[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/emotet-command-and-control/) * [Japanese](https://unit42.paloaltonetworks.com/ja/emotet-command-and-control/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # Emotet Command and Control Case Study ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 9 min read Related Products [![Advanced Threat Prevention icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced Threat Prevention](https://unit42.paloaltonetworks.com/product-category/advanced-threat-prevention/ "Advanced Threat Prevention")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Next-Generation Firewall icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Chris Navarrete](https://unit42.paloaltonetworks.com/author/chris-navarrete/) * [Yanhui Jia](https://unit42.paloaltonetworks.com/author/yanhui-jia/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:April 9, 2021 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [C2](https://unit42.paloaltonetworks.com/tag/c2/) * [Command and Control](https://unit42.paloaltonetworks.com/tag/command-and-control/) * [Emotet](https://unit42.paloaltonetworks.com/tag/emotet/) * [Exploit](https://unit42.paloaltonetworks.com/tag/exploit/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/emotet-command-and-control/?pdf=download&lg=en&_wpnonce=279fa6c5e6 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/emotet-command-and-control/?pdf=print&lg=en&_wpnonce=279fa6c5e6 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Emotet%20Command%20and%20Control%20Case%20Study&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Femotet-command-and-control%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Femotet-command-and-control%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Femotet-command-and-control%2F&title=Emotet%20Command%20and%20Control%20Case%20Study "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Femotet-command-and-control%2F&text=Emotet%20Command%20and%20Control%20Case%20Study "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Femotet-command-and-control%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Emotet%20Command%20and%20Control%20Case%20Study%20https%3A%2F%2Funit42.paloaltonetworks.com%2Femotet-command-and-control%2F "Share in Mastodon") ## Executive Summary On March 8, 2021, Unit 42 published "[Attack Chain Overview: Emotet in December 2020 and January 2021](https://unit42.paloaltonetworks.com/attack-chain-overview-emotet-in-december-2020-and-january-2021/)." Based on that analysis, the updated version of Emotet talks to different command and control (C2) servers for data exfiltration or to implement further attacks. We observed attackers taking advantage of a sophisticated evasion technique and encryption algorithm to communicate with C2 servers in order to probe the victim's network environment and processes, allowing attackers to steal a user's sensitive information or drop a new payload. In this blog, we provide a step-by-step technical analysis, beginning from where the main logic starts, covering the encryption mechanisms and ending when the C2 data is exfiltrated through HTTP protocol to the C2 server. [Palo Alto Networks Next-Generation Firewall](https://www.paloaltonetworks.com/network-security/next-generation-firewall) customers are protected from Emotet with [Threat Prevention](https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/threat-prevention) and [WildFire](https://www.paloaltonetworks.com/products/secure-the-network/wildfire) security subscriptions. Customers are also protected with [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr). ## Technical Analysis This analysis will use custom function names (i.e., collect\_process\_data) that replace the regular IDA Pro's function format (i.e., sub\_\*) and will assume a 32-bit (x86) DLL executable with an image base address of 0x2E1000. The user can refer to the following image that contains function offsets, names and custom names for easy reference. **NOTE:** Sub-functions used are not listed, since these can be easily located from the presented function offsets. ![Figure 1. IDA’s functions reference information.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-31.png) Figure 1. IDA's functions reference information. The present analysis begins from the entry point function c2\_logic\_ep (sub\_2E2C63). #### Encryption API Functions This malware uses two main functions: encryption\_functions\_one and encryption\_functions\_two. Both functions makes use of Microsoft's Base Cryptography (CryptoAPI). The following section includes the properties used and actions performed by these crypto functions during the malware execution. * *CryptAcquireContextW* - Uses a **PROV\_DH\_SCHANNEL** as provider type (**0x18** ). The **CRYPT\_VERIFYCONTEXT** and **CRYPT\_SILENT** flags are combined with a bitwise-**OR** operation (**0xf0000040**) to make sure that no user interface (UI) is displayed to the user. * *CryptDecodeObjectEx* - Uses a message encoding type **X509\_ASN\_ENCODING** and **PKCS\_7\_ASN\_ENCODING** that are combined with a bitwise-**OR** operation (**0x10001** ), a structure type **X509\_BASIC\_CONSTRAINTS** (**0x13** ) and a total of **0x6a** bytes that are going to be decoded. * *CryptImportKey* - Imports a key-blob of **0x74** in size (bytes) and type **PUBLICKEYBLOB** (**0x6** ) with a **CUR\_BLOB\_VERSION** (**0x2**) version. * *CryptGenKey* - Uses an **ALG\_ID** value that is set to **CALG\_AES\_128** (**0x0000660e**) and generates a 128-bit AES session key. * *CryptCreateHash* - Uses an **ALG\_ID** value that is set to **CALG\_SHA** (**0x00008004**), which, as the the name suggests, sets the SHA hashing