[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 13 min read Related Products [![Advanced DNS Security icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced DNS Security](https://unit42.paloaltonetworks.com/product-category/advanced-dns-security/ "Advanced DNS Security")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Cortex icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex](https://unit42.paloaltonetworks.com/product-category/cortex/ "Cortex")[![Cortex Xpanse icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex Xpanse](https://unit42.paloaltonetworks.com/product-category/cortex-xpanse/ "Cortex Xpanse")[![Next-Generation Firewall icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Lior Rochberger](https://unit42.paloaltonetworks.com/author/lior-rochberger/) * [Yoav Zemah](https://unit42.paloaltonetworks.com/author/yoav-zemah/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:January 29, 2025 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [China](https://unit42.paloaltonetworks.com/tag/china/) * [CL-STA-0048](https://unit42.paloaltonetworks.com/tag/cl-sta-0048/) * [Cobalt Strike](https://unit42.paloaltonetworks.com/tag/cobalt-strike/) * [Data exfiltration](https://unit42.paloaltonetworks.com/tag/data-exfiltration/) * [Mimikatz](https://unit42.paloaltonetworks.com/tag/mimikatz/) * [PlugX](https://unit42.paloaltonetworks.com/tag/plugx/) * [Web shells](https://unit42.paloaltonetworks.com/tag/web-shells/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/espionage-campaign-targets-south-asian-entities/?pdf=download&lg=en&_wpnonce=dc23a6ba65 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/espionage-campaign-targets-south-asian-entities/?pdf=print&lg=en&_wpnonce=dc23a6ba65 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=CL-STA-0048:%20An%20Espionage%20Operation%20Against%20High-Value%20Targets%20in%20South%20Asia&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fespionage-campaign-targets-south-asian-entities%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fespionage-campaign-targets-south-asian-entities%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fespionage-campaign-targets-south-asian-entities%2F&title=CL-STA-0048:%20An%20Espionage%20Operation%20Against%20High-Value%20Targets%20in%20South%20Asia "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fespionage-campaign-targets-south-asian-entities%2F&text=CL-STA-0048:%20An%20Espionage%20Operation%20Against%20High-Value%20Targets%20in%20South%20Asia "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fespionage-campaign-targets-south-asian-entities%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=CL-STA-0048:%20An%20Espionage%20Operation%20Against%20High-Value%20Targets%20in%20South%20Asia%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fespionage-campaign-targets-south-asian-entities%2F "Share in Mastodon") ## **Executive Summary** We identified a cluster of activity that we track as [CL-STA-0048](https://unit42.paloaltonetworks.com/from-activity-to-formal-naming/). This cluster targeted high-value targets in South Asia, including a telecommunications organization. This activity cluster used rare tools and techniques including the technique we call Hex Staging, in which the attackers deliver payloads in chunks. Their activity also includes exfiltration over DNS using ping, and abusing the [SQLcmd](https://learn.microsoft.com/en-us/sql/tools/sqlcmd/sqlcmd-utility?view=sql-server-ver16&tabs=go%2Cwindows) utility for data theft. Based on an analysis of the tactics, techniques and procedures (TTPs), as well as the tools used, the infrastructure and the victimology, we assess with moderate-high confidence that this activity originates in China. The campaign primarily aimed to obtain the personal information of government employees and steal sensitive data from targeted organizations. These objectives bear the hallmarks of a nation-state advanced persistent threat (APT) espionage operation. The threat actor behind this campaign demonstrated a methodical approach to network penetration to establish a foothold. We observed systematic attempts to exploit known vulnerabilities on public-facing servers, specifically targeting the following services: * IIS * Apache Tomcat * MSSQL services Organizations that protect sensitive information should focus on patching commonly exploited vulnerabilities. They should also follow best practices for IT hygiene, as