[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/notepad-infrastructure-compromise/) * [Spanish (LATAM)](https://unit42.paloaltonetworks.com/es-la/notepad-infrastructure-compromise/) * [French](https://unit42.paloaltonetworks.com/fr/notepad-infrastructure-compromise/) * [Japanese](https://unit42.paloaltonetworks.com/ja/notepad-infrastructure-compromise/) * [Portuguese](https://unit42.paloaltonetworks.com/pt-br/notepad-infrastructure-compromise/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/ "High Profile Threats") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # Nation-State Actors Exploit Notepad++ Supply Chain ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 8 min read Related Products [![Advanced DNS Security icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced DNS Security](https://unit42.paloaltonetworks.com/product-category/advanced-dns-security/ "Advanced DNS Security")[![Advanced Threat Prevention icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced Threat Prevention](https://unit42.paloaltonetworks.com/product-category/advanced-threat-prevention/ "Advanced Threat Prevention")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Cortex icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex](https://unit42.paloaltonetworks.com/product-category/cortex/ "Cortex")[![Cortex Cloud icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex Cloud](https://unit42.paloaltonetworks.com/product-category/cortex-cloud/ "Cortex Cloud")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Cortex XSIAM icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XSIAM](https://unit42.paloaltonetworks.com/product-category/cortex-xsiam/ "Cortex XSIAM")[![Managed Threat Hunting icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Managed Threat Hunting](https://unit42.paloaltonetworks.com/product-category/managed-threat-hunting/ "Managed Threat Hunting")[![Next-Generation Firewall icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Justin Moore](https://unit42.paloaltonetworks.com/author/justin-moore/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:February 11, 2026 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/) * [Cobalt Strike](https://unit42.paloaltonetworks.com/tag/cobalt-strike/) * [DLL Sideloading](https://unit42.paloaltonetworks.com/tag/dll-sideloading/) * [Supply chain](https://unit42.paloaltonetworks.com/tag/supply-chain/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/notepad-infrastructure-compromise/?pdf=download&lg=en&_wpnonce=279fa6c5e6 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/notepad-infrastructure-compromise/?pdf=print&lg=en&_wpnonce=279fa6c5e6 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Nation-State%20Actors%20Exploit%20Notepad++%20Supply%20Chain&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fnotepad-infrastructure-compromise%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnotepad-infrastructure-compromise%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnotepad-infrastructure-compromise%2F&title=Nation-State%20Actors%20Exploit%20Notepad++%20Supply%20Chain "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnotepad-infrastructure-compromise%2F&text=Nation-State%20Actors%20Exploit%20Notepad++%20Supply%20Chain "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnotepad-infrastructure-compromise%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Nation-State%20Actors%20Exploit%20Notepad++%20Supply%20Chain%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fnotepad-infrastructure-compromise%2F "Share in Mastodon") ## Executive Summary Between June and December 2025, the official hosting infrastructure for the text editor [Notepad++ was compromised](https://notepad-plus-plus.org/news/hijacked-incident-info-update/) by a state-sponsored threat group known as [Lotus Blossom](https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/). The attackers breached the shared hosting provider's environment. This allowed the attackers to intercept and redirect traffic destined for the Notepad++ update server. This infrastructure-level hijack enabled the attackers to selectively target specific users. The targets were primarily located in Southeast Asia across government, telecommunications and critical infrastructure sectors. Attackers served these targets malicious update manifests instead of legitimate software updates. We've identified additional unreported infrastructure, which is linked to this