[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # NetTraveler Spear-Phishing Email Targets Diplomat of Uzbekistan ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 7 min read Related Products [![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Vicky Ray](https://unit42.paloaltonetworks.com/author/vicky-khan/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:January 21, 2016 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [NetTraveler](https://unit42.paloaltonetworks.com/tag/nettraveler/) * [Spear Phishing](https://unit42.paloaltonetworks.com/tag/spear-phishing/) * [Trojan](https://unit42.paloaltonetworks.com/tag/trojan/) * [Ufa](https://unit42.paloaltonetworks.com/tag/ufa/) * [Ufe](https://unit42.paloaltonetworks.com/tag/ufe/) * [Uzbekistan](https://unit42.paloaltonetworks.com/tag/uzbekistan/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/nettraveler-spear-phishing-email-targets-diplomat-of-uzbekistan/?pdf=download&lg=en&_wpnonce=30e6d023f2 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/nettraveler-spear-phishing-email-targets-diplomat-of-uzbekistan/?pdf=print&lg=en&_wpnonce=30e6d023f2 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=NetTraveler%20Spear-Phishing%20Email%20Targets%20Diplomat%20of%20Uzbekistan&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fnettraveler-spear-phishing-email-targets-diplomat-of-uzbekistan%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnettraveler-spear-phishing-email-targets-diplomat-of-uzbekistan%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnettraveler-spear-phishing-email-targets-diplomat-of-uzbekistan%2F&title=NetTraveler%20Spear-Phishing%20Email%20Targets%20Diplomat%20of%20Uzbekistan "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnettraveler-spear-phishing-email-targets-diplomat-of-uzbekistan%2F&text=NetTraveler%20Spear-Phishing%20Email%20Targets%20Diplomat%20of%20Uzbekistan "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnettraveler-spear-phishing-email-targets-diplomat-of-uzbekistan%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=NetTraveler%20Spear-Phishing%20Email%20Targets%20Diplomat%20of%20Uzbekistan%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fnettraveler-spear-phishing-email-targets-diplomat-of-uzbekistan%2F "Share in Mastodon") Unit 42 recently identified a targeted attack against an individual working for the Foreign Ministry of Uzbekistan in China. A spear-phishing email was sent to a diplomat of the Embassy of Uzbekistan who is likely based in Beijing, China. In this report, we'll review how the actors attempted to exploit CVE-2012-0158 to install the NetTraveler Trojan. On December 12, 2015, a spear-phishing email was sent to a diplomat of the Embassy of Uzbekistan. The body and subject of the email suggests that the email was spoofed to look like it was sent by the Russian Foreign Ministry and the attachment may contain an official annual report on CHS (Council of Heads of Member States), who form the [SCO](https://en.wikipedia.org/wiki/Shanghai_Cooperation_Organisation) (Shanghai Cooperation Organization). *Filename: "2015.12.11\_сроки СГГ 2015 в Уфе.doc.doc" (translated to: "2015.12.11\_sroki CHS in 2015 Ufe.doc.doc")* *Body: "С уважением, ДАТС МИД России" (translated to: "Yours faithfully, ACSD Russian Foreign Ministry")* It is interesting to note the reference of Ufa in the file name, as the city of Ufa in Russia hosted the [SCO BRICS Summit](https://ufa2015.com/) on July 9 and 10, 2015. SCO and BRICS (Brazil, Russia, India, China and South Africa) are intergovernmental international organizations focused on issues of regional security and economic cooperation. [![diplomat 1](http://blog.paloaltonetworks.com/wp-content/uploads/2016/01/diplomat-1-500x281.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/01/diplomat-1.png) *Figure 1 Leaders of member nations at the 2015 Summit in Ufa* ### TARGETING AND MALWARE ANALYSIS Our analysis shows that actors attempted to exploit CVE-2012-0158 to install NetTraveler Trojan. [![diplomat 2](http://blog.paloaltonetworks.com/wp-content/uploads/2016/01/diplomat-2-500x341.