[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/)  
[![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/)  
Menu

* [Tools](https://unit42.paloaltonetworks.com/tools/)
* [ATOMs](https://unit42.paloaltonetworks.com/atoms/)
* [Security Consulting](https://www.paloaltonetworks.com/unit42)
* [About Us](https://unit42.paloaltonetworks.com/about-unit-42/)
* [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html)  
  English
* [English](https://unit42.paloaltonetworks.com/new-ransomware-01flip-written-in-rust/)
* [Spanish (LATAM)](https://unit42.paloaltonetworks.com/es-la/new-ransomware-01flip-written-in-rust/)
* [French](https://unit42.paloaltonetworks.com/fr/new-ransomware-01flip-written-in-rust/)
* [Japanese](https://unit42.paloaltonetworks.com/ja/new-ransomware-01flip-written-in-rust/)
* [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research")
* [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research")
* [Ransomware](https://unit42.paloaltonetworks.com/category/ransomware/ "Ransomware")  
  [Ransomware](https://unit42.paloaltonetworks.com/category/ransomware/)

# 01flip: Multi-Platform Ransomware Written in Rust

![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 9 min read  
Related Products  
[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Cortex icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex](https://unit42.paloaltonetworks.com/product-category/cortex/ "Cortex")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Cortex Xpanse icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex Xpanse](https://unit42.paloaltonetworks.com/product-category/cortex-xpanse/ "Cortex Xpanse")[![Cortex XSIAM icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XSIAM](https://unit42.paloaltonetworks.com/product-category/cortex-xsiam/ "Cortex XSIAM")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response")[![Unit 42 Ransomware Readiness Assessment icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Ransomware Readiness Assessment](https://unit42.paloaltonetworks.com/product-category/ransomware-readiness-assessment/ "Unit 42 Ransomware Readiness Assessment")

* ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg)  
  By:
  
  * [Hiroaki Hara](https://unit42.paloaltonetworks.com/author/hiroaki-hara/)

* ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg)  
  Published:December 10, 2025

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg)  
  Categories:
  
  * [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/)
  * [Ransomware](https://unit42.paloaltonetworks.com/category/ransomware/)
  * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/)

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg)  
  Tags:
  
  * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/)
  * [CL-CRI-103](https://unit42.paloaltonetworks.com/tag/cl-cri-103/)
  * [Cryptocurrency](https://unit42.paloaltonetworks.com/tag/cryptocurrency/)
  * [Forums](https://unit42.paloaltonetworks.com/tag/forums/)
  * [Linux](https://unit42.paloaltonetworks.com/tag/linux/)
  * [Rust](https://unit42.paloaltonetworks.com/tag/rust/)
  * [Sliver](https://unit42.paloaltonetworks.com/tag/sliver/)
  * [Windows](https://unit42.paloaltonetworks.com/tag/windows/)

* [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/new-ransomware-01flip-written-in-rust/?pdf=download&lg=en&_wpnonce=f6e4b1f2e6 "Click here to download")

* [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/new-ransomware-01flip-written-in-rust/?pdf=print&lg=en&_wpnonce=f6e4b1f2e6 "Click here to print")

Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg)

* ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg)
* [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=01flip:%20Multi-Platform%20Ransomware%20Written%20in%20Rust&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fnew-ransomware-01flip-written-in-rust%2F "Share in email")
* [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnew-ransomware-01flip-written-in-rust%2F "Share in Facebook")
* [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnew-ransomware-01flip-written-in-rust%2F&title=01flip:%20Multi-Platform%20Ransomware%20Written%20in%20Rust "Share in LinkedIn")
* [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnew-ransomware-01flip-written-in-rust%2F&text=01flip:%20Multi-Platform%20Ransomware%20Written%20in%20Rust "Share in Twitter")
* [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnew-ransomware-01flip-written-in-rust%2F&ts=markdown "Share in Reddit")
* [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=01flip:%20Multi-Platform%20Ransomware%20Written%20in%20Rust%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fnew-ransomware-01flip-written-in-rust%2F "Share in Mastodon")

## Executive Summary

In June 2025, we observed a new ransomware family named 01flip targeting a limited set of victims in the Asia-Pacific region. 01flip ransomware is fully written in the Rust programming language and supports multi-platform architectures by leveraging the cross-compilation feature of Rust.

