[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/manic-menagerie-targets-web-hosting-and-it/) * [Japanese](https://unit42.paloaltonetworks.com/ja/manic-menagerie-targets-web-hosting-and-it/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/ "High Profile Threats") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # Manic Menagerie 2.0: The Evolution of a Highly Motivated Threat Actor ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 14 min read Related Products [![Advanced DNS Security icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced DNS Security](https://unit42.paloaltonetworks.com/product-category/advanced-dns-security/ "Advanced DNS Security")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Cortex XSIAM icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XSIAM](https://unit42.paloaltonetworks.com/product-category/cortex-xsiam/ "Cortex XSIAM")[![Next-Generation Firewall icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Daniel Frank](https://unit42.paloaltonetworks.com/author/daniel-frank/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:June 28, 2023 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Cryptocurrency](https://unit42.paloaltonetworks.com/tag/cryptocurrency/) * [Cryptojacking](https://unit42.paloaltonetworks.com/tag/cryptojacking/) * [CVE-2021-26855](https://unit42.paloaltonetworks.com/tag/cve-2021-26855/) * [CVE-2021-33766](https://unit42.paloaltonetworks.com/tag/cve-2021-33766/) * [CVE-2021-34473](https://unit42.paloaltonetworks.com/tag/cve-2021-34473/) * [CVE-2022-41040](https://unit42.paloaltonetworks.com/tag/cve-2022-41040/) * [Manic Menagerie](https://unit42.paloaltonetworks.com/tag/manic-menagerie/) * [Microsoft Exchange Server](https://unit42.paloaltonetworks.com/tag/microsoft-exchange-server/) * [Persistence method](https://unit42.paloaltonetworks.com/tag/persistence-method/) * [ProxyNotShell](https://unit42.paloaltonetworks.com/tag/proxynotshell/) * [Webshell](https://unit42.paloaltonetworks.com/tag/webshell/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/manic-menagerie-targets-web-hosting-and-it/?pdf=download&lg=en&_wpnonce=279fa6c5e6 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/manic-menagerie-targets-web-hosting-and-it/?pdf=print&lg=en&_wpnonce=279fa6c5e6 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Manic%20Menagerie%202.0:%20The%20Evolution%20of%20a%20Highly%20Motivated%20Threat%20Actor&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fmanic-menagerie-targets-web-hosting-and-it%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fmanic-menagerie-targets-web-hosting-and-it%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fmanic-menagerie-targets-web-hosting-and-it%2F&title=Manic%20Menagerie%202.0:%20The%20Evolution%20of%20a%20Highly%20Motivated%20Threat%20Actor "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fmanic-menagerie-targets-web-hosting-and-it%2F&text=Manic%20Menagerie%202.0:%20The%20Evolution%20of%20a%20Highly%20Motivated%20Threat%20Actor "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fmanic-menagerie-targets-web-hosting-and-it%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Manic%20Menagerie%202.0:%20The%20Evolution%20of%20a%20Highly%20Motivated%20Threat%20Actor%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fmanic-menagerie-targets-web-hosting-and-it%2F "Share in Mastodon") ## **Executive Summary** Unit 42 researchers discovered an active campaign that targeted several web hosting and IT providers in the United States and European Union from late 2020 to late 2022. Unit 42 [tracks the activity](https://unit42.paloaltonetworks.com/from-activity-to-formal-naming/) associated with this campaign as CL-CRI-0021 and believes it stems from the same threat actor responsible for the previous campaign known as [Manic Menagerie](https://www.cyber.gov.au/sites/default/files/2023-03/report_manic_menagerie.pdf). The threat actor deployed coin miners on hijacked machines to abuse the compromised servers' resources. They have further deepened their foothold in victims' environments by mass deployment of web shells, which granted them sustained access, as well as access to internal resources of the compromised websites. In doing so, the attackers could potentially have turned the hijacked legitimate websites -- hosted by the targeted web hosting and IT providers -- into command and control (C2) servers at scale, affecting thousands of web pages. The threat actor could thus run their C2 activity from legitimate websites that have good reputations, and which are not necessarily flagged by security solutions as malicious. This could have a tremendous impact on the abused legitimate websites, which would in that circumstance be made to unknowingly host malicious content and harbor criminal activity. Such criminal activity could inflict legal and/or reputational damages upon the owners of the websites or the web hosting companies. While operating in the victims' networks, the