[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/)  
[![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/)  
Menu

* [Tools](https://unit42.paloaltonetworks.com/tools/)
* [ATOMs](https://unit42.paloaltonetworks.com/atoms/)
* [Security Consulting](https://www.paloaltonetworks.com/unit42)
* [About Us](https://unit42.paloaltonetworks.com/about-unit-42/)
* [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html)
* [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research")
* [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research")
* [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/ "Cybercrime")  
  [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/)

# NetWire and MITRE ChopShop

![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 6 min read

* ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg)  
  By:
  
  * [Phil Da Silva](https://unit42.paloaltonetworks.com/author/phil-da-silva/)

* ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg)  
  Published:August 25, 2014

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg)  
  Categories:
  
  * [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/)
  * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/)

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg)  
  Tags:
  
  * [419 Evolution](https://unit42.paloaltonetworks.com/tag/419-evolution/)
  * [419 Scam](https://unit42.paloaltonetworks.com/tag/419-scam/)
  * [ChopShop](https://unit42.paloaltonetworks.com/tag/chopshop/)
  * [MITRE](https://unit42.paloaltonetworks.com/tag/mitre/)
  * [NetWire](https://unit42.paloaltonetworks.com/tag/netwire/)
  * [Research](https://unit42.paloaltonetworks.com/tag/research/)
  * [Tool](https://unit42.paloaltonetworks.com/tag/tool/)

* [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/netwire-mitre-chopshop/?pdf=download&lg=en&_wpnonce=f6e4b1f2e6 "Click here to download")

* [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/netwire-mitre-chopshop/?pdf=print&lg=en&_wpnonce=f6e4b1f2e6 "Click here to print")

Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg)

* ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg)
* [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=NetWire%20and%20MITRE%20ChopShop&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fnetwire-mitre-chopshop%2F "Share in email")
* [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnetwire-mitre-chopshop%2F "Share in Facebook")
* [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnetwire-mitre-chopshop%2F&title=NetWire%20and%20MITRE%20ChopShop "Share in LinkedIn")
* [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnetwire-mitre-chopshop%2F&text=NetWire%20and%20MITRE%20ChopShop "Share in Twitter")
* [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnetwire-mitre-chopshop%2F&ts=markdown "Share in Reddit")
* [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=NetWire%20and%20MITRE%20ChopShop%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fnetwire-mitre-chopshop%2F "Share in Mastodon")
  On August 4, Unit 42, the Palo Alto Networks threat intelligence team, released a tool to decrypt the traffic from a Remote Administration Tool (RAT) named NetWire (part of the NetWiredRC malware family). For details of the encryption protocol used please see our earlier post [here](https://blog.paloaltonetworks.com/2014/08/new-release-decrypting-netwire-c2-traffic/).

The previously released protocol decoder and parser was originally built as a stand-alone module. As part of Unit 42's mission to contribute to the security community, we have developed, and are releasing today, a version of the NetWire decryption tool that works within [ChopShop](https://github.com/MITRECND/chopshop), a great open source tool from MITRE that provides a framework for protocol analysis. To use the tool, simply grab the *public\_tools* repo from the Unit 42 GitHub [repository](https://github.com/pan-unit42/public_tools). Be sure to point your ChopShop command to that directory using the -M flag.

We hope that this integration of the decryptor tool with ChopShop will provide value to incident responders and security researchers.

**Usage**

$ chopshop -M \<netwire chopshop directory\> -f \<pcap file\> "host 192.168.180.80 and port 2930" "netwire"