These financially motivated attackers likely carried this out through manual means. We have confirmed an alleged data leak from an affected organization on a dark web forum shortly after the attack. We are currently [tracking this activity](https://unit42.paloaltonetworks.com/unit-42-attribution-framework/) as CL-CRI-1036, signifying a cluster of malicious activity that is likely related to cybercrime.

Our key findings are:

* Financially motivated attackers behind CL-CRI-1036 use 01flip ransomware, a newly observed ransomware family purely written in Rust
* This ransomware supports multi-platform architecture, including Windows and Linux
* A threat actor potentially associated with CL-CRI-1036 is offering data for sale on dark web forums (likely stolen with 01flip ransomware)

While the impact of CL-CRI-1036 is limited at this point, it's likely that this activity is related to alleged data leaks.

Palo Alto Networks customers are better protected from the threats described through the following products and services:

* [Advanced WildFire](https://docs.paloaltonetworks.com/wildfire)
* [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) and [XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam)
* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse)

If you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html).

| **Related Unit 42 Topics** | [**Rust**](https://unit42.paloaltonetworks.com/tag/rust/), **[Sliver](https://unit42.paloaltonetworks.com/tag/sliver/)** , **[Ransomware](https://unit42.paloaltonetworks.com/category/ransomware/)** , **[Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/)** |
|----------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|

## Background

In early June 2025, Unit 42 researchers investigated a suspicious Windows executable. The executable caught our attention because it is a Rust-based binary that exhibited ransomware-like behavior in our sandbox.

[Our initial analysis](https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2025-06-24-IOCs-for-01flip-ransomware.txt) revealed that this is a new ransomware family fully written in Rust, called "01flip." This name is based on the appended file extension (.01flip) and the email address (01Flip@proton\[.\]me) found in the ransom note.

After further investigation, we discovered a [Linux version of 01flip ransomware](https://www.virustotal.com/gui/file/e5834b7bdd70ec904470d541713e38fe933e96a4e49f80dbfb25148d9674f957/details), which showed zero detection rate at least three months after the sample had initially been submitted to VirusTotal.

## Campaign Overview

### Victimology

At the time of writing, we observed a minimal set of victims. But victims of this ransomware include organizations responsible for critical infrastructure in Southeast Asia.

After further investigation, we found [a post on an online security forum](https://www.bleepingcomputer.com/forums/t/808867/unknown-01flip-ext-ransomware-attack-zimbra-server/) by an alleged victim of 01flip ransomware, claiming that attackers had compromised their Zimbra Server, which is an email solution for enterprises.

Due to the lack of information about victims, we assume that the use of 01flip ransomware is at a very early stage. However, there might be several victims in the Philippines and Taiwan, based on a post in a dark web forum that we believe comes from a threat actor linked to CL-CRI-1036.

### Initial Access

Investigation revealed that attackers had been attempting exploits targeting older vulnerabilities such as [CVE-2019-11580](https://nvd.nist.gov/vuln/detail/cve-2019-11580) against a victim's internet-facing applications since early April 2025. It is unclear which activities specifically succeeded in granting attackers access to this system. However, a month later, they successfully deployed a Linux version of [Sliver](https://github.com/BishopFox/sliver), a publicly available cross-platform adversary emulation framework written in Go.

### Post-Exploitation

In late May 2025, the threat actor behind CL-CRI-1036 successfully performed lateral movement to another Linux machine by downloading another Sliver implant, which was a [TCP Pivot](https://github.com/BishopFox/sliver/wiki/Pivots/d87b3e15111e7be50dd885be966c35bca629c626#tcp-pivots) profiled implant. A week later, we confirmed that attackers deployed multiple 01flip ransomware instances onto many devices within the network, including both Windows and Linux machines.

