[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # New Malware 'Rover' Targets Indian Ambassador to Afghanistan ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 7 min read * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Vicky Ray](https://unit42.paloaltonetworks.com/author/vicky-khan/) * [Kaoru Hayashi](https://unit42.paloaltonetworks.com/author/kaoru-hayashi/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:February 29, 2016 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [OpenAL](https://unit42.paloaltonetworks.com/tag/openal/) * [OpenCV](https://unit42.paloaltonetworks.com/tag/opencv/) * [Rover](https://unit42.paloaltonetworks.com/tag/rover/) * [Trojan](https://unit42.paloaltonetworks.com/tag/trojan/) * [VirusTotal](https://unit42.paloaltonetworks.com/tag/virustotal/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/new-malware-rover-targets-indian-ambassador-to-afghanistan/?pdf=download&lg=en&_wpnonce=614a722d38 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/new-malware-rover-targets-indian-ambassador-to-afghanistan/?pdf=print&lg=en&_wpnonce=614a722d38 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=New%20Malware%20'Rover'%20Targets%20Indian%20Ambassador%20to%20Afghanistan&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fnew-malware-rover-targets-indian-ambassador-to-afghanistan%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnew-malware-rover-targets-indian-ambassador-to-afghanistan%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnew-malware-rover-targets-indian-ambassador-to-afghanistan%2F&title=New%20Malware%20'Rover'%20Targets%20Indian%20Ambassador%20to%20Afghanistan "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnew-malware-rover-targets-indian-ambassador-to-afghanistan%2F&text=New%20Malware%20'Rover'%20Targets%20Indian%20Ambassador%20to%20Afghanistan "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnew-malware-rover-targets-indian-ambassador-to-afghanistan%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=New%20Malware%20'Rover'%20Targets%20Indian%20Ambassador%20to%20Afghanistan%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fnew-malware-rover-targets-indian-ambassador-to-afghanistan%2F "Share in Mastodon") On December 24, 2015, Unit 42 identified a targeted attack, delivered via email, on a high profile Indian diplomat, an Ambassador to Afghanistan. The body and content of the email suggest that it was crafted and spoofed to look like it was sent by the current Defence Minister of India, Mr. Manohar Parrikar, commending the Ambassador on his contributions and success. India has been a key nation in building and funding Afghanistan's infrastructure and economic development, which includes setting up iron ore mines, steel plants, power plants and transportation systems, helping reconstruct the Salma Dam and constructing a new [Parliament Complex](https://en.wikipedia.org/wiki/Afghanistan%E2%80%93India_relations) for the Afghan Government. Given [India's significant contributions](https://en.wikipedia.org/wiki/Afghanistan%E2%80%93India_relations) to the development of Afghanistan, it is likely that there may be groups or nations who would be interested in tracking and spying on key individuals who officially represent India in Afghanistan. ### Overview of Rover infection Figure 1 gives an overview of the exploitation, infection and C2 communications of the 'Rover' Trojan campaign targeting a victim running Windows XP. [![Indian Ambassador 1](http://blog.paloaltonetworks.com/wp-content/uploads/2016/02/Indian-Ambassador-1-500x343.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/02/Indian-Ambassador-1.png) Figure 1: Overview of the infection flow and C2 communications Rover Trojan Infection Steps: 1. RTF file exploits CVE-2010-3333 and downloads an executable from newsumbrella\[.\]net. 2. The executable file downloaded from newsumbrella\[.\]net is executed on the victim machine. 3. The executable '*file.exe* ' is a downloader which is used to call out to a server with the IP '*46.166.165.254*' and download the main Rover malware along with plugins used by the Rover malware. 4. Rover malware and plugins are downloaded and installed on the victim machine. 5. Data exfiltrated from the victim machine. ### Targeting and Infection Figure 2 shows an email which was sent to the Ambassador of India, appearing to commend the contributions the Ambassador has made in the development and success of projects on national interest, and attaching a letter of appreciation with a file name, "Appreciation\_letter.doc". The attachment is an RTF file which exploits a specific vulnerability in Microsoft Word, CVE-2010-3333. [![Indian Ambassador 2](http://blog.paloaltonetworks.com/wp-content/uploads/2016/02/Indian-Ambassador-2-500x577.