algorithm. * *CryptDuplicateHash* - Receives a handle to the hash to be duplicated. * *CryptEncrypt* - This function receives two main parameters: a handle to the encryption key generated by the *CryptGenKey* function and a handle to a hash object generated by *CryptCreateHash* . This value will be used after encryption by calling the *CryptEncrypt* function and passing as a parameter the pointer to the C2 data. * *CryptExportKey* - Uses a **SIMPLEBLOB** (**0x1** ) type and **CRYPT\_OAEP** (**0x00000040**) as a flag. The pointer to the buffer where the key-blob is exported is part of the malware's C2 data. * *CryptGetHashParam* - As in the case of the *CryptExportKey* function, the destination pointer is part of the malware's C2 data. * *CryptDestroyHash* - As its name implies, destroys the given hash. #### Machine ID Generation and Length Checking The generate\_machine\_id function, as its name states, is in charge of generating a machine identifier for the infected computer. The method used to generate the machine identifier is by making a call to the _snprintf function, which uses the format string %s_%08X to concatenate the value generated by *GetComputerNameA* and *GetVolumeInformationW* . In the particular case of the test machine used in this analysis, the resulting value is **ANANDAXPC\_58F2C41B**. ![Figure 2. Function call to generate a machine identifier (machine-ID value).](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-32.png) Figure 2. Function call to generate a machine identifier (machine-ID value). Once the machine-id is generated, a length-check verification is also generated. This is achieved by calling the "lstrlen" function wrapper gen\_machine\_id\_length and passing as a parameter the returning value from the previous function call. For the case of the testing machine, the resulting length was "**12** ", and such value will reside in a particular stack variable since it will be used as part of the C2 data. Subsequently, a new function call is made to the write\_GoR function. Its original purpose is unknown, however, based on the analysis and how the returning value (**0x16F87C**) is used. It's presumably a delimiter, since it is located at the end of the C2 data. ![Figure 3 . Function call to generate C2 data delimiter.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-33.png) Figure 3 . Function call to generate C2 data delimiter. #### Operating System Data Collection Part of the exfiltrated data also includes **OS information,** and this is achieved by calling the collect\_os\_data function. ![Figure 4. Function call to collect OS information.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-34.png) Figure 4. Function call to collect OS information. This function makes calls to *RtlGetVersion,* which stores data inside of an *OSVERSIONINFOW* structure, and *GetNativeSystemInfo* performs the same by saving its data inside a *SYSTEM\_INFO* structure. ![Figure 5. OSVERSIONINFOW and SYSTEM\_INFO structures filled up by API calls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-35.png) Figure 5. OSVERSIONINFOW and SYSTEM\_INFO structures filled up by API calls. Once the data structures are populated, specific data is fetched by the instructions located at these offsets: 0x2EC3DB (*Ret value* ), 0x2EC440 (*MajorVersion* ), 0x2EC3DB, 0x2EC3D0 (*MinorVersion* ) and 0x2EC45A (*Architecture|PROCESSOR\_ARCHITECTURE\_INTEL*). The returning value is computed by adding and multiplying against fixed values: *MajorVersion* , *MinorVersion* , *Architecture* and the returning value (0x1) of the *RtlGetNtProductType* call, which is a symbolic constant (\*NtProductWinNT)\*of the NT\_PRODUCT\_TYPE enumeration data type. The following Python code simulates the logic that generates such value. ![Figure 6. Python proof of concept (PoC) emulating the OS data generation algorithm.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-36.png) Figure 6. Python proof of concept (PoC) emulating the OS data generation algorithm. #### Remote Desktop Services Session Information Collection More calls are performed, including the one to *GetCurrentProcessId* , which retrieves the process identifier for the current process, and the returning value is passed to the *ProcessIdToSessionId* function as parameter. According to the [MSDN description](https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-processidtosessionid), the *ProcessIdToSessionId*function "retrieves the Remote Desktop Services session associated with a specified process." The returning value of this function indicates the Terminal Services session the current process is running on. ![Figure 7. Function call to retrieve the Terminal Service session identifier.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-37.png) Figure 7. Function call to retrieve the Terminal Service session identifier. #### Process Scanning and C2 Data Collection This function collects active running processes on the system by the execution of the traditional method of calling the *CreateToolhelp32Snapshot* , *Process32FirstW* , *GetCurrentProcessId* and *Process32NextW* functions. Before entering to this function, the instruction at offset 0x2E4715 loads the address of a local variable in the EAX register and pushed onto the stack. This variable will contain a pointer generated by a call to the *RtAllocateHeap* function that will eventually receive the process data information. ![Figure 8. Function call to generate and initialize values with process data.