APTs frequently attempt to gain access using methods that have proven successful in the past. We are sharing our analysis to provide defenders with means to detect and protect themselves against such advanced attacks. Palo Alto Networks customers are better protected from the threats discussed in this article through [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) and [XSIAM](https://www.paloaltonetworks.com/resources/infographics/xsiam-product-tour?utm_source=google-jg-amer-cortex-socf-siam&utm_medium=paid_search&utm_campaign=google-cortex-xsiam-amer-multi-awareness-en-eg-non_brand-broad&utm_content=7014u000001eDtMAAU&utm_term=siem%20integration&cq_plac=&cq_net=g&gad_source=1&gclid=EAIaIQobChMI9sLv--faiAMVVnFHAR1IcyvDEAAYASAAEgJ8VPD_BwE). Customers are also better protected through the following products and services: * [Cloud-Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) for the [Next-Generation Firewall](https://www.paloaltonetworks.com/network-security/next-generation-firewall), including [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire), [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering/administration) and [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security). * [Cortex Xpanse](https://docs-cortex.paloaltonetworks.com/p/XPANSE) provides proactive detection of potential adversary entry points If you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html). | **Related Unit 42 Topics** | [**China**](https://unit42.paloaltonetworks.com/tag/china/), **[Cobalt Strike](https://unit42.paloaltonetworks.com/tag/cobalt-strike/)** , **[Data Exfiltration](https://unit42.paloaltonetworks.com/tag/data-exfiltration/)** | |----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| ## **Timeline of Activity** Throughout our investigation, we observed a distinct sequence of events that characterized the threat actor's activities. Figure 1 illustrates this timeline, showcasing the key stages and progression of the attack. ![Timeline diagram titled 'CL-STA-0048 Timeline' detailing various cybersecurity events from May 2024 to November 2024, including tasks like 'IIS Server Exploit Attempt' and 'User Creation Apache' along with others related to SQL injection, credential theft, and server access. There are five points in the series.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/01/word-image-322777-138128-1.png) Figure 1. Activity timeline of CL-STA-0048. ## **Exploiting Multiple Entry Points** We observed the threat actor attempting to exploit three critical services, one after the other: * IIS * Apache Tomcat * MSSQL Services With each failure, the threat actor adapted, targeting the next vulnerable asset in this list. ### The Initial Target: Attempting to Exploit IIS Servers On the first attempt, the threat actor tried to exploit vulnerabilities on multiple IIS servers in the environment, trying to deliver and deploy several web shells. These attempts were blocked by Cortex XDR. ### Anti-Webshell and Anti-Exploitation Modules The attackers' attempts to deploy a web shell were also prevented by Cortex XDR. ### The Attackers Shift to Apache Tomcat After failing to exploit the IIS servers, the threat actor targeted an internet-facing Apache server, deploying a [ColdFusion](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-339a) web shell as shown in Figure 2. This was again blocked by Cortex XDR. ![Screenshot of code with attributes and tags like 'Form.Action', 'FileContents', and 'uploadcss', aimed at handling file uploads and form submissions, viewed in a code editor with a dark background and color-coded text.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/01/word-image-326622-138128-2.png) Figure 2. ColdFusion web shell used in the attack. ### One Final Attempt: An MSSQL Server On the third attempt, the threat actor was able to compromise an unpatched internet-facing MSSQL server. The following section details the malicious activity that we observed from the compromised server. ## **Reconnaissance and a Rarely Seen Exfiltration Technique** The threat actor leveraged PowerShell to download multiple batch scripts from a remote server. These scripts executed commands such as tasklist to enumerate running processes on compromised machines and dir to list the contents of directories. The scripts exfiltrated command outputs by formatting each line as a string constructed of a series of subdomains and sending ping requests to these subdomains. Each ping command triggered a DNS request, transmitting the exfiltrated data to the attackers via DNS. The threat actor used dnslog.pw, a Chinese DNS logging tool for pen testers, to capture the output. Figure 3 below illustrates this data exfiltration technique. ![Process tree in Cortex XDR showing a network of processes. The processes are visually connected by lines, indicating interactions and data flows, with numerical annotations and icons representing different statuses or functions. Some text and elements are blurred for privacy.