[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/ "Threat Actor Groups") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # Converging Interests: Analysis of Threat Clusters Targeting a Southeast Asian Government ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 12 min read Related Products [![Advanced DNS Security icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced DNS Security](https://unit42.paloaltonetworks.com/product-category/advanced-dns-security/ "Advanced DNS Security")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Cortex icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex](https://unit42.paloaltonetworks.com/product-category/cortex/ "Cortex")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Cortex XSIAM icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XSIAM](https://unit42.paloaltonetworks.com/product-category/cortex-xsiam/ "Cortex XSIAM")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Doel Santos](https://unit42.paloaltonetworks.com/author/doel-santos/) * [Hiroaki Hara](https://unit42.paloaltonetworks.com/author/hiroaki-hara/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:March 26, 2026 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [CL-STA-1048](https://unit42.paloaltonetworks.com/tag/cl-sta-1048/) * [CL-STA-1049](https://unit42.paloaltonetworks.com/tag/cl-sta-1049/) * [Stately Taurus](https://unit42.paloaltonetworks.com/tag/stately-taurus/) * [Trojan](https://unit42.paloaltonetworks.com/tag/trojan/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/espionage-campaigns-target-se-asian-government-org/?pdf=download&lg=en&_wpnonce=46edad538b "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/espionage-campaigns-target-se-asian-government-org/?pdf=print&lg=en&_wpnonce=46edad538b "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Converging%20Interests:%20Analysis%20of%20Threat%20Clusters%20Targeting%20a%20Southeast%20Asian%20Government&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fespionage-campaigns-target-se-asian-government-org%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fespionage-campaigns-target-se-asian-government-org%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fespionage-campaigns-target-se-asian-government-org%2F&title=Converging%20Interests:%20Analysis%20of%20Threat%20Clusters%20Targeting%20a%20Southeast%20Asian%20Government "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fespionage-campaigns-target-se-asian-government-org%2F&text=Converging%20Interests:%20Analysis%20of%20Threat%20Clusters%20Targeting%20a%20Southeast%20Asian%20Government "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fespionage-campaigns-target-se-asian-government-org%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Converging%20Interests:%20Analysis%20of%20Threat%20Clusters%20Targeting%20a%20Southeast%20Asian%20Government%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fespionage-campaigns-target-se-asian-government-org%2F "Share in Mastodon") ## Executive Summary Unit 42 researchers uncovered a series of cyberespionage campaigns targeting a government organization in Southeast Asia. Our initial investigation began with tracking Stately Taurus activity between June 1--Aug. 15, 2025. This activity involves USB-propagated malware called USBFect (aka HIUPAN), which deploys a PUBLOAD backdoor. Our investigation led to the discovery of two additional, distinct activity clusters we're tracking as CL-STA-1048 and CL-STA-1049. The attackers behind CL-STA-1048 used an espionage toolkit comprising several components: * EggStremeFuel backdoor * Masol remote access Trojan (RAT) * EggStreme Loader (which delivered the comprehensive Gorem RAT with keylogging) * A simple data theft tool we internally label TrackBak stealer In contrast, CL-STA-1049's operations involved using a novel loader, which we named Hypnosis loader, to deploy the FluffyGh0st RAT payload. These activity clusters overlap with publicly reported campaigns aimed at establishing persistent access. Significant overlap in tactics, techniques and procedures (TTPs) with known China-aligned campaigns suggests the clusters and threat group have a common target of interest, potentially coordinating their effort. Palo Alto Networks customers are better protected from the threats discussed in this article through the following products and services: * [Advanced WildFire](https://docs.paloaltonetworks.com/wildfire) * [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering) and [Advanced DNS Security](https://docs.paloaltonetworks.com/dns-security) * [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) and [XSIAM](https://docs-cortex.paloaltonetworks.com/p/XSIAM) If you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html). | **Related