[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/)  
[![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/)  
Menu

* [Tools](https://unit42.paloaltonetworks.com/tools/)
* [ATOMs](https://unit42.paloaltonetworks.com/atoms/)
* [Security Consulting](https://www.paloaltonetworks.com/unit42)
* [About Us](https://unit42.paloaltonetworks.com/about-unit-42/)
* [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html)  
  English
* [English](https://unit42.paloaltonetworks.com/ipfs-used-maliciously/)
* [Japanese](https://unit42.paloaltonetworks.com/ja/ipfs-used-maliciously/)
* [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research")
* [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research")
* [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware")  
  [Malware](https://unit42.paloaltonetworks.com/category/malware/)

# Threat Actors Rapidly Adopt Web3 IPFS Technology

![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 16 min read  
Related Products  
[![Advanced DNS Security icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced DNS Security](https://unit42.paloaltonetworks.com/product-category/advanced-dns-security/ "Advanced DNS Security")[![Advanced Threat Prevention icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced Threat Prevention](https://unit42.paloaltonetworks.com/product-category/advanced-threat-prevention/ "Advanced Threat Prevention")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Next-Generation Firewall icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall")[![Prisma Cloud icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/prisma_RGB_logo_Icon_Color.png)Prisma Cloud](https://unit42.paloaltonetworks.com/product-category/prisma-cloud/ "Prisma Cloud")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response")

* ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg)  
  By:
  
  * [Amanda Tanner](https://unit42.paloaltonetworks.com/author/amanda-tanner/)
  * [Kristopher Bleich](https://unit42.paloaltonetworks.com/author/kristopher-bleich/)
  * [Anthony Galiette](https://unit42.paloaltonetworks.com/author/anthony-galiette/)
  * [Joseph Opacki](https://unit42.paloaltonetworks.com/author/joseph-opacki/)

* ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg)  
  Published:April 19, 2023

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg)  
  Categories:
  
  * [Malware](https://unit42.paloaltonetworks.com/category/malware/)
  * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/)

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg)  
  Tags:
  
  * [Credential theft](https://unit42.paloaltonetworks.com/tag/credential-theft/)
  * [IPFS](https://unit42.paloaltonetworks.com/tag/ipfs/)
  * [Phishing](https://unit42.paloaltonetworks.com/tag/phishing/)
  * [Web3](https://unit42.paloaltonetworks.com/tag/web3/)

* [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/ipfs-used-maliciously/?pdf=download&lg=en&_wpnonce=edee969a51 "Click here to download")

* [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/ipfs-used-maliciously/?pdf=print&lg=en&_wpnonce=edee969a51 "Click here to print")

Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg)

* ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg)
* [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Threat%20Actors%20Rapidly%20Adopt%20Web3%20IPFS%20Technology&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fipfs-used-maliciously%2F "Share in email")
* [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fipfs-used-maliciously%2F "Share in Facebook")
* [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fipfs-used-maliciously%2F&title=Threat%20Actors%20Rapidly%20Adopt%20Web3%20IPFS%20Technology "Share in LinkedIn")
* [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fipfs-used-maliciously%2F&text=Threat%20Actors%20Rapidly%20Adopt%20Web3%20IPFS%20Technology "Share in Twitter")
* [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fipfs-used-maliciously%2F&ts=markdown "Share in Reddit")
* [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Threat%20Actors%20Rapidly%20Adopt%20Web3%20IPFS%20Technology%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fipfs-used-maliciously%2F "Share in Mastodon")

## Executive Summary

During 2022, analysts from Unit 42 observed the rampant adoption of the InterPlanetary File System (aka IPFS) being used as a vehicle for malicious intent. IPFS is a Web3 technology that decentralizes and distributes the storage of files and other data into a peer-to-peer network.

Like any technology, IPFS can be abused by malicious threat actors. However, because the hosted content on IPFS is decentralized and distributed, there are challenges in locating and removing malicious content from the ecosystem, making it akin to bullet-proof hosting.

From the **last quarter of 2021 through the end of the last quarter of 2022**, Palo Alto Networks detected an 893% increase in IPFS-related traffic. Our calculations also show that VirusTotal reported over 27,000% increase during the same period.

This increase in IPFS-related traffic is rife with notable increases in malicious activity, as can be expected. Analysts from Unit 42 observed numerous threat campaigns in 2022 that covered the gamut of phishing, credential theft, malicious payload distribution and general adoption by threat actors.

Some of the key takeaways from our analysis include the following:

* There was a significant jump in IPFS-related traffic at the beginning of 2022. Palo Alto Networks detected a **178% increase** in IPFS-related traffic from the **last quarter of 2021 to the first quarter of 2022** , while **VirusTotal reported more than 6,500% increase** during that same reporting period.
* We have identified threat actors discussing the adoption of the technology on forums in the dark web as well as threat actors selling services hosted on IPFS.
* We have seen several types of cyberthreats using IPFS, including phishing, credential theft, command and control (C2) communications, and malicious payload distribution.

Palo Alto Networks customers receive protections from the malware families discussed as well as their malicious components in the following ways:

* [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR)
* The [Next-Generation Firewall](https://docs.paloaltonetworks.com/ngfw) with [Cloud-Delivered Security Services](https://docs.paloaltonetworks.com/cdss) including [WildFire](https://docs.paloaltonetworks.com/wildfire) and [Advanced Threat Prevention](https://docs.paloaltonetworks.com/advanced-threat-prevention/administration).
* [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering/administration) and [DNS Security](https://docs.paloaltonetworks.com/dns-security) can analyze and block malicious IPFS domains, including malware and phishing hosting URLs, and C2 domains.

| **Related Unit 42 Topics** | [**Phishing**](https://unit42.paloaltonetworks.com/tag/phishing/) |
|----------------------------|-------------------------------------------------------------------|

## What Are Web3 and IPFS?

Before we delve into our observations around threat actor behavior associated with IPFS, it is important to have a general understanding of Web3 and also IPFS. IPFS is one of the technologies that supports Web3 infrastructures.