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/01/word-image-329289-138128-3.png) Figure 3. Process tree of the data exfiltration using the ping command. In addition, the threat actor attempted to save the output of the dir command into text files and then uploaded the output file to their command and control (C2) server using PowerShell. Figure 4 below shows the command they used. ![Text showing command line instructions for the exfiltration.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/01/word-image-331996-138128-4.png) Figure 4. Exfiltration command. ## **Preparing the Ground: The "Hex Staging" Method and Delivering Malware** ### PlugX as the Attacker's Main Backdoor The initial and primary backdoor the threat actor used in this attack was the [PlugX](https://attack.mitre.org/software/S0013/) backdoor. PlugX is a well-known remote access tool (RAT) with modular plugins and customizable settings that has been popular for over a decade, primarily among [Chinese-speaking threat groups](https://unit42.paloaltonetworks.com/plugx-variants-in-usbs/). The threat actor abused certutil to download the PlugX component from a remote domain under the following URL path: * https://h5.nasa6\[.\]com/shell/ The attackers dropped and executed the following payloads: * Acrobat.exe - A legitimate Adobe Acrobat binary * Acrobat.dxe - An encrypted PlugX payload * Acrobat.dll - A PlugX loader The payloads were saved under the path C:\\ProgramData\\DSSM\\ The threat actor then used the [DLL sideloading technique](https://attack.mitre.org/techniques/T1574/002/) and exploited vulnerable legitimate binaries (Acrobat.exe) to initiate the PlugX loader Acrobat.dll. This [technique](https://unit42.paloaltonetworks.com/dll-hijacking-techniques/) was detected by Cortex XDR. When the legitimate binary successfully sideloaded the PlugX loader, it searched for the payload Acrobat.dxe in the system. Once it found the payload, the PlugX loader proceeded to load, decrypt and then inject it into a legitimate instance of svchost.exe. The PlugX payload then connected to the C2 server mail.tttseo\[.\]com, executing in memory as a detection evasion attempt. Talos mentioned similar TTPs including the same file names, several hashes and the C2 address in their September 2024 blog about a Chinese threat actor called [DragonRank](https://blog.talosintelligence.com/dragon-rank-seo-poisoning/). Figure 5 shows how Cortex XDR captured the PlugX execution flow. ![Cortex XDR network security alert interface showing two warnings with associated process details, displaying IP addresses and module paths. Some information is redacted.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/01/word-image-334521-138128-5.png) Figure 5. Detection of PlugX execution flow, as shown in Cortex XDR. ### Hex Staging: Another Rarely Seen Technique Used by the Threat Actor Once the threat actor gained a foothold inside the network, they attempted to upload additional tools. They employed a stealthy and uncommon technique to do this, in which the attackers deliver payloads in chunks ([T1027: Obfuscated Files or Information)](https://attack.mitre.org/techniques/T1027/). We call this technique Hex Staging. In Hex Staging, an attacker incrementally writes hex-encoded data into a temporary file piece by piece, using commands passed to cmd.exe. This method avoids detection systems that scan for direct file writes. Once the file is assembled in hex format, the attacker uses a tool like certutil to decode the hex data back into ASCII. This content could be either binary executables or scripts. This method bypasses conventional security detection by using native Windows utilities to covertly deliver and execute malicious code. Figure 6 shows an example of the Hex Staging commands used by the threat actor. ![Screenshot of a table in Cortex XDR with an MZ header highlighted.