Unit 42 Topics** | **[Malware](https://unit42.paloaltonetworks.com/category/malware/)** | | **Threat Groups or Activity Clusters Discussed** | Cluster Bravo, Cluster Charlie, Crimson Palace, Earth Estries, Stately Taurus, Unfading Sea Haze, CL-STA-1048, CL-STA-1049 | | **Remote Access Trojans Discussed** | FluffyGh0st, Gh0st, Gorem, Masol | | **Loaders Discussed** | ClaimLoader, CoolClient, EggStreme, Hypnosis | | **Stealers Discussed** | TrackBak | | **Backdoors Discussed** | Backdr-NQ, EggStremeFuel, PUBLOAD, RawCookie | |--------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------| ## Southeast Asian Government Targeting This investigation revealed a persistent espionage campaign targeting a government organization in Southeast Asia. Our analysis identified three distinct clusters of activity in parallel within the victim's network, each with different tools and methods but likely working toward this common objective: * **Stately Taurus:** We attributed one of the activity clusters with high confidence to this threat actor, which leveraged USB-based malware to deploy the [PUBLOAD](https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/) backdoor, a consistent TTP for this group. * **CL-STA-1048:** This cluster includes attacks using a toolkit of espionage payloads, deploying multiple RATs like [MasolRAT](https://www.trendmicro.com/en_us/research/24/k/earth-estries.html) and the RawCookie backdoor. The use of diverse and sometimes noisy tooling suggests a determined effort to establish a foothold. This activity shows links to publicly reported China-affiliated actors like [Earth Estries](https://www.trendmicro.com/en_us/research/24/k/earth-estries.html) and those behind the [Crimson Palace](https://www.sophos.com/en-us/blog/operation-crimson-palace-sophos-threat-hunting-unveils-multiple-clusters-of-chinese-state-sponsored-activity-targeting-southeast-asia) Campaign. * **CL-STA-1049:** This cluster features stealth and persistence, with attackers using the novel Hypnosis loader to deploy the FluffyGh0st RAT. This activity overlaps with the China-aligned group known as [Unfading Sea Haze.](https://www.bitdefender.com/en-us/blog/businessinsights/deep-dive-into-unfading-sea-haze-a-new-threat-actor-in-the-south-china-sea) The convergence of these three distinct, China-aligned clusters against a single, high-value government target illustrates a complex and well-resourced operation. Figure 1 provides a visual overview of the relationships between these activity clusters, the tools used in the attacks and previously reported threat groups. ![A diagram depicting a network of cyber threats and defenses. Skulls represent threats, while gears and padlocks indicate security measures. Key elements include malware used by the different attackers.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/word-image-484412-176117-1.png) Figure 1. An overview of the activity clustering. ## **Stately Taurus - PUBLOAD Activity** On June 1, 2025, we detected PUBLOAD activity attributed to Stately Taurus across multiple endpoints at a government entity in Southeast Asia. Our investigation found the origin of this activity was likely a USB drive containing [USBFect](https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html). USBfect is a worm that spreads via removable media, often used to propagate PUBLOAD for lateral movement. This malware's functionality is identical to HIUPAN's, documented by [Trend Micro in 2024](https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html). We assess that USBFect and HIUPAN are the same malware family. The USBFect sample analyzed in this activity implemented the following previously observed capabilities: * Installing USBFect components onto the infected system * Monitoring for removable or hot-pluggable drive insertion * Copying USBFect components onto a removable or hot-pluggable drive However, this USBFect sample has an overt PDB filepath: D:\\WorkProject\\2023\\GJ0215\\src\\USBInfection\\sln\\USBFect\\Release\\USBFect.pdb. We found evidence of USBFect infection in multiple agents with the following path: D:\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\\_\\EVENT.dll. The EVENT.dll file has the following SHA256 hash: * 4b29b74798a4e6538f2ba245c57be82953383dc91fe0a91b984b903d12043e92 This malware is a variant of [ClaimLoader](https://0x0d4y.blog/mustang-panda-employ-publoader-through-claimloader-yes-another-dll-side-loading-technique-delivery-via-phishing/), which is embedded in the generated drive path and responsible for loading PUBLOAD into memory. We observed this propagation to multiple endpoints until Aug. 15, 2025, at 00:17:15 UTC. Endpoints with PUBLOAD malware also used the following file