[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/elf-based-malware-targets-cloud/) * [Spanish (LATAM)](https://unit42.paloaltonetworks.com/es-la/elf-based-malware-targets-cloud/) * [French](https://unit42.paloaltonetworks.com/fr/elf-based-malware-targets-cloud/) * [Japanese](https://unit42.paloaltonetworks.com/ja/elf-based-malware-targets-cloud/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Cloud Cybersecurity Research](https://unit42.paloaltonetworks.com/category/cloud-cybersecurity-research/ "Cloud Cybersecurity Research") [Cloud Cybersecurity Research](https://unit42.paloaltonetworks.com/category/cloud-cybersecurity-research/) # The Evolution of Linux Binaries in Targeted Cloud Operations ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 8 min read Related Products [![Cortex icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex](https://unit42.paloaltonetworks.com/product-category/cortex/ "Cortex")[![Cortex Cloud icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex Cloud](https://unit42.paloaltonetworks.com/product-category/cortex-cloud/ "Cortex Cloud")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Nathaniel Quist](https://unit42.paloaltonetworks.com/author/nathaniel-quist/) * [Bill Batchelor](https://unit42.paloaltonetworks.com/author/bill-batchelor/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:June 10, 2025 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Cloud Cybersecurity Research](https://unit42.paloaltonetworks.com/category/cloud-cybersecurity-research/) * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Endpoint](https://unit42.paloaltonetworks.com/tag/endpoint/) * [Linux Malware](https://unit42.paloaltonetworks.com/tag/linux-malware/) * [Machine Learning](https://unit42.paloaltonetworks.com/tag/machine-learning/) * [PowerShell](https://unit42.paloaltonetworks.com/tag/powershell/) * [Remote Access Trojan](https://unit42.paloaltonetworks.com/tag/remote-access-trojan/) * [VBScript](https://unit42.paloaltonetworks.com/tag/vbscript/) * [Winnti](https://unit42.paloaltonetworks.com/tag/winnti/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/elf-based-malware-targets-cloud/?pdf=download&lg=en&_wpnonce=279fa6c5e6 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/elf-based-malware-targets-cloud/?pdf=print&lg=en&_wpnonce=279fa6c5e6 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=The%20Evolution%20of%20Linux%20Binaries%20in%20Targeted%20Cloud%20Operations&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Felf-based-malware-targets-cloud%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Felf-based-malware-targets-cloud%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Felf-based-malware-targets-cloud%2F&title=The%20Evolution%20of%20Linux%20Binaries%20in%20Targeted%20Cloud%20Operations "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Felf-based-malware-targets-cloud%2F&text=The%20Evolution%20of%20Linux%20Binaries%20in%20Targeted%20Cloud%20Operations "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Felf-based-malware-targets-cloud%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=The%20Evolution%20of%20Linux%20Binaries%20in%20Targeted%20Cloud%20Operations%20https%3A%2F%2Funit42.paloaltonetworks.com%2Felf-based-malware-targets-cloud%2F "Share in Mastodon") ## Executive Summary Unit 42 researchers have identified a growing threat to cloud security: Linux Executable and Linkage Format (ELF) files that threat actors are developing to target cloud infrastructure. We predict that threat actors targeting cloud environments will start using more complex tools in their exploits. This will include reworking, improving and tailoring existing tools that historically only targeted Linux operating systems (OS). The ELF malware samples threat actors use will include backdoors, droppers, remote access Trojans (RATs), data wipers and vulnerability-exploiting binaries. During our investigation, we focused on five ELF-based malware families, each of which threat actor groups have used to target cloud environments during their operations. This involvement includes malicious operations targeting cloud environments and the direct exploitation of cloud infrastructure using these ELF binaries. These activities suggest that attackers will continue to use ELF binaries against cloud infrastructure. We analyzed each of the families and found that