The exact methods the attackers used to deploy the ransomware after the initial compromise remain unclear. However, given the rapid distribution of the ransomware to multiple devices, it is highly likely that the attackers conducted the following activities, possibly through Sliver and its modules:

* Hands-on reconnaissance
* Credential dumping
* Lateral movement

## Technical Analysis of 01flip Ransomware

### Initial Analysis

As of late October, we had observed both Windows and Linux versions of 01flip ransomware. The 01flip ransomware sample is not packed or heavily obfuscated, unlike other malware used by cybercriminals. Therefore, we can easily identify that it is compiled from Rust source code, due to the file extension (.rs), as shown in Figure 1.
![Screenshot of displaying a list of file paths in a code repository related to different program versions and components. The file name extensions are highlighted in yellow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/12/word-image-95980-167849-1.png) Figure 1. Visible Rust-related strings in the 01flip ransomware sample.

Figure 2 shows the differences in results using [rustbininfo](https://github.com/N0fix/rustbininfo) between the Windows and Linux platform samples. The rustbininfo tool generates a list of dependencies (known as "crates" in Rust), which we used to compare the two samples.

Aside from architecture-specific libraries, we can see that the Rust version, commit hash and library versions mostly match. Therefore, most of the functionality is identical, but we also noticed a few differences that we will describe later.
![Two side-by-side screenshots of 01flip ransomware samples, mostly written in the Rust programming language. The left sample is Windows with certain lines highlighted in red and the right is Linux with certain lines highlighted in green.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/12/word-image-99127-167849-2.png) Figure 2. The two 01flip ransomware samples used mostly the same crates (left: Windows, right: Linux).

The Rust compiler generally produces more complex assembly code than traditional C/C++ compilers. This added complexity can make reverse engineering Rust malware challenging for malware analysts. Despite this, the malware's capabilities are simple and straightforward.

### Ransomware Functionality

The following are key functions of 01flip ransomware:

1. Enumerating all possible drives (e.g., from A: to Z:)
2. Creating ransom notes, RECOVER-YOUR-FILE.TXT, in all writable directories
3. Renaming files containing specific file extensions with the following naming convention: \<ORIGINAL\_FILENAME\>.\<UNIQUE\_ID\>.\<0 or 1\>.01flip
4. Encrypting files using AES-128-CBC and RSA-2048
5. Deleting itself

#### Defense Evasion Techniques

01flip ransomware employs several evasion techniques. For example, both Linux and Windows versions are designed to use low-level APIs or system calls as much as possible, because such activity is less likely to stand out from normal operating system activity. Figure 3 shows an example of native APIs used in our sample of the Windows version of 01flip ransomware.
![Screenshot showing two rows of data.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/12/word-image-105425-167849-3.png) Figure 3. Example of low-level native APIs used to read/write files in the Windows version.

Additionally, most of the user-defined strings in the ransomware code are encoded. These strings are decoded at runtime:

* The ransom note content
* The ransom note filename
* The extension list
* The RSA public key

The algorithm decodes each encoded string by performing a SUB operation every two bytes as follows.  
from more\_itertools import chunked def decrypt\_string(enc: bytes) -\> str: return ''.join(chr(chunk\[0\] - chunk\[1\]) for chunk in chunked(enc, 2))

|-----------|------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 | from more\_itertools import chunked def decrypt\_string(enc: bytes) -\> str: return ''.join(chr(chunk\[0\] - chunk\[1\]) for chunk in chunked(enc, 2)) |

Encoded strings are embedded in the .text or .data section of the Windows variant based on their length. Figure 4 demonstrates how 01flip ransomware decodes the ransom note template.
![Screenshot of a computer screen displaying a ransomware note in a command line interface, with an email address provided for contact. Above the note is a block of binary.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/12/word-image-107996-167849-4.png) Figure 4. How 01flip ransomware decodes the ransom note stored with its binary.