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/01/diplomat-2.png) *Figure 2 Email containing the malicious attachment* The malicious attachment "2015.12.11\_сроки СГГ 2015 в Уфе.doc.doc" is a malicious document created by the MNKit toolkit and exploits CVE-2012-0158. Upon successful exploitation, the attachment will install the trojan known as NetTraveler using a [DLL side-loading](https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-dll-sideloading.pdf) attack technique. The [NetTraveler](https://kasperskycontenthub.com/wp-content/uploads/sites/43/vlpdfs/kaspersky-the-net-traveler-part1-final.pdf) trojan has been known to be used in targeted cyber espionage attacks for [more than a decade](https://securelist.com/blog/research/66272/nettraveler-apt-gets-a-makeover-for-10th-birthday/) by nation state threat actors and continues to be used to target its victims and exfiltrate data. The DLL side-loading attack technique has been gaining adoption within the cyber espionage realm by threat actors to bypass traditional security systems. Unit 42 also published a [blog](https://blog.paloaltonetworks.com/2015/05/plugx-uses-legitimate-samsung-application-for-dll-side-loading/) last year discussing an unrelated attack where the DLL side-loading technique was used. Figure 3 illustrates the exploitation and the infection flow of the malware. [![diplomat 3](http://blog.paloaltonetworks.com/wp-content/uploads/2016/01/diplomat-3-500x670.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/01/diplomat-3.png) *Figure 3 Overview of the infection flow* The document "2015.12.11\_сроки СГГ 2015 в Уфе.doc.doc" exploits CVE-2012-0158 to drop a decoy file "~$.doc" and the actual payload "DW20.exe". The decoy is a blank document with the meta data stripped. The payload (DW20.exe) is a self-extracting (SFX) RAR archive that contains the following files: *RasTls.exe* *rastls.dll* *Sycmentec.config* [![diplomat 4](http://blog.paloaltonetworks.com/wp-content/uploads/2016/01/diplomat-4-500x290.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/01/diplomat-4.png) *Figure 4 The payload(DW20.exe) is a SFX RAR archive* The SFX RAR uses the following configuration to launch the embedded executable, which is a legitimate application created by Symantec that will side load the rastls.dll DLL: *Setup=RasTls.exe* *TempMode* *Silent=1* *Overwrite=1* The figure below shows that the config file, 'Sycmentec.config' is encrypted. The 'Sycmentec.config' file can be decrypted using a single byte XOR algorithm using '0x77' as a key. [![diplomat 5](http://blog.paloaltonetworks.com/wp-content/uploads/2016/01/diplomat-5-500x393.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/01/diplomat-5.png) *Figure 5 Encrypted* *'Sycmentec* *.config'file* The 'rastls.dll' DLL will load and decrypt this file. The decrypted data starts with shellcode that is responsible for loading an embedded DLL and executing it. Figure 6 shows the decrypted 'Sycmentec.config'file containing an embedded DLL. [![diplomat 6](http://blog.paloaltonetworks.com/wp-content/uploads/2016/01/diplomat-6-500x393.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/01/diplomat-6.png) *Figure 6 Decrypted* *'* *Sycmentec.config' file contains an embedded DLL* The embedded DLL is the functional payload, which is a variant of the NetTraveler Trojan that has the following attributes: |-------------------|------------------------------------------------------------------| | **Size** | 52736 bytes | | **Type** | PE32 executable (DLL) (GUI) Intel 80386, for MS Windows | | **Architecture** | 32 Bits binary | | **MD5** | 3e3df4fe831d87d7f52f14933e464fc3 | | **SHA1** | cce65a0b67674a313091a947506ceb91d30605ad | | **SHA256** | 3b4e4d7a0b1185a45968d90ffe6346f4621116d14dbf88b5138040acc022c757 | | **ssdeep** | 1536:jxKW1S8mWKFU7U9lYjhjXwVqTvS/G405:wCBmUw9lAhLWqW/G40 | | **imphash** | 85ce31f87f06b02fec915d33d82958e8 | | **Date** | 0x564B2B07 \[Tue Nov 17 13:26:31 2015 UTC\] | | **CRC:(Claimed)** | 0x0, (Actual): 0x19be0 \[SUSPICIOUS\] | | **Packers** | Armadillo v1.xx - v2.xx | | **Entry Point** | 0x1000970b .text 1/5 | *Table 1 Attributes of the embedded DLL (NetTraveler)* The first execution of this NetTraveler Trojan starts off with an installation process. Like previous versions, this NetTraveler sample writes its configuration to a file, in this case the configuration is written to a file named "config.dat". [![diplomat 7](http://blog.paloaltonetworks.com/wp-content/uploads/2016/01/diplomat-7-500x268.