[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # FrostyGoop's Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 14 min read Related Products [![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Code to Cloud Platform icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/prisma_RGB_logo_Icon_Color.png)Code to Cloud Platform](https://unit42.paloaltonetworks.com/product-category/code-to-cloud-platform/ "Code to Cloud Platform")[![Cortex icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex](https://unit42.paloaltonetworks.com/product-category/cortex/ "Cortex")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Cortex Xpanse icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex Xpanse](https://unit42.paloaltonetworks.com/product-category/cortex-xpanse/ "Cortex Xpanse")[![Cortex XSIAM icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XSIAM](https://unit42.paloaltonetworks.com/product-category/cortex-xsiam/ "Cortex XSIAM")[![Next-Generation Firewall icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall")[![Prisma Cloud icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/prisma_RGB_logo_Icon_Color.png)Prisma Cloud](https://unit42.paloaltonetworks.com/product-category/prisma-cloud/ "Prisma Cloud") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Asher Davila](https://unit42.paloaltonetworks.com/author/asher-davila/) * [Chris Navarrete](https://unit42.paloaltonetworks.com/author/chris-navarrete/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:November 19, 2024 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [BUSTLEBERM](https://unit42.paloaltonetworks.com/tag/bustleberm/) * [FrostyGoop](https://unit42.paloaltonetworks.com/tag/frostygoop/) * [Go](https://unit42.paloaltonetworks.com/tag/go/) * [GoLang](https://unit42.paloaltonetworks.com/tag/golang/) * [ICS](https://unit42.paloaltonetworks.com/tag/ics/) * [IIoT](https://unit42.paloaltonetworks.com/tag/iiot/) * [IoT](https://unit42.paloaltonetworks.com/tag/iot/) * [JSON](https://unit42.paloaltonetworks.com/tag/json/) * [MikroTik](https://unit42.paloaltonetworks.com/tag/mikrotik/) * [Modbus](https://unit42.paloaltonetworks.com/tag/modbus/) * [Operational Technology](https://unit42.paloaltonetworks.com/tag/operational-technology/) * [OT](https://unit42.paloaltonetworks.com/tag/ot/) * [Russia](https://unit42.paloaltonetworks.com/tag/russia/) * [SCADA](https://unit42.paloaltonetworks.com/tag/scada/) * [Vulnerabilities](https://unit42.paloaltonetworks.com/tag/vulnerabilities/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/frostygoop-malware-analysis/?pdf=download&lg=en&_wpnonce=64814e76fb "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/frostygoop-malware-analysis/?pdf=print&lg=en&_wpnonce=64814e76fb "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=FrostyGoop’s%20Zoom-In:%20A%20Closer%20Look%20into%20the%20Malware%20Artifacts,%20Behaviors%20and%20Network%20Communications&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Ffrostygoop-malware-analysis%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Ffrostygoop-malware-analysis%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Ffrostygoop-malware-analysis%2F&title=FrostyGoop’s%20Zoom-In:%20A%20Closer%20Look%20into%20the%20Malware%20Artifacts,%20Behaviors%20and%20Network%20Communications "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Ffrostygoop-malware-analysis%2F&text=FrostyGoop’s%20Zoom-In:%20A%20Closer%20Look%20into%20the%20Malware%20Artifacts,%20Behaviors%20and%20Network%20Communications "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Ffrostygoop-malware-analysis%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=FrostyGoop’s%20Zoom-In:%20A%20Closer%20Look%20into%20the%20Malware%20Artifacts,%20Behaviors%20and%20Network%20Communications%20https%3A%2F%2Funit42.paloaltonetworks.com%2Ffrostygoop-malware-analysis%2F "Share in Mastodon") ## Executive Summary In July 2024, the operational technology (OT)-centric malware FrostyGoop/BUSTLEBERM became publicly known, after attackers used it to disrupt critical infrastructure. The outage occurred after the Cyber Security Situation Center (CSSC), affiliated with the Security Service of Ukraine, [disclosed details \[PDF\]](https://ukraine.ohchr.org/sites/default/files/2024-09/ENG%20Attacks%20on%20Ukraine%E2%80%99s%20Energy%20Infrastructure-%20%20Harm%20to%20the%20Civilian%20Population.pdf) of an attack on a municipal energy company in Ukraine in early 2024. FrostyGoop is the ninth reported OT-centric malware, but the first that used Modbus TCP communications to impact the power supply to heating services for over 600 apartment buildings. FrostyGoop can be used both within a compromised perimeter and externally if the target device is accessible over the