attackers attempted multiple techniques to evade the detection of various monitoring tools as well as active commercial cybersecurity products. They also kept executing payloads, redeploying and rerunning tools that were previously blocked, or using other similar tools. Attackers tried to stay under the radar by avoiding known malware, introducing custom tools and relying on publicly available legitimate tools. Based on the tactics, techniques and procedures (TTPs) that we observed in this attack, the threat actor whose previous campaign was dubbed [Manic Menagerie](https://www.cyber.gov.au/sites/default/files/2023-03/report_manic_menagerie.pdf) carried out this more recently observed campaign, which we therefore call Manic Menagerie 2.0. This threat actor was reported as active from at least 2018, targeting web hosting companies in Australia, by the [Australian Cyber Security Center](https://www.cyber.gov.au/). The name is most likely a reference to their noisy activity, plus the large number of attacked web hosting companies and different tools used by the attacker. Palo Alto Networks customers receive protections from the threats mentioned in this article through the following products and services: * [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) and [XSIAM](https://docs-cortex.paloaltonetworks.com/p/XSIAM) with Local Analysis, Behavioral Threat Protection, the Cryptominers module and Analytics * [Cloud-Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) including [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering/administration), [DNS Security](https://docs.paloaltonetworks.com/dns-security) and [WildFire](https://docs.paloaltonetworks.com/wildfire) * [Managed Detection and Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) services * [Next-Generation Firewall](https://docs.paloaltonetworks.com/ngfw) with a Threat Prevention security subscription * [WildFire](https://docs.paloaltonetworks.com/wildfire) cloud-delivered malware analysis service | **Related Unit 42 Topics** | [**Cryptominers**](https://unit42.paloaltonetworks.com/tag/cryptominers/), **[Web shells](https://unit42.paloaltonetworks.com/tag/webshell/)** | |----------------------------|------------------------------------------------------------------------------------------------------------------------------------------------| ## **Initial Access and Persistence** The initial foothold in the Manic Menagerie 2.0 campaign was first observed in late 2020, targeting companies in the United States and European Union. In this campaign, the threat actors gained access to target machines by exploiting vulnerable web applications and IIS servers, and deploying different web shells on these infected servers. Deploying web shells on an active web server allows the threat actor to hijack legitimate websites. The web shells are placed on these hosted websites in the following folders on the compromised server: C:\\*\[hosted websites on the server path\]*\\wwwroot\\example.com\\webshell.aspx) These actions also allow public access from outside the victim's network in the future. This effectively allows these websites to be turned into future C2 servers for the attacker. We also observed the same web shell, xn.aspx, mentioned in the [Australian Cyber Security Center's (ACSC) report](https://www.cyber.gov.au/sites/default/files/2023-03/report_manic_menagerie.pdf) about the original Manic Menagerie operation targeting web host companies in Australia. After deploying web shells in Manic Menagerie 2.0, the threat actor initiated the deployment of coin miners. This was likely done to abuse the compromised servers' powerful computing resources for the threat actor's financial gain through coin mining. During 2021-2022, upon the public disclosure of multiple Microsoft Exchange Server vulnerabilities, the threat actor attempted to exploit the following vulnerabilities in some targets: * [CVE-2021-26855](https://nvd.nist.gov/vuln/detail/CVE-2021-26855), [CVE-2022-41040](https://nvd.nist.gov/vuln/detail/CVE-2022-41040): (ProxyNotShell) Exchange Server SSRF vulnerabilities * [CVE-2021-34473](https://nvd.nist.gov/vuln/detail/cve-2021-34473): (One of the ProxyShell vulnerabilities) Exchange Server remote code execution vulnerability * [CVE-2021-33766](https://nvd.nist.gov/vuln/detail/CVE-2021-33766): (ProxyToken) Allows an attacker to modify the configuration of mailboxes of arbitrary users Therefore, in addition to vulnerabilities in the [IIS servers](https://blog.viettelcybersecurity.com/deep-understand-aspx-file-handling-and-some-related-attack-vector/) as well as [vulnerable web applications](https://attack.mitre.org/techniques/T1190/) in the environment, the previously mentioned vulnerabilities provided the threat actor another penetration and persistence vector. [Morphisec](https://blog.morphisec.com/proxyshellminer-campaign) recently researched a campaign where attackers used Exchange Server vulnerabilities (collectively