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/01/word-image-337833-138128-6.png) Figure 6. Hex Staging commands. The threat actor attempted to deliver multiple files using this method. This included binary files such as Cobalt Strike loaders and implants, as well as a .sql script, which we will describe later in this post. A PowerShell script that loaded Cobalt Strike (shown in Figure 7) was among the payloads they wrote using that technique. It was detected and prevented by Cortex XDR. ![Screenshot of a computer screen displaying complex programming code in an IDE with syntax highlighting, involving functions and system calls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/01/word-image-340634-138128-7.png) Figure 7. Alert for the malicious PowerShell script, as shown in Cortex XDR. ### Privilege Escalation Tools #### SspiUacBypass After establishing a foothold in the environment, we observed the threat actor attempting to bypass User Account Control (UAC), leveraging the [SspiUacBypass](https://github.com/antonioCoco/SspiUacBypass) tool. This technique exploits the [Windows Security Support Provider Interface (SSPI)](https://learn.microsoft.com/en-us/windows-server/security/windows-authentication/security-support-provider-interface-architecture) to sidestep UAC prompts, allowing the actor to run high-privileged processes without user consent. #### The Potato Suite To successfully execute certain tools, the threat actors needed to run their tools and commands with adequate privileges, such as Admin or SYSTEM. To do so, they used different tools from the popular Potato Suite, a collection of various native Windows privilege escalation tools. The main tools that we observed during the investigation were: * BadPotato: A local privilege escalation tool that elevates user privileges to SYSTEM for command execution * RasmanPotato: This tool exploits the Windows [Remote Access Connection Manager](https://learn.microsoft.com/en-us/sysinternals/downloads/rdcman) (RASMAN) service to gain system-level access, allowing high-privilege operations without user interaction ### Command-and-Control Tools #### SoftEther VPN Another tool that we observed the threat actor using is a renamed version of the open-source SoftEther VPN. This software is flexible and has multi-protocol support. Threat actors, [particularly those in Chinese groups](https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2024-q3-2024/), frequently abuse it for stealthy communications and bypassing network restrictions. Figure 8 shows the command the threat actors used to download the client and configuration file. ![Screenshot showing two Command Prompt inputs executing commands with parameters that include URLs and file paths related to the FortiEDR software.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/01/word-image-344839-138128-8.png) Figure 8. The command used to download the SoftEther VPN client and configuration file. #### Winos4.0-Based Downloader The threat actor also attempted to use a downloader built using the advanced malicious framework [Winos4.0](https://www.bleepingcomputer.com/news/security/hackers-increasingly-use-winos40-post-exploitation-kit-in-attacks/). The downloader, placed under drivers\\etc masquerading as hosts.exe, attempted to connect to the IP address 154.201.68\[.\]57. After a successful connection, it downloads the payload and saves it into the registry key d33f351a4aeea5e608853d1a56661059. It then executes the payload. Fortinet observed similar behavior as part of the execution of another malware called [ValleyRAT](https://www.fortinet.com/blog/threat-research/valleyrat-campaign-targeting-chinese-speakers), which we believe the threat actor built using the same framework. The downloader variant we discovered also leverages the [KCP Protocol](https://github.com/skywind3000/kcp). This is a fast and reliable [automatic repeat-request](https://en.wikipedia.org/wiki/Automatic_repeat_request) (ARQ) protocol that provides low-latency and faster communications. Chinese threat actors were the [main users of this protocol \[PDF\]](https://www.virusbulletin.com/uploads/pdf/conference/vb2023/papers/Lets-go-door-with-KCP.pdf) in the past, including the infamous [APT41](https://global.ptsecurity.com/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new). This corresponds with the fact that the main GitHub page is written in Mandarin, suggesting it mainly addresses Mandarin-speaking hackers. ## **Cobalt Strike Execution** The threat actor deployed Cobalt Strike to execute additional malicious activities within the compromised environment. Using the Hex Staging technique mentioned earlier, the loader was dropped onto the SQL server. Upon execution, it injected the Cobalt Strike beacon into winlogon.exe, initiating communication with the configured C2 server sentinelones\[.