paths: * ProgramData/intel/\_/$.ini * ProgramData/Intel/\_/EVENT.dll * ProgramData/intel/\_/u2ec.dll * ProgramData/intel/\_/UsbConfig.exe * Libraries\\Dialogui\\EVENT.dll The malware stages these files to execute and propagate its payload via USB devices. ### **ClaimLoader** ClaimLoader (EVENT.dll) is a shellcode loader, documented by Japanese IT security company [LAC in 2022](https://www.lac.co.jp/lacwatch/report/20221117_003189.html), that loads the PUBLOAD backdoor in memory. The sample identified in this activity largely had the same capabilities, but with slight variations. The malware copies its components to a working directory (e.g., C:\\Users\\Public\\Libraries\\Dialogui). These components include: * A legitimate parent process * ClaimLoader itself The loader then registers the copied legitimate application in a Windows registry autorun key to establish persistence. ClaimLoader then uses an XOR key to decrypt an embedded shellcode payload and executes the shellcode by using the CryptEnumOIDInfo API. This technique, shown below in Figure 2, is similar to the one described in LAC's report. ![Code snippet displaying a function that decodes and runs shellcode. The code uses functions like `strcpy`, `VirtualAlloc`, `memcpy`, and `CryptEnumOIDInfo`. It comments on decoding the shellcode by XOR and running the shellcode via Callback.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/word-image-487510-176117-2.png) Figure 2. Shellcode decryption and execution by ClaimLoader. The shellcode is PUBLOAD, first documented by [Cisco Talos in 2022](https://blog.talosintelligence.com/mustang-panda-targets-europe/). Variants of PUBLOAD use either HTTP or TCP for command-and-control (C2) communications. The sample we observed is a variant that uses TCP. PUBLOAD encrypts data from the infected host, including: * Volume info * Computer name * Username * Tick count The malware accomplishes this by using multiple XOR loops and sends the information with a fake TLS header (17 03 03) over TCP. Once PUBLOAD receives a response from the C2 server, it decodes and executes the final payload in memory. During our analysis, we did not identify any further stages of tooling. In November 2024, we analyzed similar activity from Stately Taurus, including an identical [PUBLOAD sample](https://www.virustotal.com/gui/file/4b29b74798a4e6538f2ba245c57be82953383dc91fe0a91b984b903d12043e92/detection). This sample maintained consistent configurations and aligned with [Trend Micro's research](https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html) on the group. ### **CoolClient** During the same time period, on Aug. 4, 2025, at 08:50:15 UTC, we detected the two suspicious DLL files listed in Table 1 on an agent without PUBLOAD activity. |------------------------------------------------------------------|------------------------------------------------------------------------------------| | **SHA256** | **File Path** | | 835795aa494021752f21fbef63c81227c1b934437a02aa1f2a258c9f60b0b7a3 | C:\\ProgramData\\GoogleUpdate\\libvlc.dll | | 851d57a2bf514202f54dafa1eb83a862653be7512b6e9535914b8d1d719d495f | C:\\Users\\$USER$\\AppData\\LocalLow\\Brother\\PrtDrv\\sangforvpnlibcrypto-1\_1.dll | Table 1. CoolClient loader DLL files. Our analysis of the samples revealed they were CoolClient loaders. CoolClient loader is a shellcode loader that heavily implements anti-disassembly techniques. Without countering these techniques, analysis tools can produce incorrectly disassembled code, as shown in Figure 3 below. ![The image displays a disassembled code snippet, showing a series of hexadecimal addresses and instructions.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/word-image-489573-176117-3.png) Figure 3. An incorrectly disassembled CoolClient loader due to anti-disassembly techniques. These DLL files load payloads from an encrypted file located at: * c:\\programdata\\GoogleUpdate\\loader.ja We were unable to obtain this file during our investigation. However, it likely overlaps with the loader.ja file [reported by Trend Micro](https://www.trendmicro.com/en_us/research/23/c/earth-preta-updated-stealthy-strategies.html) that loads the final CoolClient payload. CoolClient was first reported by [Sophos in 2022](https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/) and observed in Stately Taurus activity by [Trend Micro in 2023](https://www.trendmicro.com/en_us/research/23/c/earth-preta-updated-stealthy-strategies.html). This threat is built on the open-source C++ library HP-Socket to support multiple C2 protocols and a client/server two-way connection. Figure 4 shows HP-Socket's class information embedded in a CoolClient sample. ![Diagram illustrating similarities between class structures. The top half shows embedded class information with a highlighted section in red, linking to the bottom half which displays an identical class structure to HP-Socket's source code.