**Example Output**

Starting ChopShop  
Initializing Modules ...  
Initializing module 'netwire'  
Running Modules ...  
\[2014-05-06 18:33:52 PDT\] --------------------------------  
\[2014-05-06 18:33:52 PDT\] addr: (('192.168.180.80', 49157), ('69.65.7.136', 2930))  
\[2014-05-06 18:33:52 PDT\] Server Count: 69  
\[2014-05-06 18:33:52 PDT\] Client Count: 0  
\[2014-05-06 18:33:52 PDT\] Server offset: 0  
\[2014-05-06 18:33:52 PDT\] Client offset: 0  
\[2014-05-06 18:33:52 PDT\]  
\[2014-05-06 18:33:52 PDT\] Client Key Generated  
\[2014-05-06 18:33:52 PDT\]  
\[2014-05-06 18:33:54 PDT\] --------------------------------  
\[2014-05-06 18:33:54 PDT\] addr: (('192.168.180.80', 49157), ('69.65.7.136', 2930))  
\[2014-05-06 18:33:54 PDT\] Server Count: 0  
\[2014-05-06 18:33:54 PDT\] Client Count: 69  
\[2014-05-06 18:33:54 PDT\] Server offset: 69  
\[2014-05-06 18:33:54 PDT\] Client offset: 0  
\[2014-05-06 18:33:54 PDT\]  
\[2014-05-06 18:33:54 PDT\] Server Key Generated  
\[2014-05-06 18:33:54 PDT\]  
\[2014-05-06 18:33:54 PDT\] --------------------------------  
\[2014-05-06 18:33:54 PDT\] addr: (('192.168.180.80', 49157), ('69.65.7.136', 2930))  
\[2014-05-06 18:33:54 PDT\] Server Count: 69  
\[2014-05-06 18:33:54 PDT\] Client Count: 0  
\[2014-05-06 18:33:54 PDT\] Server offset: 69  
\[2014-05-06 18:33:54 PDT\] Client offset: 69  
\[2014-05-06 18:33:54 PDT\]  
\[2014-05-06 18:33:54 PDT\] client -\> server  
\[2014-05-06 18:33:54 PDT\] Command: 05 =\> set password, identifier and fetch computer information such as user, computername, windows version  
\[2014-05-06 18:33:54 PDT\] Payload: '\\x0101056300RENEWAL\\x07Administrator @ John-PC\\x0718\\x072014-05-07 08:33:50\\x07\\x08\>"(Cks\\x00E\\x1a\\xfe\\xd9\\x88}\\xdc9'

\[2014-05-06 18:34:02 PDT\] --------------------------------  
\[2014-05-06 18:34:02 PDT\] addr: (('192.168.180.80', 49157), ('69.65.7.136', 2930))  
\[2014-05-06 18:34:02 PDT\] Server Count: 0  
\[2014-05-06 18:34:02 PDT\] Client Count: 5  
\[2014-05-06 18:34:02 PDT\] Server offset: 138  
\[2014-05-06 18:34:02 PDT\] Client offset: 69  
\[2014-05-06 18:34:02 PDT\]  
\[2014-05-06 18:34:02 PDT\] client -\> server  
\[2014-05-06 18:34:02 PDT\] Command: 01 =\> heartbeat  
\[2014-05-06 18:34:02 PDT\] Payload: ''

\[2014-05-06 18:34:02 PDT\] --------------------------------  
\[2014-05-06 18:34:02 PDT\] addr: (('192.168.180.80', 49157), ('69.65.7.136', 2930))  
\[2014-05-06 18:34:02 PDT\] Server Count: 5  
\[2014-05-06 18:34:02 PDT\] Client Count: 0  
\[2014-05-06 18:34:02 PDT\] Server offset: 138  
\[2014-05-06 18:34:02 PDT\] Client offset: 74  
\[2014-05-06 18:34:02 PDT\]  
\[2014-05-06 18:34:02 PDT\] client -\> server  
\[2014-05-06 18:34:02 PDT\] Command: 01 =\> heartbeat  
\[2014-05-06 18:34:02 PDT\] Payload: ''  
\[2014-05-06 18:34:12 PDT\] --------------------------------

\[2014-05-06 18:34:12 PDT\] addr: (('192.168.180.80', 49157), ('69.65.7.136', 2930))  
\[2014-05-06 18:34:12 PDT\] Server Count: 5  
\[2014-05-06 18:34:12 PDT\] Client Count: 0  
\[2014-05-06 18:34:12 PDT\] Server offset: 143  
\[2014-05-06 18:34:12 PDT\] Client offset: 74  
\[2014-05-06 18:34:12 PDT\]  
\[2014-05-06 18:34:12 PDT\] client -\> server  
\[2014-05-06 18:34:12 PDT\] Command: 02 =\> Socket created  
\[2014-05-06 18:34:12 PDT\] Payload: ''