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/01/diplomat-7.png) *Figure 7 NetTraveler writes the configuration to* *'* *config.dat' file* During execution, NetTraveler creates a mutex of 'YOYWOW!657', as shown in Figure 8 below to avoid running multiple instances of its code. [![diplomat 8](http://blog.paloaltonetworks.com/wp-content/uploads/2016/01/diplomat-8-500x105.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/01/diplomat-8.png) *Figure 8 Mutex created for this NetTraveler payload* The code then enumerates the 'netsvcs' services, which are services that run within the process space of svchost.exe, specifically ignoring services named '6to4' and 'Ias' as these services have been used by other malware families. When it finds another netsvcs service with a name not matching these two names, it will delete the file associated with the service and copy the 'rastls.dll' file to that folder using '\ve.dll' as the filename as shown in Figure 9 below. [![diplomat 9](http://blog.paloaltonetworks.com/wp-content/uploads/2016/01/diplomat-9-500x644.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/01/diplomat-9.png) *Figure 9 Code enumerating 'netsvcs' services* [![diplomat 10](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/01/diplomat-10.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/01/diplomat-10.png) *Figure 10 Renamed 'rastls.dll' DLL* The malware will then change the binary path of the service to point to this new filename and copies the "Sycmentec.config" file to the same folder and the 'config.dat' file to the following location: *c:\\windows\\system\\CERTAPL.DLL* The NetTraveler payload relies on the 'rastls.dll' file to obtain its C2 server. At first glance, the NetTraveler payload appears as if it will use the following URL for its C2 server: *http://192.168.3\[.\]201/downloader2013/asp/downloader.asp* However, the NetTraveler payload reads the last '0xb0' bytes from the rastls.dll file and uses it to create the "config.dat" file that is later saved to "CERTAPL.DLL". This technique hides the true C2 server from researchers that do not have access to both the rastls.dll and Sycmentec.config files. [![diplomat 11](http://blog.paloaltonetworks.com/wp-content/uploads/2016/01/diplomat-11-500x511.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/01/diplomat-11.png) *Figure 11 Code snippet showing NetTraveler obtaining its configuration from rastls.dll.* The configuration file is structured as an ".ini" file as the Trojan uses GetPrivateProfileStringA to parse the contents. The configuration file has the following contents: \[OOOOOO\] U00P=r^?\<80\>}H\>?\<88\>\<89\>\<8A\>B\<8B\>\<85\>|\<86\>\<87\>\<89\>\<91\>\<8B\>\<90\>\<92\>\<88\>N\<84\>\<91\>\<90\>S\<94\>\<96\>\<9B\>\<8C\>\<8E\>\<9E\>Z\<95\>\<9B\>\<92\>\<94\>\_\<93\>\\ K00P=XLMNOPQRSTUVWXYZ\[\\\]^_\`abcdefghiv P00D=5 F00G=True MM1=0 MM6=1 |---------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 | \[OOOOOO\] U00P=r^?\<80\>}H\>?\<88\>\<89\>\<8A\>B\<8B\>\<85\>|\<86\>\<87\>\<89\>\<91\>\<8B\>\<90\>\<92\>\<88\>N\<84\>\<91\>\<90\>S\<94\>\<96\>\<9B\>\<8C\>\<8E\>\<9E\>Z\<95\>\<9B\>\<92\>\<94\>\_\<93\>\\ K00P=XLMNOPQRSTUVWXYZ\[\\\]^_\`abcdefghiv P00D=5 F00G=True MM1=0 MM6=1 | Unit 42 analyzed the sample and found the following configuration fields that could appear in the CERTAPL.DLL configuration file and a brief description of each field: U00P = C2 URL K00P = Key for DES P00D = Sleep interval in minutes F00G = Boolean to determine if sample should use proxy to communicate with C2 server MM1 = 0 or 1 if proxy is configured or not. MM3 = Port for configured proxy MM4 = Username for configured proxy MM5 = Password for configured proxy MM6 = 1 if Trojan is installed correctly |-------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 | U00P = C2 URL K00P = Key for DES P00D = Sleep interval in minutes F00G = Boolean to determine if sample should use proxy to communicate with C2 server MM1 = 0 or 1 if proxy is configured or not. MM3 = Port for configured proxy MM4 = Username for configured proxy MM5 = Password for configured proxy MM6 = 1 if Trojan is installed correctly | The "U00P" and "K00P" values are decrypted using a simple algorithm that subtracts the index and then subtracts ten