[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/operation-falcon-ii-silverterrier-nigerian-bec/) * [Japanese](https://unit42.paloaltonetworks.com/ja/operation-falcon-ii-silverterrier-nigerian-bec/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Business Email Compromise](https://unit42.paloaltonetworks.com/category/business-email-compromise/ "Business Email Compromise") [Business Email Compromise](https://unit42.paloaltonetworks.com/category/business-email-compromise/) # Operation Falcon II: Unit 42 Helps INTERPOL Identify Nigerian Business Email Compromise Ring Members ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 9 min read Related Products [![Advanced Threat Prevention icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced Threat Prevention](https://unit42.paloaltonetworks.com/product-category/advanced-threat-prevention/ "Advanced Threat Prevention")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Unit 42](https://unit42.paloaltonetworks.com/author/unit42/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:January 19, 2022 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Business Email Compromise](https://unit42.paloaltonetworks.com/category/business-email-compromise/) * [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Nigeria](https://unit42.paloaltonetworks.com/tag/nigeria/) * [SilverTerrier](https://unit42.paloaltonetworks.com/tag/silverterrier/) * [Syndicate Orion](https://unit42.paloaltonetworks.com/tag/syndicate-orion/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/operation-falcon-ii-silverterrier-nigerian-bec/?pdf=download&lg=en&_wpnonce=edee969a51 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/operation-falcon-ii-silverterrier-nigerian-bec/?pdf=print&lg=en&_wpnonce=edee969a51 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Operation%20Falcon%20II:%20Unit%2042%20Helps%20INTERPOL%20Identify%20Nigerian%20Business%20Email%20Compromise%20Ring%20Members&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Foperation-falcon-ii-silverterrier-nigerian-bec%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Foperation-falcon-ii-silverterrier-nigerian-bec%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Foperation-falcon-ii-silverterrier-nigerian-bec%2F&title=Operation%20Falcon%20II:%20Unit%2042%20Helps%20INTERPOL%20Identify%20Nigerian%20Business%20Email%20Compromise%20Ring%20Members "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Foperation-falcon-ii-silverterrier-nigerian-bec%2F&text=Operation%20Falcon%20II:%20Unit%2042%20Helps%20INTERPOL%20Identify%20Nigerian%20Business%20Email%20Compromise%20Ring%20Members "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Foperation-falcon-ii-silverterrier-nigerian-bec%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Operation%20Falcon%20II:%20Unit%2042%20Helps%20INTERPOL%20Identify%20Nigerian%20Business%20Email%20Compromise%20Ring%20Members%20https%3A%2F%2Funit42.paloaltonetworks.com%2Foperation-falcon-ii-silverterrier-nigerian-bec%2F "Share in Mastodon") ## Executive Summary Today, [INTERPOL](https://www.interpol.int/News-and-Events/News/2022/Nigerian-cybercrime-fraud-11-suspects-arrested-syndicate-busted) and The Nigeria Police Force announced the results of Operation Falcon II, joint operations that led to the arrest of 11 Nigerian business email compromise (BEC) actors. Collaborative in its approach, this operation leveraged intelligence and resources from several industry partners combined with law enforcement entities from over six nations in order to map global victims back to a core subset of actors who have historically operated outside of foreign law enforcement jurisdictions. BEC remains the most common and most costly threat facing our customers. This threat held the top spot for the fifth year in a row on the 2020 FBI Internet Crime Complaint Center (IC3) [report](https://www.ic3.gov/Media/PDF/AnnualReport/2020_IC3Report.pdf). Over half a decade, global losses have ballooned from $360 million in 2016 to a staggering $1.8 billion in 2020. As we eagerly await the release of the 2021 numbers, our telemetry and experience helping clients respond to BEC attacks suggests that last year's global losses will once again set new records. Despite these massive loss amounts, industry and global law enforcement continue to make considerable strides toward thwarting this activity. Furthermore, this recent operation was novel in its approach in that it didn't target the easily identifiable money mules or flashy Instagram influencers who are typically seen benefiting from these schemes. Instead, it focused predominantly on the technical backbone of BEC operations by targeting the actors who possess the skills and knowledge to build and deploy the malware and domain infrastructure used in these schemes. Of the individuals arrested, we track six out of the 11 actors as being [SilverTerrier](https://unit42.paloaltonetworks.com/silverterrier-nigerian-business-email-compromise/) (Nigerian malware) actors who have successfully avoided prosecution for the past half decade due to the complexities of mapping global victims beyond the flow of stolen funds back to the source of malicious network activity. This blog provides a brief overview of the six actors and provides recommendations to help organizations protect against these threats. Palo Alto Networks