[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/)  
[![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/)  
Menu

* [Tools](https://unit42.paloaltonetworks.com/tools/)
* [ATOMs](https://unit42.paloaltonetworks.com/atoms/)
* [Security Consulting](https://www.paloaltonetworks.com/unit42)
* [About Us](https://unit42.paloaltonetworks.com/about-unit-42/)
* [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html)
* [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research")
* [Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/ "Threat Actor Groups")
* [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware")  
  [Malware](https://unit42.paloaltonetworks.com/category/malware/)

# Unraveling Sparkling Pisces's Tool Set: KLogEXE and FPSpy

![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 7 min read  
Related Products  
[![Advanced DNS Security icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced DNS Security](https://unit42.paloaltonetworks.com/product-category/advanced-dns-security/ "Advanced DNS Security")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Cortex icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex](https://unit42.paloaltonetworks.com/product-category/cortex/ "Cortex")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Secure Access Service Edge (SASE) icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/prisma_RGB_logo_Icon_Color.png)Secure Access Service Edge (SASE)](https://unit42.paloaltonetworks.com/product-category/secure-access-service-edge/ "Secure Access Service Edge (SASE)")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response")

* ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg)  
  By:
  
  * [Daniel Frank](https://unit42.paloaltonetworks.com/author/daniel-frank/)
  * [Lior Rochberger](https://unit42.paloaltonetworks.com/author/lior-rochberger/)

* ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg)  
  Published:September 26, 2024

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg)  
  Categories:
  
  * [Malware](https://unit42.paloaltonetworks.com/category/malware/)
  * [Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/)

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg)  
  Tags:
  
  * [APT43](https://unit42.paloaltonetworks.com/tag/apt43/)
  * [DPRK](https://unit42.paloaltonetworks.com/tag/dprk/)
  * [FPSpy](https://unit42.paloaltonetworks.com/tag/fpspy/)
  * [G0086](https://unit42.paloaltonetworks.com/tag/g0086/)
  * [Keylogger](https://unit42.paloaltonetworks.com/tag/keylogger/)
  * [Kimsuky](https://unit42.paloaltonetworks.com/tag/kimsuky/)
  * [KLogExe](https://unit42.paloaltonetworks.com/tag/klogexe/)
  * [MITRE](https://unit42.paloaltonetworks.com/tag/mitre/)
  * [North Korea](https://unit42.paloaltonetworks.com/tag/north-korea/)
  * [South Korea](https://unit42.paloaltonetworks.com/tag/south-korea/)
  * [Sparkling Pisces](https://unit42.paloaltonetworks.com/tag/sparkling-pisces/)
  * [Spear Phishing](https://unit42.paloaltonetworks.com/tag/spear-phishing/)
  * [Thallium](https://unit42.paloaltonetworks.com/tag/thallium/)
  * [Velvet Chollima](https://unit42.paloaltonetworks.com/tag/velvet-chollima/)

* [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/kimsuky-new-keylogger-backdoor-variant/?pdf=download&lg=en&_wpnonce=40dbae5d0f "Click here to download")

* [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/kimsuky-new-keylogger-backdoor-variant/?pdf=print&lg=en&_wpnonce=40dbae5d0f "Click here to print")

Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg)

* ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg)
* [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Unraveling%20Sparkling%20Pisces’s%20Tool%20Set:%20KLogEXE%20and%20FPSpy&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fkimsuky-new-keylogger-backdoor-variant%2F "Share in email")
* [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fkimsuky-new-keylogger-backdoor-variant%2F "Share in Facebook")
* [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fkimsuky-new-keylogger-backdoor-variant%2F&title=Unraveling%20Sparkling%20Pisces’s%20Tool%20Set:%20KLogEXE%20and%20FPSpy "Share in LinkedIn")
* [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fkimsuky-new-keylogger-backdoor-variant%2F&text=Unraveling%20Sparkling%20Pisces’s%20Tool%20Set:%20KLogEXE%20and%20FPSpy "Share in Twitter")
* [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fkimsuky-new-keylogger-backdoor-variant%2F&ts=markdown "Share in Reddit")
* [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Unraveling%20Sparkling%20Pisces’s%20Tool%20Set:%20KLogEXE%20and%20FPSpy%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fkimsuky-new-keylogger-backdoor-variant%2F "Share in Mastodon")