Web3 -- or the third iteration of the web -- is a new version of the internet that prioritizes decentralization using blockchain technology and tokens. With Web3, users can safeguard their data against censorship and manipulation without the need for a central authority.

This decentralization allows individuals to have ownership and control over their own content, which can be posted without fear of governments or tech companies removing it. However, cybercriminals can also exploit these same benefits to further their malicious activities.

IPFS is a distributed file sharing system that was released in 2015. It is open source and uses a peer-to-peer (P2P) hypermedia protocol, making the internet faster, safer and more open.

Unlike the traditional web, IPFS is content-oriented and searches for content identifiers in the form of hashes through a decentralized network, rather than specific locations. Content on IPFS can be accessed by establishing your own node on the IPFS network or using IPFS gateways, which are third-party web-based interfaces between the web and the IPFS network. IPFS is available through any IPFS gateway, and is not gateway-specific. These gateways allow users to view and pull content through HTTP requests, but they cannot alter or add to the content.

More information about Web3 and IPFS can be found at the following sites:

* [Web3](https://en.wikipedia.org/wiki/Web3)
* [IPFS](https://github.com/ipfs/ipfs)

## Increase in Overall Traffic

Despite its relative obscurity, we observed a notable increase in IPFS traffic across Palo Alto Networks starting the first quarter of 2022, as seen in Figure 1. In the first quarter of 2022, our products detected a 178% increase in IPFS traffic as compared to what we logged at the end of the last quarter of 2021.

This traffic continued to increase following this initial observation:

* An increase of 85% in the second quarter
* A 62% increase in the third quarter
* A 19% increase in the last quarter of 2022

This equated to an overall increase of 893%.
:chart: Figure 1. Palo Alto Networks IPFS traffic.

We had also identified that IPFS-related traffic saw a similar increase on VirusTotal for the first quarter of 2022, with an increase of 6,503% when compared to the last quarter of 2021.

Similar to what was seen across Palo Alto Networks, VirusTotal continued to see the following increases quarter over quarter (as shown in Figure 2):

* A 68% increase in the second quarter
* A 69% increase in the third quarter
* A 48% increase in the last quarter of 2022

![Image 2 is a graph showing the increase of VirusTotal IPFS submissions from quarter four of 2021 to quarter four of 2022. There is a large increase over time from 149 to almost 41,500.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/04/chart-1.png) Figure 2. VirusTotal IPFS submissions.

As shown in the observed traffic for IPFS represented in Figures 1 and 2, this increase can be directly attributed to the adoption of IPFS as a technology. Unfortunately, with the adoption of any new technology, there are always people who aim to use it with malicious intent. The notable increase in IPFS traffic we observed in Palo Alto Networks and VirusTotal submissions also includes substantial increases in malicious activity using IPFS.

Analysts from Unit 42 have observed adoption of IPFS for the following types of malicious activities over the past year:

* Adoption by threat actors
* Utilization for phishing and account credential theft
* Utilization by several malware intrusion sets for malicious payload distribution
* C2 communication

## Observations of Threat Actors Adopting IPFS

Unit 42 researchers have observed threat actors discussing their use of IPFS, or their customers' adoption of this technology, particularly as it pertains to phishing and similar types of cybercrime. Threat actors often advertise their scam services, citing a variety of selling points including that sites were "not suspended online for a long time" and that their "link has no downtime." This is to say that IPFS has provided them with protection and longevity to their campaigns due to the nature of IPFS' distributed file system. These discussions are shown in Figures 3, 4, 5 and 6.
![Image 3 is a screenshot of threat actors advertising scam services using IPFS links. The threat actor is part of the HappyBrotherGroup. The message consists of a list of the different ways in the message consists of not only their services, but their skill sets.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/04/word-image-127743-3.png) Figure 3. Threat actor selling scam services using customer IPFS links. ![Image 4 is a screenshot of an advertisement by a threat actor selling an IPFS phishing page. It also includes contact info.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/04/word-image-127743-4.png) Figure 4. Threat actor selling IPFS phishing page. ![Image 5 as a screenshot of a threat actor, selling an IPFS phishing page and asking for any potential buyers to DM them.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/04/word-image-127743-5.png) Figure 5. Threat actor selling IPFS phishing page. ![Image 6 is a screenshot of an advertisement by a threat actor selling an IPFS phishing page. It includes the price and contact information as well as services offered.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/04/word-image-127743-6.png) Figure 6. Threat actor selling IPFS phishing page.

Threat actors are using public IPFS gateways as a means to deliver their malicious content. Without these internet accessible gateways, threat actors would not be able to reach their targets successfully at the scale necessary when using the IPFS network as part of their threat campaigns. This trend is seen in the use of internet accessible IPFS links found in numerous phishing and cybercrime campaigns where initial attack vectors are often email lures.

In the following sections, we will detail some of the threat campaigns we have seen during our analysis of malicious use of IPFS technology.

## Phishing

Figure 7 shows that IPFS saw exponential growth in phishing-related network traffic, particularly in the last quarter of the year. Unlike traditional phishing pages hosted on the web, a hosting provider or moderating organization cannot easily remove IPFS phishing content.

Once published to the IPFS network, anyone can obtain and republish content on their own node. Phishing content can be hosted on multiple nodes and requests would have to be made to each host for content removal. Should any one host not agree to the removal, the content would be virtually impossible to remove.