they had at least two significant code updates within the last year, meaning threat actors are actively updating and supporting them. Additionally, each of the malware strains accounted for at least 20 unique sightings of samples in the wild over the last year. This means that threat actors are actively using them. We believe these malware families are highly likely to be used in future attacks targeting cloud environments, including infrastructure. Palo Alto Networks customers are better protected through the threats described in this article through [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud). If you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html). | **Related Unit 42 Topics** | [**Linux Malware**](https://unit42.paloaltonetworks.com/tag/linux-malware/), **[Machine Learning](https://unit42.paloaltonetworks.com/tag/machine-learning/)** | |----------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------| ## Background Our recent [report on cloud threats](https://unit42.paloaltonetworks.com/2025-cloud-security-alert-trends/) showed that cloud-based alerts increased on average 388% during 2024. Additionally, [45% of organizations](https://www.paloaltonetworks.com/state-of-cloud-native-security) are reporting a rise in advanced persistent threat (APT) attacks. As threat actors target cloud infrastructure at [increasing rates](https://unit42.paloaltonetworks.com/2025-cloud-security-alert-trends/), defenders must hunt for potential attack vectors that cloud threat actors could use for access, persistence and operations. Threat hunters could benefit from investigating malicious executables that can be used against cloud endpoints. This article explores the types of malicious binaries that threat actors are developing for use in attacks against Linux-based environments. ELF files are a common standard file format for executable files within Linux operating systems (OS). Researchers estimate that between [70](https://w3techs.com/technologies/details/os-linux)% and [90](https://svitla.com/blog/linux-distribution-cloud-instance/)% of all computational instances within cloud environments are based on variants (also known as flavors) of Linux OS. While ELF-based malware is not new, these malware families and the types of attack techniques they involve are likely to evolve toward the targeting of cloud infrastructure. ## Evolving ELF Binaries Commonly known Linux malware families can evolve to actively target cloud resources. Attackers can adapt and deploy these families into cloud workloads and container environments with relative ease due to the ubiquity of Linux OS instances within the standard cloud environment. Our researchers pinpointed examples of evolving strains of ELF-based malware that include NoodleRAT, Winnti, SSHdInjector, Pygmy Goat and AcidPour. These ELF binaries use techniques such as dynamic linker hijacking, where they abuse the LD\_PRELOAD environment variable to: * Inject malicious code into legitimate system processes * Hook into critical Linux services such as the SSH daemon (sshd) * Exploit vulnerabilities or misconfigurations found in containerized infrastructure This allows threat actors to achieve persistence, maintain stealthy command and control (C2) channels, covertly exfiltrate data and impact operations by wiping critical data. ### NoodleRAT This malware enables threat actors to perform C2 operations on a targeted endpoint, including: * Access via reverse shell * SOCKS proxy tunneling * Encryption of communications * Scheduled code execution * Uploading and downloading of files * Process name spoofing NoodleRAT has both Windows and Linux variants. The [Linux variant](https://www.trendmicro.com/en_us/research/24/f/noodle-rat-reviewing-the-new-backdoor-used-by-chinese-speaking-g.html) is an ELF-based backdoor. Although Linux NoodleRAT code bears similarities to other Linux backdoor malware, including Rekoobe and Tiny SHell, NoodleRAT is considered its own malware family. NoodleRAT has been observed in both cybercriminal and cyberespionage intrusions, including from Chinese-speaking threat actors such as [Rocke](https://blog.talosintelligence.com/rocke-champion-of-monero-miners/) and suspected nation-state actors associated with the [Cloud Snooper](https://news.sophos.com/en-us/2020/02/25/cloud-snooper/) campaign. The actors behind the Linux variant of