[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/mirai-variant-echobot-resurfaces-with-13-previously-unexploited-vulnerabilities/) * [Japanese](https://unit42.paloaltonetworks.com/ja/mirai-variant-echobot-resurfaces-with-13-previously-unexploited-vulnerabilities/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # Mirai Variant ECHOBOT Resurfaces with 13 Previously Unexploited Vulnerabilities ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 6 min read Related Products [![Advanced DNS Security icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced DNS Security](https://unit42.paloaltonetworks.com/product-category/advanced-dns-security/ "Advanced DNS Security")[![Advanced Threat Prevention icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced Threat Prevention](https://unit42.paloaltonetworks.com/product-category/advanced-threat-prevention/ "Advanced Threat Prevention")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Next-Generation Firewall icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Ruchna Nigam](https://unit42.paloaltonetworks.com/author/ruchna-nigam/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:December 13, 2019 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * [Vulnerabilities](https://unit42.paloaltonetworks.com/category/vulnerabilities/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Echobot](https://unit42.paloaltonetworks.com/tag/echobot/) * [IoT](https://unit42.paloaltonetworks.com/tag/iot/) * [IoT Vulnerability](https://unit42.paloaltonetworks.com/tag/iot-vulnerability/) * [Mirai](https://unit42.paloaltonetworks.com/tag/mirai/) * [Mirai variant](https://unit42.paloaltonetworks.com/tag/mirai-variant/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/mirai-variant-echobot-resurfaces-with-13-previously-unexploited-vulnerabilities/?pdf=download&lg=en&_wpnonce=64814e76fb "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/mirai-variant-echobot-resurfaces-with-13-previously-unexploited-vulnerabilities/?pdf=print&lg=en&_wpnonce=64814e76fb "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Mirai%20Variant%20ECHOBOT%20Resurfaces%20with%2013%20Previously%20Unexploited%20Vulnerabilities&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fmirai-variant-echobot-resurfaces-with-13-previously-unexploited-vulnerabilities%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fmirai-variant-echobot-resurfaces-with-13-previously-unexploited-vulnerabilities%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fmirai-variant-echobot-resurfaces-with-13-previously-unexploited-vulnerabilities%2F&title=Mirai%20Variant%20ECHOBOT%20Resurfaces%20with%2013%20Previously%20Unexploited%20Vulnerabilities "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fmirai-variant-echobot-resurfaces-with-13-previously-unexploited-vulnerabilities%2F&text=Mirai%20Variant%20ECHOBOT%20Resurfaces%20with%2013%20Previously%20Unexploited%20Vulnerabilities "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fmirai-variant-echobot-resurfaces-with-13-previously-unexploited-vulnerabilities%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Mirai%20Variant%20ECHOBOT%20Resurfaces%20with%2013%20Previously%20Unexploited%20Vulnerabilities%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fmirai-variant-echobot-resurfaces-with-13-previously-unexploited-vulnerabilities%2F "Share in Mastodon") ## Executive Summary Since the [discovery](https://unit42.paloaltonetworks.com/new-mirai-variant-adds-8-new-exploits-targets-additional-iot-devices/) of the Mirai variant using the binary name ECHOBOT in May 2019, it has [resurfaced](https://github.com/pan-unit42/iocs/blob/master/mirai/ECHOBOT_6thAug2019.md) from time to time, using new infrastructure, and more remarkably, adding to the list of vulnerabilities it scans for, as a means to increase its attack surface with each evolution. Unlike other Mirai variants, this particular variant stands out for the sheer number of exploits it incorporates, with the latest version having a total of 71 unique exploits, 13 of which haven't been seen exploited in the wild until now, ranging from extremely old CVEs from as long back as 2003, to recent vulnerabilities made public as recently as early December 2019. Based on this seemingly