Phishing campaigns typically have shorter times to live (TTL) than other types of cybercrime due to content removal or suspension by site owners, hosting providers or moderators. The structure of IPFS allows criminals to prolong their campaign by making it more resilient to takedowns.
![Image 7 is a graph of the increase of Palo Alto Networks IPFS phishing URLs change over time. It starts with quarter four of 2021 and goes to quarter four of 2022. There is an enormous increase, especially from quarter three to quarter four of 2022.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/04/chart-2.png) Figure 7. Palo Alto Networks IPFS phishing URLs.

IPFS phishing campaigns are similar to those of traditional phishing, where attackers mimic legitimate services and software (such as DHL, DocuSign and Adobe) to increase the potential of landing in someone's inbox. The ability to block these lures depends on what email security the receiving organization has in place. While some organizations set very strict rules within their secure email gateway and other security products, others do not out of fear that legitimate emails will be affected.

Note that the names and logos shown below are the work of a threat actor attempting to impersonate a legitimate organization and do not represent an actual affiliation with that organization. The threat actor's impersonation does not imply a vulnerability in the legitimate organization's products or services.

In the example below, an email lure mimicking the DHL brand contains an attachment. Within that attachment, there is an IPFS link to the actual phishing page.
![Image 8 is a screenshot of an email phishing lure. It is disguised to resemble a DHL shipping invoice.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/04/word-image-127743-8.png) Figure 8. DHL-themed email lure with attachment submitted to VirusTotal.

Once the user clicks the attachment shown in Figure 8, a fake invoice mimicking Adobe PDF branding is previewed, as shown in Figure 9. Instead of opening a PDF, the "Open" button is actually an IPFS link that redirects the user to the actual phishing page. This page can be accessed via the internet through an IPFS gateway (also highlighted in Figure 9).
![Image 9 is a screenshot of the attachment seen in the previous image of the DHL phishing lure. It shows a PDF as well as a red button saying open.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/04/word-image-127743-9.png) Figure 9. Attachment with link from the DHL lure.

The IPFS URL takes the user to an Adobe phishing page (shown in Figure 10) via the ipfs\[.\]io gateway, which then attempts to steal the user's login credentials.
![Image 10 is a screenshot of an IPFS phishing link. This is also from the same attachment as the DHL themed phishing lure. A pop-up shows a broken image as well as a form field for email and password, and a confirmation button.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/04/word-image-127743-10.png) Figure 10. IPFS phishing link found in the attachment from the DHL-themed lure.

As in other Web3 technologies, typical data exfiltration methods are not possible on the IPFS network. There is no way for the threat actor to receive the data the victim inputs into the form meant to steal their credentials.

Standard web forms use HTML frontends to display content for presentation and backend form processors to collect, process and send the data to a web server. IPFS does not contain the same or similar technology to handle these dynamic functions.

People using IPFS are simply pulling or retrieving a read-only copy of the data, not interacting with it. Phishing pages hosted behind IPFS gateways rely on a number of other techniques instead.

For example, attackers can use embedded script code in webpages that collect account credentials. They can also use headless forms, which are static user forms that can be filled out and collected. The form fields are mapped to a JSON model to facilitate API-driven theft by sending to a backend system via an API. The information is gathered via HTTP POST requests, which are sent to the attacker, where it can be used for additional nefarious purposes.

Let's examine the use of both of these credential theft techniques.

### Unescaped Script in Nillis.html

Figure 10 shows an example of a phish mimicking Microsoft that is hosted as an HTML page. The IPFS URL to contact this page is

hxxps\[://\]bafybeicw4jjag57bk3czji7wjznkkpbocg27qk3fjvqh5krbrfiqbksr2a\[.\]ipfs\[.\]w3s\[.\]link/Nills\[.\]html.
![Image 11 is a screenshot of a phishing page that mimics a Microsoft login page. It shows what appears to be a regular Microsoft login form field, asking the user to sign in.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/04/word-image-127743-11.png) Figure 11. Phishing page for Nills.html.

To understand how the credentials will be exfiltrated, let's review the source content of the webpage.

Figure 12 shows a function named WriteHTMLtoJS. The purpose of this function is to write HTML to JavaScript (JS), and to also unescape the contents. The unescape JS function is responsible for decoding hexadecimal sequences with their actual ASCII character values. This representation can be seen on lines 3 and 4 of Figure 12.
![Image 12 is a screenshot of the source code of the phishing webpage. An red arrow in a box highlights the content to be decoded.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/04/word-image-127743-12.png) Figure 12. Source view of Nills.html webpage.

Decoding and analyzing the unescaped content (shown in Figure 13) reveals a pair of script tags and an observed URL, which is app\[.\]headlessforms\[.\]cloud. The phishing page appears to contact this URL.

A review of the headless forms indicates this phishing page is using a method for managing user forms where data can be captured on a third-party backend without having to design and/or develop a frontend web application.
![Image 13 is a screenshot of a few lines of code. It is the decoded Nills.html file that contains the location of credential exfiltration. Highlighted with a red arrow and box is the headless form phishing.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/04/word-image-127743-13.png) Figure 13. Decoded view of Nills.html containing the location of credential exfiltration.

After a victim enters an account username and password credential, it will be sent via an HTTP POST request (shown in Figure 14). The string of characters at the end of the URI (GjCP9S9nke) is a unique identifying token associated with the actor on the headless forms platform.
![Image 14 is a screenshot of many lines of code. It shows the HTTP POST and captured credentials. These are highlighted with a red arrows and boxes around the relevant content. The HTTP POST is at the top with the credential theft at the bottom.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/04/word-image-127743-14.png) Figure 14. HTTP POST and captured credentials.