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/word-image-494413-176117-4.png) Figure 4. HP-Socket's class information embedded in CoolClient. CoolClient supports the following capabilities: * Uploading and deleting a file * Tunneling packets * Starting keylogging * Sending port map information The lack of arbitrary code execution in CoolClient suggests it is designed as a tunneling tool or stealer that attackers could use to gather information for further lateral movement. CoolClient activity was distinct from PUBLOAD infections. However, we confirmed that the specific anti-disassembly technique used by the CoolClient loader samples we found is identical to that used by USBFect/HIUPAN. This supports our attribution of CoolClient activity to Stately Taurus, suggesting it was another attempt by the group to secure access. ## CL-STA-1048 - Espionage Toolkit The activity, tracked under CL-STA-1048, deployed a wide variety of tools with similar functionality. This pattern suggests that the threat actor behind CL-STA-1048 actively sought a payload that could bypass XDR. In the process of doing so, they inadvertently exposed a significant portion of their toolkit to our analysis. On Aug. 9, 2025, we observed alerts originating from a Microsoft Edge process. Our investigation of this alert identified a DLL named mscorsvc.dll (SHA256: 1aa37a477c539edf25656a300002a28d4246ec83344422dd705b42d3443a2623) being loaded into memory via mscorsvw.exe. We identified this DLL as a lightweight, TCP-based backdoor written in C, which we determined was [EggStremeFuel](https://www.bitdefender.com/en-us/blog/businessinsights/eggstreme-fileless-malware-cyberattack-apac). While the initial execution vector for EggStremeFuel remains unknown, the subsequent activity was highly revealing, including the attempted deployment of several tools. The following sections detail our analysis of these tools, starting with the initial identification of EggStremeFuel. ### **EggStremeFuel** During its initialization, EggStremeFuel encrypts embedded C2 configurations using RC4 and stores them in %APPDATA%\\Microsoft\\Windows\\Cookies\\Cookies.dat. The configuration is structured as a key-value pair separated by two pound (#) symbols. An example of this is shown below: dm:laichingte\[.\]net##ip:58.69.38\[.\]83##st:30##mp:443##mp:443##bp:5228## EggStremeFuel imports this C2 configuration from Cookies.dat upon each execution, allowing for dynamic updates. It then starts its C2 communication with an initial check-in, sending the C2 server a random 16-byte session key and its MD5 hash. The backdoor then encrypts and decrypts all C2 communication using RC4 with this session key. The backdoor supports the following capabilities: * Uploading or downloading files * Listing files or directories * Starting or terminating a reverse shell * Sending the current global IP address * Getting, updating or overwriting the C2 configuration ### **Masol RAT** Twenty minutes after we observed the EggStremeFuel deployment, Cortex XDR detected another malicious payload on the same agent at the following path C:\\Windows\\System32\\AxInstSVs.dll (SHA256 hash: 05995284b59ad0066350f43517382228f7eee63cd297e787b2a271f69ecf2dfc). We identified the second sample as Masol RAT, an HTTP-based Windows backdoor previously documented by [Sophos](https://www.sophos.com/en-us/blog/crimson-palace-new-tools-tactics-targets) and [Trend Micro](https://www.trendmicro.com/en_us/research/24/k/earth-estries.html) in 2024. The sample recovered during this incident contained an embedded program database (PDB) path identical to the one Sophos and Trend Micro referenced: E:\\Masol\_https190228\\x64\\Release\\Masol.pdb. Masol RAT also has several overlaps with the Linux backdoor known as Backdr-NQ, which [Sophos reported in 2022](https://news.sophos.com/en-us/2022/10/19/covert-channels/). Both backdoors share a similar code flow, the same configuration decryption algorithm and the same backdoor commands. The Masol RAT we observed in this incident is designed to be executed as a Windows service DLL and is not packed or obfuscated. It communicates with its C2 servers over HTTP POST, encrypted by AES. Masol RAT features backdoor commands for the following activities: * Executing arbitrary commands * Getting or updating C2 configurations * Uploading or downloading a file ### **EggStreme Loader** Concurrent with the deployment of Masol RAT, we detected other malware identified as [EggStreme loader](https://www.bitdefender.com/en-us/blog/businessinsights/eggstreme-fileless-malware-cyberattack-apac) (aka