internet. FrostyGoop sends Modbus commands to read or modify data on industrial control systems (ICS) devices, causing damage to the environment where attackers installed it. Based on this reporting, we conducted a deeper analysis and uncovered new samples of FrostyGoop and other related indicators. These new indicators include configuration files and libraries used by the malware, as well as artifacts associated with an infection. We also investigate network communications and provide new insights based on open-source intelligence (OSINT) data and our own telemetry. OT malware is an increasing concern of security professionals across the globe, and FrostyGoop provides a notable case study of this growing threat. Palo Alto Networks customers are better protected from the threats discussed in this article through our products and services such as the following: * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/zero-trust-ot-security) * Information provided by Palo Alto Networks [Next-Generation Firewall](https://docs.paloaltonetworks.com/ngfw) with [Advanced Threat Prevention](https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/threat-prevention/about-threat-prevention/advanced-threat-prevention) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Cortex Xpanse](https://docs-cortex.paloaltonetworks.com/p/XPANSE) * [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) and [Cortex XSIAM](https://docs-cortex.paloaltonetworks.com/p/XSIAM) * [Prisma Cloud](https://docs.paloaltonetworks.com/prisma/prisma-cloud) If you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html). | **Related Unit 42 Topics** | [**JSON**](https://unit42.paloaltonetworks.com/tag/json/), **[IoT Security](https://unit42.paloaltonetworks.com/tag/iot/), [Russia](https://unit42.paloaltonetworks.com/tag/russia/)** | |----------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| ## Technical Analysis of FrostyGoop Attackers employed this malware associated with Russian actors in a cyberattack that caused a two-day heating system outage affecting over 600 apartment buildings in Ukraine, during sub-zero temperatures. According to an [open-source report](https://hub.dragos.com/report/frostygoop-ics-malware-impacting-operational-technology), attackers made the initial compromise through a vulnerability in a MikroTik router. However, we have not confirmed this delivery method and bad actors might instead have delivered the malware via OT devices exposed to the internet. FrostyGoop makes use of the Modbus TCP protocol to interact directly with ICS/OT devices, and therefore it is considered an ICS-centric malware. This is the [ninth known ICS-centric malware](https://x.com/DragosInc/status/1820476794052452382). In addition, Modbus is one of the most common protocols used in critical infrastructure. During this attack, the adversaries dispatched Modbus commands to [ENCO control](https://ecopower-eu.com/en/enco-control/) devices, leading to inaccurate measurements and system malfunctions. Remediating these issues took nearly two days. Although bad actors used the malware to attack ENCO control devices, the malware can attack any other type of device that speaks Modbus TCP. Our telemetry indicates that 1,088,175 Modbus TCP devices were exposed to the internet from Sept. 2-Oct. 2, 2024, and 6,211,623 devices were exposed overall. The details needed by FrostyGoop to establish a Modbus TCP connection and send Modbus commands to a targeted ICS device can be provided as command-line arguments or included in a separate JSON configuration file. ### **Malware Samples Analysis** FrostyGoop is compiled using the Go programming language, sometimes referred to as Golang. The malware uses a relatively obscure [open-source](https://github.com/rolfl/modbus) Modbus implementation. Further analysis of the Modbus library revealed this implementation does not natively support supplying arguments using a JSON file, making this a strong identifier for the malware. Moreover, the JSON object structure follows a specific format based on the commands this malware supports. FrostyGoop also contains capabilities for logging the output to a console or to a JSON file. Attackers can supply two types of parameters to FrostyGoop: * The first type of parameter consists of the possible operations an attacker can execute toward the registers of a Modbus device * The second parameter consists of timing configurations. Figure 1 shows an example of the first type of parameter for an operation using Tasks and Iplist under the register for main::main.TaskList\_\_\_runtime.structtype\_fields. ![Screenshot of a computer screen displaying code in Binary Ninja with highlighted sections and annotations pointing to specific lines, including terms like "main:main.TaskList," "Iplist," and "Tasks.