known as ProxyShell) to drop cryptominers. ## Reconnaissance and Privilege Escalation From late 2020, threat actors involved in the Manic Menagerie 2.0 campaign began periodically trying to execute local privilege escalation proof-of-concept (PoC) tools (detailed below) to add their own users to the Administrators group in IIS servers, to further promote their interests. When one tool failed, they would try another tool with similar functionality. Attackers employed a runas.exe .NET wrapper called RunasCs. This publicly available tool enables extended functionality that the original runas.exe utility lacks, such as executing processes by using explicit user credentials. The threat actors were observed attempting to perform further network reconnaissance in an infected environment by running under a vulnerable web application. They then attempted to add their own user by running au.exe (shown in Figure 1), which is short for "add user." This file must be run by an elevated user. They then made sure their username existed by running net commands. Their usage of the usernames iis\_user and iis\_uses is notable, as the latter might initially seem to be a typo. This naming convention is also mentioned in the ACSC report mentioned above. ![Image 1 is a screenshot of the Command Prompt. The user is au.exe and creates iis\_user as well as a password. There is some redacted information in this screenshot.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/06/word-image-128904-1.png) Figure 1. au.exe creates iis\_user user and generates a password for it. The aforementioned au.exe is a tool that the threat actor attempted to run multiple times, chained with different PoC local privilege escalation tools, as shown in Figure 2. ![Image 2 is a tree diagram of the blocked execution of RunasCs. The execution is blocked at the second level.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/06/word-image-128904-2.png) Figure 2. Attempted execution of RunasCs together with other commands under a vulnerable web application, blocked by Cortex XDR. The threat actor was observed using multiple tools for the same purpose of privilege escalation. In Figure 2 above, a 64-bit version of PrintSpoofer is one of these tools. This public tool was used by attackers to elevate au.exe, which otherwise wouldn't add the user it was intended to. ## Fork Bomb and More Local Privilege Escalations The threat actors were observed attempting local privilege escalation (LPE) using multiple publicly available tools, leveraging the following vulnerabilities: * [CVE-2018-8120](https://nvd.nist.gov/vuln/detail/CVE-2018-8120) * [CVE-2019-0623](https://nvd.nist.gov/vuln/detail/CVE-2019-0623) * [CVE-2019-0803](https://nvd.nist.gov/vuln/detail/CVE-2019-0803) * [CVE-2019-1458](https://nvd.nist.gov/vuln/detail/CVE-2019-1458) Another interesting execution that we observed in Manic Menagerie 2.0 is the svchost.exe [fork bomb](https://www.okta.com/identity-101/fork-bomb/). The ACSC report on the original Manic Menagerie campaign also mentioned the presence of this type of denial-of-service (DoS) tool. The code for this fork bomb is very simple, as it runs in an endless loop (shown in Figure 3), opening more and more instances of itself until the machine runs out of memory. This activity is intended to crash the machine and force a reboot. This allows the persistence mechanism of an executable that requires a reboot to fire up. ![Image 3 is a screenshot of the code snippet creating an endless loop from the form bomb binary. It starts with while(1).](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/06/word-image-128904-3.png) Figure 3. The endless loop code snippet from the fork bomb binary. ## dllnc.dll: Run Payloads and Add User Tool Another tool that we observed in the Manic Menagerie 2.0 campaign called dllnc has two main features. One is loading some of the attacker's executables and batch files, and the other one is serving as another tool that is supposed to add the attacker's user to the Administrators group. It contains an indicative PDB path: F:\\upfile\\3389\\opents\\dlladduser\\x64\\Release\\dllnc.pdb, which did not yield any other results in VirusTotal as of the middle of May 2023. This is a good indication that this is a custom tool for this specific attacker. The loader code segment attempts to load some of the tools it expects to already be in the attacker's path (as shown in Figure 4), since there are no checks whether they are actually present or not. While doing so, it considers several possible hard-coded paths, most of them seen in this campaign. ![Image 4 is many lines of code — the hard-coded paths of the attacker’s tools.