campaign. We've observed two chains of infection including a Lua script injection variant that resulted in the delivery of Cobalt Strike beacon malware as well as DLL side-loading to deliver a Chrysalis backdoor. Unit 42 also found that this threat activity is targeting more sectors and more regions than previously reported. This campaign also affected the following sectors in South America, the U.S., Europe and Southeast Asia: * Cloud hosting * Energy * Financial * Government * Manufacturing * Software development Notepad++ is a lightweight, open-source code editor and text replacement utility. This tool is widely favored for its speed, extensive plugin ecosystem and unique ability to handle massive data files while persisting sessions that users have not yet saved. In enterprise environments, Notepad++ often serves as a foundational instrument for system administrators, network engineers and DevOps personnel. These personnel commonly use this tool to modify server configurations, parse heavy system logs and audit code on secure jump boxes where heavier applications are impractical. This specific user demographic makes Notepad++ a strategically critical target for threat actors. Compromising this single tool allows attackers to effectively bypass perimeter defenses and piggyback into the sessions of the most privileged users in the organization, gaining implicit administrative access to the network's core infrastructure. Palo Alto Networks customers receive protections from and mitigations for the activity discussed in this article in the following ways: * [Advanced URL Filtering](https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-new-features/url-filtering-features/advanced-url-filtering) and [Advanced DNS Security](https://docs.paloaltonetworks.com/dns-security) identify known URLs and domains associated with this activity as malicious * [Advanced WildFire](https://docs.paloaltonetworks.com/wildfire) machine-learning models and analysis techniques have been reviewed and updated in light of the indicators shared in this research * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) helps detect and prevent the malicious operations or configuration alterations or exploitations discussed within this article * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) and [XSIAM](https://www.paloaltonetworks.com/resources/datasheets/cortex-xsiam-aag) by employing the [Malware Prevention Engine](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-4.x-Documentation/Malware-protection) * [Next-Generation Firewall](https://docs.paloaltonetworks.com/ngfw) with the [Advanced Threat Prevention](https://docs.paloaltonetworks.com/advanced-threat-prevention/administration) is designed to defend networks against both commodity threats and targeted threats The [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) can also be engaged to help with a compromise or to provide a proactive assessment to lower your risk. | **Related Unit 42 Topics** | [**DLL Sideloading**](https://unit42.paloaltonetworks.com/tag/dll-sideloading/), [**Backdoors**](https://unit42.paloaltonetworks.com/tag/backdoor/), [**Supply Chain**](https://unit42.paloaltonetworks.com/tag/supply-chain/), **[Cobalt Strike](https://unit42.paloaltonetworks.com/tag/cobalt-strike/)** | |----------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| ## Details of the Attack on Notepad++ This supply chain attack relied on exploiting insufficient verification controls in older versions of the Notepad++ updater, [WinGUp](https://wingup.org/). This exploitation allowed the threat group to redirect traffic to attacker-controlled servers. When targeted victims attempted to update their software, they downloaded a malicious NSIS installer. This installer --- often named update.exe --- initiated a complex infection chain. This chain used DLL sideloading techniques and misused a legitimate Bitdefender component (BluetoothService.exe) to load a malicious library (log.dll) that decrypted and executed a custom backdoor. In another infection chain, attackers [utilized](https://securelist.com/notepad-supply-chain-attack/118708/) an NSIS installer to execute a command to run a malicious Lua script to load Cobalt Strike Beacon. This malware, called [Chrysalis](https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/), employed advanced evasion techniques. These included: * Using Microsoft [Warbird](https://websec.net/blog/a-deep-dive-into-microsoft-warbird-mss-kernel-mode-dynamic-packer-68ee2c87b251081f55ec8c31) code