Techniques like invoking system calls and encoded strings are not an effective evasion strategy on their own. Because the 01flip ransomware sample we analyzed works as designed in a sandbox environment, it is still relatively easy to detect.

Most ransomware is relatively straightforward and noisy. However, some of the 01flip ransomware samples implement a simple anti-sandbox technique by checking whether the filename contains the string 01flip. If the sample's filename contains the string 01flip, the ransomware proceeds to [indicator removal](https://attack.mitre.org/techniques/T1070/) without performing file encryption.

#### Data Encryption

01flip ransomware drops ransom notes in all writable directories before encrypting files. These ransom notes contain contact information and cipher data that is required to obtain a key to decrypt a victim's files, as shown in Figure 5.
![A computer screen displaying a ransomware note titled "RECOVER-YOUR-FILES.TXT" in a text editing software. The note includes instructions not to restart the computer, an email contact "mp@proton.me" for decryption key, and a session address for further communication. Some information is redacted for security concerns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/12/word-image-111270-167849-5.png) Figure 5. Example of a 01flip ransom note.

01flip ransomware excludes files with specific extensions from encryption. This encryption exclusion extension list can be found in the [Appendix](#post-167849-_570cbe1pdhwx). Finally, 01flip encrypts files using the AES encryption algorithm. The session key used for the ransomware's file-encrypting activity is itself encrypted using an embedded RSA public key. Figure 6 shows an example of this RSA key.
![Image displaying a segment of cryptographic text with a blue background, specifically showing a public key starting with 'BEGIN PUBLIC KEY' and ending with 'END PUBLIC KEY'.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/12/word-image-114513-167849-6.png) Figure 6. RSA public key from the 01flip ransomware sample.

Encrypted files are renamed with the specific naming convention \<ORIGINAL\_FILENAME\>.\<UNIQUE\_ID\>.\<0 or 1\>.01flip, as shown in Figure 7.
![Screenshot of a computer file explorer window showing three files: an image file named; a text file titled "RECOVER-YOUR-FILE.TXT"; and another image file.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/12/word-image-118024-167849-7.png) Figure 7. Example of encrypted filenames in a Windows environment infected with 01flip ransomware.

#### Indicator Removal

After completing encryption, the 01flip ransomware attempts to remove any trace of itself, to prevent it from being recovered from an infected host. The Windows and Linux variants invoke the following commands, respectively, after replacing ${self\_name} with its current filename.

# Windows ping 127.0.0.7 -n 5 \> Nul \& fsutil file setZeroData offset=0 length=4194303 ${self\_name} \> Nul \& Del /f /q ${self\_name}

|-------|---------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 | # Windows ping 127.0.0.7 -n 5 \> Nul \& fsutil file setZeroData offset=0 length=4194303 ${self\_name} \> Nul \& Del /f /q ${self\_name} |

# Linux sleep 5 \&\& dd if=/dev/urandom of=${self\_name} bs=1M count=4 \> /dev/null 2\>\&1 \&\& rm ${self\_name} \> /dev/null 2\>\&1

|-------|------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 | # Linux sleep 5 \&\& dd if=/dev/urandom of=${self\_name} bs=1M count=4 \> /dev/null 2\>\&1 \&\& rm ${self\_name} \> /dev/null 2\>\&1 |

## Possible Attribution

### Attacker Activity

Attackers behind this campaign have so far demanded one bitcoin (BTC) for decrypting files. Communication with the attackers takes place in a secure email or in a private messaging channel. Figure 8 shows an example of the demand through messaging channel text.

As of late October, the attackers behind CL-CRI-1036 don't appear to operate a double extortion site like those commonly seen in recent ransomware-as-a-service (RaaS) groups.
![Text requesting a transfer of 1 Bitcoin to a blurred-out address on a dark background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/12/word-image-120659-167849-8.png) Figure 8. Message from the attackers in a private messaging channel.