\[2014-05-06 18:34:13 PDT\] --------------------------------  
\[2014-05-06 18:34:13 PDT\] addr: (('192.168.180.80', 49157), ('69.65.7.136', 2930))  
\[2014-05-06 18:34:13 PDT\] Server Count: 0  
\[2014-05-06 18:34:13 PDT\] Client Count: 5  
\[2014-05-06 18:34:13 PDT\] Server offset: 148  
\[2014-05-06 18:34:13 PDT\] Client offset: 74  
\[2014-05-06 18:34:13 PDT\]  
\[2014-05-06 18:34:13 PDT\] client -\> server  
\[2014-05-06 18:34:13 PDT\] Command: 01 =\> heartbeat  
\[2014-05-06 18:34:13 PDT\] Payload: ''

\[2014-05-06 18:34:13 PDT\] --------------------------------  
\[2014-05-06 18:34:13 PDT\] addr: (('192.168.180.80', 49157), ('69.65.7.136', 2930))  
\[2014-05-06 18:34:13 PDT\] Server Count: 5  
\[2014-05-06 18:34:13 PDT\] Client Count: 0  
\[2014-05-06 18:34:13 PDT\] Server offset: 148  
\[2014-05-06 18:34:13 PDT\] Client offset: 79  
\[2014-05-06 18:34:13 PDT\]  
\[2014-05-06 18:34:13 PDT\] client -\> server  
\[2014-05-06 18:34:13 PDT\] Command: 01 =\> heartbeat  
\[2014-05-06 18:34:13 PDT\] Payload: ''

\[2014-05-06 18:34:19 PDT\] --------------------------------  
\[2014-05-06 18:34:19 PDT\] addr: (('192.168.180.80', 49157), ('69.65.7.136', 2930))  
\[2014-05-06 18:34:19 PDT\] Server Count: 0  
\[2014-05-06 18:34:19 PDT\] Client Count: 5  
\[2014-05-06 18:34:19 PDT\] Server offset: 153  
\[2014-05-06 18:34:19 PDT\] Client offset: 79  
\[2014-05-06 18:34:19 PDT\]  
\[2014-05-06 18:34:19 PDT\] client -\> server  
\[2014-05-06 18:34:19 PDT\] Command: 41 =\> fetch and send mail Outlook, Thunderbird credentials and certificates  
\[2014-05-06 18:34:19 PDT\] Payload: ''

\[2014-05-06 18:34:19 PDT\] --------------------------------  
\[2014-05-06 18:34:19 PDT\] addr: (('192.168.180.80', 49157), ('69.65.7.136', 2930))  
\[2014-05-06 18:34:19 PDT\] Server Count: 5  
\[2014-05-06 18:34:19 PDT\] Client Count: 0  
\[2014-05-06 18:34:19 PDT\] Server offset: 153  
\[2014-05-06 18:34:19 PDT\] Client offset: 84  
\[2014-05-06 18:34:19 PDT\]  
\[2014-05-06 18:34:19 PDT\] client -\> server  
\[2014-05-06 18:34:19 PDT\] Command: 41 =\> fetch and send mail Outlook, Thunderbird credentials and certificates  
\[2014-05-06 18:34:19 PDT\] Payload: ''

\[2014-05-06 18:34:26 PDT\] --------------------------------  
\[2014-05-06 18:34:26 PDT\] addr: (('192.168.180.80', 49157), ('69.65.7.136', 2930))  
\[2014-05-06 18:34:26 PDT\] Server Count: 0  
\[2014-05-06 18:34:26 PDT\] Client Count: 5  
\[2014-05-06 18:34:26 PDT\] Server offset: 158  
\[2014-05-06 18:34:26 PDT\] Client offset: 84  
\[2014-05-06 18:34:26 PDT\]  
\[2014-05-06 18:34:26 PDT\] client -\> server  
\[2014-05-06 18:34:26 PDT\] Command: 3d =\> fetch and send stored credentials, history and certificates from common browsers  
\[2014-05-06 18:34:26 PDT\] Payload: ''