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/word-image-814765-137491-1.png) Figure 1. Binary Ninja showing FrostyGoop operations for Tasks and Iplist under the main::main.TaskList\_\_\_runtime.structtype\_fields register. Figure 2 shows an example of an operation for Code, Address, Count, Value and State under the register for main::main.TaskList\_\_\_runtime.structtype\_fields. ![Screenshot of code in Binary Ninja displaying hex code in blue text on a black background, annotated with labels such as 'Code', 'Count', 'Address', and 'Value' at various points.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/word-image-819065-137491-2.png) Figure 2. Binary Ninja showing FrostyGoop operations for Code, Address, Count, Value and State under the main::main.TaskList\_\_\_runtime.structtype\_fields register. Figure 3 shows the timing configuration for main.Cycle.getCycleConfig. ![Screenshot of a computer code snippet in Binary Ninja featuring functions and variables related to time parsing in a programming environment.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/word-image-824362-137491-3.png) Figure 3. Binary Ninja showing FrostyGoop timing configuration in the registry entry under main.Cycle.getCycleConfig(main.Cycle x,main.Cmd cmd). FrostyGoop also leverages Goccy's [go-json library](https://github.com/goccy/go-json), a faster JSON encoder and decoder compatible with the Go programming language standard encoding/json package. In addition, it incorporates a specific [open-source execution controller named queues](https://github.com/hsblhsn/queues). The relative obscurity of this code means it can serve as another possible indicator of FrostyGoop. Figure 4 shows our analysis of a Windows executable file for FrostyGoop within the tool Binary Ninja. This analysis reveals URLs from open-source libraries for modbus, go-json and queues. ![A table displaying rows of data with columns, presenting various example URLs from GitHub repositories.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/word-image-826970-137491-4.png) Figure 4. Open-source libraries: Modbus, go-json and queues. Although not all FrostyGoop samples contain the strings shown in Figure 4, other strings contained within those libraries can serve as part of the detection for this malware. FrostyGoop also implements a debugger evasion technique by checking the BeingDebugged value in Windows' Process Environment Block (PEB). Figure 5 shows this method in the disassembled code from a FrostyGoop sample. This method provides an alternative way to check the PEB's BeingDebugged flag without calling IsDebuggerPresent(). Attackers use this technique to detect and avoid debuggers used by malware analysts. ![A screenshot of computer code in a debugging program, showcasing lines of assembly language with specific annotations and highlights; a section is marked by a red arrow pointing to the reference "PEB\_BeingDebugged" in the code.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/word-image-829747-137491-5.png) Figure 5. Disassembled code from a FrostyGoop sample showing a check for the PEB's BeingDebugged flag. #### Go-encrypt.exe Sample Analysis Our investigation revealed a Windows executable sample named [go-encrypt.exe](https://www.virustotal.com/gui/file/9cf30d82a86a9485f7bbd0786a5de207cf4902691a3efcfc966248cb1e87d5b7) written in Go that was not FrostyGoop, but it originally appeared on the same approximate date that other indicators of FrostyGoop were reported. Command-line options for this software reveal the file is used to encrypt and decrypt JSON files as illustrated in Figure 6. ![Command line interface on a screen showing the usage instructions for 'go-encrypt.exe', including options for encryption, decryption, and specifying input and output files.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/word-image-835400-137491-6.png) Figure 6. Command-line options for go-encrypt.exe. After executing go-encrypt.exe using the -encrypt argument, it creates two files: * An encrypted JSON * A 32-byte file containing a decryption key named key Figure 7 shows the encryption, decryption and the generated key. ![A screenshot of a computer terminal displaying file encryption and decryption commands, including execution of "encrypt.exe" and "decrypt.exe" on various files in the 'Downloads' directory under the user 'Asher'. The terminal lists file details.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/word-image-838833-137491-7.png) Figure 7. Using go-encrypt.exe to encrypt and decrypt a JSON file. Figure 8 shows the content of an encrypted JSON file generated by go-encrypt.exe. ![A screenshot displaying the contents of a binary file in a hex editor, showing hexadecimal values alongside the corresponding decoded ASCII text on the right side.