Let's move on to examining another phishing campaign using another collection technique.

### HTTP POST in new.html

Another phishing page (shown in Figure 15) that we discovered mimicking the Microsoft brand, which was also hosted on IPFS, is called new.html. The associated IPFS phishing URL is:

hxxp\[://\]bafybeifm5vcoj35hhuxf7ha3gg6asrrlrwu3bvcysgmrvygnm3qjmugwxq\[.\]ipfs\[.\]w3s\[.\]link/new\[.\]html?email=

![Image 15 is a screenshot of a phishing page that mimics a Microsoft account login page. It includes a form field to sign in.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/04/word-image-127743-15.png) Figure 15. Phishing page for new.html.

Review of the webpage source indicates a similar JS function to the one referenced previously, where it unescapes the contents, decoding them to the ASCII values. The unescape function can be seen in Figure 16.
![Image 16 is a screenshot of the source code for news.html](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/04/word-image-127743-16.png) Figure 16. Source view of new.html.

Decoding the content reveals a snippet of interest that is located near the bottom of a sizable amount of code, as shown in Figure 17.
![Image 17 is a screenshot of many lines of code. Highlighted inside of a red box is a URL.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/04/word-image-127743-17.png) Figure 17. new.html URL where data is POSTed.

The snippet in Figure 17 shows the external URL (fairpartner\[.\]ru) registered to a click function event for the submit button. This URL will be contacted with the data provided by an HTTP POST request, as shown in Figure 18.
![Image 18 is a screenshot of Wireshark showing the DNS request for fairpartner.ru.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/04/word-image-127743-18.png) Figure 18. DNS request for fairpartner.ru.

At the time this research was compiled, we were unable to capture the credential theft as the domain was no longer reachable. This highlights the resiliency of using a third-party service such as headless forms versus the traditional hosting used by this campaign for capturing credentials.

IPFS is not only used by threat actors for phishing. It is also used for malware intrusion sets and ransomware.

Ransomware-as-a-service (RaaS) operators such as RansomEXX are known to use the IPFS network to release the stolen data of their victims. Malware families such as Smoke Loader, XLoader, XMRig and OriginLogger often use IPFS links for malicious payload delivery. IPStorm and Dark Utilities use the IPFS network for infrastructure and staging.

Let's review how each of these groups uses IPFS.

## Malware and Red Team Tools

Threat actors use IPFS gateways in a couple different ways. These can be categorized as either delivery methods or for use as infrastructure for hosting or staging payloads, or for acting as a decentralized C2 channel.

The following malware families have been using IPFS throughout 2022. The malware family Dark Utilities has been using IPFS gateways for staging malicious payloads. IPStorm uses IPFS gateways as a C2 channel for P2P communications.

Attackers have also used IPFS gateways to deliver various red team tools and malware such as the following:

* OriginLogger
* XLoader
* XMRig
* Metasploit

We'll describe how these threats operate at a high level, including how IPFS was used to facilitate malicious operations.

### OriginLogger

The [OriginLogger](https://unit42.paloaltonetworks.com/atoms/agent-tesla/) malware family has been around since 2019. It is the continuation of the Agent Tesla remote access Trojan. It is written in .NET and functions as a highly evasive information stealer. This threat typically targets keystrokes and clipboard data, which is communicated back to an actor-controlled server through a C2 channel.

Unit 42 researchers discovered an email lure masquerading as an overdue invoice, with an XLL attachment (as shown in Figure 19). Upon opening the XLL file, an HTTP GET request is sent to the IPFS URL:

hxxps\[://\]ipfs\[.\]io/ipfs/QmXtVwamvHvXZzuEZcMn2xDsPRKN8uS17YCUzTiGx1rYnv?filename=file-05-2022.exe

This URL is used for downloading the OriginLogger payload via IPFS gateway.
![Image 19 is a screenshot of an email. The email text is requesting for overdue invoices to be paid. Highlighted in red is the attachment, which is a .XLL file.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/04/word-image-127743-19.png) Figure 19. Attachment - 30-MAY-22.xll.

Figure 20 shows the second delivery example of OriginLogger. This email lure also masquerades as an overdue invoice statement, with the subject line "Overdue Invoice Statement."

This email lure also has an XLL file attachment. Upon opening, this will also send a GET request to the IPFS URL:

hxxps\[://\]ipfs\[.\]io/ipfs/QmXtVwamvHvXZzuEZcMn2xDsPRKN8uS17YCUzTiGx1rYnv?filename=file-05-2022.exe

Clicking this URL downloads an OriginLogger payload via an IPFS gateway.
![Image 20 is a screenshot of an email. The email text is requesting for overdue invoices to be paid. Highlighted in red is the attachment, which is a .XLL file. It contains an OriginLogger payload.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/04/Figure-20.png) Figure 20. Email pushing an attachment containing an OriginLogger payload.

Some additional OriginLogger payloads hosted on IPFS are listed below, from a campaign that occurred during May-June 2022:

hxxps\[://\]ipfs\[.\]io/ipfs/QmQBPuPxy3nZjK2yVspsUJVhutajAfRQpnjc58RAcUJFrh?filename=INV-SCL0093-05-22pdf.exe

hxxps\[://\]ipfs\[.\]io/ipfs/QmY4kDbUk8VYM8Zzn1rVgfa3c4ybma4evMBfyWwyieaZxW?filename=Sign-Reurn-pdf.exe

hxxps\[://\]ipfs\[.\]io/ipfs/QmczJ1MxQ2SH8deXBTJfFgsrApM5BShgLSh1MQry4Vxc4c?filename=REF

### XLoader

The [XLoader](https://blogs.blackberry.com/en/2021/09/threat-thursday-xloader-infostealer) malware family has been around since 2020, as a rebrand of FormBook. XLoader has been advertised as a malware-as-a-service (MaaS) offering that can run on Windows as well as macOS. XLoader functions as a stealer that targets browser and login credentials, and it's also capable of keylogging and capturing screenshots.