odd choice, one could risk a guess that the attackers could potentially be aiming for the sweet spots of IoT vulnerabilities, targeting either legacy devices that are still in use but probably too old to update due to compatibility issues and newer vulnerabilities that are too recent for owners to have patched. The newly incorporated exploits target a range of devices from the usually expected routers, firewalls, IP cameras and server management utilities, to more rarely seen targets like a PLC, an online payment system and even a yacht control web application. This version first surfaced on October 28th, 2019 for a couple of hours, after which it was taken down. It then resurfaced on the 3rd of December, switching payload IPs and finally adding 2 more exploits that weren't in the samples from October. While details on this version were recently [published](https://www.bleepingcomputer.com/news/security/new-echobot-variant-exploits-77-remote-code-execution-flaws/), this post shares CVE numbers (where available) for the vulnerabilities targeted, as well as IOCs for this version I have been tracking since October. *The following section also explains the discrepancy in the exploit count used here in comparison to other publications.* ### Exploits This latest variant contains a total of 71 unique exploits, 13 of these vulnerabilities haven't been previously seen exploited in the wild prior to this version. Exploits targeting the same vulnerability in different devices (potentially sharing firmware) or targeting different ports have been grouped together. The exploits that are new to this version, and any previously seen Mirai variant for that matter, are listed in Table 1 below: |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------|------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Vulnerability** | **Affected Devices** | **Port Scanned** | **Exploit Format** | | [CVE-2019-17270](https://sploitus.com/exploit?id=PACKETSTORM:155582) | Yachtcontrol Webservers | 8081 | ![](https://unit42.paloaltonetworks.com/wp-content/uploads/2019/12/word-image-113.png) | | [CVE-2019-18396](https://medium.com/@c4pt41nnn/cve-2019-18396-command-injection-in-technicolor-router-da5dd2134052) / [CVE-2017-14127](https://github.com/fenexomega/fenexomega.github.io/commit/7abcb9e8f2ce8a3b061265dceab482c956b76838) | Technicolor TD5130v2 and Technicolor TD5336 routers. | 161 | ![](https://unit42.paloaltonetworks.com/wp-content/uploads/2019/12/word-image-114.png) | | [AVCON6 Remote Code Execution](https://www.exploit-db.com/exploits/47379) | AVCON6 video conferencing systems | 8080 | ![](https://unit42.paloaltonetworks.com/wp-content/uploads/2019/12/word-image-115.png) | | [CVE-2019-16072](https://www.exploit-db.com/exploits/47364) | Enigma Network Management Systems v65.0.0 | 80 | ![](https://unit42.paloaltonetworks.com/wp-content/uploads/2019/12/word-image-116.png) | | [CVE-2019-14931](https://www.exploit-db.com/exploits/47235) | Mitsubishi Electric smartRTU \& INEA ME-RTU | 80 | ![](https://unit42.paloaltonetworks.com/wp-content/uploads/2019/12/word-image-117.png) | | [Sar2HTML Remote Code Execution](https://www.exploit-db.com/exploits/47204) | Sar2HTML plotting tool for Linux servers, v3.2.1 | 80 | ![](https://unit42.paloaltonetworks.com/wp-content/uploads/2019/12/word-image-118.png) | | CVE-2017-16602 | NetGain Systems Enterprise Manager | 8081 | ![](https://unit42.paloaltonetworks.com/wp-content/uploads/2019/12/word-image-119.png) | | [CVE-2017-6316](https://www.exploit-db.com/exploits/42345) | Citrix NetScaler SD-WAN 9.1.2.26.561201 devices | 443 | ![](https://unit42.paloaltonetworks.com/wp-content/uploads/2019/12/word-image-120.png) | | [CVE-2013-5912](https://www.cvedetails.com/cve/CVE-2013-5912/) | Thomson Reuters Velocity Analytics Vhayu Analytic Servers 6.94 build 2995 | 80 | ![](https://unit42.paloaltonetworks.com/wp-content/uploads/2019/12/word-image-121.png) | | [ACTi ASOC2200 Remote Code Execution](https://www.exploit-db.com/exploits/16993) | ACTi ASOC 2200 Web Configurators versions 2.6 and prior. | 80 | ![](https://unit42.paloaltonetworks.com/wp-content/uploads/2019/12/word-image-122.png) | | [3Com Office Connect Remote Code Execution](https://www.exploit-db.com/exploits/9862) | 