EggStreme Agent or Gorem RAT) at C:\\Windows\\System32\\XblAuthManagers.dll (SHA256: 6caa78943939bd7518f5e7eaa44fa778d0db8b822e260d7fe281cf45513f82d9). This finding aligns with [a Bitdefender blog post](https://www.bitdefender.com/en-us/blog/businessinsights/eggstreme-fileless-malware-cyberattack-apac) detailing similar activity in Southeast Asia. EggStreme loader is a multi-layered loader designed to launch a payload, Gorem RAT. EggStreme loader leverages multiple publicly available tools, such as [DarkLoadLibrary](https://github.com/bats3c/DarkLoadLibrary) and [libpeconv](https://github.com/hasherezade/libpeconv), to achieve an in-memory payload execution. Although Cortex XDR prevented the final payload from executing, our analysis suggests attackers attempted to deploy Gorem RAT, shown below in Figure 5. ![Flowchart illustrating a malware process involving EggStreme Loader. It includes elements like "DarkLoadLibrary," a MUI file, and an EXE file. The chart shows the decryption and injection stages leading to the Gorem RAT (EXE) through DLL injection. It highlights various stages of encrypted data processes.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/word-image-497751-176117-5.png) Figure 5. An overview of EggStreme Loader's execution flow. This malware uses Google Remote Procedure Call (gRPC) for C2 communication. This method provides the malware with a wide array of functionalities through its backdoor commands. Furthermore, it acts as a launcher for a user-mode keylogger module. The keylogger module performs the following activities: * Capturing keystrokes, window titles, clipboard contents and network information * Saving the output to the following path: %LOCALAPPDATA%\\\\Microsoft\\\\Windows\\\\Explorer\\\\thumbcache.dat Gorem RAT incorporates a total of 59 backdoor commands, enabling various functionalities. Most backdoor commands are identical to the command Bitdefender reported. However, we observed a variant of Gorem RAT that implements a new feature to upload or download over Dropbox. ### **TrackBak** Finally, 40 minutes after the attackers attempted to deploy Masol RAT, we observed a malicious payload we have named TrackBak based on its log output filename. This payload masquerades as an MS Edge log file to track user activity history. (SHA256: 84e37e42312b9a502c40cf1f3fc181e3ebd4f3e35c58bbf182740dfe38d3b6b9) TrackBak is an infostealer that performs the following activities: * Collecting key logs * Exfiltrating clipboard data * Gathering network information * Collecting files from drives ### **Attribution** There are a number of links between CL-STA-1048 and China-affiliated activity. In particular, the use of both [Masol RAT](https://www.trendmicro.com/en_us/research/24/k/earth-estries.html) and [EggStreme](https://www.bitdefender.com/en-us/blog/businessinsights/eggstreme-fileless-malware-cyberattack-apac) was publicly reported in relation to China-affiliated activity, such as [Crimson Palace](https://www.sophos.com/en-us/blog/crimson-palace-new-tools-tactics-targets) and [Earth Estries](https://www.trendmicro.com/en_us/research/24/k/earth-estries.html). Chinese threat groups often share tooling, as well as tactics, techniques and procedures (TTPs) with each other. As such, we cannot state with certainty whether these public reports relate to the same group. ## CL-STA-1049 - Stealthy Loader and FluffyGh0st RAT Deployment On Aug. 1, 2025, we identified yet another cluster of activity, which we track as CL-STA-1049. The attackers deployed a novel DLL loader to install [FluffyGh0st RAT](https://www.bitdefender.com/en-us/blog/businessinsights/deep-dive-into-unfading-sea-haze-a-new-threat-actor-in-the-south-china-sea). We named this malware Hypnosis loader. FluffyGh0st RAT is associated with [Unfading Sea Haze](https://www.bitdefender.com/en-us/blog/businessinsights/deep-dive-into-unfading-sea-haze-a-new-threat-actor-in-the-south-china-sea) and overlaps with activity tracked by Sophos as [Crimson Palace](https://news.sophos.com/en-us/2024/06/05/operation-crimson-palace-sophos-threat-hunting-unveils-multiple-clusters-of-chinese-state-sponsored-activity-targeting-southeast-asia/). Starting on Aug. 1, 2025, Cortex XDR generated multiple alerts related to suspicious files in the C:\\Program Files\\Common Files\\Bitdefender\\SetupInformation\\ directory. These alerts highlighted a DLL sideloading attack that used a legitimate Bitdefender executable, seccenter.exe. Alerts focused on three files associated with the Hypnosis loader activity that were dropped in the Bitdefender application directory are shown in Table 2. |------------------------------------------------------------------|---------------------------------------------------------------------------------|--------------------------------------------------------| | **SHA256 