## **Executive Summary**

Unit 42 researchers discovered two malware samples used by the Sparkling Pisces (aka Kimsuky) threat group. This includes an undocumented keylogger, called KLogEXE by its authors, and an undocumented variant of a backdoor dubbed FPSpy. These samples enhance Sparkling Pisces' already extensive arsenal and demonstrate the group's continuous evolution and increasing capabilities.

Based on our analysis, we suspect that the FPSpy variant detailed in this report is a variant of malware mentioned in a campaign [carried out in 2022](https://asec.ahnlab.com/ko/30582/). That campaign targeted users of a South Korean technology conglomerate.

In this article, we will provide a technical analysis of KLogEXE and FPSpy, and we'll shed some light on Sparkling Pisces's infrastructure. By understanding the mechanics of those two pieces of malware and the methods employed by Sparkling Pisces, organizations can better prepare and defend against such threats.

Palo Alto Networks customers receive better protection from the threats discussed in this article through [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) and [XSIAM](https://www.paloaltonetworks.com/resources/infographics/xsiam-product-tour?utm_source=google-jg-amer-cortex-socf-siam&utm_medium=paid_search&utm_campaign=google-cortex-xsiam-amer-multi-awareness-en-eg-non_brand-broad&utm_content=7014u000001eDtMAAU&utm_term=siem%20integration&cq_plac=&cq_net=g&gad_source=1&gclid=EAIaIQobChMI9sLv--faiAMVVnFHAR1IcyvDEAAYASAAEgJ8VPD_BwE).

Customers are also better protected through [Cloud-Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) for the [Next-Generation Firewall](https://www.paloaltonetworks.com/network-security/next-generation-firewall), including [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire), [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering/administration), [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) and [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention).

If you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html).

| **Related Unit 42 Topics** | [**North Korea**](https://unit42.paloaltonetworks.com/tag/north-korea/), **[Keylogger](https://unit42.paloaltonetworks.com/tag/keylogger/)** |
|----------------------------|----------------------------------------------------------------------------------------------------------------------------------------------|

## **Background: Who Is Sparkling Pisces?**

The North Korean APT group Sparkling Pisces (aka Kimsuky, THALLIUM, Velvet Chollima) is known for its sophisticated cyberespionage operations and advanced spear phishing attacks. The group's most notable attack was against [Korea Hydro and Nuclear Power](https://www.industrialcybersecuritypulse.com/threats-vulnerabilities/throwback-attack-korea-hydro-and-nuclear-power-highlights-the-vulnerability-of-critical-systems/) (KHNP) in 2014.

The group initially targeted South Korean government agencies, research institutions and think tanks. As it evolved, it expanded its reach to Western countries, including the [United States](https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/), highlighting the group's status as a global threat.

Nicknamed "[the king of spear phishing](https://www.virusbulletin.com/virusbulletin/2020/03/vb2019-paper-kimsuky-group-tracking-king-spearphishing/)," the group has conducted hundreds of attacks to lure victims into downloading and executing malicious payloads. Recently, the group targeted South Koreans by [masquerading as a legitimate Korean company](https://medium.com/s2wblog/kimsuky-disguised-as-a-korean-company-signed-with-a-valid-certificate-to-distribute-troll-stealer-cfa5d54314e2) and using a valid certificate to sign malware. Sparkling Pisces is also known for its complex and constantly evolving infrastructure, which overlaps between multiple malware strains and campaigns.

## **Infrastructure Pivoting: Discovering New Malware Links**

While tracking Sparkling Pisces's infrastructure, we found connections between different operations and tools. We also discovered the group using new and undocumented malware.