Unit 42 researchers observed the following in the wild (ITW) URLs related to the hosting of XLoader payloads:

hxxp\[://\]bafybeiafb63z73aoz3d4jdpve2rhlwo6ujlzjyri26z63flqnara2dqwoa\[.\]ipfs\[.\]dweb\[.\]link/order.exe

bafybeicokadgkcohrqslwdnmtu5mcc2zmo2hveiw2bh5j5z35onsxe3cy4\[.\]ipfs\[.\]dweb\[.\]link

### XMRig

[XMRig](https://www.welivesecurity.com/2017/09/28/monero-money-mining-malware/) is a cryptomining malware family that has been around since 2017. XMRig is an open-source utility that various threat groups have adapted to be delivered either in malspam or in campaigns that exploit vulnerable public facing applications, leading to XMRig being deployed.

Figure 21 shows an ITW IPFS domain that was serving an XMRig payload in late March 2023. Unit 42 researchers also observed threat actors abusing Cloudflare's [IPFS gateway](https://developers.cloudflare.com/web3/ipfs-gateway/) to host XMRig.
![Image 21 is a screenshot of the ITW domain that downloads the XMRig payload. Highlighted in red are two sections.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/04/word-image-127743-21.png) Figure 21. ITW domain downloading XMRig payload.

Unit 42 researchers observed the following URLs related to the hosting of XMRig:

hxxps\[://\]bafybeibgc3snqi6qesnhskujhjcbduu7lfhju7eppumuqhymapuwvln6tq\[.\]ipfs\[.\]nftstorage\[.\]link

hxxps\[://\]cloudflareipfs\[.\]com/ipns/12D3KooWDdu1TTG9JRzFisv8HBXE2Zi2qpqs1r2vb88vEE1ws5mc/phpupdate.exe

Figure 22 shows the attributes of the executable PE file properties for XMRig.
![Image 22 is a screenshot of the file property is for the XMRig PE file.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/04/word-image-127743-22.png) Figure 22. View of XMRig PE file information.

### Metasploit

The [Metasploit Framework](https://malpedia.caad.fkie.fraunhofer.de/details/win.meterpreter) is a penetration testing toolkit that has been around since the early 2000s. Metasploit contains exploits, modules, payloads and auxiliary capabilities. The primary use case for this toolkit is to generate payloads and achieve code execution to set up a communication channel with a victim machine. This allows someone using the toolkit to gain access to and control of an environment or user.

In late March 2023, Unit 42 researchers observed an ITW IPFS domain:

hxxps\[://\]bafybeihtuhj7ezvjbtig75qpv43t7eh6dmcnarlm454fx5yjb4uzqbidpy\[.\]ipfs\[.\]infura-ipfs\[.\]io

This domain has been serving a Metasploit shellcode payload since May 26, 2022. The shellcode connects back to the IP address 51.254.127\[.\]82 as shown in Figures 23 and 24.
![Image 23 is a screenshot showing what it looks like when the Metasploit payload is downloaded. Highlighted in red is the payload in the file name.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/04/word-image-127743-23.png) Figure 23. Downloading Metasploit payload from IPFS domain. ![Image 24 is a screenshot of a few lines of code. Highlighted within the code is the IP connection.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/04/word-image-127743-24.png) Figure 24. Metasploit shellcode reverse shell IP connection.

An additional ITW domain was also observed associated with the same Metasploit payload:

hxxps\[://\]ipfs.infura\[.\]io/ipfs/QmejguEysvXLMaAYmXe3EXmjfnoAqMdVfn4ojto1yLTGhK

### IPStorm

The IPStorm malware family has been around since 2019, as reported by researchers at [Anomali](https://www.anomali.com/blog/the-interplanetary-storm-new-malware-in-wild-using-interplanetary-file-systems-ipfs-p2p-network). [IPStorm](https://www.bitdefender.com/files/News/CaseStudies/study/376/Bitdefender-Whitepaper-IPStorm.pdf) is a notable botnet as it uses IPFS as a C2 channel.

IPStorm uses the open-source library [libp2p](https://docs.libp2p.io/concepts/introduction/overview/) for its networking stack and P2P communication over the IPFS network. The executable is written in Golang and contains multiple notable package names that can be used to identify the malware family. This threat uses the folder name /storm before the module name, as shown in Figure 25.
![Image 25 is the screenshot of the GO libraries. The included columns show the address, length, type, and finally the string. Highlighted in yellow are the source storm parts of the path.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/04/word-image-127743-25.png) Figure 25. Screenshot of GO libraries used in b8ee3897aff6c6660557a4c73b243870020705df6c87287040bfcd68b7c8b100.

### Dark Utilities

The [Dark Utilities](https://blog.talosintelligence.com/dark-utilities/) malware family was initially identified in 2022 by Cisco Talos. Dark Utilities is a C2-as-a-service product offering that uses IPFS as its delivery channel of choice.

This threat can be compiled for Windows, macOS, Linux or various embedded systems. The product offers cryptomining and DDoS capabilities, as well as typical remote access functionality.