Hash** | **File Path** | **Malware** | | 9d7c8d3bc4ac108fb2602424a1f4918c051c2443f0526bbb2c970c8e57dbd90d | C:\\Program Files\\Common Files\\Bitdefender\\SetupInformation\\version.dll | Hypnosis loader | | c774fd7373084f93383593f0a40f56c8a8b95b73e59cd4fc7117daa6b7441e73 | C:\\Program Files\\Common Files\\Bitdefender\\SetupInformation\\bdusersy.dll | Likely final payload | | 35ca351a831c67f0e0a658a186be0065043e0977cb70771c03a24b0523edcf30 | C:\\Program Files\\Common Files\\Bitdefender\\SetupInformation\\$FILE\_NAME$.log | An additional malicious DLL masquerading as a log file | Table 2. Identified samples of malware from the Hypnosis loader activity. ### **Hypnosis Loader** Our analysis revealed that the malicious Hypnosis loader DLL is sideloaded by seccenter.exe. To prevent the seccenter.exe application that sideloaded the malicious Hypnosis loader DLL from crashing, all the DLL's exported functions are proxied to the legitimate version.dll file located in the Windows system directory. Once side-loaded by the EXE, Hypnosis loader patches the DLL's host process entry point, redirecting execution to an infinite Sleep function. This ensures the main thread does not terminate while the malicious routine executes later, as shown in Figures 6 and 7. ![Screenshot of a code snippet with hex values. It includes calls to VirtualProtect and calculations involving memory addresses and offsets.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/word-image-501446-176117-6.png) Figure 6. Hypnosis loader's code to patch the DLL's host process entry point. ![Code comparison image highlighting differences between "before patch" and "after patch" sections on the left, and a "jump" point leading to an "infinite loop" section on the right.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/word-image-503599-176117-7.png) Figure 7. Disassembled instructions showing the patched DLL host process code. After patching the DLL's host process, Hypnosis loader creates a new thread to decrypt the name of the final payload (bdusersy.dll) with an RC4 key and loads it using the LoadLibrary API. ### **Initial Analysis of the Final Payload** Based on our analysis of Hypnosis loader (version.dll), the file named bdusersy.dll is likely the final payload. However, we could not recover this sample. Our telemetry revealed the bdusersy.dll file communicated with a server at webmail.rpcthai\[.\]com. The base domain rpcthai\[.\]com appears to be used for the website of a legitimate Thai-based company, which implies that attackers hijacked the domain and created webmail.rpcthai\[.\]com to act as a C2 server. Looking for other related samples communicating to this domain, we found a DLL file with the SHA256 hash 34bf325492614dd4d842ec24f22a402ab73908cb91a74846945eae4775290ff2. This DLL's imphash value 0bf0bd027fda34d4afa5f86b6340019 leads to two payloads on VirusTotal uploaded in 2024: * SHA256 hash: [f07b2af21e3fab6af5166a44ca77ed0ebc7c9a3e623202a63d4c4492abce8d65](https://www.virustotal.com/gui/file/f07b2af21e3fab6af5166a44ca77ed0ebc7c9a3e623202a63d4c4492abce8d65) * SHA256 hash: [58ed0463d4cb393cd09198a6409591b39cae06bb0ba5f5d760186de88410f6b8](https://www.virustotal.com/gui/file/58ed0463d4cb393cd09198a6409591b39cae06bb0ba5f5d760186de88410f6b8) Our analysis revealed that these payloads were FluffyGh0st. Sophos referenced the second sample in a report on a [Chinese espionage campaign called Crimson Palace](https://news.sophos.com/en-us/2024/09/10/crimson-palace-new-tools-tactics-targets/). ### **$FILE\_NAME$.log and Its Relationship to the Final Payload** The file named $FILE\_NAME$.log is a DLL file. Advanced WildFire analysis revealed this DLL file has an embedded network configuration pointing to webmail.homesmountain\[.\]com, which matches the domain structure of the C2 server that the likely final payload bdusersy.dll communicated with. With its imphash value 511898b2f71f31932dfb3ee06e904289, we identified additional samples that we also attributed to FluffyGh0st: * SHA256 hash: [4e26aa1bb28874f0897ab9a08e61d4b99caaa395fe63cbe4398f7297371e388c](https://www.virustotal.com/gui/file/4e26aa1bb28874f0897ab9a08e61d4b99caaa395fe63cbe4398f7297371e388c) * SHA256 hash: [11c7728697d5ea11c592fee213063c6369340051157f71ddc7ca891f5f367720](https://www.virustotal.com/gui/file/4e26aa1bb28874f0897ab9a08e61d4b99caaa395fe63cbe4398f7297371e388c) The 11c7728697d5ea11c592fee213063c6369340051157f71ddc7ca891f5f367720 sample is contained in a [ZIP archive file that was submitted to VirusTotal](https://www.virustotal.com/gui/file/c47d55ad95a6c6ffac45c2b205e03bddadf5e36f55988599053b1fd0e49448a5). This ZIP archive also contained