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/06/word-image-128904-4.png) Figure 4. Hard-coded paths of the attacker's tools as seen in dllnc.dll. The tool then deletes the current iis\_user user and then re-adds it, this time with a hard-coded password. Again, this behavior correlates with the ACSC report on the original Manic Menagerie campaign. An old variant of the [Relative ID (RID) hijacking](https://www.ired.team/offensive-security/persistence/rid-hijacking) tool (shown in Figure 5), which was also mentioned in that report, resembles this behavior. ![Image 5 is a screenshot of the Administrator command line. It is the RID hijacking tool output. There is some redacted information in this screenshot.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/06/word-image-128904-5.png) Figure 5. RID hijacking tool output. Source: Figure 6 of the [Australian Cyber Security Centre (ACSC) Report 2018-143](https://www.cyber.gov.au/sites/default/files/2023-03/report_manic_menagerie.pdf). There is a clear, strong resemblance between the password in both variants, as both use the xman prefix and a similar suffix (shown in Figure 6). ![Image 6 is a screenshot of the iis\_user and the password. Some of the informal is redacted.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/06/word-image-128904-6.png) Figure 6. The user iis\_user and its hard-coded password. ## PCHunter PCHunter, another tool we observed being used by the Manic Menagerie 2.0 campaign, is reminiscent of older tools like GMER and Rootkit Unhooker. It is a legitimate and powerful toolkit for browsing and modifying different Windows Internals components. Figure 7 shows the attempted execution of PCHunter being blocked. ![Image 7 is a screenshot of Cortex XDR where PCHunter64.exe has been blocked. Included is the path and the SHA and signature.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/06/word-image-128904-7.png) Figure 7. PCHunter blocked execution. Figure 8 shows the digital signature of PCHunter, by "Epoolsoft Corporation." The comments in Chinese provide a quick description of the tool. This is translated as "Yipmin is a Windows system information viewing tool (security category)." ![Image 8 is a screenshot of the PCHunter signer information. It includes the copyright, product, description, original name, internal name, file version, comments (which are written in Chinese characters) and the date signed.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/06/word-image-128904-8.png) Figure 8. PCHunter signer information. ## Second Wave: Backdooring at Scale ### Deploying a Known Web Shell to Multiple Destinations The second distinct wave of attacks observed in the Manic Menagerie 2.0 campaign is characterized mainly by massive deployment of web shells to the hosted websites. This allows the attacker to strengthen their foothold by enabling them future public access, and to hide their web shells deep in nested folders. These legitimate hijacked websites could potentially be used as C2 servers in the future (e.g., as part of a botnet infrastructure). The attacker's deployment attempts go back to early 2022, when they deployed the same known web shell called ASPXSpy to multiple hosted websites. We observed this web shell being written to hundreds of different paths, as shown in Figure 9. ![Image 9 is a screenshot of Cortex XDR. The columns are action type, file, path, and the SHA. The action type is File Write and most of the file path has been redacted.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/06/word-image-128904-9.png) Figure 9. ASPXSpy web shell being written to different hosted websites paths. ### GoIIS The attackers also ran a tool called IIS1.asp or GoIIS.exe (shown in Figure 10), compiled in 2017. The tool is written in Golang and is used to traverse the server's folders to retrieve the server's configuration information. This allows the attacker to gain valuable information about the compromised server. ![Image 10 is a screenshot of the ISS tool output. This is highlighted in the two red boxes.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/06/word-image-128904-10.png) Figure 10. IIS tool output. ### Sh.exe: A Custom Web Shell Deployment Tool Later in 2022, the attacker deployed a custom tool named sh.exe as part of the Manic Menagerie 2.0 campaign, whose execution can be seen in Figure 11 below. The role of this tool is to write web shells at scale to hosted websites, based on a preconfigured list of paths and legitimate hijacked websites on the server sharing the same public IP address. In order to facilitate the use of this tool, the attackers used a custom wrapper for caclcs.exe (that they named mycacls.com), which is a command-line tool used to manage access control lists (ACLs). This tool enabled them to change the web server's ACL permissions in bulk as well as lowering the IIS security settings. ![Image 11 is a screenshot of Cortex XDR. It is a tree diagram showing where exactly the sh.exe was blocked. Included in the screenshot are multiple file paths.