paloaltonetworks.com/retail-hospitality-heists-in-the-digital-age/).") ### Fallout From Salesloft Drift Attack New developments seem to surface daily related to this supply chain attack, which [Salesloft indicates](https://trust.salesloft.com/?uid=Update+on+Mandiant+Drift+and+Salesloft+Application+Investigations) may date as far back as March 2025 in terms of threat actor reconnaissance. The attacks are attributed by Google to [UNC6395](https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift), a cluster of threat activity that appears focused on stealing sensitive credentials and data from various Salesforce objects (Account, Contact, Case and Opportunity records). It is currently unclear if this activity is related or not to the aforementioned targeting of Salesforce tenants by UNC6040 and Bling Libra. However, one theme remains clear --- cybercriminals see great value in stealing customer data from digital platforms like Salesforce and leveraging it for their own financial gain. Essentially, this data has become the digital equivalent to diamonds from physical heists in past decades. ### Glimpses Into Telegram Claims Threat actors claiming to be associated with Muddled Libra (aka Scattered Spider) and Bling Libra have launched various Telegram channels in recent weeks, including many labeled using a combination of the words "[Scattered LAPSUS$ Hunters](https://falconfeeds.io/blogs/scattered-lapsus-hunters-investigative-timeline)." In these channels, they boast of their vast data theft extortion activities, including those impacting various organizations within the retail industry. Several of the email addresses provided by the threat actors to facilitate communications with buyers or victims overlap with prior Unit 42 research into Bling Libra. Additionally, the threat actors claim to soon be launching a new RaaS dubbed "[ShinySpider](https://www.theregister.com/2025/08/12/scattered_spidershinyhunterslapsus_cybercrime_collab/)" which they assert could reach encryption speeds of one GB per second. As of September 5, some of the Telegram channels associated with these threat actors have either been banned or disabled, while others remain active. ### Affiliation With "The Com" As noted in a recent Unit 42 [Insights piece](https://unit42.paloaltonetworks.com/why-the-focus-on-muddled-libra/) on Muddled Libra, many of the threat actors conducting these types of attacks are likely affiliated with "The Com." This means that they are relatively young and fluent in speaking English. This makes it extremely difficult for organizations to detect their social engineering activity. To me, what really stands out about these Com-affiliated threat actors in terms of their effectiveness in achieving their goals is their focus on exploiting inherent flaws within people and processes of targeted organizations, not vulnerabilities inherent within technologies via zero-day exploits or other mechanisms. (See the [2025 Unit 42 Global Incident Response Report: Social Engineering Edition](https://unit42.paloaltonetworks.com/2025-unit-42-global-incident-response-report-social-engineering-edition/) for more details of this trend.) One of the members of Muddled Libra was [recently sentenced](https://www.news4jax.com/news/local/2025/08/20/palm-coast-man-linked-to-scattered-spider-cybercrime-gang-sentenced-to-10-years-for-cryptocurrency-theft/) to 10 years in federal prison, in addition to being ordered to pay more than $13 million in restitution. It will be interesting to see if this has some sort of short or long term deterrence effect on other cybercriminals associated with The Com, including those conducting the aforementioned social engineering attacks targeting Salesforce tenants. One news outlet [recently quoted](https://www.infosecurity-magazine.com/news/cybercriminals-spooked-scattered/)several security firms which indicated that the threat actors were indeed "spooked" by four arrests made by UK law enforcement officials in July. ### Future Shift in Tactics Salesforce [announced](https://help.salesforce.com/s/articleView?id=005132365&type=1) that beginning this month it will restrict the ability of end users to leverage uninstalled connected applications. This should help prevent threat actors from using a modified version of their Data Loader or other applications. Threat actors will likely change their approach to accessing and exfiltrating sensitive data in response, including potentially targeting other third-party digital platforms for data theft extortion. ### The Road Ahead for Retail Cyberattacks One of the more notable trends across