[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [German](https://unit42.paloaltonetworks.com/de/north-korean-synthetic-identity-creation/) * [English](https://unit42.paloaltonetworks.com/north-korean-synthetic-identity-creation/) * [Spanish (LATAM)](https://unit42.paloaltonetworks.com/es-la/north-korean-synthetic-identity-creation/) * [French](https://unit42.paloaltonetworks.com/fr/north-korean-synthetic-identity-creation/) * [Italian](https://unit42.paloaltonetworks.com/it/north-korean-synthetic-identity-creation/) * [Japanese](https://unit42.paloaltonetworks.com/ja/north-korean-synthetic-identity-creation/) * [Korean](https://unit42.paloaltonetworks.com/ko/north-korean-synthetic-identity-creation/) * [Portuguese](https://unit42.paloaltonetworks.com/pt-br/north-korean-synthetic-identity-creation/) * [Chinese (Traditional)](https://unit42.paloaltonetworks.com/zh-hant/north-korean-synthetic-identity-creation/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/ "Cybercrime") [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/) # False Face: Unit 42 Demonstrates the Alarming Ease of Synthetic Identity Creation ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 7 min read Related Products [![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response")[![Unit 42 Insider Threat Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Insider Threat Services](https://unit42.paloaltonetworks.com/product-category/insider-threat-services/ "Unit 42 Insider Threat Services") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Evan Gordenker](https://unit42.paloaltonetworks.com/author/evan-gordenker/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:April 21, 2025 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/) * [Learning Hub](https://unit42.paloaltonetworks.com/category/learning-hub/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [DPRK](https://unit42.paloaltonetworks.com/tag/dprk/) * [Social engineering](https://unit42.paloaltonetworks.com/tag/social-engineering/) * [Wagemole](https://unit42.paloaltonetworks.com/tag/wagemole/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/north-korean-synthetic-identity-creation/?pdf=download&lg=en&_wpnonce=1f7a0335d5 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/north-korean-synthetic-identity-creation/?pdf=print&lg=en&_wpnonce=1f7a0335d5 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=False%20Face:%20Unit%2042%20Demonstrates%20the%20Alarming%20Ease%20of%20Synthetic%20Identity%20Creation&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fnorth-korean-synthetic-identity-creation%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnorth-korean-synthetic-identity-creation%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnorth-korean-synthetic-identity-creation%2F&title=False%20Face:%20Unit%2042%20Demonstrates%20the%20Alarming%20Ease%20of%20Synthetic%20Identity%20Creation "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnorth-korean-synthetic-identity-creation%2F&text=False%20Face:%20Unit%2042%20Demonstrates%20the%20Alarming%20Ease%20of%20Synthetic%20Identity%20Creation "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnorth-korean-synthetic-identity-creation%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=False%20Face:%20Unit%2042%20Demonstrates%20the%20Alarming%20Ease%20of%20Synthetic%20Identity%20Creation%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fnorth-korean-synthetic-identity-creation%2F "Share in Mastodon") ## Executive Summary Evidence suggests that North Korean IT workers are using real-time deepfake technology to infiltrate organizations through remote work positions, which poses significant security, legal and compliance risks. The detection strategies we outline in this report provide security and HR teams with practical guidance to strengthen their hiring processes against this threat. In our demonstration, it took just over an hour with no prior experience to figure out how to create a real-time deepfake using readily available tools and cheap consumer hardware. This allows adversaries to easily create convincing synthetic identities, enabling them to operate undetected and potentially generate revenue for sanctioned regimes. While we can still detect limitations in current deepfake technology, these limitations are rapidly diminishing. Organizations must implement layered defenses by combining enhanced verification procedures, technical controls and ongoing monitoring throughout the employee lifecycle. Palo Alto Networks customers are better protected from the threats discussed in this article through [Unit 42 Insider Threat Services](https://www.paloaltonetworks.com/resources/datasheets/unit42-insider-threat-services). Organizations