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-38.png) Figure 8. Function call to generate and initialize values with process data. This function also makes calls to the sub-function named copy\_collected\_data\_parent. During its execution, it generates a new memory section made by a call to the *RtlAllocateHeap* function, and some subsequent calls to the memcpy wrapper function to copy collected C2 data to the new allocated section. ![Figure 9. Function call that collects and initializes values with C2 data.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-39.png) Figure 9. Function call that collects and initializes values with C2 data. The next function to call is HTTP\_LAUNCHER, which contains sub-functions that provide web capability, among other tasks. At this point in time, the variables are initialized with the corresponding return values from the previously executed functions. The following ASCII dump shows the variable addresses, the related data and information about which function, or instruction offset, provided the given data. ![Figure 10. Stack-snapshot including collected data and the data generation functions references.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-40.png) Figure 10. Stack-snapshot including collected data and the data generation functions references. The next step is a call to the c2\_data\_write function, which calls the write\_collected\_data sub-function and passes as parameters two values: 1. A pointer to the C2 data (0x2EAC3E). 2. The returning value (address) of a new memory allocation generated by a call to the *RtlAllocateHeap* function located at offset 0x2F989B. This newly generated data passes through an algorithm, which in addition to writing (at offset 0x2FA830) also modifies certain bytes (at offset 0x2FA6DE) of the C2 data, especially some filename extensions. ![Figure 11. Function calls that write collected data in memory.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-41.png) Figure 11. Function calls that write collected data in memory. Once the data is collected, a call to write\_c2\_data\_zero is made, which will allocate additional memory by calling the AllocateHeap (0x2E99DC) function. This function will eventually be called twice, and it will call more sub-functions in where the instructions at offset 0x2F362A of the write\_c2\_data\_one function will generate two DWORD values: 0x1, which is a fixed value, and 0x132, which is the length of the C2 data. The next step is a call to copy\_c2\_data (a wrapper to memcpy at offset 0x2F794C) function, which copies the C2 data to a new location next to the two values mentioned earlier. ![Figure 12. Function calls that perform intermediary C2 data copying.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-42.png) Figure 12. Function calls that perform intermediary C2 data copying. The next sequential function execution is a call to *CryptDuplicateHash* . After that, a call to copy\_binary\_data is made, which makes a final C2 data copy to a new memory allocation. This location will contain the last C2 data before being encrypted by the *CryptEncrypt* function, as will be performed in subsequent steps. ![Figure 13. Function calls that make a final copy of unencrypted C2 data.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-43.png) Figure 13. Function calls that make a final copy of unencrypted C2 data. The following picture shows the buffer with its related values and description highlighted with different colors for easy reference. ![Figure 14. In-memory byte offsets and sizes, including individual descriptions.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-44.png) Figure 14. In-memory byte offsets and sizes, including individual descriptions. The next call is to the *CryptEncrypt* function wrapper, which will reach the real API function via an indirect call to the EAX register located at offset 0x2F0AD4. ![Figure 15. Function call to CryptEncrypt to encrypt C2 data.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-45.png) Figure 15. Function call to CryptEncrypt to encrypt C2 data. The following picture shows the before and after encryption status of the C2 data. ![Figure 16. Before and after encryption status of C2 data.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-46.png) Figure 16. Before and after encryption status of C2 data. Once the C2 data is encrypted, the following step is to export the current encryption key by calling the *CryptExportKey* function at offset 0x2EFF2C. ![Figure 17. Function call to CryptExportKey wrapper.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-47.png) Figure 17. Function call to CryptExportKey wrapper. After exporting the key, a loop located at offset 0x2EFF41 has an instruction at offset 0x2EFF43 that writes into C2 data 0x60 bytes of the exported key. ![Figure 18. Write loop to populate exported crypto key data.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-48.png) Figure 18. Write loop to populate exported crypto key data. Now, a call to the API function *CryptGetHashParam* is made with a parameter that contains a pointer to *CryptDestroyHash* that will write 20 bytes of the generated hash into the C2 data. ![Figure 19. Function call to CryptGetHashParam.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-49.png) Figure 19. Function call to CryptGetHashParam. The following image shows how the final C2 data is stored in memory. ![Figure 20. In-memory byte inclusion of Exported Key, Hash Value and Encrypted C2 data.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-50.png) Figure 20. In-memory byte inclusion of Exported Key, Hash Value and Encrypted C2 data. #### C2 Exfiltration: HTTP Post Request Generation At this stage, the C2 data containing **Exported Key** , **Hash Value** , and **Encrypted C2 data** are done. Thus, the last stage is the completion of the data exfiltration. The following steps prepare the required data (e.g., IP address, HTTP form structure and values, etc.). ![Figure 21. Function calls to fulfill the first half of HTTP requirements before data exfiltration.