\]com. One of their initial objectives was dumping the LSASS process. This attempt was detected and successfully blocked by Cortex XDR, preventing the harvesting of credentials. The threat actor also used the Cobalt Strike implant to deliver additional payloads. Those payloads were two sets of legitimate binaries and DLLs: * The first pair was a legitimate ecmd.exe and the malicious DLL msvcp140.dll * The second pair was the AppLaunch.exe application and the malicious DLL mscoree.dll The threat sideloaded the malicious DLLs to the legitimate binaries to load [Stowaway](https://github.com/ph4ntonn/Stowaway/blob/master/README_EN.md), a multi-hop proxy tool, shown in Figure 9 below. The threat actor used this tool to create a connection back to one of its main C2 servers: 43.247.135\[.\]106. After failing to load the malicious DLLs, the threat actor tried to use another tool for the same purpose: [iox](https://github.com/EddieIvan01/iox), a port forward and intranet proxy tool. Finally, the actor attempted to create a new database user through the Cobalt Strike beacon. We will explore this step and its implications in detail in the [following section](#post-138128-_179f1fh0662z). ![Cortex XDR process tree showing a cyber attack sequence, with numbered steps indicating the progression of processes and interactions between files and commands, including connections to IP addresses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/01/word-image-347562-138128-9.png) Figure 9. Execution flow of Cobalt Strike, as shown in Cortex XDR. ## **Aiming Toward the Database: Stealing Tables Data** ### Creating a Privileged Database User Once the threat actor established their presence in the network, they attempted to exfiltrate sensitive data from SQL servers. The threat actor initially attempted to create a database user with the username webuseraa and password teasd$%!FFr. They granted the user System Administrator privileges on the main database using the command shown in Figure 10. ![Command prompt screenshot showing the execution of SQL commands to create a login named 'newuseraa' with a specified password and adding this user to the 'sysadmin' role on a Microsoft SQL server.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/01/word-image-350792-138128-10.png) Figure 10. Creation of database user. ### Deploying a Malicious SQL Script The attacker also created an SQL script named 1.sql.tmp using the Hex Staging technique mentioned earlier in this post. They first decoded the hex file into ASCII using certutil and saved the file as 1.sql (shown in Figure 11). ![Screenshot of a computer screen displaying a complex SQL query code on a dark background with light text.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/01/word-image-354076-138128-11.png) Figure 11. The malicious SQL script. Then they executed the script and saved the output into the text file shown in Figure 12 below. ![Screenshot displaying a command line interface with a typed command that includes a file path pointing to the "cmd.exe" in the Windows System32 directory.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/01/word-image-357116-138128-12.png) Figure 12. Execution of the malicious SQL script. This script identifies and exfiltrates sensitive contact information stored across multiple databases by searching for columns that could contain phone-related data, such as those named "phone," "Mobile" or "TEL." The script then aggregates results across databases, generating a list with the database name, schema, table, column names and total row count for each match. Figure 13 shows the execution flow of the SQL script. ![Cortex XDR process tree depicting various CMD command lines involving system tasks. The flow starts from a single point on the left, expanding into multiple branches.