3Com OfficeConnect routers | 80 | ![](https://unit42.paloaltonetworks.com/wp-content/uploads/2019/12/word-image-123.png) | | [CVE-2006-4000](https://www.exploit-db.com/exploits/28321) | Barracuda Spam Firewall versions 3.3.x | 80 | ![](https://unit42.paloaltonetworks.com/wp-content/uploads/2019/12/word-image-124.png) | | [CCBill Remote Code Execution](https://www.exploit-db.com/exploits/53) | CCBill Online Payment Systems | 80 | ![](https://unit42.paloaltonetworks.com/wp-content/uploads/2019/12/word-image-125.png) ![](https://unit42.paloaltonetworks.com/wp-content/uploads/2019/12/word-image-126.png) | *Table 1 Previously unexploited vulnerabilities in latest ECHOBOT version* Other exploits included in this version are listed in the Appendix. ### Other Technical Details Like its predecessors, this version of ECHOBOT also makes use of the key 0xDFDAACFD for XOR encryption of its strings. The new default credentials brute forced by this variant are listed below : * root/trendimsa1.0 * admin/fritzfonbox * r00t/boza * root/welc0me * admin/welc0me * root/bagabu * welc0me/ * unknown/ * UNKNOWN/ ### Infrastructure This version first surfaced on 28th October 2019 for a couple of hours, after which it was taken down. It then resurfaced on the 3rd of December, switching payload IPs and finally adding 2 more exploits that weren't in the samples from October. Figure 1 shows the dropper script that was live at the IP 145.249.106\[.\]241 until the 12th of December. [![](https://unit42.paloaltonetworks.com/wp-content/uploads/2019/12/Figure-1.-Dropper-script-1024x242.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2019/12/Figure-1.-Dropper-script.png) *Figure 1. Dropper script* Prior to this, samples of this version were briefly hosted at : * 45\.89.106\[.\]108 on 2019-10-28 * 80\.82.67\[.\]184 on 2019-12-03 * 80\.82.67\[.\]209 on 2019-12-04 * 145\.249.106\[.\]241 on and after 2019-11-12 It makes use of the same domains for Command and Control as its predecessors. IOCs for all activity mentioned in this post can be found at the Unit42 [github](https://github.com/pan-unit42/iocs/blob/master/mirai/ECHOBOT_28thOct2019.md). # Conclusion The Mirai variant ECHOBOT differentiates itself from concurrent variants by the sheer volume of vulnerabilities targeted, as opposed to other variants that stick to certain vulnerabilities that have proven effective over time. The exploits unique to this new version target vulnerabilities ranging from extremely old CVEs from as long back as 2003, to ones made public as recently as early December 2019. This choice of exploits could possibly imply its authors are targeting either legacy devices that are still in use but probably too old to update due to compatibility issues and newer vulnerabilities that are too recent for owners to have patched. We are unable to speculate at this point in time on the overall effectiveness of their approach - be it the use of a large number of exploits, or the choice of the exploits themselves. Palo Alto Networks customers are protected by: * WildFire which detects all related samples with malicious verdicts * Threat Prevention and PANDB that block all exploits and IPs/URLs used by this variant. AutoFocus customers can track these activities using individual exploit tags: * [CVE-2019-17270](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2019-17270) * [CVE-2019-18396](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2019-18396) * [AVCON6RCE](https://autofocus.paloaltonetworks.com/#/tag/Unit42.AVCON6RCE) * [CVE-2019-16072](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2019-16072) * [CVE-2019-14931](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2019-14931) * [Sar2HTMLRCE](https://autofocus.paloaltonetworks.com/#/tag/Unit42.Sar2HTMLRCE) * [CVE-2017-16602](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2017-16602) * [CVE-2017-6316](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2017-6316) * [CVE-2013-5912](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2013-5912) * [ACTiASOC2200RCE](https://autofocus.paloaltonetworks.com/#/tag/Unit42.ACTiASOC2200RCE) * [3ComOfficeConnectRCE](https://autofocus.paloaltonetworks.com/#/tag/Unit42.3ComOfficeConnectRCE) * [CVE-2006-4000](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2006-4000) * [CCBillRCE](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CCBillRCE) The