the retail threat landscape in recent years involves the shift in monetization tactics used by high profile threat actors. For example, cybercriminal groups such as Rambunctious Libra (aka FIN6, Skeleton Spider) and Squeamish Libra (aka FIN7, Carbon Spider) traditionally used point-of-sale (POS) malware and digital skimming to steal payment card data from retailers. They would then resell it on now-defunct carding shops (e.g., Joker's Stash) as a means to cash out their intrusion operations. Since that time, the rise and evolution of RaaS programs has provided these cybercriminal groups with a more lucrative and less resource-intensive method (affiliate model) to monetize their intrusion operations. However, given the attention that law enforcement officials have placed on disrupting the ransomware ecosystem, it is highly possible, if not likely, that cybercriminal groups will shift to data theft extortion or other monetization tactics (e.g., payroll fraud, gift card fraud) to stay under the radar of authorities. Cybercrime is typically a copycat game, so if the playbooks used by entities like UNC6040 and Bling Libra prove to be effective and sustainable models, others will follow suit. ### My Recommendations Prior to joining Unit 42 earlier this summer, I spent five and a half years as an analyst and leader on a widely recognized cyber threat intelligence team for a prominent retail corporation. I've applied that experience below to make suggestions that could help defenders at similar organizations. Actively participating within organizations like the [Retail and Hospitality Information Sharing and Analysis Center (RH-ISAC)](https://rhisac.org/) can be incredibly impactful for defenders. This participation can be especially valuable for understanding high profile threat actors targeting the retail sector. Based on my prior and current experience working closely with this organization and its members, you'll likely gain unique insights into the infrastructure and tools used by these threat actors. You may also gain information such as audio recordings of vishing attempts that your security teams could use to better tailor awareness messaging. Keep an eye out for real-world observations of social engineering attacks and how to mitigate them. For example, Salesforce released [suggestions specific to their environment](https://www.salesforce.com/blog/protect-against-social-engineering/) informing customers of social engineering threats and what can be done to mitigate or prevent impacts from them. The [2025 Unit 42 Global Incident Response Report: Social Engineering Edition](https://unit42.paloaltonetworks.com/2025-unit-42-global-incident-response-report-social-engineering-edition/) also shares insights from across a variety of incident response cases and provides mitigation suggestions. As I learned from leaders at my prior organization, cybersecurity is truly a team sport, and we are all better when we are in it together. Staying abreast of information from peer organizations and other defenders can help you put threats in context and build a defense strategy that works for you. Back to top ### Tags * [Bling Libra](https://unit42.paloaltonetworks.com/tag/bling-libra/ "Bling Libra") * [Extortion](https://unit42.paloaltonetworks.com/tag/extortion/ "Extortion") * [Lapsus$](https://unit42.paloaltonetworks.com/tag/lapsus/ "Lapsus$") * [Muddled Libra](https://unit42.paloaltonetworks.com/tag/muddled-libra/ "Muddled Libra") * [Salesforce](https://unit42.paloaltonetworks.com/tag/salesforce/ "Salesforce") * [Salesloft](https://unit42.paloaltonetworks.com/tag/salesloft/ "Salesloft") * [Social engineering](https://unit42.paloaltonetworks.com/tag/social-engineering/ "social engineering") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Model Namespace Reuse: An AI Supply-Chain Attack Exploiting Model Name Trust](https://unit42.paloaltonetworks.com/model-namespace-reuse/ "Model Namespace Reuse: An AI Supply-Chain Attack Exploiting Model Name Trust") ### Related Articles * [Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "article - table of contents") * [Inside the Modern SOC: The Identity Front Door](https://unit42.paloaltonetworks.com/soc-identity-front-door/ "article - table of contents") * [When "Hi, This Is IT" Comes Through Microsoft Teams](https://unit42.paloaltonetworks.com/microsoft-teams-phishing/ "article - table of contents") ## Related Hospitality Hacks and Retail Reality Checks Resources ![A board room against a backdrop of windows showing a cityscape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/09/05_Opinion_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) July 