Unit 42 researchers found numerous ITW domains still serving Dark Utilities payloads in late March 2023. Figures 26 and 27 show the ITW domain and associated SHA256 hash.
![Image 26 is a screenshot showing the download of an ITW domain. Highlighted in red is the URL.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/04/word-image-127743-26.png) Figure 26. ITW domain downloading Dark Utilities payload. ![Image 27 is a screenshot of the SHA256 of Dark Utilities payload.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/04/word-image-127743-27.png) Figure 27. SHA256 of Dark Utilities payload.

bafybeidravcab5p3acvthxtwosm4rfpl4yypwwm52s7sazgxaezfzn5xn4\[.\]ipfs.infura-ipfs.io

bafybeibmryvvmv6vzdsewqw63j46k72pm4lqkb37hnc757qa3jyqktscxy\[.\]ipfs.infura-ipfs.io

bafybeiehf33obq42jx73m3nfilstzgk52wuvwmoechf4wmbt652p36jsia\[.\]ipfs.nftstorage.link

bafybeidqh7dk3sse4u5d66web5v446nnygtw5jeav5vunueyonjx5wp6gm\[.\]ipfs.nftstorage.link

Figure 28 shows the decompiled view of the Python source code used to build the Dark Utilities executables, which is hosted on the IPFS network. The main function in the source code shown determines whether a system is Windows or Linux-based. Upon determining what operating system is running, the code continues by setting up persistence, among other tasks.
![Image 28 is a screenshot of many lines of code. It is the decompile view of the Dark Utilities Python code.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/04/word-image-127743-28.png) Figure 28. Decompiled view of Dark Utilities Python code.

## Conclusion

Threat actors increasing their adoption of IPFS is a growing concern because, as a decentralized and distributed storage technology, IPFS poses unique challenges in locating and removing malicious content from the ecosystem. It is important to note that there is no single solution for removing malicious content from the IPFS networks. Different approaches might be more or less effective depending on the specific circumstances and the participation of the owners of the decentralized networks in which the content is ultimately hosted.

The significant increase in IPFS-related traffic we observed during 2022 at Palo Alto Networks and VirusTotal data highlights the growing popularity of this technology among threat actors. The threat campaigns observed by analysts from Unit 42 demonstrate the versatility of IPFS for carrying out a variety of malicious activities, including phishing, credential theft, C2 communications and payload distribution.

Threat actors' adoption of IPFS, as well as the sale of services hosted on IPFS, underscores the need for continued vigilance and proactive measures to detect and mitigate threats on this platform. It is imperative that the cybersecurity community remains vigilant and takes proactive steps to stay ahead of evolving threats on IPFS and other emerging technologies.

## Product Protections

Palo Alto Networks customers receive protections from the threats discussed above through the following products:

* [Prisma Cloud](https://docs.paloaltonetworks.com/prisma/prisma-cloud) customers are protected from these malware families through [WildFire](https://docs.paloaltonetworks.com/wildfire)
* The [Next-Generation Firewall](https://docs.paloaltonetworks.com/ngfw) with [Cloud-Delivered Security Services](https://docs.paloaltonetworks.com/cdss) including [WildFire](https://docs.paloaltonetworks.com/wildfire) and [Advanced Threat Prevention](https://docs.paloaltonetworks.com/advanced-threat-prevention/administration).
* [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering/administration) and [DNS Security](https://docs.paloaltonetworks.com/dns-security) can analyze and block malicious IPFS domains, including malware and phishing hosting URLs, and C2 domains.
* [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) customers are protected from these malware families and their components.

If you think you might have been compromised or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call:

* North America Toll-Free: 866.486.4842 (866.4.UNIT42)
* EMEA: +31.20.299.3130
* APAC: +65.6983.8730
* Japan: +81.50.1790.0200

Palo Alto Networks has shared these findings, including file samples and indicators of compromise, with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org).