Further investigation revealed an alleged data leak of the affected organization on a dark web forum posted on the day after the ransomware deployment. Figure 9 shows this post. While we were unable to verify the legitimacy of the post, the data appears to be credible based on the positive reactions of other users in the forum.
![Screenshot of a dark web forum with some of the title of a post and identifying information of the poster redacted or blurred. The screenshot refers to data leaks.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/12/word-image-123683-167849-9.png) Figure 9. Post of the alleged data leak on a dark web forum.

While this user who made this post has been registered in this forum since April 2023, we were able to confirm only three posts since June 2025. The post indicates that victims in Taiwan and the Philippines were also targeted. The username itself is not particularly unique, but we have confirmed that a Russian-speaking user with the same username has been selling data and network access on the well-known dark web forum XSS since 2020.

Of note, 01flip ransomware cannot exfiltrate data, so the only connection between this poster and 01flip is the victim.

### Possible Overlap With LockBit?

During our analysis of 01flip ransomware, we found that there is one particularly interesting extension in the list of file extensions excluded from encryption, which is lockbit as shown in Figure 10.
![A screenshot of assembly code, showing various data declarations and comments on an IDE with blue background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/12/word-image-126995-167849-10.png) Figure 10. Lockbit extension in the list of file extensions excluded from encryption by the 01flip ransomware sample.

Avoiding encrypting files with a lockbit file extension implies a possible overlap of the threat actor behind CL-CRI-1036 and the group behind LockBit ransomware, which we track as Flighty Scorpius. However, other than this odd bit of code, we can find no other connection between these two ransomware families.

## Conclusion

We have described emerging activity, which we currently track as CL-CRI-1036, where financially motivated attackers used a new Rust-based ransomware named 01flip. This activity highlights the challenges faced by defenders from attackers using modern programming languages in malware development. Based on our analysis, this campaign seems to be in its early stages and may be related to an alleged data leak on a dark web forum.

### Palo Alto Networks Protection and Mitigation

Palo Alto Networks customers are better protected from the threats discussed above through the following products:

* The[Advanced WildFire](https://docs.paloaltonetworks.com/wildfire) machine-learning models and analysis techniques have been reviewed and updated in light of the indicators shared in this research.
* [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) and [XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) help prevent the threats outlined in this blog by employing the [Malware Prevention Engine](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-4.x-Documentation/Malware-protection). This approach combines several layers of protection, including [WildFire](https://docs.paloaltonetworks.com/wildfire), Behavioral Threat Protection and the Local Analysis module, to prevent both known and unknown malware from causing harm to endpoints.

In addition, the [Anti-Ransomware module](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-3.x-Documentation/Endpoint-protection-capabilities) enables Cortex XDR to protect against encryption-based activity associated with ransomware, to help analyze and halt ransomware before any data loss occurs.

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) can help detect internet-facing instances of insecure software, such as Atlassian Crowd Server, which was noted as being exploited by CVE-2019-11580 and leading to initial access.

Cortex Xpanse has an [Attack Surface Rule](https://docs-cortex.paloaltonetworks.com/r/Cortex-XPANSE/2/Cortex-Xpanse-Expander-User-Guide/Attack-surface-rules) for "Insecure Atlassian Crowd Server" meant to identify this example, as well as many other detections out of the box for applications with RCE vulnerabilities which are attractive for Ransomware operators.

All detections in Cortex Xpanse are also available in Cortex XSIAM as part of the Attack Surface Management (ASM) add-on.

If you think you may have been compromised or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call:

* North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
* UK: +44.20.3743.3660
* Europe and Middle East: +31.20.299.3130
* Asia: +65.6983.8730
* Japan: +81.50.1790.0200
* Australia: +61.2.4062.7950
* India: 000 800 050 45107
* South Korea: +82.080.467.8774

Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org).