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/01/word-image-359581-138128-13.png) Figure 13. Execution flow of the SQL script, as shown in Cortex XDR. After executing the script, the threat actor attempted to exfiltrate the output text file containing the results to their C2 server, as shown in Figure 14. They then deleted the script from the server. ![Screenshot of text on a computer screen displaying a command line prompt executing a PowerShell script.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/01/word-image-362778-138128-14.png) Figure 14. Exfiltration command. ### The Abuse of Sqlcmd.exe for Data Exfiltration By leveraging the [sqlcmd](https://learn.microsoft.com/en-us/sql/tools/sqlcmd/sqlcmd-utility?view=sql-server-ver16&tabs=go%2Cwindows&pivots=cs1-bash) utility, the attacker connected to the local SQL server instance (127.0.0\[.\]1) on port 1434 and executed a dynamic SQL query. Such a query creates a temporary table to store metadata about all tables across accessible databases. The script dynamically generates SQL commands to iterate through all user databases (excluding system databases) and retrieves details like database name, schema name and table name. Figure 15 below shows the database harvesting command. ![Screenshot showing a command line interface executing a script that interacts with system databases.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/01/word-image-365337-138128-15.png) Figure 15. DB harvesting command-line execution. The results are then sorted and written into an output file (C:\\users\\public\\123.txt), which the threat actors tried to exfiltrate later, as shown in Figure 16 below. After that, the threat actor deleted the temporary table. ![Screenshot showing a snippet of computer code for exfiltration.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/01/word-image-367995-138128-16.png) Figure 16. Exfiltration command. Finally, the threat actor attempted to extract personally identifiable information (PII) and sensitive client data from one of the databases, specifically targeting details such as: * Client names * Mobile numbers * Gender * Birth dates * Email IDs * Residential addresses The command groups this data by mobile number and saves the output as a .zip file, as shown in Figure 17. ![Screenshot displaying a line of SQL code on a dark background with syntax highlighting, showing commands and functions for querying client details from a database.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/01/word-image-370866-138128-17.png) Figure 17. Database theft command-line execution. ## **Connection to the Chinese Nexus** ### Overlaps with DragonRank The threat actor behind this cluster of activity employed PlugX as one of its primary backdoors. They used specific components (notably the loader and payload), exhibiting an overlap with those used by [DragonRank](https://blog.talosintelligence.com/dragon-rank-seo-poisoning/), a recently identified Chinese threat group. We lack sufficient data on DragonRank to definitively link it to CL-STA-0048. However, we acknowledge the similarities between the two while keeping CL-STA-0048 as a distinct cluster for tracking purposes. This allows us to monitor for potential connections without making premature conclusions. ### Activity Time Frame During our investigation, we successfully traced the time frame of the threat actor's interactive sessions. We focused on hands-on-keyboard commands executed on the compromised SQL server, as well as commands sent to the different active backdoors. A thorough review of the activity's time over several months revealed a notable and consistent pattern. Our findings, as illustrated in Figure 18 below, demonstrate a correlation with typical 9-to-5 working hours in the UTC+8 time zone. This time period notably aligns with the business hours of various Asian nations, with China being a prominent example. ![Dual line chart showing two data sets, plotted over time.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/01/word-image-373622-138128-18.png) Figure 18. Comparison of activity time frame between UTC and UTC+8. ### DNS Logging Service Figure 19 shows that the threat actor used a DNS logging service primarily designed for a Chinese-speaking audience to exfiltrate command output, as we mentioned earlier in this article. Although this service is globally accessible, its usage patterns and associated tool ecosystems suggest a predominant adoption within Chinese cybersecurity circles, where it closely aligns with local security testing practices. ![Screenshot of a website named DNSlog.pw featuring the DNSlog System. The text is in Chinese and describes the website.