\[2014-05-06 18:34:26 PDT\] --------------------------------  
\[2014-05-06 18:34:26 PDT\] addr: (('192.168.180.80', 49157), ('69.65.7.136', 2930))  
\[2014-05-06 18:34:26 PDT\] Server Count: 5  
\[2014-05-06 18:34:26 PDT\] Client Count: 0  
\[2014-05-06 18:34:26 PDT\] Server offset: 158  
\[2014-05-06 18:34:26 PDT\] Client offset: 89  
\[2014-05-06 18:34:26 PDT\]  
\[2014-05-06 18:34:26 PDT\] client -\> server  
\[2014-05-06 18:34:26 PDT\] Command: 3d =\> fetch and send stored credentials, history and certificates from common browsers  
\[2014-05-06 18:34:26 PDT\] Payload: ''

\[2014-05-06 18:34:29 PDT\] --------------------------------  
\[2014-05-06 18:34:29 PDT\] addr: (('192.168.180.80', 49157), ('69.65.7.136', 2930))  
\[2014-05-06 18:34:29 PDT\] Server Count: 0  
\[2014-05-06 18:34:29 PDT\] Client Count: 5  
\[2014-05-06 18:34:29 PDT\] Server offset: 163  
\[2014-05-06 18:34:29 PDT\] Client offset: 89  
\[2014-05-06 18:34:29 PDT\]  
\[2014-05-06 18:34:29 PDT\] client -\> server  
\[2014-05-06 18:34:29 PDT\] Command: 01 =\> heartbeat  
\[2014-05-06 18:34:29 PDT\] Payload: ''

\[2014-05-06 18:34:29 PDT\] --------------------------------  
\[2014-05-06 18:34:29 PDT\] addr: (('192.168.180.80', 49157), ('69.65.7.136', 2930))  
\[2014-05-06 18:34:29 PDT\] Server Count: 5  
\[2014-05-06 18:34:29 PDT\] Client Count: 0  
\[2014-05-06 18:34:29 PDT\] Server offset: 163  
\[2014-05-06 18:34:29 PDT\] Client offset: 94  
\[2014-05-06 18:34:29 PDT\]  
\[2014-05-06 18:34:29 PDT\] client -\> server  
\[2014-05-06 18:34:29 PDT\] Command: 01 =\> heartbeat  
\[2014-05-06 18:34:29 PDT\] Payload: ''

\[2014-05-06 18:34:39 PDT\] --------------------------------  
\[2014-05-06 18:34:39 PDT\] addr: (('192.168.180.80', 49157), ('69.65.7.136', 2930))  
\[2014-05-06 18:34:39 PDT\] Server Count: 5  
\[2014-05-06 18:34:39 PDT\] Client Count: 0  
\[2014-05-06 18:34:39 PDT\] Server offset: 168  
\[2014-05-06 18:34:39 PDT\] Client offset: 94  
\[2014-05-06 18:34:39 PDT\]  
\[2014-05-06 18:34:39 PDT\] client -\> server  
\[2014-05-06 18:34:39 PDT\] Command: 02 =\> Socket created  
\[2014-05-06 18:34:39 PDT\] Payload: ''

\[2014-05-06 18:34:39 PDT\] --------------------------------  
\[2014-05-06 18:34:39 PDT\] addr: (('192.168.180.80', 49157), ('69.65.7.136', 2930))  
\[2014-05-06 18:34:39 PDT\] Server Count: 0  
\[2014-05-06 18:34:39 PDT\] Client Count: 5  
\[2014-05-06 18:34:39 PDT\] Server offset: 173  
\[2014-05-06 18:34:39 PDT\] Client offset: 94  
\[2014-05-06 18:34:39 PDT\]  
\[2014-05-06 18:34:39 PDT\] client -\> server  
\[2014-05-06 18:34:39 PDT\] Command: 01 =\> heartbeat  
\[2014-05-06 18:34:39 PDT\] Payload: ''