## Indicators of Compromise

### Malicious Samples

#### Windows Version of 01flip Ransomware

* SHA-256 hash: 6aad1c36ab9c7c44350ebe3a17178b4fd93c2aa296e2af212ab28d711c0889a3
* File size: 741,888 bytes
* File type: PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows

#### Linux Version of 01flip Ransomware

* SHA-256 hash: e5834b7bdd70ec904470d541713e38fe933e96a4e49f80dbfb25148d9674f957
* File size: 948,640 bytes
* File type: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), static-pie linked, stripped

#### Linux Sliver Beacon, TCP Pivot as C2

* SHA-256 hash: ba41f0c7ea36cefe7bc9827b3cf27308362a4d07a8c97109704df5d209bce191
* File size: 13,414,400 bytes
* File type: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped

## Appendix: Encryption Exclusion Extension List

### A-L

* 01flip
* 386
* Idf
* Ink
* a
* adv
* ani
* apk
* app
* bat
* bin
* cab
* cmd
* com
* cpl
* cur
* deb
* deskthemepack
* diagcab
* diagcfg
* diagpkg
* dll
* dmg
* dmp
* drv
* encrypt
* exe
* fnt
* fon
* gadget
* hlp
* hta
* icl
* icns
* ico
* ics
* idx
* ini
* ipa
* iso
* key
* la
* lnk
* lock
* lockbit

### M-Z

* mod
* mp3
* mp4
* mpa
* msc
* msi
* msp
* msstyles
* msu
* nls
* nomedia
* o
* ocx
* otf
* part
* pdb
* pif
* prf
* ps1
* reg
* rom
* rpd
* rtp
* scr
* sfcache
* shs
* so
* spl
* sys
* theme
* themepack
* tmp
* ttf
* wad
* wav
* winmd
* wma
* woff
* wpx
* xex

Back to top

### Tags

* [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin")
* [CL-CRI-103](https://unit42.paloaltonetworks.com/tag/cl-cri-103/ "CL-CRI-103")
* [Cryptocurrency](https://unit42.paloaltonetworks.com/tag/cryptocurrency/ "Cryptocurrency")
* [Forums](https://unit42.paloaltonetworks.com/tag/forums/ "forums")
* [Linux](https://unit42.paloaltonetworks.com/tag/linux/ "Linux")
* [Rust](https://unit42.paloaltonetworks.com/tag/rust/ "Rust")
* [Sliver](https://unit42.paloaltonetworks.com/tag/sliver/ "Sliver")
* [Windows](https://unit42.paloaltonetworks.com/tag/windows/ "Windows")  
  [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: New Prompt Injection Attack Vectors Through MCP Sampling](https://unit42.paloaltonetworks.com/model-context-protocol-attack-vectors/ "New Prompt Injection Attack Vectors Through MCP Sampling")

### Table of Contents

* 

### Related Articles

* [The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "article - table of contents")
* [The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "article - table of contents")
* [Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "article - table of contents")

## Related Resources

![Pictorial representation of Russian global webmail espionage campaign. A digital illustration of a world map in a network style, highlighting continents with glowing lines and connectivity points in a red and blue theme.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/06_Nation-State-cyberattacks_1920x900-1-786x368.jpg)  
[![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) July 23, 2026 [#### Russian Global Webmail Espionage](https://unit42.paloaltonetworks.com/russian-webmail-espionage/)

* [CL-STA-1114](https://unit42.paloaltonetworks.com/tag/cl-sta-1114/ "CL-STA-1114")

* [JavaScript](https://unit42.paloaltonetworks.com/tag/javascript/ "JavaScript")

* [Javascript injection](https://unit42.paloaltonetworks.com/tag/javascript-injection/ "javascript injection")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/russian-webmail-espionage/ "Russian Global Webmail Espionage")  
  ![Pictorial representation of a woman standing in a server room holding a laptop that projects a digital code overlay.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/06_Security-Technology_Category_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) May 28, 2026 [#### 2026 World Cup: Discussing The World's Biggest Game's Attack Surface](https://unit42.paloaltonetworks.com/fifa-world-cup-attack-surface/)