One of the malware samples, KLogEXE, was found by tracking the infrastructure that the group used as the command and control (C2) of a PowerShell keylogger that [the JPCERT](https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html) documented. The threat actor delivered the PowerShell keylogger, which an [earlier report by ASEC](https://asec.ahnlab.com/en/49295/) also mentioned, in a spear phishing campaign targeting South Korean users.

The PowerShell keylogger from the aforementioned JPCERT report communicates with www.vic.apollo-star7\[.\]kro.kr, which resolves to 152.32.138\[.\]167.

Pivoting on that IP address led us to another file, a Portable Executable (PE) called powershell.exe (a173a425d17b6f2362eca3c8ea4de9860b52faba414bbb22162895641dda0dc2).

When examining the file, we found that it communicates to a different domain that resolves to the same IP address as the PowerShell keylogger. It also uses an unknown Uniform Resource Identifier (URI) pattern that we didn't observe in any other malware associated with Sparkling Pisces.

The Maltego graph in Figure 1 below shows the overlaps between the PowerShell malware and the two examples of PE malware we discovered called KLogEXE and FPSpy. This includes similar domains registered by the same registrant email.
![Attach chain diagram showing a network with connections between various nodes including Keylogger, FSpy, LoggerX, and others linked to email addresses and IP addresses. The central node highlights a specific IP address.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/09/word-image-1481-136892-1.png) Figure 1. Infrastructure layout showing the connection between the malware.

## **KLogExe Analysis**

The first PE malware we discovered (powershell.exe) is a keylogger named KLogExe. Based on the dialog resource, the internal name is KLogExe, and it appears to be a similar implementation of the aforementioned PowerShell keylogger, but written in C++.
![Software dialog box titled "About KLogExe" featuring a logo on the left and text displaying "KLogExe, Version 1.0 Copyright 2023." An "OK" button is available at the bottom.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/09/word-image-4949-136892-2.png) Figure 2. Dialog resource of KLogExe.

KLogExe collects the following data from the compromised machine:

* Applications currently running on the compromised host
* Keyboard keylogging using the GetAsyncKeyState method
* Mouse clicks, including retrieving the button name

KLogExe saves the collected data in an .ini file, under C:\\Users\\user\\AppData\\Roaming\\Microsoft\\desktops.ini. When it reaches its file size limit, KLogExe adds the date to the name of the file, generates a random boundary, and sends it over HTTP to the C2 using the following URI: /wp-content/include.php?_sys_=7.
![Wireshark TCP stream window screenshot displaying HTTP headers in a network request with highlighted content type boundary information and a filename. Some information is highlighted within three boxes.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/09/word-image-7390-136892-3.png) Figure 3. Exfiltration of the stolen data through a POST request.

## **FPSpy Analysis**

The second piece of PE malware we uncovered is FPSpy, a threat that has remained relatively under the radar since at least 2022. Based on code and behavioral similarities, this malware appears to be a variant of the malware described in [ASEC's research from 2022](https://asec.ahnlab.com/ko/30582/). Several characteristics, including the naming conventions of additional downloaded modules and logs, as well as the malware's capabilities, also closely resemble Sparkling Pisces's [KGHSpy backdoor](https://www.cybereason.com/blog/research/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite) discovered in 2020.

Similar to KGHSpy, we suspect that there is the possibility that FPSpy binaries are [timestomped](https://attack.mitre.org/techniques/T1070/006/). This means that threat authors modified the compilation time to hide the real creation time of the malware.

FPSpy was first uploaded to VirusTotal on June 26, 2024, although its compilation timestamp dates back to 2018. Moreover, we discovered that the hard-coded subdomain for the malware's C2 server bitjoker2024.000webhostapp\[.\]com, was first seen in 2024.

Unlike KLogExe, FPSpy is a DLL named sys.dll with a unique export called MazeFunc. The DLL is contained in a resource called DB in its custom loader, whose purpose is to drop sys.dll to the C:\\Users\\user\\AppData\\Local\\Microsoft\\WPSOffice\\ folder and load it. Figure 4 below shows the loader's code.
![A screenshot of computer code featuring functions and variables in various colors on a black background, including functions related to file loading.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/09/word-image-9870-136892-4.png) Figure 4. The code from the sys.dll loader is in charge of loading sys.dll.