\[2014-05-06 18:34:39 PDT\] --------------------------------  
\[2014-05-06 18:34:39 PDT\] addr: (('192.168.180.80', 49157), ('69.65.7.136', 2930))  
\[2014-05-06 18:34:39 PDT\] Server Count: 5  
\[2014-05-06 18:34:39 PDT\] Client Count: 0  
\[2014-05-06 18:34:39 PDT\] Server offset: 173  
\[2014-05-06 18:34:39 PDT\] Client offset: 99  
\[2014-05-06 18:34:39 PDT\]  
\[2014-05-06 18:34:39 PDT\] client -\> server  
\[2014-05-06 18:34:39 PDT\] Command: 01 =\> heartbeat  
\[2014-05-06 18:34:39 PDT\] Payload: ''

\[2014-05-06 18:34:49 PDT\] --------------------------------  
\[2014-05-06 18:34:49 PDT\] addr: (('192.168.180.80', 49157), ('69.65.7.136', 2930))  
\[2014-05-06 18:34:49 PDT\] Server Count: 5  
\[2014-05-06 18:34:49 PDT\] Client Count: 0  
\[2014-05-06 18:34:49 PDT\] Server offset: 178  
\[2014-05-06 18:34:49 PDT\] Client offset: 99  
\[2014-05-06 18:34:49 PDT\]  
\[2014-05-06 18:34:49 PDT\] client -\> server  
\[2014-05-06 18:34:49 PDT\] Command: 02 =\> Socket created  
\[2014-05-06 18:34:49 PDT\] Payload: ''

\[2014-05-06 18:34:51 PDT\] --------------------------------  
\[2014-05-06 18:34:51 PDT\] addr: (('192.168.180.80', 49157), ('69.65.7.136', 2930))  
\[2014-05-06 18:34:51 PDT\] Server Count: 0  
\[2014-05-06 18:34:51 PDT\] Client Count: 5  
\[2014-05-06 18:34:51 PDT\] Server offset: 183  
\[2014-05-06 18:34:51 PDT\] Client offset: 99  
\[2014-05-06 18:34:51 PDT\]  
\[2014-05-06 18:34:51 PDT\] client -\> server  
\[2014-05-06 18:34:51 PDT\] Command: 01 =\> heartbeat  
\[2014-05-06 18:34:51 PDT\] Payload: ''

\[2014-05-06 18:34:51 PDT\] --------------------------------  
\[2014-05-06 18:34:51 PDT\] addr: (('192.168.180.80', 49157), ('69.65.7.136', 2930))  
\[2014-05-06 18:34:51 PDT\] Server Count: 5  
\[2014-05-06 18:34:51 PDT\] Client Count: 0  
\[2014-05-06 18:34:51 PDT\] Server offset: 183  
\[2014-05-06 18:34:51 PDT\] Client offset: 104  
\[2014-05-06 18:34:51 PDT\]  
\[2014-05-06 18:34:51 PDT\] client -\> server  
\[2014-05-06 18:34:51 PDT\] Command: 01 =\> heartbeat  
\[2014-05-06 18:34:51 PDT\] Payload: ''

\[2014-05-06 18:35:01 PDT\] --------------------------------  
\[2014-05-06 18:35:01 PDT\] addr: (('192.168.180.80', 49157), ('69.65.7.136', 2930))  
\[2014-05-06 18:35:01 PDT\] Server Count: 5  
\[2014-05-06 18:35:01 PDT\] Client Count: 0  
\[2014-05-06 18:35:01 PDT\] Server offset: 188  
\[2014-05-06 18:35:01 PDT\] Client offset: 104  
\[2014-05-06 18:35:01 PDT\]  
\[2014-05-06 18:35:01 PDT\] client -\> server  
\[2014-05-06 18:35:01 PDT\] Command: 02 =\> Socket created  
\[2014-05-06 18:35:01 PDT\] Payload: ''

\[2014-05-06 18:35:02 PDT\] --------------------------------  
\[2014-05-06 18:35:02 PDT\] addr: (('192.168.180.80', 49157), ('69.65.7.136', 2930))  
\[2014-05-06 18:35:02 PDT\] Server Count: 0  
\[2014-05-06 18:35:02 PDT\] Client Count: 5  
\[2014-05-06 18:35:02 PDT\] Server offset: 193  
\[2014-05-06 18:35:02 PDT\] Client offset: 104  
\[2014-05-06 18:35:02 PDT\]  
\[2014-05-06 18:35:02 PDT\] client -\> server  
\[2014-05-06 18:35:02 PDT\] Command: 01 =\> heartbeat  
\[2014-05-06 18:35:02 PDT\] Payload: ''