a [sample of Hypnosis loader](https://www.virustotal.com/gui/file/8781f2d85eec49205b29aa4bc09b1d7d1dd9e1a650634393e3adbc5354738a51). Given the overlaps of bdusersy.dll with FluffyGh0st and our discovery of the ZIP archive with both Hypnosis loader and FluffyGh0st, it is plausible that the bdusersy.dll discovered is FluffyGh0st. ### **FluffyGh0st** FluffyGh0st is a custom version of the publicly available Gh0st RAT, which [Bitdefender first reported in 2024 \[PDF\]](https://blogapp.bitdefender.com/labs/content/files/2024/05/Bitdefender-Report-DeepDive-creat7721-en_EN.pdf). Bitdefender attributed this malware to a China-aligned threat actor that they call Unfading Sea Haze. FluffyGh0st is designed to allow the attacker to manipulate the system via remote access, but its full capabilities require additional plugins. It downloads these plugins from C2 servers embedded in the sample, which are encrypted with RC4 and compressed using LZNT1, before attempting to execute the export function InstallPlugin. ### **Attribution** Although we did not observe direct evidence linking CL-STA-1049 with CL-STA-1048 during this incident, these clusters may be part of the Crimson Palace campaign. CL-STA-1049 is likely associated with the group Bitdefender called Unfading Sea Haze, and some of its tooling overlaps with [Cluster Bravo of Crimson Palace](https://www.sophos.com/en-us/blog/operation-crimson-palace-sophos-threat-hunting-unveils-multiple-clusters-of-chinese-state-sponsored-activity-targeting-southeast-asia). CL-STA-1048 is potentially linked to [Cluster Charlie of Crimson Palace,](https://www.sophos.com/en-us/blog/operation-crimson-palace-sophos-threat-hunting-unveils-multiple-clusters-of-chinese-state-sponsored-activity-targeting-southeast-asia) based on its use of FluffyGh0st. ## Conclusion Between June and August 2025, attackers targeted a Southeast Asian government entity with a persistent cyberespionage campaign involving three distinct clusters of activity. One cluster we've attributed to Stately Taurus, and the other two we have designated as CL-STA-1048 and CL-STA-1049. The convergence of these activity clusters, all of which show links to known China-aligned actors, points to a coordinated effort to achieve a common strategic goal. The attackers' methodology indicates they intended to gain long-term, persistent access to sensitive government networks, not just to cause disruption. These well-resourced adversaries used diverse tool sets, including Stately Taurus's USB propagation, CL-STA-1048's multi-payload strategy and CL-STA-1049's stealthy FluffyGh0st RAT. Their primary goal was to continuously locate and exfiltrate data, as evidenced by the deployment of infostealers and comprehensive backdoors. ### **Palo Alto Networks Protection and Mitigation** Palo Alto Networks customers are better protected from the threats discussed above through the following products and services: * The [Advanced WildFire](https://docs.paloaltonetworks.com/wildfire) machine-learning models and analysis techniques have been reviewed and updated in light of the indicators shared in this research. * [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering) and [Advanced DNS Security](https://docs.paloaltonetworks.com/dns-security) identify known domains and URLs associated with this activity as malicious. * [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) and [XSIAM](https://docs-cortex.paloaltonetworks.com/p/XSIAM) can help prevent the threats described in this article by employing the [Malware Prevention Engine](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-4.x-Documentation/Malware-protection). This approach combines several layers of protection, including [Advanced WildFire](https://docs.paloaltonetworks.com/wildfire), Behavioral Threat Protection and the Local Analysis module, designed to prevent both known and unknown malware from causing harm to endpoints. If you think you may have been compromised or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call: * North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) * UK: +44.20.3743.3660 * Europe and Middle East: +31.20.299.3130 * Asia: +65.6983.8730 * Japan: +81.50.1790.0200 * Australia: +61.2.4062.7950 * India: 000 800 050 45107 * South Korea: +82.080.467.8774 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org). ## Indicators of Compromise ### SHA256 Hashes * 05995284b59ad0066350f43517382228f7eee63cd297e787b2a271f69ecf2dfc * 07bd506d2a8db98c2478ac11bb6c46d84f1aa84f4a9af643804ed857ad7399c3 * 11c7728697d5ea11c592fee213063c6369340051157f71ddc7ca891f5f367720 * 1aa37a477c539edf25656a300002a28d4246ec83344422dd705b42d3443a2623 * 21fe238c462b2f22a7e97f1f06e4f12e8c6e5f3a6fffe671b671909b501fa537 * 