protection framework * Custom API hashing to reduce antivirus detection * Establishing persistent remote control over infected systems ### Additional Exploitation Activity in This Campaign Unit 42 observed evidence of two separate attack sequences: * One in which a malicious NSIS installer drops a compiled Lua script containing an installer to download and execute a Cobalt Strike Beacon payload * One in which attackers used DLL side-loading to inject the Chrysalis backdoor into memory We observed additional activity dating between mid-August and November 2025 that was consistent with this exploitation activity. In an August incident, we observed communication with a command-and-control (C2) IP address 45.76.155\[.\]202. After days of C2 beacon traffic to this IP address, attackers shifted to a second C2 server at 45.77.31\[.\]210, with communication lasting until September. In cases between September and November 2025, we observed activity consistent with outbound connections to a C2 server. These were followed by subsequent download requests for update.exe that are consistent with the reported Chrysalis backdoor. In some cases, download attempts were made to an IP address, whereas others were made to domains. Successful beacons to malicious servers occurred within seconds of successful download of the malicious payload and continued for an unspecified amount of time. In September and October 2025, we observed a Lua script injection variant deploying malicious Lua scripts to inject shellcode. This attack used the EnumWindowStationsW API and resulted in the delivery of Cobalt Strike beacon malware. In this case, the download originated from: * 45\.76.155\[.\]202/update/update.exe Separately, we also observed a Bluetooth DLL sideloading variant in the same case. This Lua variant uses Bluetooth service DLL sideloading techniques to deploy the Chrysalis backdoor. Download attempts for this variant were made from a different malicious server: * 45\.32.144\[.\]255/update/update.exe ## Interim Guidance [Notepad++ recommends](https://notepad-plus-plus.org/news/hijacked-incident-info-update/) the following: * Downloading version 8.9.1, which includes the relevant security enhancement * Running the installer to update your Notepad++ manually According to Notepad++, they have migrated their website to a new hosting provider with significantly stronger security practices. Within Notepad++ itself, they enhanced the WinGup updater in v8.8.9 to verify both the certificate and the signature of the downloaded installer. Additionally, they also note: * The XML returned by the update server is now signed (XMLDSig) * Certificate and signature verification will be enforced starting with the upcoming version 8.9.2, which they expect to release in about a month ## Unit 42 Managed Threat Hunting Queries The Unit 42 Managed Threat Hunting team continues to track any signs of misuse or anomalous activity, using Cortex XDR and the XQL queries below. Cortex XDR customers can also use these XQL queries to assist with their investigations or hunting. As the majority of activity likely occurred prior to December 2, we recommend reviewing data retention limits to determine if these queries will be effective in your environment. If available in your environment, you may consider using "cold storage" queries (cold\_dataset = xdr\_data) to query data beyond hot retention limits. Please note that running queries against cold storage will consume compute units. // Name: DLL sideloading via BYO application // Description: Identifies renamed Bitdefender utility loading a log.dll file // MITRE TTP ID: T1574.001 config case\_sensitive = false | dataset = xdr\_data | fields actor\_process\_signature\_vendor, actor\_process\_signature\_product, action\_module\_path, actor\_process\_image\_path, actor\_process\_image\_sha256, agent\_os\_type, event\_type, event\_id, agent\_hostname, \_time, actor\_process\_image\_name | filter event\_type = ENUM.LOAD\_IMAGE and agent\_os\_type = ENUM.AGENT\_OS\_WINDOWS | filter actor\_process\_signature\_vendor contains "Bitdefender SRL" and action\_module\_path contains "log.dll" | filter actor\_process\_image\_path not contains "Program Files\\Bitdefender" | filter not actor\_process\_image\_name in ("eps.rmm64.exe", "downloader.exe", "installer.exe", "epconsole.exe", "EPHost.exe", "epintegrationservice.exe", "EPPowerConsole.exe", "epprotectedservice.exe", "DiscoverySrv.exe", "epsecurityservice.exe", "EPSecurityService.exe", "epupdateservice.exe", "testinitsigs.exe", "EPHost.Integrity.exe", "WatchDog.exe", "ProductAgentService.exe", "EPLowPrivilegeWorker.exe", "Product.Configuration.Tool.exe", "eps.rmm.exe") |-------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 | // Name: DLL sideloading via BYO application // Description: Identifies renamed Bitdefender utility loading a log.dll file // MITRE TTP ID: T1574.001 config case\_sensitive = false | dataset = xdr\_data | fields actor\_process\_signature\_vendor, actor\_process\_signature\_product, action\_module\_path, actor\_process\_image\_path, actor\_process\_image\_sha256, agent\_os\_type, event\_type, event\_id, agent\_hostname, \_time, actor\_process\_image\_name | filter event\_type = ENUM.LOAD\_IMAGE and agent\_os\_type = ENUM.AGENT\_OS\_WINDOWS | filter actor\_process\_signature\_vendor contains "Bitdefender SRL" and action\_module\_path contains "log.dll" | filter actor\_process\_image\_path not contains "Program Files\\Bitdefender" | filter not actor\_process\_image\_name in ("eps.rmm64.exe", "downloader.exe", "installer.exe", "epconsole.exe", "EPHost.exe", "epintegrationservice.exe", "EPPowerConsole.exe", "epprotectedservice.exe", "DiscoverySrv.exe", "epsecurityservice.exe", "EPSecurityService.exe", "epupdateservice.exe", "testinitsigs.exe", "EPHost.Integrity.exe", "WatchDog.exe", "ProductAgentService.exe", "EPLowPrivilegeWorker.exe", "Product.Configuration.Tool.exe", "eps.rmm.exe") | // Name: Chrysalis Mutex // Description: Identifies a Mutex known to be related to the chrysalis backdoor malware // MITRE TTP ID: T1480.002 config case\_sensitive = false | dataset = xdr\_data | fields \_time, agent\_hostname, actor\_effective\_username, actor\_process\_image\_name, actor\_process\_image\_path, actor\_process\_command\_line, event\_type, event\_sub\_type, action\_syscall\_string\_params | filter event\_type = ENUM.SYSTEM\_CALL and event\_sub\_type = ENUM.SYSTEM\_CALL\_NT\_CREATE\_MUTANT | alter mutex = json\_extract\_scalar(action\_syscall\_string\_params, "$.1") | filter mutex = "Global\\\\Jdhfv\_1.0.1" |-------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 | // Name: Chrysalis Mutex // Description: Identifies a Mutex known to be related to the chrysalis backdoor malware // MITRE TTP ID: T1480.002 config case\_sensitive = false | dataset = xdr\_data | fields \_time, agent\_hostname, actor\_effective\_username, actor\_process\_image\_name, actor\_process\_image\_path, actor\_process\_command\_line, event\_type, event\_sub\_type, action\_syscall\_string\_params | filter event\_type = ENUM.SYSTEM\_CALL and event\_sub\_type = ENUM.SYSTEM\_CALL\_NT\_CREATE\_MUTANT | alter mutex = json\_extract\_scalar(action\_syscall\_string\_params, "$.1") | filter mutex = "Global\\\\Jdhfv\_1.0.1" | // Name: GUP.exe Writing Unusual Files to Temp Folder // Description: Detects cases where the Notepad++ updater (gup.exe) writes files to a temp folder that that deviate from the normal and expected. // MITRE TTP ID: T1036.005 config case\_sensitive = false | dataset = xdr\_data | fields _time, agent\_hostname, event\_type, event\_sub\_type, action\_file\_name, action\_file\_path, actor\_effective\_username, action\_file\_extension, action\_file\_previous\_file\_path, action\_file\_sha256, action\_file\_size, actor\_process\_image\_name, actor\_process\_image\_path, actor\_process\_command\_line, actor\_process\_image\_sha256, causality\_actor\_process\_image\_name, causality\_actor\_process\_image\_path, os\_actor\_primary\_username, os\_actor\_process\_command\_line, os\_actor\_process\_image\_name, os\_actor\_process\_image\_path, agent\_os\_type | filter event\_type = ENUM.FILE and event\_sub\_type = ENUM.FILE\_WRITE | filter lowercase(actor\_process\_image\_name) = "gup.exe" and action\_file\_sha256 != null | filter lowercase(actor\_process\_command\_line) !~= "((\\\\notepad\\+\\+(?:_?x?\\d+?)??|\\\\nppp?\[\\.\\d\]\*?(?:portable)??(?:\\.x64)??).\*?\\\\plugins|-ihttps:\\/\\/notepad-plus-plus\\.org\\/update\\/getdownloadurl\\.php)" and lowercase(action\_file\_path) ~= "(\\\\appdata\\\\local\\\\temp\\\\|\\\\windows\\\\temp)" and lowercase(action\_file\_name) !~= "(npp\[\\.