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/06/word-image-128904-11.png) Figure 11. Attempted sh.exe execution along with other tools and commands, as blocked by Cortex XDR. The parameters passed on to sh.exe contain a list of relevant websites that share the same public IP. Upon execution, the sh.exe tool generates various legitimate-looking subfolders, such as images and css to further conceal their activity. It's possible that this was intended to give attackers future access to victims' machines from the internet and to potentially use this infrastructure in the future as C2 servers at scale. sh.exe is signed with an invalid certificate issued by "Fujian identical investment co.,Ltd." as shown in Figure 12. This is the same name used to sign another tool, which the ACSC report described in a previous campaign. In the sample we observed, sh.exe was compiled on Nov. 3, 2022. Its certificate was signed on Dec. 6, 2022. Shortly after signing it, threat actors were seen executing sh.exe in one of the compromised environments. The compilation timestamp and the date range of the invalid certificate could indicate the tool was made specifically for this particular campaign. ![Image 12 is a pop-up window of the digital signature details. It is open to the general tab. The information included is the name, email, signing time, and an option to view the certificate. Countersignatures are also available.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/06/word-image-128904-12.png) Figure 12. sh.exe invalid signature. While the threat actor deleted most of the files, we found a connection between sh.exe and the files it dropped that could not be recovered. Our investigation uncovered three distinct compiled .NET DLLs that the attackers used. [These DLLs are compiled](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/hafnium-china-chopper-and-aspnet-runtime/) by the IIS server once a "raw" ASPX file is accessed for the first time. Upon decompiling the code, interesting similarities were found between the web shell and sh.exe, based on indicative strings found in both files. Browsing to one of the websites where one of the web shells was dropped, the content on the page is the string ONEPIECE, as shown in Figure 13 below. ![Image 13 is a screenshot of the web shell resource with information redacted.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/06/word-image-128904-13.png) Figure 13. Browsing the web shell resource in one of the hijacked websites. Browsing the code of one of the web shells and looking at the code responsible for showing the HTML content, this string can be seen together with other indicative strings, such as x\_best\_911 (shown in Figure 14). ![Image 14 is a screenshot of a few lines of code. These are the strings, and included is ONEPIECE, which is hard coded in the web shell's DLL code.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/06/word-image-128904-14.png) Figure 14. The ONEPIECE string hard-coded in the compiled web shell's DLL code. The x\_best\_911 string can also be found in sh.exe, as shown in Figure 15. ![Image 15 is a screenshot of a few lines of code. Hardcoded is a string for x\_best\_911.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/06/word-image-128904-15.png) Figure 15. The x\_best\_911 string hard-coded in sh.exe. Going back to the report by the ACSC, the password generated upon execution of the aforementioned RID Hijack tool contains the xman string. This string can be also found in sh.exe, as shown in Figure 16, which indicates yet another similarity between the novel tool seen in this recent campaign and the previous Manic Menagerie campaign. ![Image 16 is a screenshot of a few lines of code. Hard-code into sh.exe is the xman string.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/06/word-image-128904-16.png) Figure 16. The xman string is hard-coded in sh.exe. ### More LPE Attempts #### LPE Toolset: Hippos and Potatoes As mentioned in the previous section, once the IIS server accesses a web shell, a .NET DLL is compiled on the fly and placed in a temporary directory. One such compiled DLL web shell file, which can be seen in Figure 17 below, is App\_Web\_xvuga1zl.dll. The connection the attackers had made with the web shell resulted in yet another attempt to remotely execute multiple LPE publicly available tools, as seen in many stages of attacks associated with this campaign. As the attacker had done previously, they also used several privilege escalation tools. In one case, there were only minutes separating each execution, to try to avoid being blocked: * JuicyPotato * PrintSpoofer * JuicyPotatoNG * EfsPotato * PetitPotam ("little hippo" in French) ![Image 17 is a Cortex XDR screenshot. It is a tree diagram. It displays the multiple local privilege escalation tools that were detected and blocked by the program. Highlighted in a red rectangle is a DLL.