malware family can be tracked in AutoFocus using the tag [Mirai](https://autofocus.paloaltonetworks.com/#/tag/Unit42.Mirai) # Appendix Other exploits embedded in this ECHOBOT version are listed below: |-------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------|---------------------------------| | **Vulnerability** | **Function name in unstripped binaries** | **Port(s) Scanned** | | [CVE-2019-15107](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2019-15107) | webmin\_init | 10000 | | [CVE-2014-8361](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2014-8361) | realtekscan, dlinkscan | 52869, 49152 | | [FritzBox Command Injection](https://autofocus.paloaltonetworks.com/#/tag/Unit42.FritzBoxCmdInjection) | fritzboxscan | 80 | | [CVE-2019-12989, CVE-2019-12991](https://www.exploit-db.com/exploits/47112) | citrix\_init | 80 | | [Xfinity Gateway Remote Code Execution](https://autofocus.paloaltonetworks.com/#/tag/Unit42.XfinityGatewayRCE) | xfinityscan | 80 | | [Beward N100 Remote Code Execution](https://autofocus.paloaltonetworks.com/#/tag/Unit42.BewardN100RCE) | bewardscan | 80 | | [FLIR Thermal Camera Command Injection](https://autofocus.paloaltonetworks.com/#/tag/Unit42.FLIR_FCSPT_RCE) | thermalscan | 80 | | [EyeLock nano NXT Remote Code Execution](https://autofocus.paloaltonetworks.com/#/tag/Unit42.EyeLockNXT_RCE) | nxtscan | 11000 | | [IrisAccess ICU Cross-Site Scripting](https://autofocus.paloaltonetworks.com/#/tag/Unit42.IrisAccessICU_RCE) | irisscan | 80 | | [EnGenius Remote Code Execution](https://autofocus.paloaltonetworks.com/#/tag/Unit42.EnGeniusRCE) | cloudscan | 9000 | | [Sapido RB-1732 Remote Command Execution](https://autofocus.paloaltonetworks.com/#/tag/Unit42.SapidoRB1732_RCE) | sapidoscan | 80 | | [CVE-2016-0752](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2016-0752) | railsscan | 3000 | | [CVE-2014-3914](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2014-3914) | rocketscan | 8888 | | [CVE-2015-4051](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2015-4051) | beckhoffscan | 5120 | | [CVE-2015-2208](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2015-2208) | phpmoadmin | 80 | | CVE-2018-7297 | homematicscan | 2001 | | [SpreeCommerce Remote Code Execution](https://autofocus.paloaltonetworks.com/#/tag/Unit42.SpreecommerceRCE) | spreecommercescan | 80 | | [Redmine Remote Code Execution](https://autofocus.paloaltonetworks.com/#/tag/Unit42.RedmineRCE) | redminescan | 80 | | [CVE-2003-0050](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2003-0050) | quicktimescan | 1220 | | [CVE-2011-3587](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2011-3587) | plonescan | 80 | | [CVE-2005-2773](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2005-2773) | openviewscan | 2447 | | [Op5Monitor Remote Code Execution](https://autofocus.paloaltonetworks.com/#/tag/Unit42.OP5MonitorRCE) | op5v7scan | 443 | | [CVE-2012-0262](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2012-0262) | op5scan | 443 | | [CVE-2009-2288](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2009-2288) | nagiosscan | 12489 | | [MitelAWC Remote Code Execution](https://autofocus.paloaltonetworks.com/#/tag/Unit42.MitelAWC_RCE) | mitelscan | 80 | | [Gitorious Remote Code Execution](https://autofocus.paloaltonetworks.com/#/tag/Unit42.GitoriousRCE) | gitoriousscan | 9418 | | [CVE-2012-4869](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2012-4869) | freepbxscan | 5060 | | [CVE-2011-5010](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2011-5010) | ctekscan | 52869 | | [DogfoodCRM\_Remote Code Execution](https://autofocus.paloaltonetworks.com/#/tag/Unit42.DogfoodCRM_RCE) | crmscan | 8000 | | [CVE-2005-2848](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2005-2848) | barracudascan | 80 | | [CVE-2006-2237](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2006-2237) | awstatsmigratescan | 80 | | [CVE-2005-0116](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2005-0116) | awstatsconfigdirscan | 80 | | [CVE-2008-3922](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2008-3922) | awstatstotalsscan | 80 | | [CVE-2007-3010](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2007-3010) | telscan | 80 | | [ASUSModemRCEs](https://autofocus.paloaltonetworks.com/#/tag/Unit42.ASUSModemRCE) (CVE-2013-5948, CVE-2018-15887) | asuswrtscan, asusscan | 80 | | [CVE-2009-0545](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2009-0545) | zeroshellscan | 80 | | [CVE-2013-5758](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2013-5758) | yealinkscan | 52869 | | [CVE-2016-10760](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2016-10760) | seowonintechscan | 80 | | [CVE-2009-5157](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2009-5157) | linksysscan | 80 | | [CVE-2009-2765](https://www.exploit-db.com/exploits/9209) | ddwrtscan | 80 | | [CVE-2010-5330](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2010-5330) | airosscan | 80 | | [CVE-2009-5156](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2009-5156) | asmaxscan | 80 | | [GoAheadRCE](https://autofocus.paloaltonetworks.com/#/tag/Unit42.GoAheadRCE) | wificamscan | 80 | | [CVE-2017-5174](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2017-5174) | geutebruckscan | 80 | | [CVE-2018-6961](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2018-6961) | vmwarescan | 80 | | [CVE-2018-11510](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2018-11510) | admscan | 8001 | | [OpenDreamBox\_RCE](https://autofocus.paloaltonetworks.com/#/tag/Unit42.OpenDreamBox_RCE) | dreamboxscan/ dreambox8889scan, dreambox8880scan, dreambox10000scan | 10000, 8889, 8880, 10000 | | [WePresentCmdInjection](https://autofocus.paloaltonetworks.com/#/tag/Unit42.WePresentCmdInjection) | wepresentscan | 80 | | [CVE-2018-17173](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2018-17173) | supersignscan | 9080 | | [CVE-2019-2725](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2019-2725) | oraclescan | 1234 | | [NetgearReadyNAS\_RCE](https://autofocus.paloaltonetworks.com/#/tag/Unit42.NetgearReadyNAS_RCE) | nuuoscan, netgearscan | 50000, 80 | | [CVE-2018-20841](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2018-20841) | hootooscan | 6666 | | [DellKACE\_SysMgmtApp\_RCE](https://autofocus.paloaltonetworks.com/#/tag/Unit42.DellKACE_SysMgmtApp_RCE) | dellscan | 80 | | [CVE-2018-7841](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2018-7841) | umotionscan | 80 | | [CVE-2016-6255](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2016-6255) | veralite\_init | 49451 | | [CVE-2019-3929](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2019-3929) | Blackboxscan | 80 | | [CVE-2019-12780](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2019-12780) | belkin\_init | 49152 | Back to top ### Tags * [Echobot](https://unit42.paloaltonetworks.com/tag/echobot/ "Echobot") * [IoT](https://unit42.paloaltonetworks.com/tag/iot/ "IoT") * [IoT Vulnerability](https://unit42.paloaltonetworks.com/tag/iot-vulnerability/ "IoT Vulnerability") * [Mirai](https://unit42.paloaltonetworks.com/tag/mirai/ "Mirai") * [Mirai variant](https://unit42.paloaltonetworks.com/tag/mirai-variant/ "Mirai variant") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Unit 42 Presents New Research at BlueHat Seattle on Three New Windows RDP Vulnerability Exploit Methods](https://unit42.paloaltonetworks.com/unit-42-presents-new-research-at-bluehat-seattle-on-three-new-windows-rdp-vulnerability-exploit-methods/ "Unit 42 Presents New Research at BlueHat Seattle on Three New Windows RDP Vulnerability Exploit Methods") ### Related Articles * [A Deep Dive Into Attempted Exploitation of CVE-2023-33538](https://unit42.paloaltonetworks.com/exploitation-of-cve-2023-33538/ "article - table of contents") * [Understanding the Russian Cyberthreat to the 2026 Winter Olympics](https://unit42.paloaltonetworks.com/russian-cyberthreat-2026-winter-olympics/ "article - table of contents") * [TOTOLINK X6000R: Three New Vulnerabilities Uncovered](https://unit42.paloaltonetworks.com/totolink-x6000r-vulnerabilities/ "article - table of contents") ## Related Resources ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/) * [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API") * [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway") * [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)