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/01/word-image-376694-138128-19.png) Figure 19. DNSlog System web description. ### KCP Protocol The threat actor's use of a Winos4.0-based Downloader leveraging the KCP Protocol could suggest a Chinese origin. The protocol has been historically associated with Chinese threat actors like APT41 and is documented primarily in Mandarin, indicating its intended audience is Chinese-speaking developers. This linguistic and operational context points to a likely connection to the Chinese cyberthreat ecosystem. ### Supershell Panel During our investigation, we observed the attackers downloading several files from the IP address 206.237.0\[.\]49. [Elastic](https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657) disclosed this IP address in January 2024 as part of the Supershell C2 platform. While [Supershell](https://github.com/tdragon6/Supershell/tree/main) is openly available on GitHub, its interface and documentation are primarily tailored to a Mandarin-speaking audience, further solidifying the connection to the Chinese nexus. ## **Conclusion** The CL-STA-0048 campaign represents a significant threat, targeting government and telecom entities in South Asia with a clear focus on espionage. The threat actor behind it leverages tactics to evade detection, bypass security measures and exfiltrate sensitive data from high-value targets. CL-STA-0048 exploits unpatched vulnerabilities in widely used services such as IIS, Apache Tomcat and MSSQL. It adapts to new defenses and deploys rarely seen techniques, adjusting its methods to overcome defenses and achieve its objectives. Our analysis indicates a strong link between this group and the Chinese nexus based on the observed tools, techniques and victimology. These findings emphasize the critical need for organizations to prioritize proactive cybersecurity measures. Addressing known vulnerabilities, maintaining robust IT hygiene and employing vigilant threat monitoring are essential to counter adversaries like CL-STA-0048. Organizations can better protect sensitive data and defend against advanced and persistent threats by strengthening security measures and staying informed about emerging threats. ## **Protections and Mitigations** For Palo Alto Networks customers, our products and services provide the following coverage associated with this activity cluster: * [Advanced WildFire](https://www.paloaltonetworks.com/products/secure-the-network/wildfire) cloud-delivered malware analysis service accurately identifies the PlugX and CobaltStrike samples mentioned in this article as malicious. * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) and [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/dns-security) identify domains associated with this group as malicious. * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) and [XSIAM](https://docs-cortex.paloaltonetworks.com/p/XSIAM) are designed to: * Prevent the execution of known malicious malware and also prevent the execution of unknown malware using [Behavioral Threat Protection and](https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/threat-prevention) machine learning based on the Local Analysis module. * Protect against exploitation of different vulnerabilities using the [Anti-Exploitation modules](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Endpoint-Protection-Capabilities) as well as Behavioral Threat Protection. * Detect post-exploit activity, including [credential-based attacks](https://www.paloaltonetworks.com/resources/techbriefs/cortex-xdr-identity-analytics), with behavioral [analytics](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Analytics-Concepts) through Cortex XDR Pro and XSIAM. * Detect user and credential-based threats by analyzing anomalous user activity from multiple data sources. * Protect from threat actors dropping and executing commands from web shells using Anti-Webshell Protection. * [Cortex Xpanse](https://docs-cortex.paloaltonetworks.com/p/XPANSE) is able to detect internet-exposed Microsoft IIS, Apache Tomcat and MSSQL Servers, among hundreds of other types of enterprise applications. If you think you might have been impacted or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call: * North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) * UK: +44.20.3743.3660 * Europe and Middle East: +31.20.299.3130 * Asia: +65.6983.8730 * Japan: +81.50.1790.0200 * Australia: +61.2.4062.7950 * India: 00080005045107 Palo Alto Networks has shared these findings, including file samples and indicators of compromise, with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org). ## **Indicators of Compromise** ### Cobalt Strike Loaders * 525540eac2d90c94dd3352c7dd624720ff2119082807e2670785aed77746301d * af0baf0a9142973a3b2a6c8813a3b4096e516188a48f7fd26ecc8299bce508e1 ### Cobalt Strike C2 * sentinelones\[.