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/06/word-image-128904-17.png) Figure 17. Multiple local privilege escalation tools detected and blocked by Cortex XDR. #### MyComEop As we analyzed several loaders recovered from organizations targeted by the Manic Menagerie 2.0 campaign, another finding caught our eye. These loaders included hard-coded strings for the files x and x.tmp. When executing these loaders in a debugger, they successfully decrypted their payloads, revealing yet another PoC LPE tool and backdoor, with distinctive PDB paths: * E:\\git\\MyComEopPower\\MyComEopPipe\\Build\\Quantum.pdb * E:\\git\\MyComEopPower\\MyComEopPipe\\Build\\MyComEop.pdb While searching for the PDB paths in VirusTotal, we found more notable metadata from two other variants, as shown in Figure 18. ![Image 18 is the file version information of a variant. Included is the copyright, product, description, original name, internal name, and the file version. It is a mix of English language as well as Chinese characters.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/06/word-image-128904-18.png) Figure 18. File metadata retrieved from another variant sharing the same PDB path. The product name and description translate to "protocol rights escalation tool" and "internal special edition." Pivoting on the two different metadata components returned more similar variants with very similar PDB paths. Some of these variants are tagged with the [CVE-2017-0213](https://nvd.nist.gov/vuln/detail/CVE-2017-0213) tag in VirusTotal. After further research, we found this is yet another rarely seen privilege escalation tool and backdoor, as shown in Figures 19a and 19b. ![Image 19 is a screenshot of a few lines of code. It is a hard-coded paths from a privilege escalation tool.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/06/word-image-128904-19.png) Figure 19a. Hardcoded paths from the described tool. ![Image 20 is a screenshot of a few lines of code. Highlighted in red through the screenshot is the word backdoor. These are backdoor logs from the described tool.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/06/word-image-128904-20.png) Figure 19b. Backdoor logs from the described tool. ## Back in the Game In April 2023, while monitoring activity associated with Manic Menagerie 2.0, we began to see the threat actor deploying new modified tools and accessing compromised environments via a previously deployed web shell. This was found in addition to indicators of older tools being deployed in parallel, as well as updated tools, such as au.exe. The attacker also searched for the presence of their iis\_user by executing net commands. They then started deploying modified tools in the %programdata%\\x path, which was also familiar behavior. One of the tools they deployed is called GodPotato, shown in Figure 20, which is another variant of the known "potatoes" LPE family. This tool is also publicly available. ![Image 21 is a screenshot from the GodPotato tool. The word GodPotato is text art made from capital F. The screenshot also includes arguments and eggs, an example of what to enter in the command line.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/06/word-image-128904-21.png) Figure 20. A screenshot from the GodPotato tool. Another tool that we observed is yet another custom backdoor, shown in Figure 21. By looking at its PDB path, D:\\project\\后门类\\dllnc\\exenc\\x64\\Release\\exenc.pdb, it appears to be a new variant to the aforementioned dllnc tool. This variant focuses on backdooring capabilities rather than serving mainly as a loader. "后门类" literally means "back door" when translated into English. ![Image 22 is a screenshot of money lines of code. It shows the main method of the new back door. There is some redacted information in the screenshot.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/06/word-image-128904-22.png) Figure 21. The main method of the new backdoor. ## **Conclusion** Unit 42 researchers uncovered an active campaign, which we have called "Manic Menagerie 2.0," that targeted web hosting and IT companies for over two years. We believe the campaign was conducted by a threat actor whose previous endeavor was dubbed "Manic Menagerie." The current campaign demonstrates an evolved iteration of that operation. Unit 42 tracks the activity associated with this campaign under CL-CRI-0021. The threat actor associated with Manic Menagerie 2.0 is still active, continuing to change their TTPs to try to remain under the radar. The main goal of the threat actor behind this operation appeared to be to abuse the resources of the compromised web servers for monetary gain. The threat actor deployed multiple coin miners in Manic Menagerie 2.0, as previously reported by the ACSC that they did in the original campaign. Our investigation also revealed that the attackers expanded their arsenal and evolved their TTPs over time to hijack legitimate websites. They did this by mass deploying web shells to compromised sites at scale, which they could then use as C2 servers. **Protections and Mitigations** Palo Alto Networks customers receive protections from the campaign mentioned in this article through the following products and services: * * The [Next-Generation