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/02/Indian-Ambassador-2.png) Figure 2: Spear phishing email sent to the Ambassador of Afghanistan If the recipient of the e-mail opened the attachment in a vulnerable version of Word, the exploit code would download and execute a file from the domain *newsumbrella\[.\]net* as shown in Figure 3 below. [![Indian Ambassador 3](http://blog.paloaltonetworks.com/wp-content/uploads/2016/02/Indian-Ambassador-3-500x127.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/02/Indian-Ambassador-3.png) Figure 3: Hexdump showing the domain and the executable downloaded ### Malware Analysis During the time of analysis the executable file *systemupdateAPI.exe* was no longer being hosted on the newsumbrealla\[.\]net domain. However, we have noticed the same domain hosting another executable in the past within the same parent directory and having a similar naming for the folders as shown below *newsumbrella\[.\]net/ne3s/lat3st/w0rld/systemupdateAPI\[.\]exe* *newsumbrella\[.\]net/ne3s/file\[.\]exe -- hosted earlier* We believe that the executables hosted under the parent directory 'ne3s' are variants of the same downloader Trojan, which was used to download the Rover Trojan. The file, *file.exe,* contains the following debug information that indicates the file was originally named *systemupdateAPI.exe*. [![Indian Ambassador 4](http://blog.paloaltonetworks.com/wp-content/uploads/2016/02/Indian-Ambassador-42-500x97.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/02/Indian-Ambassador-42.png) Figure 4: Debug information of downloader program By analyzing file.exe, we can see that it is a downloader, which creates '*c:\\system*' directory and depending on the OS version used, downloads the main Rover payload along with multiple DLL modules from 46.166.165.254. [![Indian Ambassador 5](http://blog.paloaltonetworks.com/wp-content/uploads/2016/02/Indian-Ambassador-5-500x669.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/02/Indian-Ambassador-5.png) Figure 5: Code snippet showing the OS version check and the subsequent download from 46.166.165.254 If the infected system is running an OS version prior to Windows Vista, it would download the following files from 46.166.165.254: * WindowsSecurityService2.exe ('Rover' main module) * Openal32.dll * Cxcore210.dll (OpenCV) * Highgui210.dll (OpenCV) * libsndfile-1.dll If the OS version is Windows Vista or later, it would download the following files from 46.166.165.254 : * WindowsSecurityService3.exe ('Rover' main module) * OpenAL32.dll * opencv\_world300.dll * msvcp100.dll * msvcp110.dll * msvcp120.dll * msvcr100.dll * msvcr110.dll * msvcr120.dll After retrieving these files, the downloader Trojan executes the main module. Even though the main modules use different library versions, the functionality of the backdoors are identical. By analyzing the files downloaded to the victim machine, we can see that the executable *WindowsSecurityService2.exe* imports the four DLL files that were downloaded to the same directory. The four DDLs are *cxcore210.dll, highgui210.dll, OpenAL32.dll* and *libsndfile-1.dll* as shown in Figure 6 *[![Indian Ambassador 6](http://blog.paloaltonetworks.com/wp-content/uploads/2016/02/Indian-Ambassador-6-500x280.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/02/Indian-Ambassador-6.png)* Figure 6: Executable and DLLs downloaded to the victim machine Attributes of the Rover variant \############################################## *File: WindowsSecurityService2.exe* \############################################## *Meta-data* =============================================== Size : 337920 bytes Type : PE32 executable (console) Intel 80386, for MS Windows Architecture : 32 Bits binary MD5 : 76429f8515768f9f5def697e71071f51 SHA1 : d04ce934561934f758d77dfa944bd6743dd82cff SHA256: 7757517ae6b4d513a57826f9ab65bd070d99d25ac526cfae3e9955c3c7cd457assdeep : 6144:JabBRNUKgZ9SN0jzoFBB9hcrpXwg9xXYOGl93XO2rQLfbTpLuO7bIWjRO5gjPNq:JarSKu6yzoF8rpAqXYv3XOgQLfnpLuOu imphash : b5aa366f452feb9f4dff3c72157ca1f9 Date : 0x5637227B \[Mon Nov 2 08:44:43 2015 UTC\] Language : ENGLISH CRC: (Claimed) : 0x59736, (Actual): 0x59736 Entry Point : 0x43e3c8 .text 0/5 =============================================== Imports =============================================== \[1\] ADVAPI32.dll \[2\] WS2\_32.dll \[3\] WLDAP32.dll **\[4\] cxcore210.dll (OpenCV module)** **\[5\] highgui210.dll (OpenCV module)** **\[6\] OpenAL32.dll** **\[7\] libsndfile-1.dll** \[8\] GDI32.dll \[9\] KERNEL32.dll \[10\] USER32.dll \[11\] MSVCP90.dll \[12\] RPCRT4.dll \[13\] MSVCR90.dll The author of 'Rover' used the following open source projects to implement the main functionalities of this custom malware. OpenCV -- Taking photos from the