can engage the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) for specific assistance with this threat and others. | **Related Unit 42 Topics** | [**Social Engineering**](https://unit42.paloaltonetworks.com/tag/social-engineering/), [**DPRK**](https://unit42.paloaltonetworks.com/tag/dprk/), **[Wagemole](https://unit42.paloaltonetworks.com/tag/wagemole/)** | |----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| ## Interviewing North Koreans Talent acquisition and cybersecurity communities have recently reported a surge in candidates employing real-time deepfakes during job interviews. Investigators have documented cases where interviewees presented synthetic video feeds, using identical virtual backgrounds across different candidate profiles as shown in Figure 1. ![Screenshots of two individuals in a virtual meeting, each displayed within separate, blue-bordered video call frames. The background shows a simple office and a plain blue wall. Both are deepfake interviews.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/04/word-image-301669-139512-1.png) Figure 1. A side-by-side comparison of two deepfake interviewees. Source: [Daniel Grek Sanchez Castellanos](https://www.linkedin.com/posts/daniel-grek-sanchez-castellanos-63801262_one-of-the-interview-questions-you-need-to-activity-7270458696927694849-bXRR?utm_source=share&utm_medium=member_desktop&rcm=ACoAABQaDB8BpwtT-BTkCDbsTjVeh8EcvDXosMQ) and [Bettina Liporazzi](https://www.linkedin.com/posts/bettina-liporazzi_i-didnt-anticipate-so-much-engagement-activity-7306031381434789889-sQoi?utm_source=share&utm_medium=member_desktop&rcm=ACoAABQaDB8BpwtT-BTkCDbsTjVeh8EcvDXosMQ). The [Pragmatic Engineer](https://newsletter.pragmaticengineer.com/p/ai-fakers) newsletter documented a case study involving a Polish AI company that encountered two separate deepfake candidates. Interviewers suspected the same individual operated both personas, particularly when the operator showed notably increased confidence during the second technical interview after previously experiencing the interview format and questions. Unit 42's analysis of indicators shared in the Pragmatic Engineer report aligns with known tactics, techniques and procedures (TTPs) attributed to Democratic People's Republic of Korea (DPRK) [IT worker operations](https://unit42.paloaltonetworks.com/north-korean-it-workers/). This represents a logical evolution of their established fraudulent work infiltration scheme. North Korean threat actors have consistently demonstrated a significant interest in identity manipulation techniques. In our [2023 investigation](https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/), we reported on their efforts to create synthetic identities supported by compromised personal information, making them more difficult to detect. We found further evidence when we analyzed the [breach of Cutout.pro](https://www.bitdefender.com/en-us/blog/hotforsecurity/hacker-leaks-records-of-20-million-users-of-ai-visual-creation-platform-online), an AI image manipulation service, which revealed scores of email addresses likely tied to DPRK IT worker operations. Figure 2 shows such image manipulation in face-swapped headshots. ![Side-by-side images of a person before and after a face swap, showing a transformation from a natural look on the left to a more polished appearance with a filter.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/04/word-image-308904-139512-2.png) Figure 2. A North Korean operator experiments with face-swapping. DPRK IT workers incrementally advanced their infiltration methodology by implementing real-time deepfake technology. This offers two key operational advantages. First, it allows a single operator to interview for the same position multiple times using different synthetic personas. Second, it helps operatives avoid being identified and added to security bulletins and wanted notices like the one shown in Figure 3. Combined, it helps DPRK IT workers enjoy enhanced operational security and decreased detectability. ![Wanted poster by the FBI featuring photos of multiple individuals labeled as 'DPRK IT Workers' with their names displayed beneath each photo.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/04/word-image-317745-139512-3.png) Figure 3. A [wanted poster](https://www.fbi.gov/wanted/cyber/dprk-it-workers) for DPRK IT workers, retrieved on March 20, 2025. ## Zero to Passable A single researcher with no image manipulation experience, limited deepfake knowledge and a five-year-old computer created a synthetic identity for job interviews in 70 minutes. The ease of creation demonstrates how dangerously accessible this technology has become to threat actors. Using only an AI search engine, a passable internet connection and a GTX 3070 graphics processing unit purchased in late 2020, they produced the sample shown in Figure 4. Figure 4. A demonstration of a realtime deepfake on cheap and widely-available hardware. They used only single images generated by thispersonnotexist\[.