\[2014-05-06 18:35:02 PDT\] --------------------------------  
\[2014-05-06 18:35:02 PDT\] addr: (('192.168.180.80', 49157), ('69.65.7.136', 2930))  
\[2014-05-06 18:35:02 PDT\] Server Count: 5  
\[2014-05-06 18:35:02 PDT\] Client Count: 0  
\[2014-05-06 18:35:02 PDT\] Server offset: 193  
\[2014-05-06 18:35:02 PDT\] Client offset: 109  
\[2014-05-06 18:35:02 PDT\]  
\[2014-05-06 18:35:02 PDT\] client -\> server  
\[2014-05-06 18:35:02 PDT\] Command: 01 =\> heartbeat  
\[2014-05-06 18:35:02 PDT\] Payload: ''

Shutting Down Modules ...  
Shutting Down NetWire  
Module Shutdown Complete ...  
ChopShop Complete

Back to top

### Tags

* [419 Evolution](https://unit42.paloaltonetworks.com/tag/419-evolution/ "419 Evolution")
* [419 Scam](https://unit42.paloaltonetworks.com/tag/419-scam/ "419 Scam")
* [ChopShop](https://unit42.paloaltonetworks.com/tag/chopshop/ "ChopShop")
* [MITRE](https://unit42.paloaltonetworks.com/tag/mitre/ "MITRE")
* [NetWire](https://unit42.paloaltonetworks.com/tag/netwire/ "NetWire")
* [Research](https://unit42.paloaltonetworks.com/tag/research/ "Research")
* [Tool](https://unit42.paloaltonetworks.com/tag/tool/ "Tool")  
  [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Pivot on Google Code C2 Reveals Additional Malware](https://unit42.paloaltonetworks.com/pivot-google-code-c2-reveals-additional-malware/ "Pivot on Google Code C2 Reveals Additional Malware")

### Related Articles

* [Paved With Intent: ROADtools and Nation-State Tactics in the Cloud](https://unit42.paloaltonetworks.com/roadtools-cloud-attacks/ "article - table of contents")
* [Novel Technique to Detect Cloud Threat Actor Operations](https://unit42.paloaltonetworks.com/tracking-threat-groups-through-cloud-logging/ "article - table of contents")
* [Muddled Libra Threat Assessment: Further-Reaching, Faster, More Impactful](https://unit42.paloaltonetworks.com/muddled-libra/ "article - table of contents")

## Related Cybercrime Resources

![Pictorial representation of Russian global webmail espionage campaign. A digital illustration of a world map in a network style, highlighting continents with glowing lines and connectivity points in a red and blue theme.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/06_Nation-State-cyberattacks_1920x900-1-786x368.jpg)  
[![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) July 23, 2026 [#### Russian Global Webmail Espionage](https://unit42.paloaltonetworks.com/russian-webmail-espionage/)

* [CL-STA-1114](https://unit42.paloaltonetworks.com/tag/cl-sta-1114/ "CL-STA-1114")

* [JavaScript](https://unit42.paloaltonetworks.com/tag/javascript/ "JavaScript")

* [Javascript injection](https://unit42.paloaltonetworks.com/tag/javascript-injection/ "javascript injection")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/russian-webmail-espionage/ "Russian Global Webmail Espionage")  
  ![Pictorial representation of a woman standing in a server room holding a laptop that projects a digital code overlay.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/06_Security-Technology_Category_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) May 28, 2026 [#### 2026 World Cup: Discussing The World's Biggest Game's Attack Surface](https://unit42.paloaltonetworks.com/fifa-world-cup-attack-surface/)

* [Fiddling Scorpius](https://unit42.paloaltonetworks.com/tag/fiddling-scorpius/ "Fiddling Scorpius")

* [Fighting Ursa](https://unit42.paloaltonetworks.com/tag/fighting-ursa/ "Fighting Ursa")