web cam OpenAL -- Recording Audio Libsndfile -- C library used for reading and writing audio files LibCurl -- For all network communications ### **OpenCV and OpenAL** Both versions of Rover use [OpenCV](https://opencv.org/) and [OpenAL](https://www.openal.org) for some of the main functions. [OpenCV](https://docs.opencv.org/master/d1/dfb/intro.html#gsc.tab=0) is a library of functions written primarily for building real time [computer vision](https://www.cs.uml.edu/~holly/teaching/91450/spring2013/bschroeder_vision_robotics1.pdf) applications, image processing and also machine learning. It has seen wide acceptance in security systems, medical image analysis, unmanned vehicles, visual surveillance, object tracking, Artificial Intelligence and many other applications. [OpenAL](https://en.wikipedia.org/wiki/OpenAL) is a cross-platform audio API for rendering multichannel three-dimensional positional audio (i.e., It is a means to generate audio in a three-dimensional space.) Earlier versions of OpenAL were opensource but later versions (since v1.1) have been proprietary. Once executed, Rover creates following registry entry to execute itself when the computer reboots. *HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\"System Application" = c:\\system\\WindowsSecurityService\[2 or 3\].exe* The malware then creates six threads, each with a different job: * Heartbeat * Screenshot * Stealing Files from HDD * Keylogger * Search files on USB * Backdoor [![Indian Ambassador 7](http://blog.paloaltonetworks.com/wp-content/uploads/2016/02/Indian-Ambassador-7-500x279.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/02/Indian-Ambassador-7.png) Figure 7: Threads created by the malware 1. Heartbeat: This sends heartbeat signal on HTTP to the C2 server at 46.166.165.254 every five seconds and checks whether the C2 server is running. 2. ScreenShot: This saves screenshots as c:\\system\\screenshot.bmp and sends it to the C2 server at 46.166.165.254 every 60 minutes. [![Indian Ambassador 8](http://blog.paloaltonetworks.com/wp-content/uploads/2016/02/Indian-Ambassador-8-500x385.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/02/Indian-Ambassador-8.png) Figure 8: Screenshots sent to C2 server at 46.166.165.254 3. Finding specific file types on Removable Drive: This thread searches for for files with the following extensions on removable drives and copies them to '*c:\\system*' every 5 seconds. * pdf * doc * docx * ppt * pptx * xls * xlsx 4. Keylogger: This logs key strokes at '*c:\\system\\log.txt*' and sends captured data to the C2 every 10 seconds 5. Stealing specific file types from Hard Drive: This thread searches for for files with the following extensions on fixed drives and sends them to C2 every 60 minutes. * pdf * doc * docx * ppt * pptx * xls * xlsx [![Indian Ambassador 9](http://blog.paloaltonetworks.com/wp-content/uploads/2016/02/Indian-Ambassador-9-500x384.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/02/Indian-Ambassador-9.png) Figure 9: Document file being sent to C2 6. Backdoor: This thread obtains backdoor commands from C2 every 10 seconds and executes them. Backdoor commands are listed below: |-------------|----------------------------------------------------------------------------------------------------| | **Command** | **Description** | | CAMERA | Take photos using system webcam and store them as c:\\system\\camera.jpg before sending to the C2. | | AUDIO | Record audio from default audio input as c:\\system\\audio.ogg and sending it to the C2. | | SCREEN | Take a screenshot and save it as c:\\system\\screenshot.bmp then send it to the C2. | | KILL | Remove persistence registry entry and terminate itself. | Though 'Rover' is unsophisticated and lacks many modern features common to advanced malware, detection rate of the 'Rover' is extremely low. At the time of this writing, two out of three samples on VirusTotal were not detected by any Antivirus product [![Indian Ambassador 10](http://blog.paloaltonetworks.com/wp-content/uploads/2016/02/Indian-Ambassador-10-500x291.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/02/Indian-Ambassador-10.png) Figure 10: No detection by any AV product on Virustotal [![Indian Ambassador 11](http://blog.paloaltonetworks.com/wp-content/uploads/2016/02/Indian-Ambassador-11-500x232.