Firewall](https://docs.paloaltonetworks.com/ngfw) with a [Threat Prevention](https://docs.paloaltonetworks.com/advanced-threat-prevention/administration) security subscription can block the attacks with Best Practices via Threat Prevention signatures [90796](https://threatvault.paloaltonetworks.com/?query=90796), [90815](https://threatvault.paloaltonetworks.com/?query=90815), [91505](https://threatvault.paloaltonetworks.com/?query=91505), [91651](https://threatvault.paloaltonetworks.com/?query=91651), [91368](https://threatvault.paloaltonetworks.com/?query=91368), [91589](https://threatvault.paloaltonetworks.com/?query=91589) and [91577](https://threatvault.paloaltonetworks.com/?query=91577) * The [WildFire](https://www.paloaltonetworks.com/products/secure-the-network/wildfire?_gl=1*nq7ug8*_ga*NzQyNjM2NzkuMTY2NjY3OTczNw..*_ga_KS2MELEEFC*MTY2OTcyNDAwMC4zMC4xLjE2Njk3MjQwNjEuNjAuMC4w) cloud-delivered malware analysis service accurately identifies known samples as malicious. * [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering/administration) and [DNS Security](https://docs.paloaltonetworks.com/dns-security) identify domains associated with this group as malicious. * [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) detects user and credential-based threats by analyzing user activity from multiple data sources including endpoints, network firewalls, Active Directory, identity and access management solutions, and cloud workloads. It builds behavioral profiles of user activity over time with machine learning. By comparing new activity to past activity, peer activity and the expected behavior of the entity, Cortex XDR detects anomalous activity indicative of credential-based attacks. It also offers the following protections related to the attacks discussed in this post: * Prevents the execution of known malicious malware, and also prevents the execution of unknown malware using [Behavioral Threat Protection and](https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/threat-prevention?_gl=1*13pmp8e*_ga*NzQyNjM2NzkuMTY2NjY3OTczNw..*_ga_KS2MELEEFC*MTY2OTczNjA2MS4zMS4wLjE2Njk3MzYwNjEuNjAuMC4w) machine learning based on the Local Analysis module. * Protects against credential gathering tools and techniques using the new Credential Gathering Protection available from Cortex XDR 3.4. * Protects from threat actors dropping and executing commands from web shells using Anti-Webshell Protection, newly released in Cortex XDR version 3.4. * Protects against exploitation of different vulnerabilities including ProxyShell and ProxyLogon using the Anti-Exploitation modules as well as Behavioral Threat Protection. * Cortex XDR Pro [detects post-exploit activity](https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-analytics-alert-reference/cortex-xdr-analytics-alert-reference/analytics-alerts-by-required-data-source), including credential-based attacks, with behavioral analytics. If you think you might have been impacted or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html?_gl=1*13pmp8e*_ga*NzQyNjM2NzkuMTY2NjY3OTczNw..*_ga_KS2MELEEFC*MTY2OTczNjA2MS4zMS4wLjE2Njk3MzYwNjEuNjAuMC4w) or call: North America Toll-Free: 866.486.4842 (866.4.UNIT42) * EMEA: +31.20.299.3130 * APAC: +65.6983.8730 * Japan: +81.50.1790.0200 Palo Alto Networks has shared these findings, including file samples and indicators of compromise, with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org). ## **Indicators of Compromise** **Web Shells** * B00cd3b39bc2fd6a4077c679f050d97ed26ef20a1fe80ad3525ea0dbbd131f74 * 0153246cf5e1d980d65d4920bdc5b2ac4c9aba6d5b6676f0e9bbde794dd04314 * 0f9dca8599d7b350050149e63a6a977f1d157d5967ba6da534919530063cdcde * 9215371ec6058ba38780a5d336eb3201a47c77bb97bb00a60f1bec0386185c77 * adf2ee0ad2f5f13b9bf72741c75910f786d2cfee84b5ae78ea3e5464f46addde **Compiled Web Shell DLLs** * fcd44c32ae6078f2ba44c8c5e2efa3f9b788d4c6470a5ee9bd4944699fb8357a * 2e24c384f9ae7d09179bd41e51c4a9bb43102d170990e8e1576e79362b049ed6 * 3ab6a849d81b66a52d717cc1b0178882e30d44c39b1089604c5746a187b2e4ce * 905cf864acad6b4a664582eb9fc6e0afab87198274a29e5f7d7863fee29f37cd **StreamEx Malware** * a812d5472458c6fc993ae1e9e8b9f04e31d176e2ec9f5ce5ac48e32ed72fb414 * 8402967a4b0bff39fc3ccc7a5b613734135551e9f6f32cf8c14fd6541a85d4d5 **Coin Miners** * 4cdcec18ef5d3657b488f32912a8ccf4541891e4e4c8518afbc1e1b0e147e96b * db2712470ca60e874b15fa1e5ef667dbf6b755223ee5eb20843843115537e1c4 * c67ce681677909aa5ae9abcf42c35faffee08cd73b5cee8d975fa07159f76c87 * 308643ef08bd65afaba08315826985975515845fb5d6235db80a9bc5bdbb00f3 **SpoolPotato** * 238f5771b8350633e258221e25223e52545709b74cbe2c9361e2b730f9dbfa00 **JuicyPotato** * 5cb0710bef7c7b0ff226bf5ca12f499859505547696f22fa06ce1f47ea312d82 **x.bat** * f20b0a716c3980c46a2996ae21e3566c0151202557417d171566b82e97057f2f **x.tmp** * b4de4eb9763ad18e060513048eed4ac39481cfe62127345d0bb058eb26a18528 **x.tmp (decrypted)** * 2092ce3cef30198cb7833851a1b1805bbfe71474152c1357ecd27f71ce807527 **x** * 