10, 2026 [#### No Manners Here: The Ruthless Rise of The Gentlemen Ransomware](https://unit42.paloaltonetworks.com/the-gentlemen-ransomware/) * [Howling Scorpius](https://unit42.paloaltonetworks.com/tag/howling-scorpius/ "Howling Scorpius") * [RaaS](https://unit42.paloaltonetworks.com/tag/raas/ "RaaS") * [Spikey Scorpius](https://unit42.paloaltonetworks.com/tag/spikey-scorpius/ "Spikey Scorpius") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/the-gentlemen-ransomware/ "No Manners Here: The Ruthless Rise of The Gentlemen Ransomware") ![Pictorial representation of a command center featuring glowing wireframe figures standing on a reflective circular pattern.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/12_Myth-Busting_Category_1505x922-718x440.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) March 20, 2026 [#### Who's Really Shopping? Retail Fraud in the Age of Agentic AI](https://unit42.paloaltonetworks.com/retail-fraud-agentic-ai/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [E-commerce](https://unit42.paloaltonetworks.com/tag/e-commerce/ "e-commerce") * [Retail](https://unit42.paloaltonetworks.com/tag/retail/ "Retail") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/retail-fraud-agentic-ai/ "Who’s Really Shopping? Retail Fraud in the Age of Agentic AI") ![Pictorial representation of a bokeh style graphic showing purple and orange spheres with interconnected white network lines.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/11/07_Listicle_Category_1505x922-718x440.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) November 26, 2025 [#### The Golden Scale: 'Tis the Season for Unwanted Gifts](https://unit42.paloaltonetworks.com/new-shinysp1d3r-ransomware/) * [Bling Libra](https://unit42.paloaltonetworks.com/tag/bling-libra/ "Bling Libra") * [Lapsus$](https://unit42.paloaltonetworks.com/tag/lapsus/ "Lapsus$") * [Leak site](https://unit42.paloaltonetworks.com/tag/leak-site/ "Leak site") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/new-shinysp1d3r-ransomware/ "The Golden Scale: 'Tis the Season for Unwanted Gifts") ![Pictorial illustration of the libra sign on a purple, starry background with orange highlights.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/10/Libra-Cybercrime-A-1920x900-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) October 20, 2025 [#### The Golden Scale: Notable Threat Updates and Looking Ahead](https://unit42.paloaltonetworks.com/scattered-lapsus-hunters-updates/) * [Bling Libra](https://unit42.paloaltonetworks.com/tag/bling-libra/ "Bling Libra") * [Extortion](https://unit42.paloaltonetworks.com/tag/extortion/ "Extortion") * [Lapsus$](https://unit42.paloaltonetworks.com/tag/lapsus/ "Lapsus$") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/scattered-lapsus-hunters-updates/ "The Golden Scale: Notable Threat Updates and Looking Ahead") ![Pictorial illustration of Bling Libra on a purple, starry background with orange highlights.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/10/03-2-Bling-Libra-1920x900-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) October 10, 2025 [#### The Golden Scale: Bling Libra and the Evolving Extortion Economy](https://unit42.paloaltonetworks.com/scattered-lapsus-hunters/) * [Bling Libra](https://unit42.paloaltonetworks.com/tag/bling-libra/ "Bling Libra") * [Extortion](https://unit42.paloaltonetworks.com/tag/extortion/ "Extortion") * [Lapsus$](https://unit42.paloaltonetworks.com/tag/lapsus/ "Lapsus$") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/scattered-lapsus-hunters/ "The Golden Scale: Bling Libra and the Evolving Extortion Economy") ![Pictorial representation of a man silhouetted against a background of towering skyscarpers covered in colorful data and abstract code.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/03_Resize_Myth-Busting_Overview_1920x900-1-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) August 26, 2025 [#### Data Is the New Diamond: Heists in the Digital Age](https://unit42.paloaltonetworks.com/retail-hospitality-heists-in-the-digital-age/) * [Bling Libra](https://unit42.paloaltonetworks.com/tag/bling-libra/ "Bling Libra") * [Extortion](https://unit42.paloaltonetworks.com/tag/extortion/ "Extortion") * [Social engineering](https://unit42.paloaltonetworks.com/tag/social-engineering/ "social engineering") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/retail-hospitality-heists-in-the-digital-age/ "Data Is the New Diamond: Heists in the Digital Age") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)