from each character, which is depicted in the following: def subtraction\_algo(ct): out = "" i = 0 for e in ct: out += chr(ord(e)-i-10) i += 1 return out |---------------|-------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 | def subtraction\_algo(ct): out = "" i = 0 for e in ct: out += chr(ord(e)-i-10) i += 1 return out | These two fields decrypt to the following, the U00P value being the C2 URL and the K00P value being the basis for an encryption key for the DES algorithm: *U00P: http://www.voennovosti.com/optdet/index.asp (decrypted)* *K00P: NAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAM (decrypted)* The C2 server will respond to requests issued by the Trojan with commands to carry out activities on the compromised system. We analyzed the code within NetTraveler that handles commands issued by the C2 server and found four available commands that are listed in Table 2. |----------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Command** | **Description** | | \:UNINSTALL | Deletes %APPDATA%\\cert2013.dat and %STARTUP%\\consent.lnk and exits the process. This attempts to uninstall the Trojan, but will not work as the filenames are not used by this version of NetTraveler | | \:RUN\_REBOOT | Reboots the system | | \:RUN\_STARTUP | Downloads a file to %TEMP%\\Temp.bmp and copies it to the startup folder | | \:RUN\_DIRECT | Download a file to %TEMP%\\tmp.bmp and execute it | *Table 2 Commands available within NetTraveler and a description of their functionality* ### INFRASTRUCTURE At the time of analysis, the domain voennovosti\[.\]com was resolving to IP '98.126.38\[.\]107', which is hosted by Krypt Technologies. A [report](https://kasperskycontenthub.com/wp-content/uploads/sites/43/vlpdfs/kaspersky-the-net-traveler-part1-final.pdf) published by Kaspersky Labs in 2011 on NetTraveler also mentions the C2 servers were being hosted by Krypt Technolgies. This web hosting service provider continues to be the hosting provider of choice for the threat actors behind NetTraveler. [![diplomat 12](http://blog.paloaltonetworks.com/wp-content/uploads/2016/01/diplomat-12-500x218.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/01/diplomat-12.png) *Figure 12 DNS query for voennovosti\[.\]com resolves to '98.126.38.107'* [![diplomat 13](http://blog.paloaltonetworks.com/wp-content/uploads/2016/01/diplomat-13-500x364.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/01/diplomat-13.png) *Figure 13 Encoded network communications* ### CONCLUSION NetTraveler has been used to target diplomats, embassies and government institutions for over a decade, and remains the tool of choice by the adversaries behind these cyber espionage campaigns. The use of NetTraveler for such a long period of time shows its effectiveness and success by the adversaries in targeting their victims with impunity. As seen in this case, the threat actors continue to evolve and employ new techniques within their modus operandi, like 'DLL side-loading' to install malware. It is likely that the use of 'DLL side loading' attack technique will increase due to it's effectiveness to bypass traditional security systems. It is essential to raise awareness on such attacks to better protect organizations from adversaries who maybe backed by nation states. [WildFire](https://www.paloaltonetworks.com/products/technologies/wildfire.html) correctly classifies NetTraveler as malicious. [AutoFocus](https://www.paloaltonetworks.com/products/platforms/subscriptions/autofocus.html) tags are created to identify NetTraveler samples and respective IOCs are added to Palo Alto Networks [Threat Prevention](https://paloaltonetworks.com/solutions/initiative/threat-prevention.html). ### INDICATORS |------------------------------------------------------------------|-----------------------------------------| | **SHA256 Hash** | **File Name** | | 3f4fcde99775b83bc88d30ca99f5c70c1dd8b96d970dbfd5a846b46c6ea3e534 | 2015.12.11\_сроки СГГ 2015 в Уфе.doc.doc | | 001fff6c09497f56532e83e998aaa80690a668883b6655129d408dd098bd1b4b | DW20.exe | | 74db11900499aa74be9e62d51889e7611eb8161cd141b9379e05eeca9d7175c9 | rastls.dll | | 8f6af103bf7e3201045ce6c2af41f7a17ef671f33f297d36d2aab8640d00b0f0 | Sycmentec.config | | 495bb9c680f114b255f92448e784563e4fd34ad19cf616cc537bec6245931b7e | config.dat | | 41650cb6b4ae9f06c92628208d024845026c19af1ab3916c99c80c6457bd4fa9 | CERTAPL.DLL | | 3b4e4d7a0b1185a45968d90ffe6346f4621116d14dbf88b5138040acc022c757 | (NetTraveler DLL payload) | **Command and Control** voennovosti\[.