* [Fiddling Scorpius](https://unit42.paloaltonetworks.com/tag/fiddling-scorpius/ "Fiddling Scorpius")

* [Fighting Ursa](https://unit42.paloaltonetworks.com/tag/fighting-ursa/ "Fighting Ursa")

* [Muddled Libra](https://unit42.paloaltonetworks.com/tag/muddled-libra/ "Muddled Libra")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/fifa-world-cup-attack-surface/ "2026 World Cup: Discussing The World’s Biggest Game’s Attack Surface")  
  ![Pictoral representation of a man holding a cellphone with a bokeh skyline in the background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/05_Listicle_Category_1505x922-718x440.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) May 27, 2026 [#### Out of the Crypt: The Evolving Cyber Extortion Economy](https://unit42.paloaltonetworks.com/cyber-extortion-economy/)

* [Bling Libra](https://unit42.paloaltonetworks.com/tag/bling-libra/ "Bling Libra")

* [Extortion](https://unit42.paloaltonetworks.com/tag/extortion/ "Extortion")

* [Frontier AI](https://unit42.paloaltonetworks.com/tag/frontier-ai/ "Frontier AI")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/cyber-extortion-economy/ "Out of the Crypt: The Evolving Cyber Extortion Economy")  
  ![Pictorial representation of Iran cyber attacks. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/12_Security-Technology_Category_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) April 17, 2026 [#### Threat Brief: Escalation of Cyber Risk Related to Iran (Updated April 17)](https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/)

* [APK](https://unit42.paloaltonetworks.com/tag/apk/ "APK")

* [DDoS attacks](https://unit42.paloaltonetworks.com/tag/ddos-attacks/ "DDoS attacks")

* [GenAI](https://unit42.paloaltonetworks.com/tag/genai/ "GenAI")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/ "Threat Brief: Escalation of Cyber Risk Related to Iran (Updated April 17)")  
  ![Pictorial representation of the APT Boggy Serpens. An illustrated blue snake is highlighted by a red circle against a night sky. The constellation serpens.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/Boggy-Serpens-1920x900-1-786x368.png)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) March 16, 2026 [#### Boggy Serpens Threat Assessment](https://unit42.paloaltonetworks.com/boggy-serpens-threat-assessment/)

* [Advanced Persistent Threat](https://unit42.paloaltonetworks.com/tag/advanced-persistent-threat/ "Advanced Persistent Threat")

* [Boggy Serpens](https://unit42.paloaltonetworks.com/tag/boggy-serpens/ "Boggy Serpens")

* [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/boggy-serpens-threat-assessment/ "Boggy Serpens Threat Assessment")  
  ![Pictorial representation of Muddled Libra, aka Scattered Spider. A vibrant illustration of the Libra zodiac sign, featuring a stylized balance scale overlaid with a prominent Libra symbol. The background is a starry night sky with shades of purple and blue, suggesting a cosmic theme.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/03-1-Muddle-Libra-1920x900-1-786x368.png)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/threat-actor-groups.svg)Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/) February 10, 2026 [#### A Peek Into Muddled Libra's Operational Playbook](https://unit42.paloaltonetworks.com/muddled-libra-ops-playbook/)

* [Muddled Libra](https://unit42.paloaltonetworks.com/tag/muddled-libra/ "Muddled Libra")

* [PowerShell](https://unit42.paloaltonetworks.com/tag/powershell/ "PowerShell")

* [Scattered Spider](https://unit42.paloaltonetworks.com/tag/scattered-spider/ "Scattered Spider")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/muddled-libra-ops-playbook/ "A Peek Into Muddled Libra’s Operational Playbook")  
  ![Pictorial representation of a group of individuals discussing an idea with a whiteboard.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/02_Listicle_Overview_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) February 3, 2026 [#### Why Smart People Fall For Phishing Attacks](https://unit42.paloaltonetworks.com/psychology-of-phishing/)