6f77fea2e8e34fe3bb7134e110036e44e30a6d5144794669a6de21a30f3b7247 **x (decrypted)** * db7290032479a53fa7a43262188132d572fab63d00d6d64d39f9256df6c10f55 **PCHunter** * 5cb0710bef7c7b0ff226bf5ca12f499859505547696f22fa06ce1f47ea312d82 **PrintSpoofer** * 609d04a4be3878328503c342f0d73c9ba5ff1c6c62f4c894516e50721207ef83 **PetitPotam** * 419e8bfae7a0887fad0eb273791cf0d03c0ed01d1957c7dc796c6e0d1a43f3d6 **JuicyPotatoNG** * 181daac34fd958aaadf1c9de1414cc3b331ef394ba47d5d2c77d30e9ac89ef17 **EfsPotato** * ef8eae74cddea603c5051de7808f402943d674c6bb557db1eff6a50d25114b6b **au.exe** * b08a089f0e44c2703a9e0dc4f6ef8d9285a08241499ad21dbf7f1fbc262d22bd * 1d61842f5ecdca970f43246ce93f51fa4c85c00b93b6b9e37db17325077497eb **RunasCs\_net2** * 009a28656abb84a6e7794fdd721565a2e2ca2565870597962d67a8e2c3707241 **CVE-2018-8120** * 88f62989cb2f220db3d289ffea924423487b180fabe37711d2ef5c7f2e306f13 **CVE-2019-0803** * 068bfbb2dc6dadc3860eb16cc7ece97d935948f9b64ec66d5afda08e682be790 **CVE-2019-1458** * 3e2041c2efd120960c00bf794b5db4c967fc862e2d536ed5f7b5d5d1cf9bfda0 **CVE-2019-0623** * 74b95e6b8e02ea623849b6bcbf702922dd064ae06238b27cbb20504e38d85756 **Fork bomb** * 6c569dd683df9600a098a93c9200d44778d535f58f5a82f4a58aeed3855fb9ca **dllnc** * 67fdef1b6fdf6fbec44e4df1608fb46dfbcfa3363bf62872ec132d000092a18f * ae35de63065040d752ef9fa76c553c0fa5c3cc5c8d67cf6981c66d3c8d86a6a6 **sh.exe** * 9e761c6811679311c80291b7d65f23cdd53865f72af64b5a72ae1a86d9ef27d0 **GodPotato** * 4e04472b21365c76d9cf0a324f889f723621fc42433a2f211a23dce728fa4a8a * 5a4a2272ce4388e56fb9d33255ac8c584d41c7099588ef9f39e4bee54be92992 **MyCACLS** * 15c52422bfa461b01901953f5e0d9c77aa0f898c8de4841303a572c59a269674 **PDB Paths** * "F:\\upfile\\3389\\opents\\dlladduser\\x64\\Release\\dllnc.pdb" * "E:\\git\\MyComEopPower\\MyComEopPipe\\Build\\Quantum.pdb" * "E:\\git\\MyComEopPower\\MyComEopPipe\\Build\\MyComEop.pdb" * "D:\\project\\后门类\\dllnc\\exenc\\x64\\Release\\exenc.pdb" ## Additional Resources * [Manic Menagerie: Malicious activity targeting web hosting providers](https://www.cyber.gov.au/sites/default/files/2023-03/report_manic_menagerie.pdf) -- ACSC Report 2018-143, Australian Cyber Security Centre * [Deep understand ASPX file handling and some related attack vectors](https://blog.viettelcybersecurity.com/deep-understand-aspx-file-handling-and-some-related-attack-vector/) -- Viettel Cyber Security * [ProxyShellMiner Campaign Creating Dangerous Backdoors](https://blog.morphisec.com/proxyshellminer-campaign) -- Morphisec * [What Is a Fork Bomb? Definition, Code, Prevention \& Removal](https://www.okta.com/identity-101/fork-bomb/) -- Okta * [RID Hijacking](https://www.ired.team/offensive-security/persistence/rid-hijacking) -- ired.team notes * [HAFNIUM, China Chopper and ASP.NET Runtime](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/hafnium-china-chopper-and-aspnet-runtime/) -- SpiderLabs Blog, Trustwave Back to top ### Tags * [Cryptocurrency](https://unit42.paloaltonetworks.com/tag/cryptocurrency/ "Cryptocurrency") * [Cryptojacking](https://unit42.paloaltonetworks.com/tag/cryptojacking/ "cryptojacking") * [CVE-2021-26855](https://unit42.paloaltonetworks.com/tag/cve-2021-26855/ "CVE-2021-26855") * [CVE-2021-33766](https://unit42.paloaltonetworks.com/tag/cve-2021-33766/ "CVE-2021-33766") * [CVE-2021-34473](https://unit42.paloaltonetworks.com/tag/cve-2021-34473/ "CVE-2021-34473") * [CVE-2022-41040](https://unit42.paloaltonetworks.com/tag/cve-2022-41040/ "CVE-2022-41040") * [Manic Menagerie](https://unit42.paloaltonetworks.com/tag/manic-menagerie/ "Manic Menagerie") * [Microsoft Exchange Server](https://unit42.paloaltonetworks.com/tag/microsoft-exchange-server/ "Microsoft Exchange Server") * [Persistence method](https://unit42.paloaltonetworks.com/tag/persistence-method/ "persistence method") * [ProxyNotShell](https://unit42.paloaltonetworks.com/tag/proxynotshell/ "ProxyNotShell") * [Webshell](https://unit42.paloaltonetworks.com/tag/webshell/ "webshell") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Detecting Popular Cobalt Strike Malleable C2 Profile Techniques](https://unit42.paloaltonetworks.com/cobalt-strike-malleable-c2/ "Detecting Popular Cobalt Strike Malleable C2 Profile Techniques") ### Table of Contents * ### Related Articles * [Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation](https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/ "article - table of contents") * [Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files](https://unit42.paloaltonetworks.com/gremlin-stealer-evolution/ "article - table of contents") * [01flip: Multi-Platform Ransomware Written in Rust](https://unit42.paloaltonetworks.com/new-ransomware-01flip-written-in-rust/ "article - table of contents") ## Related Malware Resources ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/) * [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API") * [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway") * [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)