\]com ### PlugX * 3503d6ccb9f49e1b1cb83844d1b05ae3cf7621dfec8dc115a40abb9ec61b00bb * 0f85b67f0c4ca0e7a80df8567265b3fa9f44f2ad6ae09a7c9b7fac2ca24e62a8 ### PlugX C2 * mail.tttseo\[.\]com ### PotatoSuite * c5af6fd69b75507c1ea339940705eaf61deadd9c3573d2dec5324c61e77e6098 * 8dfc107662f22cff20d19e0aba76fcd181657255078a78fb1be3d3a54d0c3d46 ### SspiUacBypass * 336892ff8f07e34d18344f4245406e001f1faa779b3f10fd143108d6f30ebb8a ### Winos4.0-based Malware * 35da93d03485b07a8387e46d1ce683a81ae040e6de5bb1a411feb6492a0f8435 ### Winos4.0-based Malware C2 * 154\.201.68\[.\]57 ### Stowaway * a09179dec5788a7eee0571f2409e23df57a63c1c62e4b33f2af068351e5d9e2d * edc9222aece9098ad636af351dd896ffee3360e487fda658062a9722edf02185 ### C2 Servers * 43\.247.135\[.\]106 * 38\.54.30\[.\]117 * 38\.54.56\[.\]88 * 65\.20.69\[.\]103 * 52\.77.234\[.\]115 * 192\.227.180\[.\]124 * 107\.174.39\[.\]125 * 18\.183.94\[.\]114 * 206\.237.0\[.\]49 ### Domains * h5.nasa6\[.\]com * test.nulq5r.ceye\[.\]io * web.nginxui\[.\]cc ## Additional Resources * [DragonRank, a Chinese-speaking SEO manipulator service provider](https://blog.talosintelligence.com/dragon-rank-seo-poisoning/) -- Talos * [Unmasking a Financial Services Intrusion: REF0657](https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657) -- Elastic Security Labs * [A Deep Dive into a New ValleyRAT Campaign Targeting Chinese Speakers](https://www.fortinet.com/blog/threat-research/valleyrat-campaign-targeting-chinese-speakers) -- FortiGuard Labs, Fortinet * [Behind the Great Wall: Void Arachne Targets Chinese-Speaking Users With the Winos 4.0 C\&C Framework](https://www.trendmicro.com/en_us/research/24/f/behind-the-great-wall-void-arachne-targets-chinese-speaking-user.html) -- Trend Micro Back to top ### Tags * [China](https://unit42.paloaltonetworks.com/tag/china/ "China") * [CL-STA-0048](https://unit42.paloaltonetworks.com/tag/cl-sta-0048/ "CL-STA-0048") * [Cobalt Strike](https://unit42.paloaltonetworks.com/tag/cobalt-strike/ "Cobalt Strike") * [Data exfiltration](https://unit42.paloaltonetworks.com/tag/data-exfiltration/ "data exfiltration") * [Mimikatz](https://unit42.paloaltonetworks.com/tag/mimikatz/ "Mimikatz") * [PlugX](https://unit42.paloaltonetworks.com/tag/plugx/ "PlugX") * [Web shells](https://unit42.paloaltonetworks.com/tag/web-shells/ "web shells") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Threat Brief: CVE-2025-0282 and CVE-2025-0283 (Updated March 11)](https://unit42.paloaltonetworks.com/threat-brief-ivanti-cve-2025-0282-cve-2025-0283/ "Threat Brief: CVE-2025-0282 and CVE-2025-0283 (Updated March 11)") ### Table of Contents * ### Related Articles * [The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version](https://unit42.paloaltonetworks.com/xcsset-v40-malware-analysis/ "article - table of contents") * [CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure](https://unit42.paloaltonetworks.com/cl-sta-1062-tinyrct-backdoor/ "article - table of contents") * [Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System](https://unit42.paloaltonetworks.com/autonomous-ai-cloud-attacks/ "article - table of contents") ## Related Malware Resources ![Pictorial representation of a magnifying glass illuminating a glowing orange circular digital circuit interface on a dark, high-tech background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Myth-Busting_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) September 16, 2026 [#### Atomic macOS (AMOS) Stealer Activity](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/) * [MacOS](https://unit42.paloaltonetworks.com/tag/macos/ "macOS") * [Threat intelligence](https://unit42.paloaltonetworks.com/tag/threat-intelligence/ "threat intelligence") * [Unit 42](https://unit42.paloaltonetworks.com/tag/unit-42/ "Unit 42") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/ "Atomic macOS (AMOS) Stealer Activity") ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/content/pan/en_US/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)