* [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI")

* [Phishing](https://unit42.paloaltonetworks.com/tag/phishing/ "phishing")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/psychology-of-phishing/ "Why Smart People Fall For Phishing Attacks")  
  ![Pictorial representation of threat groups from Russia. The silhouette of a bear and the Ursa constellation inside an orange abstract planet. Abstract, stylized cosmic setting with vibrant blue and purple shapes, representing space and distant planetary bodies.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/01/Ursa-Russia-B-1920x900-1-786x368.png)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) January 29, 2026 [#### Understanding the Russian Cyberthreat to the 2026 Winter Olympics](https://unit42.paloaltonetworks.com/russian-cyberthreat-2026-winter-olympics/)

* [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI")

* [IoT](https://unit42.paloaltonetworks.com/tag/iot/ "IoT")

* [Russia](https://unit42.paloaltonetworks.com/tag/russia/ "Russia")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/russian-cyberthreat-2026-winter-olympics/ "Understanding the Russian Cyberthreat to the 2026 Winter Olympics")  
  ![Pictorial representation of RaaS RansomHouse. Digital representation of cybersecurity concept with a padlock superimposed over computer circuit boards, symbolizing data protection and encryption technologies.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/12/06_Ransomware_Category_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) December 17, 2025 [#### From Linear to Complex: An Upgrade in RansomHouse Encryption](https://unit42.paloaltonetworks.com/ransomhouse-encryption-upgrade/)

* [ESXi](https://unit42.paloaltonetworks.com/tag/esxi/ "ESXi")

* [Jolly Scorpius](https://unit42.paloaltonetworks.com/tag/jolly-scorpius/ "Jolly Scorpius")

* [RansomHouse](https://unit42.paloaltonetworks.com/tag/ransomhouse/ "RansomHouse")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ransomhouse-encryption-upgrade/ "From Linear to Complex: An Upgrade in RansomHouse Encryption")

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)  
  ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]()  
  ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png)  
  ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42

## Peace of mind comes from staying ahead of threats. Subscribe today.

Your Email

Subscribe for email updates to all Unit 42 threat research.  
By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement")

This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.

Invalid captcha!
Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg)  
{#footer} Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security)

* [Secure AI by Design](https://www.paloaltonetworks.com/ai-security)

* [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase)

* [Prisma SASE](https://www.paloaltonetworks.com/sase)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam)

* [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira)

* [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management)

* [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management)

* [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager)

* [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance)

* [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management)

* [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic)

* [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management)

* [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance)

* [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery)

* [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42)

* [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense)

* [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses)

* [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy)

* [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence)

* [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond)  
  Company

* [About Us](https://www.paloaltonetworks.com/about-us)

* [Careers](https://jobs.paloaltonetworks.com/en/)

* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales)

* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility)

* [Customers](https://www.paloaltonetworks.com/customers)

* [Investor Relations](https://investors.paloaltonetworks.com/)

* [Location](https://www.paloaltonetworks.com/about-us/locations)

* [Newsroom](https://www.paloaltonetworks.com/company/newsroom)  
  Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/)

* [Communities](https://www.paloaltonetworks.com/communities)

* [Content Library](https://www.paloaltonetworks.com/resources)

* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia)

* [Event Center](https://events.paloaltonetworks.com/)

* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)

* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z)

* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications)

* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure)

* [Sitemap](https://www.paloaltonetworks.com/sitemap)

* [Tech Docs](https://docs.paloaltonetworks.com/)

* [Unit 42](https://unit42.paloaltonetworks.com/)

* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)

* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy)

* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center)

* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use)

* [Documents](https://www.paloaltonetworks.com/legal)

Copyright © 2026 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* EN  
  Select your language  
  ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg)

### Default Heading

Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg)  
Seekbar

![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg)  
![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg)  
Volume
![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)