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/F8.png) Figure 8. An encrypted JSON file viewed in a hex editor. Figure 9 shows a filtered list of processes generated by go-encrypt.exe in [Process Monitor](https://learn.microsoft.com/en-us/sysinternals/downloads/procmon). We have highlighted when go-encrypt.exe created the decryption file named key and the 32 character content of this key file. ![Screenshot of Process Monitor software showing a list of system processes and file operations, with focus on a registry change. A separate file explorer window is open displaying the contents of the Downloads folder. Red arrows point from the process monitor to the Downloads folder, and then to the key folder.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/word-image-849408-137491-9.png) Figure 9. Process Monitor showing go-encrypt.exe generating the key file. Decompiling go-encrypt.exe revealed it uses the Cipher Feedback (CFB) mode of the AES encryption algorithm to create the encryption/decryption key in the key file as shown in Figures 10 and 11. ![Screenshot of computer code in an assembler-like language, displayed in a text editor with line numbers and hexadecimal values, possibly related to encryption functions.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/word-image-854164-137491-10.png) Figure 10. Decompiled code of go-encrypt.exe showing its AES main encryption routine. ![Screenshot of a programming IDE displaying code with variables and functions, mainly written in C++. The code contains several if-else statements, function parameters, and returns, highlighting the logic related to cryptographic operations. Various warnings are commented out within the code indicating potential issues or checks omitted during runtime. A red arrow points to line 59.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/word-image-857893-137491-11.png) Figure 11. Decompiled code of go-encrypt.exe showing CFB mode. As shown previously for the key generated in Figure 7, the key value is in decimal format. The decimal value of the key from Figure 7 is: * 71 76 90 67 120 104 86 98 85 97 88 54 88 50 75 77 71 78 116 89 74 66 51 50 75 103 70 117 56 100 117 88 We can decode these decimal numbers into the 32-byte value of the key through a variety of methods, like the Python script shown in Figure 12. This script will convert the binary values to hexadecimal. ![Python code snippet in an IDE showing a function named 'to\_hex' that converts a list to hexadecimal format.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/word-image-863163-137491-12.png) Figure 12. Example of a Python script to convert the decimal value of the key to hexadecimal. The 32-byte value of the key in hexadecimal is: * 47 4c 5a 43 78 68 56 62 55 61 58 36 58 32 4b 4d 47 4e 74 59 4a 42 33 32 4b 67 46 75 38 64 75 58 According to Go's [documentation](https://cs.opensource.google/go/go/+/go1.23.1:src/crypto/aes/cipher.go;l=34) for aes.NewCipher, a byte stream of 32 bytes corresponds to a 256-bit AES encryption in CFBmode. We confirmed the 32-byte hexadecimal value of the key from our example matches the ASCII value in the key file using [CyberChef](https://gchq.github.io/CyberChef/) as shown below in Figure 13. ![Screenshot of a CyberChef application interface showing various operations and windows. The main focus is on a conversion from Hexadecimal to ASCII, with annotations pointing out the hexadecimal value of the key, its conversion to ASCII, and a comparison with a matching ASCII string in a key file.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/word-image-865554-137491-13.jpeg) Figure 13. Using CyberChef to verify the hex value matches the ASCII value of the key file. Although we cannot confirm go-encrypt.exe was used for the FrostyGoop attack, two circumstances indicate the attackers might have used it during this activity: * First, it is used to encrypt and decrypt JSON files, and encrypted JSON files are an essential element of FrostyGoop functionality. * Second, go-encrypt.exe first appeared in the wild around the same time as the FrostyGoop samples and the task\_test.json file. Therefore, attackers could have used this piece of software to conceal target information in JSON files for later use to perpetrate attacks. ### **Investigation of the Targeted Infrastructure** According to the [Dragos report on FrostyGoop](https://hub.dragos.com/report/frostygoop-ics-malware-impacting-operational-technology), they initially discovered this malware in April 2024. This report notes an example of a FrostyGoop configuration file named task\_test.json. Searching VirusTotal, we found one occurrence of task\_test.json on Oct. 10, 2023. Pivoting on that file, we discovered Windows executable files that we subsequently identified as FrostyGoop and go-encrypt.exe. Figure 14 shows the same first-seen date of Oct. 10, 2023, for task\_test.json, go-encrypt.exe and the other Windows executable files. ![Screenshot displaying a list of file download links, each with a unique alpha-numeric code, file size, number of downloads, and associated icons for different actions such as Export, Tools and more.