\\d\]+?installer)" | sort desc \_time |-------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 | // Name: GUP.exe Writing Unusual Files to Temp Folder // Description: Detects cases where the Notepad++ updater (gup.exe) writes files to a temp folder that that deviate from the normal and expected. // MITRE TTP ID: T1036.005 config case\_sensitive = false | dataset = xdr\_data | fields _time, agent\_hostname, event\_type, event\_sub\_type, action\_file\_name, action\_file\_path, actor\_effective\_username, action\_file\_extension, action\_file\_previous\_file\_path, action\_file\_sha256, action\_file\_size, actor\_process\_image\_name, actor\_process\_image\_path, actor\_process\_command\_line, actor\_process\_image\_sha256, causality\_actor\_process\_image\_name, causality\_actor\_process\_image\_path, os\_actor\_primary\_username, os\_actor\_process\_command\_line, os\_actor\_process\_image\_name, os\_actor\_process\_image\_path, agent\_os\_type | filter event\_type = ENUM.FILE and event\_sub\_type = ENUM.FILE\_WRITE | filter lowercase(actor\_process\_image\_name) = "gup.exe" and action\_file\_sha256 != null | filter lowercase(actor\_process\_command\_line) !~= "((\\\\notepad\\+\\+(?:_?x?\\d+?)??|\\\\nppp?\[\\.\\d\]\*?(?:portable)??(?:\\.x64)??).\*?\\\\plugins|-ihttps:\\/\\/notepad-plus-plus\\.org\\/update\\/getdownloadurl\\.php)" and lowercase(action\_file\_path) ~= "(\\\\appdata\\\\local\\\\temp\\\\|\\\\windows\\\\temp)" and lowercase(action\_file\_name) !~= "(npp\[\\.\\d\]+?installer)" | sort desc \_time | // Name: GUP.exe Downloading Improperly Signed Installer // MITRE TTP ID: T1036.001 config case\_sensitive = false | dataset = xdr\_data | fields \_time, agent\_hostname, event\_type, event\_sub\_type, action\_process\_username, action\_process\_user\_sid, action\_process\_image\_name, action\_process\_image\_path, action\_process\_image\_command\_line, action\_process\_image\_sha256, action\_process\_os\_pid, action\_process\_cwd, action\_process\_file\_info, action\_process\_file\_size, action\_process\_file\_web\_mark, action\_process\_signature\_vendor, action\_process\_signature\_product, action\_process\_signature\_status, actor\_effective\_username, actor\_effective\_user\_sid, actor\_process\_image\_name, actor\_process\_image\_path, actor\_process\_command\_line, actor\_process\_signature\_vendor, actor\_process\_signature\_product, actor\_process\_signature\_status, causality\_actor\_primary\_username, causality\_actor\_process\_image\_name, causality\_actor\_process\_image\_path, causality\_actor\_process\_command\_line, os\_actor\_primary\_username, os\_actor\_process\_image\_name, os\_actor\_process\_image\_path, os\_actor\_process\_image\_command\_line, os\_actor\_process\_image\_sha256, action\_process\_instance\_id, actor\_process\_instance\_id, causality\_actor\_process\_instance\_id, agent\_os\_type, agent\_id | filter event\_type = ENUM.PROCESS and event\_sub\_type = ENUM.PROCESS\_START and \_product = "XDR agent" and \_vendor = "PANW" | filter lowercase(actor\_process\_image\_name) = "gup.exe" and actor\_process\_signature\_status not in (null, ENUM.UNSUPPORTED, ENUM.FAILED\_TO\_OBTAIN ) and action\_process\_signature\_status not in (null, ENUM.UNSUPPORTED, ENUM.FAILED\_TO\_OBTAIN ) and action\_process\_image\_sha256 not in ( "71431fa7b66f8132453e18e3a5f8ef0af3ca079a7793f828df06fdb5d7bd915d", "2dd5473736ef51e4340cae005e3fc8cdf0e42ec649bc6ed186484a79be409928", "a19aa1cd7ecb9ca3f1fd0e118fffd0d673fba404ced8c39c2e210a63b70f9c15", "e22abc9af328d063e652f0829819124a6a748c224bc8b10f98473f87cda2c0cd", "61c3077b989e272117167c90fc35e7f06bea4f992f3395b40ccee083d7258082", "49d2531893b09cb6a8e3429ca0a734e871a2d96fa2575c0eec3229d383fa233a", "32aa12d3c9521477a5a1e086e400ec0f77f8a97a8190806a0f1953688b883cfb", "8117c82a3821965d92ee3f9f3ae10efcd602bd4b6e52a2fe957d70aafe479744", "05abc57952974d08feafa399d6fdb37945a3fd0a10f37833dd837a5788e421d5", "c6d1e5aacbf69aa18df4caf1346fd69638491a5ad0085729bae91c662d1c62bb", "e1df78704001bba1a3d343f62a1242a4484ff6ad269170714263c03b802eb0b1", "7094a07167648628e47249a16d9d6db922e5aa1255ac4322a2e4900d233372dd" ) | filter lowercase(action\_process\_image\_name) ~= "(npp\[\\.