\]org, which permits the use of generated faces for personal and commercial purposes, as well as free tools for deepfakes. With these, they generated multiple identities, as shown in Figure 5. Figure 5. A demonstration of identity switching. A simple wardrobe and background image change could be all it takes to come back to a hiring manager as a brand-new candidate. In fact, the most time-consuming part of this entire process was creating a virtual camera feed to capture in video conferencing software. With a little more time and a much more powerful graphics processing unit, a higher resolution version of the same process produced more convincing results, as shown in Figure 6. Figure 6. A higher quality deepfake using a more resource-intensive technique. ## Detection Opportunities There are several technical shortcomings in real-time deepfake systems that create detection opportunities: 1. **Temporal consistency issues**: Rapid head movements caused noticeable artifacts as the tracking system struggled to maintain accurate landmark positioning 2. **Occlusion handling**: When the operator's hand passed over their face, the deepfake system failed to properly reconstruct the partially obscured face 3. **Lighting adaptation**: Sudden changes in lighting conditions revealed inconsistencies in the rendering, particularly around the edges of the face 4. **Audio-visual synchronization**: Slight delays between lip movements and speech were detectable under careful observation At this time, there are several ways to make life difficult for the would-be deepfakers. The most effective method appears to be passing a hand over a face, which disrupts facial landmark tracking. Govind Mittal et al. of New York University [suggest additional strategies](https://arxiv.org/html/2210.06186v4): * Rapid head movements * Exaggerated facial expressions * Sudden lighting changes These techniques exploit weaknesses in real-time deepfake systems, causing visible artifacts that help humans detect fakes with high accuracy. We'll demonstrate three more options to add to an interviewer's repertoire in Figures 7a-c. Figure 7a. The "ear-to-shoulder." Figure 7b. The "nose show." Figure 7c. The "sky-or-ground." ## Mitigation Strategies The DPRK IT worker campaign demands close collaboration between human resources (HR) and information security teams. When both work together, it affords an organization more detection opportunities across the entire hiring and employment lifecycle. **Disclaimer**: The following are mitigation strategies meant to offer insights and suggestions for the reader's consideration. They are being provided for informational purposes only and should not be considered legal advice. Prior to implementing any of these practices, consult with your own legal counsel to confirm alignment with applicable laws. **For HR Teams:** * Ask candidates to turn their cameras on for interviews, including initial consultations * Record these sessions (with proper consent) for potential forensic analysis * Implement a comprehensive identity verification workflow that includes: * Document authenticity verification using automated forensic tools that check for security features, tampering indicators and consistency of information across submitted documents * ID verification with integrated liveness detection that requires candidates to present their physical ID while performing specific real-time actions * Matching between ID documents and interviewee, ensuring the person interviewing matches their purported identification * Train recruiters and technical interviewing teams to identify suspicious patterns in video interviews such as unnatural eye movement, lighting inconsistencies and audio-visual synchronization issues * Have interviewers get comfortable with asking candidates to perform movements challenging for deepfake software (e.g., profile turns, hand gestures near the face or rapid head movements) **For Security Teams:** * Secure the hiring pipeline by recording job application IP addresses and checking they aren't from anonymizing infrastructure or suspicious geographic regions * Enrich provided phone numbers to check if they are Voice over Internet Protocol (VoIP) carriers, particularly those commonly associated with identity concealment * Maintain information sharing agreements with partner companies and participate in applicable Information Sharing and Analysis Centers (ISACs) to stay