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/word-image-868969-137491-14.png) Figure 14. Malware samples and task\_test.json detection timestamps in VirusTotal. The data structure of task\_test.json and its key/values are the format we would expect to be used as a configuration file by a FrostyGoop executable file. Our analysis of FrostyGoop samples indicates the malware performs read, write and write-multiple Modbus operations. The content of the task\_test.json sample depicted in Figure 15 only shows read operations (Code 3). ![Screenshot of JSON code data displaying an array called 'Tasks' with details of various entries that include 'Code', 'Count', and 'Value' fields. Some information is redacted.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/word-image-871935-137491-15.png) Figure 15. The content of task\_test.json used by a FrostyGoop malware sample. The IP address contained in this JSON file corresponds to an ENCO control device located in Romania as noted. ![Screenshot displaying network security analytics, highlighting an IP address (redacted) and case location in Craiova, Romania with a focus on Enco Therma Enviro Control 1.0. The image includes graphs showing open ports and service activities over several months.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/word-image-874678-137491-16.png) Figure 16. Xpanse query indicating it is an ENCO device in Romania. Widening our search for exposed ENCO devices, our telemetry revealed 32 IP addresses, all located in either Romania or Ukraine as noted in Figure 17. ![Results of our Xpanse search for exposed ENCO devices revealed 32 IP addresses, a;; on Romania or Ukraine. Screenshot of Cortex XPANSE application interface showing search results for exposed ENCO devices in Romania, revealing 32 IP addresses. Red arrows point to the Ukraine IP address separated from the list of Romanian IP addresses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/word-image-879003-137491-17.png) Figure 17. Xpanse query of IP addresses with exposed ENCO devices. The ENCO devices we discovered all have TCP port 23 exposed for Telnet. Telnet provides a communications and management interface that is considered obsolete because it has no built-in encryption. Simply connecting to an exposed ENCO device over Telnet reveals an ENCO banner with a list of available commands as shown below in Figure 18. This provides [a reportedly easy method](https://zerontek.com/zt/2024/07/24/how-to-find-and-probe-enco-plcs-on-the-internet-just-like-frostygoop-malware/) to probe for and identify ENCO programmable logic controller (PLC) devices on the internet. ![A screenshot of Enco Telnet Server v1.00 interface with a dark background and green text displaying various available network commands, among others, in a command-line interface format. Some information is redacted.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/word-image-883884-137491-18.jpeg) Figure 18. Telnet banner from an exposed ENCO device. Figure 19 shows a portion of our Xpanse report covering details of the network services running on the server listed in task\_test.json. This matches the exposed ports among the other ENCO exposed devices we discovered: * TCP ports 23 (Telnet) * 502 (Modbus) * 1024 (Router WebUI) * 37777 (ENCO connect port) ![Bar chart showing the number of open ports from April to September with key details about specific ports, services, and device fingerprints listed in a table below. Notable ports include 23, 502, 1024, and 37777 with associated services shown.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/word-image-887064-137491-19.png) Figure 19. Xpanse report for open ports on. We can glean further information on the ENCO device by accessing it using a web browser and recording the traffic. Figure 20 shows a login screen shown when accessing the ENCO device from a web browser. By viewing the web traffic in Wireshark and examining the HTTP response headers, we find the router is being used as a web server and the name of the router is TP-LINK Wireless Lite N Router WR740N. ![A series of screenshots. The top shows a web browser during a login attempt on a router's web access interface. This is accessing ENCO device from a web browser. The bottom screenshot shows web traffic viewed in Wireshark. It includes the IP address and TCP port for web access of the ENCO device. A red arrow points to the line that acts as a web server for ENCO device web access. Another arrow points to the name of the router for web access.