\\d\]+?installer)" | dedup agent\_id by desc \_time | filter action\_process\_signature\_status != ENUM.SIGNED or lowercase(action\_process\_signature\_vendor) != "notepad++" | sort desc \_time |-------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 | // Name: GUP.exe Downloading Improperly Signed Installer // MITRE TTP ID: T1036.001 config case\_sensitive = false | dataset = xdr\_data | fields \_time, agent\_hostname, event\_type, event\_sub\_type, action\_process\_username, action\_process\_user\_sid, action\_process\_image\_name, action\_process\_image\_path, action\_process\_image\_command\_line, action\_process\_image\_sha256, action\_process\_os\_pid, action\_process\_cwd, action\_process\_file\_info, action\_process\_file\_size, action\_process\_file\_web\_mark, action\_process\_signature\_vendor, action\_process\_signature\_product, action\_process\_signature\_status, actor\_effective\_username, actor\_effective\_user\_sid, actor\_process\_image\_name, actor\_process\_image\_path, actor\_process\_command\_line, actor\_process\_signature\_vendor, actor\_process\_signature\_product, actor\_process\_signature\_status, causality\_actor\_primary\_username, causality\_actor\_process\_image\_name, causality\_actor\_process\_image\_path, causality\_actor\_process\_command\_line, os\_actor\_primary\_username, os\_actor\_process\_image\_name, os\_actor\_process\_image\_path, os\_actor\_process\_image\_command\_line, os\_actor\_process\_image\_sha256, action\_process\_instance\_id, actor\_process\_instance\_id, causality\_actor\_process\_instance\_id, agent\_os\_type, agent\_id | filter event\_type = ENUM.PROCESS and event\_sub\_type = ENUM.PROCESS\_START and \_product = "XDR agent" and \_vendor = "PANW" | filter lowercase(actor\_process\_image\_name) = "gup.exe" and actor\_process\_signature\_status not in (null, ENUM.UNSUPPORTED, ENUM.FAILED\_TO\_OBTAIN ) and action\_process\_signature\_status not in (null, ENUM.UNSUPPORTED, ENUM.FAILED\_TO\_OBTAIN ) and action\_process\_image\_sha256 not in ( "71431fa7b66f8132453e18e3a5f8ef0af3ca079a7793f828df06fdb5d7bd915d", "2dd5473736ef51e4340cae005e3fc8cdf0e42ec649bc6ed186484a79be409928", "a19aa1cd7ecb9ca3f1fd0e118fffd0d673fba404ced8c39c2e210a63b70f9c15", "e22abc9af328d063e652f0829819124a6a748c224bc8b10f98473f87cda2c0cd", "61c3077b989e272117167c90fc35e7f06bea4f992f3395b40ccee083d7258082", "49d2531893b09cb6a8e3429ca0a734e871a2d96fa2575c0eec3229d383fa233a", "32aa12d3c9521477a5a1e086e400ec0f77f8a97a8190806a0f1953688b883cfb", "8117c82a3821965d92ee3f9f3ae10efcd602bd4b6e52a2fe957d70aafe479744", "05abc57952974d08feafa399d6fdb37945a3fd0a10f37833dd837a5788e421d5", "c6d1e5aacbf69aa18df4caf1346fd69638491a5ad0085729bae91c662d1c62bb", "e1df78704001bba1a3d343f62a1242a4484ff6ad269170714263c03b802eb0b1", "7094a07167648628e47249a16d9d6db922e5aa1255ac4322a2e4900d233372dd" ) | filter lowercase(action\_process\_image\_name) ~= "(npp\[\\.\\d\]+?installer)" | dedup agent\_id by desc \_time | filter action\_process\_signature\_status != ENUM.SIGNED or lowercase(action\_process\_signature\_vendor) != "notepad++" | sort desc \_time | // Name: GUP.exe Spawning Unusual Subprocesses // Description: Detects cases where the Notepad++ updater (gup.exe) spawns child processes that deviate from the normal and expected. // MITRE TTP ID: T1202 config case\_sensitive = false | dataset = xdr\_data | fields \_time, agent\_hostname, event\_type, event\_sub\_type, action\_process\_username, action\_process\_user\_sid, action\_process\_image\_name, action\_process\_image\_path, action\_process\_image\_command\_line, action\_process\_image\_sha256, action\_process\_os\_pid, action\_process\_cwd, action\_process\_file\_info, action\_process\_file\_size, action\_process\_file\_web\_mark, action\_process\_signature\_vendor, action\_process\_signature\_product, action\_process\_signature\_status, actor\_effective\_username, actor\_effective\_user\_sid, actor\_process\_image\_name, actor\_process\_image\_path, actor\_process\_command\_line, actor\_process\_signature\_vendor, actor\_process\_signature\_product, actor\_process\_signature\_status, causality\_actor\_primary\_username, causality\_actor\_process\_image\_name, causality\_actor\_process\_image\_path, causality\_actor\_process\_command\_line, os\_actor\_primary\_username, os\_actor\_process\_image\_name, os\_actor\_process\_image\_path, os\_actor\_process\_image\_command\_line, os\_actor\_process\_image\_sha256, action\_process\_instance\_id, actor\_process\_instance\_id, causality\_actor\_process\_instance\_id, agent\_os\_type, agent\_id | filter event\_type = ENUM.PROCESS and event\_sub\_type = ENUM.PROCESS\_START | filter lowercase(actor\_process\_image\_name) = "gup.exe" | filter lowercase(action\_process\_image\_name) !~= "(npp\[\\.\\d\]+?installer|consent\\.exe|explorer\\.exe|werfault\\.exe|smartscreen\\.exe|adminbyrequest\\.exe|openwith\\.exe)" and lowercase(action\_process\_image\_command\_line) !