\]com 98\.126.38\[.\]107 ### REFERENCES * [https://securelist.com/blog/research/35936/nettraveler-is-running-red-star-apt-attacks-compromise-high-profile-victims/](https://securelist.com/blog/research/35936/nettraveler-is-running-red-star-apt-attacks-compromise-high-profile-victims/) * [https://www.fireeye.com/blog/threat-research/2014/04/dll-side-loading-another-blind-spot-for-anti-virus.html](https://www.fireeye.com/blog/threat-research/2014/04/dll-side-loading-another-blind-spot-for-anti-virus.html) * [http://blog.paloaltonetworks.com/2015/05/plugx-uses-legitimate-samsung-application-for-dll-side-loading/](https://blog.paloaltonetworks.com/2015/05/plugx-uses-legitimate-samsung-application-for-dll-side-loading/) * [http://indianexpress.com/article/business/business-others/10-years-on-sco-decides-to-induct-india-as-full-member/](https://indianexpress.com/article/business/business-others/10-years-on-sco-decides-to-induct-india-as-full-member/) * [https://en.wikipedia.org/wiki/Shanghai\_Cooperation\_Organisation](https://en.wikipedia.org/wiki/Shanghai_Cooperation_Organisation) * [http://ufa2015.com/](https://ufa2015.com/) Back to top ### Tags * [NetTraveler](https://unit42.paloaltonetworks.com/tag/nettraveler/ "NetTraveler") * [Spear Phishing](https://unit42.paloaltonetworks.com/tag/spear-phishing/ "Spear Phishing") * [Trojan](https://unit42.paloaltonetworks.com/tag/trojan/ "Trojan") * [Ufa](https://unit42.paloaltonetworks.com/tag/ufa/ "Ufa") * [Ufe](https://unit42.paloaltonetworks.com/tag/ufe/ "Ufe") * [Uzbekistan](https://unit42.paloaltonetworks.com/tag/uzbekistan/ "Uzbekistan") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Using IDAPython to Make Your Life Easier: Part 5](https://unit42.paloaltonetworks.com/using-idapython-to-make-your-life-easier-part-5/ "Using IDAPython to Make Your Life Easier: Part 5") ### Related Articles * [Threat Brief: Widespread Impact of the Axios Supply Chain Attack](https://unit42.paloaltonetworks.com/axios-supply-chain-attack/ "article - table of contents") * [Converging Interests: Analysis of Threat Clusters Targeting a Southeast Asian Government](https://unit42.paloaltonetworks.com/espionage-campaigns-target-se-asian-government-org/ "article - table of contents") * [Threat Brief: Recruiting Scheme Impersonating Palo Alto Networks Talent Acquisition Team](https://unit42.paloaltonetworks.com/phishing-attackers-pose-as-panw-recruiters/ "article - table of contents") ## Related Malware Resources ![Pictorial representation of TLS Certificate compromise. A person typing on a laptop with digital graphics of binary code and light beams emanating from the screen, representing data transfer or cyber activity.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/07_Security-Technology_Category_1920x900-1-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) October 22, 2026 [#### EMudhra Intermediate CA Certificates Compromised](https://unit42.paloaltonetworks.com/emudhra-certificate-compromise/) * [Certificates](https://unit42.paloaltonetworks.com/tag/certificates/ "certificates") * [Compromise](https://unit42.paloaltonetworks.com/tag/compromise/ "Compromise") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/emudhra-certificate-compromise/ "EMudhra Intermediate CA Certificates Compromised") ![](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/AdobeStock_1246251272-2-1-786x369.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) October 21, 2026 [#### "Next Exploit Opportunities": How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities](https://unit42.paloaltonetworks.com/ai-assisted-cybercrime-analysis/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Data exfiltration](https://unit42.paloaltonetworks.com/tag/data-exfiltration/ "data exfiltration") * [DeepSeek](https://unit42.paloaltonetworks.com/tag/deepseek/ "DeepSeek") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-assisted-cybercrime-analysis/ "“Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities") ![Pictorial representation of AI-powered campaign targeting government infrastructure. A glowing, blue, brain-shaped structure floats above a central microchip on a circuit board. The scene is futuristic, with neon lights illuminating the interconnected pathways and components.