2616dfadf8aa222303269eb7202c75e2a8fc5b05b6b63ae2cb7576b9a27733f9 * 29d4cc64c7c9b7ecd16d96e9c6dcde1fe22a4c2d202074aadf41cbcef494bc19 * 34bf325492614dd4d842ec24f22a402ab73908cb91a74846945eae4775290ff2 * 4b29b74798a4e6538f2ba245c57be82953383dc91fe0a91b984b903d12043e92 * 4e26aa1bb28874f0897ab9a08e61d4b99caaa395fe63cbe4398f7297371e388c * 58ed0463d4cb393cd09198a6409591b39cae06bb0ba5f5d760186de88410f6b8 * 6745422717f0ccdf2ae3330d133945268d4cd21215adcf982400d82b38ebeeca * 6caa78943939bd7518f5e7eaa44fa778d0db8b822e260d7fe281cf45513f82d9 * 6f4f76c7a2638087a0da6002cd2c76d1673305b1e850a1f4068f14755f59d45b * 74e7093615da36b28effb3aa6eef5a31e7ea59627bd619b488f087091e8d65e9 * 835795aa494021752f21fbef63c81227c1b934437a02aa1f2a258c9f60b0b7a3 * 83f06fa37f1136f765f799851812f11060ab34df3b34bc61777acc59a30b4c6e * 84e37e42312b9a502c40cf1f3fc181e3ebd4f3e35c58bbf182740dfe38d3b6b9 * 851d57a2bf514202f54dafa1eb83a862653be7512b6e9535914b8d1d719d495f * c47d55ad95a6c6ffac45c2b205e03bddadf5e36f55988599053b1fd0e49448a5 * d4d753c6ea5c86a44c9a65cd0d4eaeabb072b19e0ef68ef7da3a879f689772c9 * e1672dab0daf1c84f14f7bb827851c27753da067490e10cd6144fe7873892fec * e61a1f4269e934481f6cb19576b3dbc434952b01445fd4e1ebc6906a1b449ef8 * e9b52577091c8e25e91c485216de34d5a26ab707a10b1e5cd31ed7aa055939d3 * f07b2af21e3fab6af5166a44ca77ed0ebc7c9a3e623202a63d4c4492abce8d65 * f62223c9750fb2edfd979a8cae204cb9ce5e0950b52a47b62f195cd05dd3e2fb ### IPv4 Addresses * 103\.15.29\[.\]17 * 103\.131.95\[.\]107 * 103\.122.164\[.\]106 * 109\.248.24\[.\]177 * 120\.89.46\[.\]135 ### Domains * distrilyy\[.\]net * fikksvex\[.\]com * laichingte\[.\]net * popnike-share\[.\]com * shepinspect\[.\]com * theuklg\[.\]com * webmail.homesmountain\[.\]com * webmail.rpcthai\[.\]com ## Additional Resources * [Deep Dive Into Unfading Sea Haze: A New Threat Actor in the South China Sea](https://www.bitdefender.com/en-us/blog/businessinsights/deep-dive-into-unfading-sea-haze-a-new-threat-actor-in-the-south-china-sea) -- Bitdefender * [Crimson Palace returns: New Tools, Tactics, and Targets](https://news.sophos.com/en-us/2024/09/10/crimson-palace-new-tools-tactics-targets/) -- Sophos * [Stately Taurus Activity in Southeast Asia Links to Bookworm Malware](https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/) -- Unit 42, Palo Alto Networks * [Earth Preta Evolves its Attacks with New Malware and Strategies](https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html) -- TrendMicro * [HoneyMyte updates CoolClient and deploys multiple stealers in recent campaigns](https://securelist.com/honeymyte-updates-coolclient-uses-browser-stealers-and-scripts/118664/) -- SecureList Back to top ### Tags * [CL-STA-1048](https://unit42.paloaltonetworks.com/tag/cl-sta-1048/ "CL-STA-1048") * [CL-STA-1049](https://unit42.paloaltonetworks.com/tag/cl-sta-1049/ "CL-STA-1049") * [Stately Taurus](https://unit42.paloaltonetworks.com/tag/stately-taurus/ "Stately Taurus") * [Trojan](https://unit42.paloaltonetworks.com/tag/trojan/ "Trojan") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Threat Brief: Recruiting Scheme Impersonating Palo Alto Networks Talent Acquisition Team](https://unit42.paloaltonetworks.com/phishing-attackers-pose-as-panw-recruiters/ "Threat Brief: Recruiting Scheme Impersonating Palo Alto Networks Talent Acquisition Team") ### Table of Contents * ### Related Articles * [Threat Brief: Widespread Impact of the Axios Supply Chain Attack](https://unit42.paloaltonetworks.com/axios-supply-chain-attack/ "article - table of contents") * [Bookworm to Stately Taurus Using the Unit 42 Attribution Framework](https://unit42.paloaltonetworks.com/bookworm-to-stately-taurus/ "article - table of contents") * [Threat Actor Groups Tracked by Palo Alto Networks Unit 42 (Updated Aug. 1, 2025)](https://unit42.paloaltonetworks.com/threat-actor-groups-tracked-by-palo-alto-networks-unit-42/ "article - table of contents") ## Related Malware Resources ![Pictorial representation of a magnifying glass illuminating a glowing orange circular digital circuit interface on a dark, high-tech background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Myth-Busting_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) September 16, 2026 [#### Atomic macOS (AMOS) Stealer Activity](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/) * [MacOS](https://unit42.paloaltonetworks.com/tag/macos/ "macOS") * [Threat intelligence](https://unit42.paloaltonetworks.com/tag/threat-intelligence/ "threat intelligence") * [Unit 42](https://unit42.paloaltonetworks.com/tag/unit-42/ "Unit 42") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/ "Atomic macOS (AMOS) Stealer Activity") ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/content/pan/en_US/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)