NoodleRAT have targeted entities in multiple countries across the Asia-Pacific region including Thailand, India, Japan, Malaysia and Taiwan. ### Winnti Winnti has both Windows and Linux versions. This malware achieves persistence through abuse of the LD\_PRELOAD environment variable, enabling it to load into memory without altering any legitimate system binaries. The backdoor has the following functionality: * Providing remote command execution capability * Enabling file exfiltration * Supporting SOCKS5 proxying to facilitate C2 communication The [Linux variant of Winnti](https://medium.com/chronicle-blog/winnti-more-than-just-windows-and-gates-e4f03436031a) malware is a backdoor reportedly used by several China-nexus threat actors, including those that we track as Starchy Taurus (aka [Winnti](https://attack.mitre.org/groups/G0044/) Group and BARIUM) and Nuclear Taurus (aka Tumbleweed Typhoon, THORIUM, [Bronze Vapor](https://malpedia.caad.fkie.fraunhofer.de/actor/bronze_vapor)). The backdoor consists of two files: a primary ELF executable (libxselinux) and an additional dynamic library (libxselinux.so). ### SSHdInjector This [Linux SSH backdoor](https://www.fortinet.com/blog/threat-research/analyzing-elf-sshdinjector-with-a-human-and-artificial-analyst) injects malicious code into the SSH daemon (sshd) at runtime. The injected code grants the threat actor persistent access and facilitates malicious activities such as: * Credential theft * Remote command execution * Malware ingress * File and directory access * Opening a remote shell * Data exfiltration SSHdInjector has been observed being used by several China-nexus threat actors, including one that we track as [Digging Taurus](https://unit42.paloaltonetworks.com/threat-actor-groups-tracked-by-palo-alto-networks-unit-42/#:~:text=Software%20and%20Technology-,Digging%20Taurus,-Also%20Known%20As) (aka Daggerfly, Evasive Panda). [Targets](https://attack.mitre.org/groups/G1034/) are cyberespionage-related and have included individuals, government institutions, and telecommunications organizations. ### Pygmy Goat Pygmy Goat is a Linux backdoor that was [discovered on Sophos XG firewall devices \[PDF\]](https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/pygmy-goat/ncsc-mar-pygmy-goat.pdf) but is designed to target additional Linux-based systems. The malware gains initial access and persistence through rootkit functionality by leveraging the libsophos.so library file, which is vulnerable to authentication bypass ([CVE-2022-1040](https://nvd.nist.gov/vuln/detail/cve-2022-1040)). The executable then injects itself into the SSH daemon (sshd) using the LD\_PRELOAD environment variable on the targeted device and intercepts SSH communications. The threat actor can initiate communications with the malware by sending specially crafted ICMP packets --- a technique known as "[port knocking](https://en.wikipedia.org/wiki/Port_knocking)" --- or by sending a series of [magic bytes](https://en.wikipedia.org/wiki/List_of_file_signatures) embedded in SSH traffic. Its capabilities include: * Establishing remote shells * Capturing network packets * Creating cron jobs * Tunneling via a reverse SOCKS5 proxy Reported targets include government agencies and suppliers, non-governmental organizations (NGOs), healthcare and transportation sector entities in the Asia-Pacific region. ### Acid Pour/AcidRain AcidRain and the newer [AcidPour](https://www.sentinelone.com/labs/acidpour-new-embedded-wiper-variant-of-acidrain-appears-in-ukraine/) variant are strains of destructive Linux wiper malware linked to the Russian threat actor [Razing Ursa](https://unit42.paloaltonetworks.com/threat-actor-groups-tracked-by-palo-alto-networks-unit-42/#:~:text=Research-,Razing%20Ursa,-Also%20Known%20As) (aka Sandworm, Voodoo Bear). AcidRain is an ELF binary that targets modems and routers that are based on the [MIPS architecture](https://en.wikipedia.org/wiki/MIPS_architecture). AcidPour is a similar ELF binary but is compiled for x86. It can affect a broader range of targets, such as Linux x86-based storage arrays, network devices and industrial control systems. Both wipers use Input/Output Controls (IOCTLs) to effect destruction of data and then they self-delete for defense evasion. AcidPour or a new variant of this binary would be effective at wiping unprotected x86-based cloud systems if a