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/AdobeStock_637057734-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) October 15, 2026 [#### AI-Powered Espionage Campaign Targets Government Linux Infrastructure](https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/) * [Exfiltration](https://unit42.paloaltonetworks.com/tag/exfiltration/ "exfiltration") * [LLM](https://unit42.paloaltonetworks.com/tag/llm/ "LLM") * [Network security](https://unit42.paloaltonetworks.com/tag/network-security/ "network security") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/ "AI-Powered Espionage Campaign Targets Government Linux Infrastructure") ![Pictorial representation of PEERSTITCH, a FortiGate implant. A digital illustration depicting a circuit board with a prominent red warning triangle and exclamation mark in the center. The background is filled with various computer circuitry patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/09_Vulnerabilities_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) October 14, 2026 [#### Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/) * [Apache](https://unit42.paloaltonetworks.com/tag/apache/ "Apache") * [CL-STA-0954](https://unit42.paloaltonetworks.com/tag/cl-sta-0954/ "CL-STA-0954") * [Logging](https://unit42.paloaltonetworks.com/tag/logging/ "logging") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/ "Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant") ![Pictorial representation of operation blinder tunnel. Screen displaying code with a prominent alert symbol and the words 'VIRUS DETECTED' highlighted in red.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/05_Malware_Category_1920x900-1-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) October 6, 2026 [#### Blinder Tunnel Campaign Targets Iraqi Infrastructure](https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/) * [Advanced Persistent Threat](https://unit42.paloaltonetworks.com/tag/advanced-persistent-threat/ "Advanced Persistent Threat") * [Agent Serpens](https://unit42.paloaltonetworks.com/tag/agent-serpens/ "Agent Serpens") * [AppDomainManager](https://unit42.paloaltonetworks.com/tag/appdomainmanager/ "AppDomainManager") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/ "Blinder Tunnel Campaign Targets Iraqi Infrastructure") ![Pictorial representation of how K8 operators betray your security posture. A close-up of a futuristic microchip with glowing circuits in vibrant colors, including blue, purple, and orange, reflecting light.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_652069707-1-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 29, 2026 [#### OperTraitors: How Kubernetes Operators Betray Your Security Posture](https://unit42.paloaltonetworks.com/agentic-ai-kubernetes-operator-risks/) * [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI") * [AI agents](https://unit42.paloaltonetworks.com/tag/ai-agents/ "AI agents") * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/agentic-ai-kubernetes-operator-risks/ "OperTraitors: How Kubernetes Operators Betray Your Security Posture") ![Pictorial representation of a magnifying glass illuminating a glowing orange circular digital circuit interface on a dark, high-tech background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Myth-Busting_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) September 16, 2026 [#### Atomic macOS (AMOS) Stealer Activity](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/) * [MacOS](https://unit42.paloaltonetworks.com/tag/macos/ "macOS") * [Threat intelligence](https://unit42.paloaltonetworks.com/tag/threat-intelligence/ "threat intelligence") * [Unit 42](https://unit42.paloaltonetworks.com/tag/unit-42/ "Unit 42") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/ "Atomic macOS (AMOS) Stealer Activity") ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * Observability * [Cortex XCOR](https://www.paloaltonetworks.com/cortex/xcor) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center-subscribe.html) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)