## MalwareBazaar References

|--------------------|-------------------------------------------------------------------------------------------------------------|
| **Malware Family** | **Malware Bazaar Report Link**                                                                              |
| Phishing           | hxxps\[://\]bazaar\[.\]abuse\[.\]ch/sample/460a3720734df53891c36340dc037122d73103517fe57b7c36480dfae3c0f4d7 |
| Phishing           | hxxps://bazaar\[.\]abuse\[.\]ch/sample/2a060e0db155844605077e78270b45b8627c2aedef503b26fc6ecaf2f6742023     |
| OriginLogger       | hxxps://bazaar\[.\]abuse\[.\]ch/sample/edfc3c3090eba1aba9c9960d68a1464bcf668773a1eec38ec8c54c357dca0c61     |
| OriginLogger       | hxxps://bazaar\[.\]abuse\[.\]ch/sample/3b9ef32ea71c375cd63e599a54ca3f5b58ac8b6e589c3036a3a0d4886c730ddd     |
| OriginLogger       | hxxps://bazaar\[.\]abuse\[.\]ch/sample/3072a7ec1f71a9adc7a714092172e4b763a9f7128ead2ae67e72663863b1143b     |
| OriginLogger       | hxxps://bazaar\[.\]abuse\[.\]ch/sample/b6f8699b55c9e9ca2d84c18c689eff12be9b7bd849a527a44d39e2aaa4dbf3a0     |
| OriginLogger       | hxxps://bazaar\[.\]abuse\[.\]ch/sample/c7ceafc46a828d2ccca49936ddc8d5da666e885455ecd6ad6bd77aa23c284fe6     |
| XLoader            | hxxps://bazaar\[.\]abuse\[.\]ch/sample/a12635fd762876c38da85b88adf42141beb117cc12464c3e0d122c9395bd2a4b     |
| XLoader            | hxxps://bazaar\[.\]abuse\[.\]ch/sample/1a41a5bf751fd2deb7cf46b231e45843adc5f036149979de847c053177be2eb8     |
| XMRig              | hxxps://bazaar\[.\]abuse\[.\]ch/sample/d1ea28dee35382c510a49e4304ed7cead25bcee5cc869c73c9c53f333139e060     |
| XMRig              | hxxps://bazaar\[.\]abuse\[.\]ch/sample/a372e07a691f8759e482615fd7624bfca2a2bc2cd8652a47ff9951ff035759a5     |
| Metasploit         | hxxps://bazaar\[.\]abuse\[.\]ch/sample/894b5e81fe56418b8df30639fd8b8c484c934aba8a121397b592039e07f766ee     |
| IPStorm            | hxxps://bazaar\[.\]abuse\[.\]ch/sample/b8ee3897aff6c6660557a4c73b243870020705df6c87287040bfcd68b7c8b100     |
| IPStorm            | hxxps://bazaar\[.\]abuse\[.\]ch/sample/765a4d57b2db92c2fd904b11a3e2dd26cdaa38843cc1760ae84e3334822bf4c4     |
| IPStorm            | hxxps://bazaar\[.\]abuse\[.\]ch/sample/cdddd240d432b084b2c5cbe6b4a89b39a33d97840630210772b7758ec87dcacd     |
| Dark Utilities     | hxxps://bazaar\[.\]abuse\[.\]ch/sample/65a1b3fb9430c7342d13f79b460b2cc7d9f9ddced2aeecd37f2862a67083e68c     |
| Dark Utilities     | hxxps://bazaar\[.\]abuse\[.\]ch/sample/c9deeda7cd7adb4ff584d13ea64cdb50c9e8b5c616f1dff476f372e86c9b9be6     |
| Dark Utilities     | hxxps://bazaar\[.\]abuse\[.\]ch/sample/554f955a405be9393eb2e9af182029029d562d79d23a6a8663704b1c00abfb56     |
| Dark Utilities     | hxxps://bazaar\[.\]abuse\[.\]ch/sample/583d96d55608ab7079b7867c34c195766699a711ef3aa9df826ac3c5bc5c3232     |
| Dark Utilities     | hxxps://bazaar\[.\]abuse\[.\]ch/sample/e1512098be4bd1a8b67839b077a58451941a87407257beb05752155ef5e04d40     |
| Dark Utilities     | hxxps://bazaar\[.\]abuse\[.\]ch/sample/ba81c3a82a01fcd2f4c24904e4dc0b7ca26f472e50db9056af6e2217f925e9f5     |

## Indicators of Compromise

### Hashes

|----------------|------------------------------------------------------------------|
| **Family**     | **SHA256**                                                       |
| Phishing       | 460a3720734df53891c36340dc037122d73103517fe57b7c36480dfae3c0f4d7 |
| Phishing       | 2a060e0db155844605077e78270b45b8627c2aedef503b26fc6ecaf2f6742023 |
| OriginLogger   | edfc3c3090eba1aba9c9960d68a1464bcf668773a1eec38ec8c54c357dca0c61 |
| OriginLogger   | 3b9ef32ea71c375cd63e599a54ca3f5b58ac8b6e589c3036a3a0d4886c730ddd |
| OriginLogger   | cfa0a616bb5e61e215e915a3d7942094db58b8c3f8a613d9410a807df4837d5a |
| OriginLogger   | 3072a7ec1f71a9adc7a714092172e4b763a9f7128ead2ae67e72663863b1143b |
| OriginLogger   | b6f8699b55c9e9ca2d84c18c689eff12be9b7bd849a527a44d39e2aaa4dbf3a0 |
| OriginLogger   | c7ceafc46a828d2ccca49936ddc8d5da666e885455ecd6ad6bd77aa23c284fe6 |
| XLoader        | a12635fd762876c38da85b88adf42141beb117cc12464c3e0d122c9395bd2a4b |
| XLoader        | 1a41a5bf751fd2deb7cf46b231e45843adc5f036149979de847c053177be2eb8 |
| XMRig          | a372e07a691f8759e482615fd7624bfca2a2bc2cd8652a47ff9951ff035759a5 |
| XMRig          | d1ea28dee35382c510a49e4304ed7cead25bcee5cc869c73c9c53f333139e060 |
| Metasploit     | 894b5e81fe56418b8df30639fd8b8c484c934aba8a121397b592039e07f766ee |
| IPStorm        | b8ee3897aff6c6660557a4c73b243870020705df6c87287040bfcd68b7c8b100 |
| IPStorm        | 765a4d57b2db92c2fd904b11a3e2dd26cdaa38843cc1760ae84e3334822bf4c4 |
| IPStorm        | cdddd240d432b084b2c5cbe6b4a89b39a33d97840630210772b7758ec87dcacd |
| Dark Utilities | 65a1b3fb9430c7342d13f79b460b2cc7d9f9ddced2aeecd37f2862a67083e68c |
| Dark Utilities | c9deeda7cd7adb4ff584d13ea64cdb50c9e8b5c616f1dff476f372e86c9b9be6 |
| Dark Utilities | 554f955a405be9393eb2e9af182029029d562d79d23a6a8663704b1c00abfb56 |
| Dark Utilities | 583d96d55608ab7079b7867c34c195766699a711ef3aa9df826ac3c5bc5c3232 |
| Dark Utilities | e1512098be4bd1a8b67839b077a58451941a87407257beb05752155ef5e04d40 |
| Dark Utilities | ba81c3a82a01fcd2f4c24904e4dc0b7ca26f472e50db9056af6e2217f925e9f5 |

## Acknowledgments

Special thanks to Lucas Hu for his contributions on the curation of some of the IPFS-related URLs and data sources used in this blog.