~= "(https:\\/\\/notepad-plus-plus\\.org\\/|https:\\/\\/npp-user-manual\\.org\\/)" and lowercase(actor\_process\_command\_line) !~= "(\\\\notepad\\+\\+\\\\plugins|https:\\/\\/notepad-plus-plus\\.org\\/)" | sort desc \_time |-------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 | // Name: GUP.exe Spawning Unusual Subprocesses // Description: Detects cases where the Notepad++ updater (gup.exe) spawns child processes that deviate from the normal and expected. // MITRE TTP ID: T1202 config case\_sensitive = false | dataset = xdr\_data | fields \_time, agent\_hostname, event\_type, event\_sub\_type, action\_process\_username, action\_process\_user\_sid, action\_process\_image\_name, action\_process\_image\_path, action\_process\_image\_command\_line, action\_process\_image\_sha256, action\_process\_os\_pid, action\_process\_cwd, action\_process\_file\_info, action\_process\_file\_size, action\_process\_file\_web\_mark, action\_process\_signature\_vendor, action\_process\_signature\_product, action\_process\_signature\_status, actor\_effective\_username, actor\_effective\_user\_sid, actor\_process\_image\_name, actor\_process\_image\_path, actor\_process\_command\_line, actor\_process\_signature\_vendor, actor\_process\_signature\_product, actor\_process\_signature\_status, causality\_actor\_primary\_username, causality\_actor\_process\_image\_name, causality\_actor\_process\_image\_path, causality\_actor\_process\_command\_line, os\_actor\_primary\_username, os\_actor\_process\_image\_name, os\_actor\_process\_image\_path, os\_actor\_process\_image\_command\_line, os\_actor\_process\_image\_sha256, action\_process\_instance\_id, actor\_process\_instance\_id, causality\_actor\_process\_instance\_id, agent\_os\_type, agent\_id | filter event\_type = ENUM.PROCESS and event\_sub\_type = ENUM.PROCESS\_START | filter lowercase(actor\_process\_image\_name) = "gup.exe" | filter lowercase(action\_process\_image\_name) !~= "(npp\[\\.\\d\]+?installer|consent\\.exe|explorer\\.exe|werfault\\.exe|smartscreen\\.exe|adminbyrequest\\.exe|openwith\\.exe)" and lowercase(action\_process\_image\_command\_line) !~= "(https:\\/\\/notepad-plus-plus\\.org\\/|https:\\/\\/npp-user-manual\\.org\\/)" and lowercase(actor\_process\_command\_line) !~= "(\\\\notepad\\+\\+\\\\plugins|https:\\/\\/notepad-plus-plus\\.org\\/)" | sort desc \_time | ## Conclusion This campaign marks a notable evolution in the operational tradecraft of threat actors of this type, representing a pivot from broad infrastructure pre-positioning to highly targeted "soft" supply chain interdiction. Recent campaigns from groups like Volt Typhoon and Salt Typhoon have focused primarily on compromising critical infrastructure backbones and edge devices, relying on living-off-the-land techniques and minimal malware. This operation instead illuminates a distinct strategic priority of focusing on administrative keyholders. Hijacking the traffic flow of a trusted utility rather than injecting code into the software build pipeline allowed the threat actors to weaponize their delivery mechanism without alerting the vendor. This adversary-in-the-middle (AitM) capability allowed for dynamic fingerprinting of incoming update requests, enabling for highly selective filtering of priority targets. This campaign is not focused on disruption, but on long-term valuable intelligence. This is illustrated by the combination of the threat actor's selective victimology --- focused on system administrators and developers in many geopolitically strategic regions --- and their choice to use a lightweight backdoor with a low-profile. Palo Alto Networks has shared our findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org/). Palo Alto Networks customers are better protected by our products, as listed below. We will update this threat brief as more relevant information becomes available. ## Palo Alto Networks Product Protections Palo Alto Networks customers can leverage a variety of product protections and updates to identify and defend against this threat. If you think you might have been compromised or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call: * North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) * UK: +44.20.3743.3660 * Europe and Middle East: +31.20.299.3130 * Asia: +65.6983.8730 * Japan: +81.50.1790.0200 * Australia: +61.2.4062.7950 * India: 000 800 050 45107 * South Korea: +82.080.467.8774 ### Advanced WildFire [Advanced WildFire](https://docs.paloaltonetworks.com/wildfire) machine-learning