threat actor gained shell access, for example via a successful web shell deployment or container escape. We observed new hash values of these malware families in the months preceding this report. As organizations continue to migrate to the cloud, threat actors will continue to develop these malware families and pivot into cloud runtime environments. This highlights the need for enhanced detection and prevention security capabilities in cloud workloads and containers. ## Conclusion Cloud-based alerts increased on average 388% during 2024. We predict that threat actors targeting cloud environments will start using more complex tools in their attacks. This includes reworking, improving and tailoring existing tools that historically only targeted Linux OS systems. Given the estimates previously cited that as many as 90% of cloud environments operate on Linux compute instances, the logical next step is for threat actors to use these malware families against cloud environments. It is more critical than ever to implement endpoint security agents on cloud computing instances to ensure that all malicious runtime processing, network traffic and suspicious behavioral operations are detected. Modern cloud endpoint agents can detect these malware families. The introduction of machine learning in endpoint detection is a significant advancement in cloud security. Palo Alto Networks Protection and Mitigation We recommend a machine-learning detection approach to flag binaries. An evolving approach should consider factors like: * Kernel-mode system calls * Import functions * Evasion techniques * Network traffic * Unknown binary patterns Figure 1 shows a previously unknown ELF binary that triggered the Cortex Machine Learning alert. ![Screenshot of Cortex XDR showing an execution flow. At the top are numerous icons representing a chain of events. At bottom is a table explaining the different processes. These include the Resource, Category, Action, Alert Name and more.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/word-image-976774-142727-1.png) Figure 1. Cortex Cloud ELF Machine Learning execution alert. #### ELF Machine Learning Detections [Palo Alto Networks Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) has developed a new machine learning module specifically to detect Linux ELF files. Cortex researchers conducted tests using over 100 unique ELF binaries across all five of the malware families discussed in this article. Each malware family was successfully detected, and 92% of all samples were accurately flagged as malicious. The remaining 8% were found to contain Linux shared (.so) libraries that were out of scope for the model used. The files that were detected fell within the following testing criteria: * Malicious * Suspicious * Benign Samples that received a score of 0.85 or above are categorized as malicious, results between 0.84 and 0.65 are considered suspicious and any result below 0.64 is considered benign. Figure 2 shows that 61% of the samples tested had results above 0.85 and were considered malicious. ![Pie chart of the machine learning testing scores showing the distribution as: 61.5% malicious, 30.8% suspicious, and 7.7% benign.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/chart-2.png) Figure 2. ELF machine learning testing scores by percentage of benign, suspicious or malicious. 92\.3% of all samples submitted surpassed the suspicious threshold of 0.65. This demonstrates that all but 7.7% of the samples provided are considered suspicious and would trigger an alert if they were executed within the environment. #### PowerShell and VBS Machine Learning Detections We also used the Cortex PowerShell and VBS Machine Learning module to investigate the detection of cloud-specific operations. We submitted over 100 PowerShell and Visual Basic scripts (VBS) to the ML model. These scripts were hand picked as malicious scripts that performed the following activities: * Cloud resource discovery and creation * Storage container object deletion and exfiltration * Identity access and management (IAM) operations Figure 3 shows that 67% of these scripts were successfully identified as malicious or suspicious. Notably, nearly 96% of the malicious samples received a score of 0.95 or higher. ![Pie chart of the PowerShell and VBS machine learning testing scores as: 56.8% Malicious (\>95%), 33.0% Benign, 8.0% Suspicious, and 2.3% Malicious.