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/word-image-891254-137491-20.png) Figure 20. Information gleaned from accessing an ENCO device over a web browser. According to the NIST website, versions 1 and 2 of the WR740N router's firmware are [susceptible to a command injection vulnerability](https://nvd.nist.gov/vuln/detail/CVE-2023-33538). However, there is no hard evidence to indicate that the attackers exploited this vulnerability in the July 2024 FrostyGoop attack. ### **Network Traffic Analysis** To analyze FrostyGoop traffic, we tested two samples using task\_test.json as the configuration file. The two FrostyGoop samples have the following SHA256 hashes: * 5d2e4fd08f81e3b2eb2f3eaae16eb32ae02e760afc36fa17f4649322f6da53fb * a63ba88ad869085f1625729708ba65e87f5b37d7be9153b3db1a1b0e3fed309c The task\_test.json configuration file only has a function code value of 3, which represents a Modbus command to read the holding registers. Accordingly, the FrostyGoop samples only generated commands to read the holding registers of the targeted device at over TCP port 502. Figure 21 shows an example of the Modbus traffic generated during our test of the FrostyGoop samples, filtered in Wireshark with a customized column display. It reveals Modbus traffic to over TCP port 502, as well as the four register values specified in the task\_test.json configuration file: * 53370 * 53882 * 53760 * 54272 ![Screenshot of a Modbus function code 3 operation in Wireshark software, displaying multiple queries for reading holding registers with detailed timestamps and values.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/word-image-894428-137491-21.jpeg) Figure 21. Example of Modbus traffic from our FrostyGoop sample test filtered in Wireshark. Figure 22 shows an example of a Modbus function code 3 request to read values from the holding registers of the ENCO device, starting with the register number 53760 for the next 123 registries. The device responded with values from registry 53760-53882. These registry entries hold UINT16 values for unsigned integers that can range from 0-65535. ![Two screenshots of Wireshark network analysis tool displaying Modbus protocol information, including data packets and highlighted request details for reading specific register values. On the left an arrow indicates where the Modbus read request of 123 register values starting at register 53760. On the right an arrow indicates the Modbus device responds with the values 123 registers from register 53760 through register 53882.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/word-image-897335-137491-22.jpeg) Figure 22. Modbus interaction with the hardware device. We reverse engineered the samples to track down their functions. Our analysis revealed that the taskWorker function selects actions performed through the following function parameters: * read holding registers (3) * write (6) * writeMultiple (6) If the JSON configuration file contains the number 1 as a word count value, only one register is returned. If it does not contain the number 1 as a word count value, more than one register is returned. Figure 23 shows a code snippet from a FrostyGoop sample with the logic to select Modbus operations depending on the value provided: * 3 for read holding registers * 6 for write single holding register * 16 for write multiple holding registers operation ![A screenshot of computer code in an Integrated Development Environment (IDE) with lines of code highlighted in yellow and green, focusing on function definitions and conditional statements.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/word-image-900573-137491-23.png) Figure 23. Code snippet from a FrostyGoop sample showing how it implements Modbus operations. ## Conclusion With cyberattacks against ICS/OT devices and critical infrastructure increasing in recent years, the cybersecurity landscape in these types of environments has become increasingly dangerous. Countries like Ukraine, Romania, Israel, China, Russia and the United States have all been affected by attacks targeting their critical infrastructure. Prior to these incidents, cybersecurity in OT was not considered an essential part of their defensive operations. The past decade has seen an increase in CS-centric malware, with FrostyGoop being the most recent prominent example. During this time frame, the number of OT and internet of things (IoT) devices exposed to the internet has drastically increased. An increasing number of OT networks