FPSpy implements a range of additional capabilities beyond keylogging. Some of these capabilities include:

* Storing configuration data about the infected device in a separate file called Param.ini
* Storing a vast amount of system information in a file with the naming format Sysinfo\_\<date\>\_.txt
* Downloading and executing additional encrypted modules
* Working in a multithreading model, with a thread in charge of downloading additional modules, and one in charge of uploading data to the C2
* Executing arbitrary commands
* Executing the PowerShell tree command to enumerate drives, folders and files on the infected device, which the malware stores in a file named Drv\_\<drive letter\>

Figure 5 below shows the aforementioned files, which are also stored under the C:\\Users\\user\\AppData\\Local\\Microsoft\\WPSOffice\\ folder.
![File explorer window displaying three items: "Drv\_C" file with 12,368 KB size, "Param.ini" configuration settings file of 1 KB, and "SysInfo\_21\_04\_94.txt" text document of 3 KB.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/09/word-image-12039-136892-5.png) Figure 5. Files created by FPSpy.

## **The Connection Between KLogExe and FPSpy**

Our analysis indicates that FPSpy shares its codebase with KLogExe, suggesting a possible connection between the two. For example, Figure 6 shows its dialog resource.
![Screenshot of an 'About FPSpy' software dialog box showing software icon, version 1.0, and copyright information for 2018, with an OK button.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/09/word-image-14529-136892-6.png) Figure 6. Dialog resource of FPSpy.

We were able to find code similarities in the implementations of both malware. These similarities include:

* Using the same HackingTeam's leaked code for [dynamic API calls](https://github.com/hackedteam/core-win32/blob/master/DynamiCall/dynamic_import.cpp) to harden static detection
* Similar hard-coded HTTP packet structure, including similar headers, a randomly generated boundary string and a Chrome version Chrome/31.0.1650.57 used for the User-Agent that is over a decade old
* Storing the malware's data (such as keylogging data) in an .ini file with similar content

Figure 7 below depicts the section in the code that is in charge of the beginning of the keylogging process. This section also builds the HTTP packet for data exfiltration of KLogExe and FPSpy respectively.
![Image showing two side-by-side screenshots of code in text editors with highlighted syntax, one labeled FPSpy and the other labeled XLogExe, displaying functions related to file operations in C programming language. Separate elements on both screenshots are highlighted within white boxes.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/09/word-image-16953-136892-7.png) Figure 7. Comparison between FPSpy and KLogExe's HTTP packet structure.

## **Conclusion**

Our research highlights the continuous evolution and sophistication of Sparkling Pisces's tool set, and their constantly evolving infrastructure. We uncovered another piece of Sparkling Pisces's infrastructure, and two additional threats in their tool set. This included an undocumented type of malware, KLogExe, and a previously undocumented variant of malware called FPSpy.

Through examining KLogExe, we revealed its keylogging and data exfiltration mechanisms. Our investigation of FPSpy uncovered its advanced functionalities, including data collection and arbitrary command execution.

By identifying the connections between KLogExe and FPSpy, we demonstrated the shared codebase and methodologies employed by Sparkling Pisces.

Most of the targets we observed during our research originated from South Korea and Japan, which is congruent with previous Kimsuky targeting.

## **Protections and Mitigations**

Palo Alto Networks Cortex XDR and XSIAM detect and prevent the execution of KLogExe and FPSpy.
![Two identical screenshots of a "Cortex XDR Prevention Alert" dialog box reporting a blocked malicious activity. Each alert has buttons for "OK" and "Show details", and an advisory to contact help desk for questions or additional information.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/09/word-image-19359-136892-8.png) Figure 8. Prevention of KLogExe and FPSpy by Cortex and XSIAM.