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/02/Indian-Ambassador-11.png) Figure 11: Low detection rate ### Summary OpenCV has been extensively used by organizations, government bodies, and research groups for real time capture, image manipulation, object detection and many other uses in new forms of Human-Computer interaction, security systems, driver-less cars among many others. OpenCV was also used by the [Mars Rovers]() to send captured data back to Earth. It is interesting to see the very code used in such significant projects also being used to track and spy on individuals being targeted and which can remain undetected by traditional security systems. Though 'Rover' is an unsophisticated malware lacking modern malware features, it seems to be successful in bypassing traditional security systems and fulfilling the objectives of the threat actor behind the campaign in exfiltrating information from the targeted victim. It is important to understand the techniques and tools being used by such threat actors to better defend and protect organizations from such threats. Palo Alto Networks AutoFocus users can identify this threat using the [Rover tag](https://autofocus.paloaltonetworks.com/#/tag/Unit42.Rover). ### **IOCs:** *C2:* *46.166.165.254* *Downloader hosting links:* *newsumbrella\[.\]net/ne3s/lat3st/w0rld/systemupdateAPI\[.\]exe* *newsumbrella\[.\]net/ne3s/file\[.\]exe* *newsumbrella\[.\]net/bla3k/extra7/systemupdateAPI\[.\]exe* |--------------------------------------|---------------|--------------------------------------------------------------------| | **Filename** | **File Type** | **SHA 256** | | **Appreciation\_l** **etter.doc** | RTF | 6c9862a65741b56b849928300 aff310d60b815ee5f5f9f133469 e3b035e7e936 | | **Questionnaire.doc** | RTF | 5f656cf07a1d5e7c439aad4023 5dc78e47bac719c62e03728cc 40267383880bd | | **Terrorism.doc;** **India \&** | RTF | 6096ff941af95638944f2fcdf4a5 046aa028b803b010b1a2d000 028b1a4967bc | | **Appreciation\_ letter.doc** | RTF | 7bf3a425be41ad9cc713e4821 6e061c788f36e2727de5d0b6b 6ac4f435fe1c06 | | | RTF | 06b12649dba7f61cb581f97797 bdfba3a7f057a36b448d4c91a3 a7d89fff8d54 | | **WindowsSecurity** **Service3.exe** | PE | 61a2935fcb0a385f9e67855ef6f 95bda5f09fdb7c1435f215ce18 b7b61993daa | | **file.exe** | PE | a5e5571cda838e97a6beb1a65 acdfbaaf80027f60417aadb0d3 4292f19c0f3b3 | | **WindowsSecurity** **Service2.exe** | PE | 7757517ae6b4d513a57826f9ab 65bd070d99d25ac526cfae3e99 55c3c7cd457a | | **WindowsSecurity** **Service3.exe** | PE | 3dc709a3bcaa82220d6a76ea47 374bd864c37817c7041c7e9f4e e8ba42847f34 | ### References [https://en.wikipedia.org/wiki/Afghanistan%E2%80%93India\_relations](https://en.wikipedia.org/wiki/Afghanistan%E2%80%93India_relations)[http://docs.opencv.org/3.1.0/#gsc.tab=0](https://docs.opencv.org/3.1.0/#gsc.tab=0)[http://docs.opencv.org/2.4/modules/highgui/doc/highgui.html](https://docs.opencv.org/2.4/modules/highgui/doc/highgui.html)[https://en.wikipedia.org/wiki/OpenAL](https://en.wikipedia.org/wiki/OpenAL)[http://www.cs.uml.edu/~holly/teaching/91450/spring2013/bschroeder\_vision\_robotics1.pdf](https://www.cs.uml.edu/~holly/teaching/91450/spring2013/bschroeder_vision_robotics1.pdf)[https://ti.arc.nasa.gov/m/pub-archive/422h/0422%20(Pedersen).pdf]() Back to top ### Tags * [OpenAL](https://unit42.paloaltonetworks.com/tag/openal/ "OpenAL") * [OpenCV](https://unit42.paloaltonetworks.com/tag/opencv/ "OpenCV") * [Rover](https://unit42.paloaltonetworks.com/tag/rover/ "Rover") * [Trojan](https://unit42.paloaltonetworks.com/tag/trojan/ "Trojan") * [VirusTotal](https://unit42.paloaltonetworks.com/tag/virustotal/ "VirusTotal") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: KeyBase Threat Grows Despite Public Takedown: A Picture is Worth a Thousand Words](https://unit42.paloaltonetworks.com/keybase-threat-grows-despite-public-takedown-a-picture-is-worth-a-thousand-words/ "KeyBase Threat Grows Despite Public Takedown: A Picture is Worth a Thousand Words") ### Related Articles * [The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "article - table of contents") * [TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development](https://unit42.paloaltonetworks.com/tuxbot-v3-evolution-iot-botnet/ "article - table of contents") * [OpenClaw's Skill Marketplace and the Emerging AI Supply Chain Threat](https://unit42.paloaltonetworks.com/openclaw-ai-supply-chain-risk/ "article - table of contents") ## Related Malware Resources ![Pictorial representation of a magnifying glass illuminating a glowing orange circular digital circuit interface on a dark, high-tech background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Myth-Busting_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) September 16, 2026 [#### Atomic macOS (AMOS) Stealer Activity](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/) * [MacOS](https://unit42.paloaltonetworks.com/tag/macos/ "macOS") * [Threat intelligence](https://unit42.paloaltonetworks.com/tag/threat-intelligence/ "threat intelligence") * [Unit 42](https://unit42.paloaltonetworks.com/tag/unit-42/ "Unit 42") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/ "Atomic macOS (AMOS) Stealer Activity") ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)