have been connected with IT networks to facilitate facilities management. This has unleashed new ways to perform cyberattacks that can not only damage the cyberspace realm, but also the physical world. Malicious actors can send control commands to field devices easily disguised as regular operations within network traffic, making the activity more difficult to detect and prevent. For these reasons, we must implement security measures to prevent and mitigate these attacks. Palo Alto Networks customers are better protected from the threats discussed in this blog through the following products: * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/zero-trust-ot-security) is designed to: * Use machine learning techniques to detect abnormal network traffic and abnormal behavior in engineering workstations and field devices * Raise alerts in the event of a compromised environment, based on anomalous command access * Generate alerts based on Modbus operations * Implement analytics rules for detection of suspicious traffic including anonymous telnet login, brute-force login attempts, default credentials usage * Cover and identify Common Vulnerabilities and Exposures (CVEs) in MikroTik and other common routers * Leverage upstream Advanced WildFire and Advanced Threat Prevention detections, along with IoT device detection capabilities, to detect malware command and control communication * Detect devices running vulnerable versions of firmware * Next-Generation Firewall ([NGFW](https://docs.paloaltonetworks.com/ngfw)) and [Advanced Threat Prevention](https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/threat-prevention/about-threat-prevention/advanced-threat-prevention) are designed to: * Provide complete visibility and control of the applications in use across all users and devices in all locations all the time * Automatically reprogram your firewall with the latest intelligence using inline machine learning as well as the application and threat signatures * Implement rules TID 31667 (Modbus read coils) and TID 31668 (Modbus write coils), which allows administrators to identify abnormal devices performing Modbus operations * Implement MikroTik CVEs related to prevent remote code execution and command injection vulnerabilities from being exploited within the network * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) is designed to: * Identify malicious binaries and make verdict determinations when analyzing executing processes * Implement detection rules to identify, block and prevent deployment of FrostyGoop/BUSTLEBERM and its variants, as well as other ICS-centric ransomware and malware * [Cortex Xpanse](https://docs-cortex.paloaltonetworks.com/p/XPANSE) is designed to: * Provide a complete, accurate and continuously updated inventory of all global internet-facing assets, including exposed OT services and devices * Enable discovery, evaluation and mitigation of cyberattack surface risks * Facilitate evaluation of supplier risk * [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) and [XSIAM](https://www.paloaltonetworks.com/resources/datasheets/cortex-xsiam-aag) are designed to: * Accurately detect threats with behavioral analytics and reveal the root cause to speed up investigations * Better protect against malware discussed in this article through [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr), including [WildFire](https://docs.paloaltonetworks.com/wildfire), Behavioral Threat Protection and the Local Analysis module * Unit 42 researchers at Palo Alto Networks are committed to discovering new malware and threats. We share our findings and feed the results back into our products and services, so our customers are better protected. If you think you may have been compromised or have an urgent matter, get in touch with the[Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call: * North America Toll-Free: 866.486.4842 (866.4.UNIT42) * EMEA: +31.20.299.3130 * APAC: +65.6983.8730 * Japan: +81.50.1790.0200 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org). ## Indicators of Compromise SHA256 hash: * 5d2e4fd08f81e3b2eb2f3eaae16eb32ae02e760afc36fa17f4649322f6da53fb * File size: 3.7 MB (3,699,200 bytes) * File type: PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows * File description: Windows executable file for FrostyGoop malware SHA256 hash: * a63ba88ad869085f1625729708ba65e87f5b37d7be9153b3db1a1b0e3fed309c * File size: 2.4 MB (2,439,680 bytes) * File type: PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows * File description: Windows executable file for FrostyGoop malware SHA256 hash: * 2fd9cb69ef30c0d00a61851b2d96350a9be68c7f1f25a31f896082cfbf39559a * File size: 3.4 MB (3,359,232 bytes) * File type: PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows * File description: Windows executable file for FrostyGoop malware SHA256 hash: * c64b67c116044708e282d0d1a8caea2360270a7fc679befa5e28d1ca15f6714c * File size: 2.0 MB (1,951,232 bytes) * File type: PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows * File description: Windows executable file for FrostyGoop malware SHA256 hash: * 91062ed8cc5d92a3235936fb93c1e9181b901ce6fb9d4100cc01167cdc08745f * File size: 2.5 MB (2,516,480 bytes) * File type: PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows * File description: Windows executable file for FrostyGoop malware SHA256 hash: * a25f91b6133cb4eb3ecb3e0598bbab16b80baa40059e623e387a6b1082d6f575 * File size: 2.5 MB (2,515,968 bytes) * File type: PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows * File description: Windows executable file for FrostyGoop malware SHA256 hash: * 9cf30d82a86a9485f7bbd0786a5de207cf4902691a3efcfc966248cb1e87d5b7 * File size: 1.8 MB (1,773,568 bytes) * File type: PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows * File description: Windows executable file for go-encrypt.exe, likely used during previous FrostyGoop activity SHA256 hash: * 06919e6651820eb7f783cea8f5bc78184f3d437bc9c6cde9bfbe1e38e5c73160 * File size: 0.4 KB (379 bytes) * File type: JSON text data * File description: JSON file named task-test.json likely used to test go-encrypt.exe in July 2024 FrostyGoop attack ## Additional Resources * [Impact of FrostyGoop ICS Malware on Connected OT Systems](https://hub.dragos.com/report/frostygoop-ics-malware-impacting-operational-technology) -- Dragos Intelligence Brief * [Simple 'FrostyGoop' malware responsible for turning off Ukrainians' heat in January attack](https://www.sans.org/blog/whats-the-scoop-on-frostygoop-the-latest-ics-malware-and-ics-controls-considerations/) -- SANS Blog * [go-json: Fast JSON encoder/decoder compatible with encoding/json for Go](https://github.com/goccy/go-json) -- goccy (Masaaki Goshima) on GitHub * [Queues: A simple sync.WaitGroup like queue and goroutine execution controller](https://github.com/hsblhsn/queues) -- hsblhsn (Hasibul Hasan) on GitHub * [How to Find and Probe ENCO PLCs on the Internet Just Like FrostyGoop malware](https://zerontek.com/zt/2024/07/24/how-to-find-and-probe-enco-plcs-on-the-internet-just-like-frostygoop-malware/) -- ZeroNtek * [CVE-2023-33538 Detail](https://nvd.nist.gov/vuln/detail/CVE-2023-33538) -- NIST NVD *Updated Nov. 19, 2024, at 9:00 a.m. PT to align statements with Dragos report.* *Updated Nov. 20, 2024, at 10:00 a.m. PT to correct PANW product names.* *Updated Nov. 20, 2024, at 10:54 a.m. PT to correct Modbus code.* *Updated Dec. 3, 2024, at 10:23 a.m. PT to correct typo.* Back to top ### Tags * [BUSTLEBERM](https://unit42.paloaltonetworks.com/tag/bustleberm/ "BUSTLEBERM") * [FrostyGoop](https://unit42.paloaltonetworks.com/tag/frostygoop/ "FrostyGoop") * [Go](https://unit42.paloaltonetworks.com/tag/go/ "Go") * [GoLang](https://unit42.paloaltonetworks.com/tag/golang/ "GoLang") * [ICS](https://unit42.paloaltonetworks.com/tag/ics/ "ICS") * [IIoT](https://unit42.paloaltonetworks.com/tag/iiot/ "IIoT") * [IoT](https://unit42.paloaltonetworks.com/tag/iot/ "IoT") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") * [MikroTik](https://unit42.paloaltonetworks.com/tag/mikrotik/ "MikroTik") * [Modbus](https://unit42.paloaltonetworks.com/tag/modbus/ "Modbus") * [Operational Technology](https://unit42.paloaltonetworks.com/tag/operational-technology/ "Operational Technology") * [OT](https://unit42.paloaltonetworks.com/tag/ot/ "OT") * [Russia](https://unit42.paloaltonetworks.com/tag/russia/ "Russia") * [SCADA](https://unit42.paloaltonetworks.com/tag/scada/ "SCADA") * [Vulnerabilities](https://unit42.paloaltonetworks.com/tag/vulnerabilities/ "Vulnerabilities") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Fake North Korean IT Worker Linked to BeaverTail Video Conference App Phishing Attack](https://unit42.paloaltonetworks.com/fake-north-korean-it-worker-activity-cluster/ "Fake North Korean IT Worker Linked to BeaverTail Video Conference App Phishing Attack") ### Table of Contents * ### Related Articles * [The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "article - table of contents") * [The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "article - table of contents") * [Double Agents: Exposing Security Blind Spots in GCP Vertex AI](https://unit42.paloaltonetworks.com/double-agents-vertex-ai/ "article - table of contents") ## Related Malware Resources ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/) * [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API") * [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway") * [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)