For Palo Alto Networks customers, our products and services provide the following coverage associated with this group:

[Advanced WildFire](https://www.paloaltonetworks.com/products/secure-the-network/wildfire) cloud-delivered malware analysis service accurately identifies the FPSpy and KLogExe samples mentioned in this article as malicious.

[Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) and [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/dns-security) identify domains associated with this group as malicious.

[**Cortex XDR**](https://www.paloaltonetworks.com/cortex/cortex-xdr) and [**XSIAM**](https://www.paloaltonetworks.com/cortex/cortex-xsiam) help detect user and credential-based threats by analyzing user activity from multiple data sources, including the following:

* Endpoints
* Network firewalls
* Active Directory
* Identity and access management solutions
* Cloud workloads

Cortex XDR and XSIAM build behavioral profiles of user activity over time with machine learning. By comparing new activity to past activity, peer activity and the expected behavior of the entity, Cortex XDR and XSIAM help detect anomalous activity indicative of credential-based attacks.

If you think you may have been impacted or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call:

North America Toll-Free: 866.486.4842 (866.4.UNIT42)

* EMEA: +31.20.299.3130
* APAC: +65.6983.8730
* Japan: +81.50.1790.0200

Palo Alto Networks has shared these findings, including file samples and indicators of compromise, with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org).

## **Indicators of Compromise**

### KLogExe

* 990b7eec4e0d9a22ec0b5c82df535cf1666d9021f2e417b49dc5110a67228e27
* a173a425d17b6f2362eca3c8ea4de9860b52faba414bbb22162895641dda0dc2
* faf666019333f4515f241c1d3fcfc25c67532463245e358b90f9e498fe4f6801

### FPSpy

* c69cd6a9a09405ae5a60acba2f9770c722afde952bd5a227a72393501b4f5343
* 2e768cee1c89ad5fc89be9df5061110d2a4953b336309014e0593eb65c75e715

### Domains

* mail.apollo-page.r-e\[.\]kr
* nidlogin.apollo.r-e\[.\]kr
* bitjoker2024.000webhostapp\[.\]com
* www.vic.apollo-star7\[.\]kro.kr

### IP addresses

* 152\.32.138\[.\]167

### URL

* hxxp\[:\]//mail.apollo-page.r-e\[.\]kr/wp-content/include.php?_sys_=7
* hxxp\[:\]//mail.apollo-page.r-e\[.\]kr/plugin/include.php?_sys_=7
* hxxps\[:\]//nidlogin.apollo.r-e\[.\]kr/cmd/index.php?_idx_=7

## Additional Resources

* [Attack Activities by Kimsuky Targeting Japanese Organizations](https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html) -- JPCERT/CC
* [Back to the Future: Inside the Kimsuky KGH Spyware Suite](https://www.cybereason.com/blog/research/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite) -- Cybereason
* [Information leaking malware disguised as a famous domestic portal site](https://asec.ahnlab.com/ko/30582/) -- AhnLab (in Korean)

*Updated Sept. 26, 2024, at 6:32 a.m. PT to update Cortex product protection information.*
Back to top

### Tags

* [APT43](https://unit42.paloaltonetworks.com/tag/apt43/ "APT43")
* [DPRK](https://unit42.paloaltonetworks.com/tag/dprk/ "DPRK")
* [FPSpy](https://unit42.paloaltonetworks.com/tag/fpspy/ "FPSpy")
* [G0086](https://unit42.paloaltonetworks.com/tag/g0086/ "G0086")
* [Keylogger](https://unit42.paloaltonetworks.com/tag/keylogger/ "Keylogger")
* [Kimsuky](https://unit42.paloaltonetworks.com/tag/kimsuky/ "Kimsuky")
* [KLogExe](https://unit42.paloaltonetworks.com/tag/klogexe/ "KLogExe")
* [MITRE](https://unit42.paloaltonetworks.com/tag/mitre/ "MITRE")
* [North Korea](https://unit42.paloaltonetworks.com/tag/north-korea/ "North Korea")
* [South Korea](https://unit42.paloaltonetworks.com/tag/south-korea/ "South Korea")
* [Sparkling Pisces](https://unit42.paloaltonetworks.com/tag/sparkling-pisces/ "Sparkling Pisces")
* [Spear Phishing](https://unit42.paloaltonetworks.com/tag/spear-phishing/ "Spear Phishing")
* [Thallium](https://unit42.paloaltonetworks.com/tag/thallium/ "Thallium")
* [Velvet Chollima](https://unit42.paloaltonetworks.com/tag/velvet-chollima/ "Velvet Chollima")  
  [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Investigating Infrastructure and Tactics of Phishing-as-a-Service Platform Sniper Dz](https://unit42.paloaltonetworks.com/phishing-platform-sniper-dz-unique-tactics/ "Investigating Infrastructure and Tactics of Phishing-as-a-Service Platform Sniper Dz")