* [Muddled Libra](https://unit42.paloaltonetworks.com/tag/muddled-libra/ "Muddled Libra")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/fifa-world-cup-attack-surface/ "2026 World Cup: Discussing The World’s Biggest Game’s Attack Surface")  
  ![Pictoral representation of a man holding a cellphone with a bokeh skyline in the background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/05_Listicle_Category_1505x922-718x440.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) May 27, 2026 [#### Out of the Crypt: The Evolving Cyber Extortion Economy](https://unit42.paloaltonetworks.com/cyber-extortion-economy/)

* [Bling Libra](https://unit42.paloaltonetworks.com/tag/bling-libra/ "Bling Libra")

* [Extortion](https://unit42.paloaltonetworks.com/tag/extortion/ "Extortion")

* [Frontier AI](https://unit42.paloaltonetworks.com/tag/frontier-ai/ "Frontier AI")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/cyber-extortion-economy/ "Out of the Crypt: The Evolving Cyber Extortion Economy")  
  ![Pictorial representation of the APT Boggy Serpens. An illustrated blue snake is highlighted by a red circle against a night sky. The constellation serpens.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/Boggy-Serpens-1920x900-1-786x368.png)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) March 16, 2026 [#### Boggy Serpens Threat Assessment](https://unit42.paloaltonetworks.com/boggy-serpens-threat-assessment/)

* [Advanced Persistent Threat](https://unit42.paloaltonetworks.com/tag/advanced-persistent-threat/ "Advanced Persistent Threat")

* [Boggy Serpens](https://unit42.paloaltonetworks.com/tag/boggy-serpens/ "Boggy Serpens")

* [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/boggy-serpens-threat-assessment/ "Boggy Serpens Threat Assessment")  
  ![Pictorial representation of Muddled Libra, aka Scattered Spider. A vibrant illustration of the Libra zodiac sign, featuring a stylized balance scale overlaid with a prominent Libra symbol. The background is a starry night sky with shades of purple and blue, suggesting a cosmic theme.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/03-1-Muddle-Libra-1920x900-1-786x368.png)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/threat-actor-groups.svg)Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/) February 10, 2026 [#### A Peek Into Muddled Libra's Operational Playbook](https://unit42.paloaltonetworks.com/muddled-libra-ops-playbook/)

* [Muddled Libra](https://unit42.paloaltonetworks.com/tag/muddled-libra/ "Muddled Libra")

* [PowerShell](https://unit42.paloaltonetworks.com/tag/powershell/ "PowerShell")

* [Scattered Spider](https://unit42.paloaltonetworks.com/tag/scattered-spider/ "Scattered Spider")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/muddled-libra-ops-playbook/ "A Peek Into Muddled Libra’s Operational Playbook")  
  ![Pictorial representation of a group of individuals discussing an idea with a whiteboard.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/02_Listicle_Overview_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) February 3, 2026 [#### Why Smart People Fall For Phishing Attacks](https://unit42.paloaltonetworks.com/psychology-of-phishing/)

* [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI")

* [Phishing](https://unit42.paloaltonetworks.com/tag/phishing/ "phishing")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/psychology-of-phishing/ "Why Smart People Fall For Phishing Attacks")  
  ![Pictorial representation of threat groups from Russia. The silhouette of a bear and the Ursa constellation inside an orange abstract planet. Abstract, stylized cosmic setting with vibrant blue and purple shapes, representing space and distant planetary bodies.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/01/Ursa-Russia-B-1920x900-1-786x368.png)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) January 29, 2026 [#### Understanding the Russian Cyberthreat to the 2026 Winter Olympics](https://unit42.paloaltonetworks.com/russian-cyberthreat-2026-winter-olympics/)

* [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI")

* [IoT](https://unit42.paloaltonetworks.com/tag/iot/ "IoT")

* [Russia](https://unit42.paloaltonetworks.com/tag/russia/ "Russia")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/russian-cyberthreat-2026-winter-olympics/ "Understanding the Russian Cyberthreat to the 2026 Winter Olympics")  
  ![Pictorial representation of 01flip ransomware written in Rust. Digital artwork of a pixelated U.S. dollar bill disintegrating into small blocks against a blue data matrix background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/12/05_Ransomware_Category_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) December 10, 2025 [#### 01flip: Multi-Platform Ransomware Written in Rust](https://unit42.paloaltonetworks.com/new-ransomware-01flip-written-in-rust/)