## Additional Resources

* * [Analyzing the Various Layers of AgentTesla's Packing](https://unit42.paloaltonetworks.com/unit42-analyzing-various-layers-agentteslas-packing/) - Unit 42, Palo Alto Networks
  * [OriginLogger: A Look at Agent Tesla's Successor](https://unit42.paloaltonetworks.com/originlogger/) - Unit 42, Palo Alto Networks
  * [Agent Tesla Malware](https://unit42.paloaltonetworks.com/atoms/agent-tesla/) - Unit 42, Palo Alto Networks
  * [Threat Thursday: xLoader Infostealer](https://blogs.blackberry.com/en/2021/09/threat-thursday-xloader-infostealer) - Blackberry
  * [IPStorm White Paper](https://www.bitdefender.com/files/News/CaseStudies/study/376/Bitdefender-Whitepaper-IPStorm.pdf) - Bitdefender
  * [The InterPlanetary Storm: New Malware in Wild Using InterPlanetary File System's (IPFS) p2p network](https://www.anomali.com/blog/the-interplanetary-storm-new-malware-in-wild-using-interplanetary-file-systems-ipfs-p2p-network) - The Anomali Blog
  * [Attackers leveraging Dark Utilities "C2aaS" platform in malware campaigns](https://blog.talosintelligence.com/dark-utilities/) - Talos
  * [Money‑making machine: Monero‑mining malware](https://www.welivesecurity.com/2017/09/28/monero-money-mining-malware/) - WeLiveSecurity, ESET
  * [Are Your Nagios XI Servers Turning Into Cryptocurrency Miners for Attackers?](https://unit42.paloaltonetworks.com/nagios-xi-vulnerability-cryptomining/) - Unit 42, Palo Alto Networks

*Updated April 24, 2023, at 1:08 p.m. PT.*
Back to top

### Tags

* [Credential theft](https://unit42.paloaltonetworks.com/tag/credential-theft/ "credential theft")
* [IPFS](https://unit42.paloaltonetworks.com/tag/ipfs/ "IPFS")
* [Phishing](https://unit42.paloaltonetworks.com/tag/phishing/ "phishing")
* [Web3](https://unit42.paloaltonetworks.com/tag/web3/ "Web3")  
  [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Unit 42 Unveils Most 'Expansive' Cloud Threat Research Yet: Cloud Threat Report Volume 7 Examines the Expanding Attack Surface](https://unit42.paloaltonetworks.com/cloud-threat-report-expanding-attack-surface/ "Unit 42 Unveils Most ‘Expansive’ Cloud Threat Research Yet: Cloud Threat Report Volume 7 Examines the Expanding Attack Surface")

### Table of Contents

* 

### Related Articles

* [The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version](https://unit42.paloaltonetworks.com/xcsset-v40-malware-analysis/ "article - table of contents")
* [Russian Global Webmail Espionage](https://unit42.paloaltonetworks.com/russian-webmail-espionage/ "article - table of contents")
* [Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector](https://unit42.paloaltonetworks.com/phantom-squatting-hallucinated-web-domains/ "article - table of contents")

## Related Malware Resources

![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg)  
[![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/)

* [API](https://unit42.paloaltonetworks.com/tag/api/ "API")

* [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic")

* [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE")  
  ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/)

* [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel")

* [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2")

* [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure")  
  ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/)

* [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI")

* [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT")

* [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America")  
  ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/)

* [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa")

* [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID")

* [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams")  
  ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/)

* [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor")

* [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin")

* [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution")  
  ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/)

* [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication")

* [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft")

* [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels")  
  ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/)

* [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK")

* [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum")

* [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet")  
  ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/)

* [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum")

* [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain")

* [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications")  
  ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/)

* [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain")

* [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop")

* [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm")  
  ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/)

* [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API")

* [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway")

* [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources")

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)  
  ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]()  
  ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png)  
  ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42

## Peace of mind comes from staying ahead of threats. Subscribe today.

Your Email

Subscribe for email updates to all Unit 42 threat research.  
By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement")

This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.

Invalid captcha!
Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg)  
{#footer} Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security)

* [Secure AI by Design](https://www.paloaltonetworks.com/ai-security)

* [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase)

* [Prisma SASE](https://www.paloaltonetworks.com/sase)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam)

* [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira)

* [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management)

* [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management)

* [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager)

* [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance)

* [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management)

* [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic)

* [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management)

* [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance)

* [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery)

* [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42)

* [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense)

* [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses)

* [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy)

* [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence)

* [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond)  
  Company

* [About Us](https://www.paloaltonetworks.com/about-us)

* [Careers](https://jobs.paloaltonetworks.com/en/)

* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales)

* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility)

* [Customers](https://www.paloaltonetworks.com/customers)

* [Investor Relations](https://investors.paloaltonetworks.com/)

* [Location](https://www.paloaltonetworks.com/about-us/locations)

* [Newsroom](https://www.paloaltonetworks.com/company/newsroom)  
  Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/)

* [Communities](https://www.paloaltonetworks.com/communities)

* [Content Library](https://www.paloaltonetworks.com/resources)

* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia)

* [Event Center](https://events.paloaltonetworks.com/)

* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)

* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z)

* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications)

* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure)

* [Sitemap](https://www.paloaltonetworks.com/sitemap)

* [Tech Docs](https://docs.paloaltonetworks.com/)

* [Unit 42](https://unit42.paloaltonetworks.com/)

* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)

* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy)

* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center)

* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use)

* [Documents](https://www.paloaltonetworks.com/legal)

Copyright © 2026 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* EN  
  Select your language  
  ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg)

### Default Heading

Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg)  
Seekbar

![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg)  
![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg)  
Volume
![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)