### Table of Contents

* 

### Related Articles

* [Paved With Intent: ROADtools and Nation-State Tactics in the Cloud](https://unit42.paloaltonetworks.com/roadtools-cloud-attacks/ "article - table of contents")
* [Threat Brief: Recruiting Scheme Impersonating Palo Alto Networks Talent Acquisition Team](https://unit42.paloaltonetworks.com/phishing-attackers-pose-as-panw-recruiters/ "article - table of contents")
* [Boggy Serpens Threat Assessment](https://unit42.paloaltonetworks.com/boggy-serpens-threat-assessment/ "article - table of contents")

## Related Malware Resources

![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg)  
[![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/)

* [API](https://unit42.paloaltonetworks.com/tag/api/ "API")

* [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic")

* [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE")  
  ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/)

* [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel")

* [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2")

* [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure")  
  ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/)

* [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI")

* [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT")

* [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America")  
  ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/)

* [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa")

* [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID")

* [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams")  
  ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/)

* [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor")

* [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin")

* [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution")  
  ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/)

* [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication")

* [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft")

* [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels")  
  ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/)

* [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK")

* [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum")

* [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet")  
  ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/)

* [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum")

* [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain")

* [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications")  
  ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/)

* [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain")

* [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop")

* [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm")  
  ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/)

* [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API")

* [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway")

* [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources")

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)  
  ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]()  
  ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png)  
  ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42

## Peace of mind comes from staying ahead of threats. Subscribe today.

Your Email

Subscribe for email updates to all Unit 42 threat research.  
By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement")

This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.

Invalid captcha!
Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg)  
{#footer} Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security)

* [Secure AI by Design](https://www.paloaltonetworks.com/ai-security)

* [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase)

* [Prisma SASE](https://www.paloaltonetworks.com/sase)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam)

* [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira)

* [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management)

* [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management)

* [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager)

* [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance)

* [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management)

* [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic)

* [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management)

* [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance)

* [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery)

* [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42)

* [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense)

* [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses)

* [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy)

* [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence)

* [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond)  
  Company

* [About Us](https://www.paloaltonetworks.com/about-us)

* [Careers](https://jobs.paloaltonetworks.com/en/)

* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales)

* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility)

* [Customers](https://www.paloaltonetworks.com/customers)

* [Investor Relations](https://investors.paloaltonetworks.com/)

* [Location](https://www.paloaltonetworks.com/about-us/locations)

* [Newsroom](https://www.paloaltonetworks.com/company/newsroom)  
  Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/)

* [Communities](https://www.paloaltonetworks.com/communities)

* [Content Library](https://www.paloaltonetworks.com/resources)

* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia)

* [Event Center](https://events.paloaltonetworks.com/)

* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)

* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z)

* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications)

* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure)

* [Sitemap](https://www.paloaltonetworks.com/sitemap)

* [Tech Docs](https://docs.paloaltonetworks.com/)

* [Unit 42](https://unit42.paloaltonetworks.com/)

* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)

* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy)

* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center)

* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use)

* [Documents](https://www.paloaltonetworks.com/legal)

Copyright © 2026 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* EN  
  Select your language  
  ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg)

### Default Heading

Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg)  
Seekbar

![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg)  
![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg)  
Volume
![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)