* [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin")

* [CL-CRI-103](https://unit42.paloaltonetworks.com/tag/cl-cri-103/ "CL-CRI-103")

* [Cryptocurrency](https://unit42.paloaltonetworks.com/tag/cryptocurrency/ "Cryptocurrency")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/new-ransomware-01flip-written-in-rust/ "01flip: Multi-Platform Ransomware Written in Rust")  
  ![Pictorial representation of malicious LLMs. Close-up view of a digital wall displaying various glowing icons, representing a high-tech network interface.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/11/AdobeStock_1270203474-786x440.jpeg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) November 25, 2025 [#### The Dual-Use Dilemma of AI: Malicious LLMs](https://unit42.paloaltonetworks.com/dilemma-of-ai-malicious-llms/)

* [Credential Harvesting](https://unit42.paloaltonetworks.com/tag/credential-harvesting/ "Credential Harvesting")

* [Data exfiltration](https://unit42.paloaltonetworks.com/tag/data-exfiltration/ "data exfiltration")

* [LLM](https://unit42.paloaltonetworks.com/tag/llm/ "LLM")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/dilemma-of-ai-malicious-llms/ "The Dual-Use Dilemma of AI: Malicious LLMs")  
  ![Pictorial representation of Gh0st RAT malware. A woman analyzes code on a computer screen in an office setting, with another individual working in the background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/11/04_Security-Technology_Category_1505x922-718x440.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) November 14, 2025 [#### Digital Doppelgangers: Anatomy of Evolving Impersonation Campaigns Distributing Gh0st RAT](https://unit42.paloaltonetworks.com/impersonation-campaigns-deliver-gh0st-rat/)

* [DLL Sideloading](https://unit42.paloaltonetworks.com/tag/dll-sideloading/ "DLL Sideloading")

* [Gh0st Rat](https://unit42.paloaltonetworks.com/tag/gh0st-rat/ "Gh0st Rat")

* [PDNS](https://unit42.paloaltonetworks.com/tag/pdns/ "PDNS")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/impersonation-campaigns-deliver-gh0st-rat/ "Digital Doppelgangers: Anatomy of Evolving Impersonation Campaigns Distributing Gh0st RAT")

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)  
  ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]()  
  ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png)  
  ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42

## Peace of mind comes from staying ahead of threats. Subscribe today.

Your Email

Subscribe for email updates to all Unit 42 threat research.  
By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement")

This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.

Invalid captcha!
Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg)  
{#footer} Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security)

* [Secure AI by Design](https://www.paloaltonetworks.com/ai-security)

* [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase)

* [Prisma SASE](https://www.paloaltonetworks.com/sase)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam)

* [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira)

* [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management)

* [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management)

* [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager)

* [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance)

* [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management)

* [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic)

* [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management)

* [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance)

* [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery)

* [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42)

* [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense)

* [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses)

* [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy)

* [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence)

* [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond)  
  Company

* [About Us](https://www.paloaltonetworks.com/about-us)

* [Careers](https://jobs.paloaltonetworks.com/en/)

* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales)

* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility)

* [Customers](https://www.paloaltonetworks.com/customers)

* [Investor Relations](https://investors.paloaltonetworks.com/)

* [Location](https://www.paloaltonetworks.com/about-us/locations)

* [Newsroom](https://www.paloaltonetworks.com/company/newsroom)  
  Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/)

* [Communities](https://www.paloaltonetworks.com/communities)

* [Content Library](https://www.paloaltonetworks.com/resources)

* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia)

* [Event Center](https://events.paloaltonetworks.com/)

* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)

* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z)

* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications)

* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure)

* [Sitemap](https://www.paloaltonetworks.com/sitemap)

* [Tech Docs](https://docs.paloaltonetworks.com/)

* [Unit 42](https://unit42.paloaltonetworks.com/)

* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)

* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy)

* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center)

* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use)

* [Documents](https://www.paloaltonetworks.com/legal)

Copyright © 2026 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* EN  
  Select your language  
  ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg)

### Default Heading

Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg)  
Seekbar

![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg)  
![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg)  
Volume
![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)