current on the latest synthetic identity techniques * Identify and block software applications that enable [virtual webcam installation](https://democreator.wondershare.com/virtual-camera/virtual-camera-software.html) on corporate-managed devices when there is no legitimate business justification for their use. **Additional Indicators:** * Monitor for abnormal network access patterns post-hiring, particularly connections to anonymizing services or unauthorized data transfers * Deploy multi-factor authentication methods that require physical possession of devices, making identity impersonation more difficult **Organizational Policy Considerations:** * Develop clear protocols for handling suspected synthetic identity cases, including escalation procedures and evidence preservation methods * Create a security awareness program that educates all employees involved in hiring about synthetic identity red flags * Establish technical controls that limit access for new employees until additional verification milestones are reached * Document verification failures and share appropriate technical indicators with industry partners and relevant government agencies By implementing these layered detection and mitigation strategies, organizations can significantly reduce the risk of synthetic identity infiltration while maintaining an efficient hiring process for legitimate candidates. ## Conclusion The synthetic identity threat typified by North Korean IT worker operations represents an evolving challenge for organizations worldwide. Our research demonstrates the alarming accessibility of synthetic identity creation, with continuously lowering technical barriers as AI-generated faces, document forgery tools and real-time voice/video manipulation technologies become more sophisticated and readily available. As synthetic identity technologies continue to evolve, organizations must implement layered defense strategies that combine: * Enhanced verification procedures * AI-assisted countermeasures for deepfake detection * Continuous verification throughout employment This approach significantly improves an organization's ability to detect and mitigate against not only North Korean IT workers but also a variety of similar threats. No single detection method will guarantee protection against synthetic identity threats, but a layered defense strategy significantly improves your organization's ability to identify and mitigate these risks. By combining HR best practices with security controls, you can maintain an efficient hiring process while protecting against the sophisticated tactics employed by North Korean IT workers and similar threat actors. Palo Alto Networks customers can better protect against the threats discussed above through Unit 42 [Insider Threat Services](https://www.paloaltonetworks.com/resources/datasheets/unit42-insider-threat-services) to holistically improve detection and remediation. If you think you might have been compromised or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call: * North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) * UK: +44.20.3743.3660 * Europe and Middle East: +31.20.299.3130 * Asia: +65.6983.8730 * Japan: +81.50.1790.0200 * Australia: +61.2.4062.7950 * India: 00080005045107 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org). ## Additional Resources * [Fake North Korean IT Worker Linked to BeaverTail Video Conference App Phishing Attack](https://unit42.paloaltonetworks.com/fake-north-korean-it-worker-activity-cluster/) -- Unit 42, Palo Alto Networks * [Global Companies Are Unknowingly Paying North Koreans: Here's How to Catch Them](https://unit42.paloaltonetworks.com/north-korean-it-workers/) -- Unit 42, Palo Alto Networks * [Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of DPRK Threat Actors](https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/) -- Unit 42, Palo Alto Networks * [Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware](https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/) -- Unit 42, Palo Alto Networks * [Gotcha: Real-Time Video Deepfake Detection via Challenge-Response](https://arxiv.org/html/2210.06186v4) -- Govind Mittal, Chinmay Hegde, Nasir Memon * [AI fakers exposed in tech dev recruitment: postmortem](https://newsletter.pragmaticengineer.com/p/ai-fakers) -- Gergely Orosz, The Pragmatic Engineer * [Here's what happens in a deepfake interview](https://www.itbrew.com/stories/2024/09/20/here-s-what-happens-in-a-deepfake-interview) -- Billy Hurley, IT Brew * [The Emerging Dynamics of Deepfake Scam Campaigns on the Web](https://unit42.paloaltonetworks.com/dynamics-of-deepfake-scams/) - Unit 42 Back to top ### Tags * [DPRK](https://unit42.paloaltonetworks.com/tag/dprk/ "DPRK") * [Social engineering](https://unit42.paloaltonetworks.com/tag/social-engineering/ "social engineering") * [Wagemole](https://unit42.paloaltonetworks.com/tag/wagemole/ "Wagemole") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Cascading Shadows: An Attack Chain Approach to Avoid Detection and Complicate Analysis](https://unit42.paloaltonetworks.com/phishing-campaign-with-complex-attack-chain/ "Cascading Shadows: An Attack Chain Approach to Avoid Detection and Complicate Analysis") ### Table of Contents * ### Related Articles * [Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "article - table of contents") * [Inside the Modern SOC: The Identity Front Door](https://unit42.paloaltonetworks.com/soc-identity-front-door/ "article - table of contents") * [When "Hi, This Is IT" Comes Through Microsoft Teams](https://unit42.paloaltonetworks.com/microsoft-teams-phishing/ "article - table of contents") ## Related Cybercrime Resources ![Pictorial representation of Russian global webmail espionage campaign. A digital illustration of a world map in a network style, highlighting continents with glowing lines and connectivity points in a red and blue theme.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/06_Nation-State-cyberattacks_1920x900-1-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) July 23, 2026 [#### Russian Global Webmail Espionage](https://unit42.paloaltonetworks.com/russian-webmail-espionage/) * [CL-STA-1114](https://unit42.paloaltonetworks.com/tag/cl-sta-1114/ "CL-STA-1114") * [JavaScript](https://unit42.paloaltonetworks.com/tag/javascript/ "JavaScript") * [Javascript injection](https://unit42.paloaltonetworks.com/tag/javascript-injection/ "javascript injection") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/russian-webmail-espionage/ "Russian Global Webmail Espionage") ![Pictorial representation of a woman standing in a server room holding a laptop that projects a digital code overlay.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/06_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) May 28, 2026 [#### 2026 World Cup: Discussing The World's Biggest Game's Attack Surface](https://unit42.paloaltonetworks.com/fifa-world-cup-attack-surface/) * [Fiddling Scorpius](https://unit42.paloaltonetworks.com/tag/fiddling-scorpius/ "Fiddling Scorpius") * [Fighting Ursa](https://unit42.paloaltonetworks.com/tag/fighting-ursa/ "Fighting Ursa") * [Muddled Libra](https://unit42.paloaltonetworks.com/tag/muddled-libra/ "Muddled Libra") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/fifa-world-cup-attack-surface/ "2026 World Cup: Discussing The World’s Biggest Game’s Attack Surface") ![Pictoral representation of a man holding a cellphone with a bokeh skyline in the background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/05_Listicle_Category_1505x922-718x440.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) May 27, 2026 [#### Out of the Crypt: The Evolving Cyber Extortion Economy](https://unit42.paloaltonetworks.com/cyber-extortion-economy/) * [Bling Libra](https://unit42.paloaltonetworks.com/tag/bling-libra/ "Bling Libra") * [Extortion](https://unit42.paloaltonetworks.com/tag/extortion/ "Extortion") * [Frontier AI](https://unit42.paloaltonetworks.com/tag/frontier-ai/ "Frontier AI") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/cyber-extortion-economy/ "Out of the Crypt: The Evolving Cyber Extortion Economy") ![Pictorial representation of the APT Boggy Serpens. An illustrated blue snake is highlighted by a red circle against a night sky. The constellation serpens.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/Boggy-Serpens-1920x900-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) March 16, 2026 [#### Boggy Serpens Threat Assessment](https://unit42.paloaltonetworks.com/boggy-serpens-threat-assessment/) * [Advanced Persistent Threat](https://unit42.paloaltonetworks.com/tag/advanced-persistent-threat/ "Advanced Persistent Threat") * [Boggy Serpens](https://unit42.paloaltonetworks.com/tag/boggy-serpens/ "Boggy Serpens") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/boggy-serpens-threat-assessment/ "Boggy Serpens Threat Assessment") ![Pictorial representation of Muddled Libra, aka Scattered Spider. A vibrant illustration of the Libra zodiac sign, featuring a stylized balance scale overlaid with a prominent Libra symbol. The background is a starry night sky with shades of purple and blue, suggesting a cosmic theme.