models and analysis techniques have been reviewed and updated in light of the indicators shared in this research. ### Next-Generation Firewalls With Advanced Threat Prevention [Next-Generation Firewall](https://docs.paloaltonetworks.com/ngfw) with the [Advanced Threat Prevention](https://docs.paloaltonetworks.com/advanced-threat-prevention/administration) is designed to defend networks against both commodity threats and targeted threats. ### Cloud-Delivered Security Services for the Next-Generation Firewall [Advanced URL Filtering](https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-new-features/url-filtering-features/advanced-url-filtering) and [Advanced DNS Security](https://docs.paloaltonetworks.com/dns-security) identify known URLs and domains associated with this activity as malicious. ### Cortex XDR and XSIAM [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) and [XSIAM](https://www.paloaltonetworks.com/resources/datasheets/cortex-xsiam-aag) help to prevent the threats described in this article by employing the [Malware Prevention Engine](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-4.x-Documentation/Malware-protection). This approach combines several layers of protection, including [Advanced WildFire](https://docs.paloaltonetworks.com/wildfire), Behavioral Threat Protection and the Local Analysis module, to prevent both known and unknown malware from causing harm to endpoints. ### Cortex Cloud Organizations using [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud), such as those within the cloud hosting industry which were actively targeted during this campaign, are better protected from the downloading and execution of the malware mentioned within this article through the proper placement of Cortex Cloud [XDR endpoint agent](https://docs-cortex.paloaltonetworks.com/r/Cortex-CLOUD/Cortex-Cloud-Runtime-Security-Documentation/Endpoint-protection) and [serverless agents](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Premium-Documentation/Use-cases) within a cloud environment. Designed to protect a cloud's posture and runtime operations against these threats, Cortex Cloud helps detect and prevent the malicious operations or configuration alterations or exploitations discussed within this article. ## Indicators of Compromise * 1f6d28370f4c2b13f3967b38f67f77eee7f5fba9e7743b6c66a8feb18ae8f33e * a3cf1c86731703043b3614e085b9c8c224d4125370f420ad031ad63c14d6c3ec * a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9 * skycloudcenter\[.\]com * self-dns\[.\]it\[.\]com * safe-dns\[.\]it\[.\]com * cdncheck\[.\]it\[.\]com * 95\[.\]179\[.\]213\[.\]0 * 45\[.\]76\[.\]155\[.\]202 * 45\[.\]77\[.\]31\[.\]210 * 61\[.\]4\[.\]102\[.\]97 * 59\[.\]110\[.\]7\[.\]32 * 95\[.\]179\[.\]213\[.\]0/update/AutoUpdater.exe * 95\[.\]179\[.\]213\[.\]0/update/Upgrade.exe * 45\[.\]32\[.\]144\[.\]255/update/update.exe * 45\[.\]76\[.\]155\[.\]202/update/update.exe * 59\[.\]110\[.\]7\[.\]32/dpixel * self-dns\[.\]it\[.\]com/help/Get-Start * self-dns\[.\]it\[.\]com/resolve * self-dns\[.\]it\[.\]com/dns-query * safe-dns\[.\]it\[.\]com/help/Get-Start * safe-dns\[.\]it\[.\]com/resolve * safe-dns\[.\]it\[.\]com/dns-query Back to top ### Tags * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Cobalt Strike](https://unit42.paloaltonetworks.com/tag/cobalt-strike/ "Cobalt Strike") * [DLL Sideloading](https://unit42.paloaltonetworks.com/tag/dll-sideloading/ "DLL Sideloading") * [Supply chain](https://unit42.paloaltonetworks.com/tag/supply-chain/ "supply chain") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: A Peek Into Muddled Libra's Operational Playbook](https://unit42.paloaltonetworks.com/muddled-libra-ops-playbook/ "A Peek Into Muddled Libra’s Operational Playbook") ### Table of Contents * ### Related Articles * [The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "article - table of contents") * [Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain](https://unit42.paloaltonetworks.com/sdlc-supply-chain/ "article - table of contents") * [The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15)](https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/ "article - table of contents") ## Related Malware Resources ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/) * [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API") * [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway") * [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)