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/chart-3.png) Figure 3. PowerShell and VBS Machine Learning testing scores by percentage of benign, suspicious or malicious. ## **Cortex Cloud** Defenders can gain valuable insights by threat hunting for common ELF malware executions within cloud endpoints. This can be done through cloud detection and response (CDR), which is a cloud security solution that combines: * Endpoint detection and response (EDR) capabilities * Detection and prevention of executable processes running on cloud endpoints * Auditing and logging capabilities inherent within the cloud service platform Palo Alto Networks customers are better protected from the threats discussed above through the following products: * Cortex ELF Machine Learning detection module * Cortex PowerShell and VBS Machine Learning detection module If you think you may have been compromised or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call: * North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) * UK: +44.20.3743.3660 * Europe and Middle East: +31.20.299.3130 * Asia: +65.6983.8730 * Japan: +81.50.1790.0200 * Australia: +61.2.4062.7950 * India: 00080005045107 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org). ## Additional Resources Several sources were used to support and guide this research: * [Cloud Threats on the Rise](https://unit42.paloaltonetworks.com/2025-cloud-security-alert-trends/) -- Unit 42, Palo Alto Networks * [2024 State of the Cloud Report](https://www.paloaltonetworks.com/resources/research/state-of-cloud-native-security-2024) -- Unit 42, Palo Alto Networks * [AcidPour Wiper Malware: Threat Analysis and Detections](https://www.splunk.com/en_us/blog/security/acidpour-wiper-malware-threat-analysis-and-detections.html) -- Splunk, CISCO * [AcidPour | New Embedded Wiper Variant of AcidRain Appears in Ukraine](https://www.sentinelone.com/labs/acidpour-new-embedded-wiper-variant-of-acidrain-appears-in-ukraine/) -- SentinelLABS, SentinelOne * [Malware Analysis Report: Pygmy Goat \[PDF\]](https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/pygmy-goat/ncsc-mar-pygmy-goat.pdf) -- Nation Cyber Security Centre * [Analyzing ELF/Sshdinjector.A!tr with a Human and Artificial Analyst](https://www.fortinet.com/blog/threat-research/analyzing-elf-sshdinjector-with-a-human-and-artificial-analyst) -- Fortinet * [Noodle RAT: Reviewing the Backdoor Used by Chinese-Speaking Groups](https://www.trendmicro.com/en_us/research/24/f/noodle-rat-reviewing-the-new-backdoor-used-by-chinese-speaking-g.html) -- Trend Micro * [RevivalStone: Winnti Group](https://www.lac.co.jp/lacwatch/report/20250213_004283.html) -- LAC's Cyber Emergency Center Back to top ### Tags * [Endpoint](https://unit42.paloaltonetworks.com/tag/endpoint/ "endpoint") * [Linux Malware](https://unit42.paloaltonetworks.com/tag/linux-malware/ "Linux Malware") * [Machine Learning](https://unit42.paloaltonetworks.com/tag/machine-learning/ "Machine Learning") * [PowerShell](https://unit42.paloaltonetworks.com/tag/powershell/ "PowerShell") * [Remote Access Trojan](https://unit42.paloaltonetworks.com/tag/remote-access-trojan/ "Remote Access Trojan") * [VBScript](https://unit42.paloaltonetworks.com/tag/vbscript/ "VBScript") * [Winnti](https://unit42.paloaltonetworks.com/tag/winnti/ "Winnti") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Roles Here? Roles There? Roles Anywhere: Exploring the Security of AWS IAM Roles Anywhere](https://unit42.paloaltonetworks.com/aws-roles-anywhere/ "Roles Here? Roles There? Roles Anywhere: Exploring the Security of AWS IAM Roles Anywhere") ### Table of Contents * ### Related Articles * [Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "article - table of contents") * [Tracking TamperedChef Clusters via Certificate and Code Reuse](https://unit42.paloaltonetworks.com/tracking-tampered-chef-clusters/ "article - table of contents") * [That AI Extension Helping You Write Emails? It's Reading Them First](https://unit42.paloaltonetworks.com/high-risk-gen-ai-browser-extensions/ "article - table of contents") ## Related Resources ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/) * [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API") * [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway") * [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)