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/03-1-Muddle-Libra-1920x900-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/threat-actor-groups.svg)Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/) February 10, 2026 [#### A Peek Into Muddled Libra's Operational Playbook](https://unit42.paloaltonetworks.com/muddled-libra-ops-playbook/) * [Muddled Libra](https://unit42.paloaltonetworks.com/tag/muddled-libra/ "Muddled Libra") * [PowerShell](https://unit42.paloaltonetworks.com/tag/powershell/ "PowerShell") * [Scattered Spider](https://unit42.paloaltonetworks.com/tag/scattered-spider/ "Scattered Spider") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/muddled-libra-ops-playbook/ "A Peek Into Muddled Libra’s Operational Playbook") ![Pictorial representation of a group of individuals discussing an idea with a whiteboard.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/02_Listicle_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) February 3, 2026 [#### Why Smart People Fall For Phishing Attacks](https://unit42.paloaltonetworks.com/psychology-of-phishing/) * [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI") * [Phishing](https://unit42.paloaltonetworks.com/tag/phishing/ "phishing") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/psychology-of-phishing/ "Why Smart People Fall For Phishing Attacks") ![Pictorial representation of threat groups from Russia. The silhouette of a bear and the Ursa constellation inside an orange abstract planet. Abstract, stylized cosmic setting with vibrant blue and purple shapes, representing space and distant planetary bodies.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/01/Ursa-Russia-B-1920x900-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) January 29, 2026 [#### Understanding the Russian Cyberthreat to the 2026 Winter Olympics](https://unit42.paloaltonetworks.com/russian-cyberthreat-2026-winter-olympics/) * [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI") * [IoT](https://unit42.paloaltonetworks.com/tag/iot/ "IoT") * [Russia](https://unit42.paloaltonetworks.com/tag/russia/ "Russia") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/russian-cyberthreat-2026-winter-olympics/ "Understanding the Russian Cyberthreat to the 2026 Winter Olympics") ![Pictorial representation of 01flip ransomware written in Rust. Digital artwork of a pixelated U.S. dollar bill disintegrating into small blocks against a blue data matrix background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/12/05_Ransomware_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) December 10, 2025 [#### 01flip: Multi-Platform Ransomware Written in Rust](https://unit42.paloaltonetworks.com/new-ransomware-01flip-written-in-rust/) * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [CL-CRI-103](https://unit42.paloaltonetworks.com/tag/cl-cri-103/ "CL-CRI-103") * [Cryptocurrency](https://unit42.paloaltonetworks.com/tag/cryptocurrency/ "Cryptocurrency") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/new-ransomware-01flip-written-in-rust/ "01flip: Multi-Platform Ransomware Written in Rust") ![Pictorial representation of malicious LLMs. Close-up view of a digital wall displaying various glowing icons, representing a high-tech network interface.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/11/AdobeStock_1270203474-786x440.jpeg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) November 25, 2025 [#### The Dual-Use Dilemma of AI: Malicious LLMs](https://unit42.paloaltonetworks.com/dilemma-of-ai-malicious-llms/) * [Credential Harvesting](https://unit42.paloaltonetworks.com/tag/credential-harvesting/ "Credential Harvesting") * [Data exfiltration](https://unit42.paloaltonetworks.com/tag/data-exfiltration/ "data exfiltration") * [LLM](https://unit42.paloaltonetworks.com/tag/llm/ "LLM") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/dilemma-of-ai-malicious-llms/ "The Dual-Use Dilemma of AI: Malicious LLMs") ![Pictorial representation of Gh0st RAT malware. A woman analyzes code on a computer screen in an office setting, with another individual working in the background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/11/04_Security-Technology_Category_1505x922-718x440.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) November 14, 2025 [#### Digital Doppelgangers: Anatomy of Evolving Impersonation Campaigns Distributing Gh0st RAT](https://unit42.paloaltonetworks.com/impersonation-campaigns-deliver-gh0st-rat/) * [DLL Sideloading](https://unit42.paloaltonetworks.com/tag/dll-sideloading/ "DLL Sideloading") * [Gh0st Rat](https://unit42.paloaltonetworks.com/tag/gh0st-rat/ "Gh0st Rat") * [PDNS](https://unit42.paloaltonetworks.com/tag/pdns/ "PDNS") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/impersonation-campaigns-deliver-gh0st-rat/ "Digital Doppelgangers: Anatomy of Evolving Impersonation Campaigns Distributing Gh0st RAT") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/content/pan/en_US/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)