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-51.png) Figure 21. Function calls to fulfill the first half of HTTP requirements before data exfiltration. At this point, subsequent function calls are performed to generate the binary data that will be included within the HTTP form. The following section will describe the detailed steps that lead to such encrypted data and its exfiltration to the C2 server. This step consists of copying the C2 data (bytes) to the web form. This is achieved by the execution of the copy\_c2\_data sub-function. This function will generate a binary **MIME attachment** of the "application/octet-stream" content type with the input data to be suitable for binary transfer. ![Figure 22. Function calls to copy binary data to the web form.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-52.png) Figure 22. Function calls to copy binary data to the web form. At this stage, the final payload is preparing the environment to submit information to the C2 server. To do so, it executes function calls to retrieve the required data to finally perform the HTTP request. ![Figure 23. Function calls to fulfill the second half of HTTP requirements before data exfiltration.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-53.png) Figure 23. Function calls to fulfill the second half of HTTP requirements before data exfiltration. As can be seen in the function call list, the HttpSendRequestW() API function is used to send the data to the server. This function allows the sender to exceed the amount of data that is normally sent by HTTP clients. ![Figure 24. Wireshark capture showing POST request including Exported Key, Hash Value and Encrypted C2 data.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/text-table-description-automatically-generated.jpeg) Figure 24. Wireshark capture showing POST request including Exported Key, Hash Value and Encrypted C2 data. ## Conclusion Emotet was active in the wild for several years before a [coordinated law enforcement campaign](https://www.europol.europa.eu/newsroom/news/world%E2%80%99s-most-dangerous-malware-emotet-disrupted-through-global-action) shut down its infrastructure in late January 2021. Its attack tactics and techniques had evolved over time, and the attack chain is very mature and sophisticated, which makes it a good case study for security researchers. This research provides an example of Emotet C2 communication, including C2 server IP selection and data encryption, so we can better understand how Emotet malware utilizes this sophisticated technique to evade security production detection. Palo Alto Networks customers are protected from this kind of attack by the following: 1. [Threat Prevention](https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/threat-prevention) signatures [21201](https://threatvault.paloaltonetworks.com/?query=21201), [21185](https://threatvault.paloaltonetworks.com/?query=21185) and [21167](https://threatvault.paloaltonetworks.com/?query=21167) identify HTTP C2 requests attempting to download the new payload and post sensitive info. 2. [WildFire](https://www.paloaltonetworks.com/products/secure-the-network/wildfire) and [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) identify and block Emotet and its droppers. #### **Indicators of Compromise** ###### Samples 2cb81a1a59df4a4fd222fbcb946db3d653185c2e79cf4d3365b430b1988d485f ###### Droppers bbb9c1b98ec307a5e84095cf491f7475964a698c90b48a9d43490a05b6ba0a79 bd1e56637bd0fe213c2c58d6bd4e6e3693416ec2f90ea29f0c68a0b91815d91a ###### URLs http://allcannabismeds\[.\]com/unraid-map/ZZm6/ http://giannaspsychicstudio\[.\]com/cgi-bin/PP/ http://ienglishabc\[.\]com/cow/JH/ http://abrillofurniture\[.\]com/bph-nclex-wygq4/a7nBfhs/ https://etkindedektiflik\[.\]com/pcie-speed/U/ https://vstsample\[.\]com/wp-includes/7eXeI/ http://ezi-pos\[.\]com/categoryl/x/ ###### IPs 5\.2.136\[.\]90 161\.49.84\[.\]2 70\.32.89\[.\]105 190\.247.139\[.\]101 138\.197.99\[.\]250 152\.170.79\[.\]100 190\.55.186\[.\]229 132\.248.38\[.\]158 110\.172.180\[.\]180 37\.46.129\[.\]215 203\.157.152\[.\]9 157\.245.145\[.\]87 Back to top ### Tags * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [Command and Control](https://unit42.paloaltonetworks.com/tag/command-and-control/ "Command and Control") * [Emotet](https://unit42.paloaltonetworks.com/tag/emotet/ "Emotet") * [Exploit](https://unit42.paloaltonetworks.com/tag/exploit/ "exploit") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Attackers Conducting Cryptojacking Operation Against U.S. Education Organizations](https://unit42.paloaltonetworks.com/attackers-conducting-cryptojacking-u-s-education-organizations/ "Attackers Conducting Cryptojacking Operation Against U.S. Education Organizations") ### Table of Contents * ### Related Articles * [Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "article - table of contents") * [Almost Half of Malware Samples Communicate Direct to IP](https://unit42.paloaltonetworks.com/malware-bypass-dns-direct-to-ip/ "article - table of contents") * [TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development](https://unit42.paloaltonetworks.com/tuxbot-v3-evolution-iot-botnet/ "article - table of contents") ## Related Malware Resources ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/) * [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API") * [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway") * [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)