customers are protected against the types of BEC threats discussed in this blog by products including [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) and the [WildFire](https://www.paloaltonetworks.com/products/secure-the-network/wildfire), [Threat Prevention](https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/threat-prevention), [AutoFocus](https://www.paloaltonetworks.com/cortex/autofocus) and [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) subscription services for the [Next-Generation Firewall](https://www.paloaltonetworks.com/network-security/next-generation-firewall). ![An arrest photo related to Operation Falcon II, provided by INTERPOL.](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/01/word-image-39.png) An arrest photo related to Operation Falcon II, provided by INTERPOL. |--------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Operation Falcon II arrests include threat actors tracked as | [SilverTerrier](https://unit42.paloaltonetworks.com/tag/silverterrier/) | | Related Unit 42 Topics | [cybercrime](https://unit42.paloaltonetworks.com/tag/cyber-crime/), [business email compromise](https://unit42.paloaltonetworks.com/tag/business-email-compromise/) | ## The BEC Threat Actors ### Darlington Ndukwu ![Photo of Darlington Ndukwu from social media. Recently arrested as part of joint operations related to Operation Falcon, seeking to stop business email compromise threat actors.](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/01/word-image-40.png) Figure 1. Photo of Darlington Ndukwu from social media. \*\*Aliases:\*\*Darlington Opara, Darlington Smith, Darlly Ndu, DN Network, Engr. DN, ask4dn, padarlingtonsmith, darllymoore4u, dnhovercraft2000 **Domains** : This actor supports several other Nigerian BEC actors, and as such, we found over 1,300 domain registrations sharing some degree of connection to this actor. Of that number, 285 are directly linked with this actor. Most notably, in addition to malware, he operated his own hosting service and name server, both of which supported other actors. These include domains that have historically impersonated banking institutions, government entities and others. Some examples include: annexbanks\[.\]com, bangkokbnk\[.\]com, barcklaysplc\[.\]com, cimbmy\[.\]com, hsbc-london.co\[.\]uk, western-union\[.\]org, americans-airforce\[.\]com, armymilitary\[.\]us, fbigov\[.\]org, immigration-ng\[.\]com, indonesia-gov\[.\]com, iowahomelandsecurity\[.\]com, military-welfare\[.\]com and unitednatios\[.\]eu **Malware:** ISRStealer, Keybase, Pony, LokiBot, PredatorPain, ISpySoftware \*\*Oldest Activity:\*\*2014 **Interesting Notes:** This actor is known to have targeted a security researcher by using their name and organization to register a fraudulent domain. More importantly, this actor is also believed to have been arrested in 2018 as part of the FBI's operation [WireWire](https://www.justice.gov/opa/pr/74-arrested-coordinated-international-enforcement-operation-targeting-hundreds-individuals). Thus, his recent arrest marks one of the first known instances of a Nigerian actor being arrested twice for BEC. It further suggests that his initial prosecution fell short of dissuading continued criminal activity. ### Onuegwu Ifeanyi Ephraim ![Photo of Onuegwu Ifeanyi Ephraim from social media. Arrested as part of the first Operation Falcon, he was arrested again in December 2021 as part of Operation Falcon II](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/01/word-image-42.png) Figure 2. Photo of Onuegwu Ifeanyi Ephraim from social media. \*\*Aliases:\*\*Ifemonums, SSGToolz, SSGDomains, Alper Larcin **Domains** : This actor also supports several other Nigerian BEC actors. There are over 144 domains registered using this actor's names, aliases and email addresses. Examples of domains used by this actor include: Some examples include: gulf-capital\[.\]net, owenscorming\[.\]com, pennssylvania\[.\]com\[.\]mx, starwooclhotels\[.\]com, and us-military-service\[.\]com. Similarly, domains registered by this actor for use by his associates include: ayamholy\[.\]com and kabospy\[.\]com. **Malware:** LokiBot, PredatorPain, ISRStealer, Pony, NanoCore, AzoRult, ISpySoftware, Agent Tesla, Keybase \*\*Oldest Activity:\*\*2014 **Interesting Notes:** This actor has been active for over seven years. Over that time he has sponsored and provided services for several junior actors looking to follow his criminal pursuits. In one BEC forum alone, he is known to have sponsored 30 other actors for access. In November 2020, this actor was [arrested](https://www.interpol.int/en/News-and-Events/News/2020/Three-arrested-as-INTERPOL-Group-IB-and-the-Nigeria-Police-Force-disrupt-prolific-cybercrime-group) along with three associates for his BEC activities. The arrests were part of the first Operation Falcon, which was a joint effort between INTERPOL, The Nigeria Police Force and [Group IB](https://www.group-ib.com/media/gib-interpol-bec/). Following his release, this actor quickly returned to his previous schemes and was observed registering the domain ​​covid19-fundservices\[.\]com in March 2021. With the identification of additional evidence, this actor was arrested once again in December 2021 as part of Operation Falcon II. ### Oyebade Fisayo ![Photo of Oyebade Fisayo from social media. Recently arrested as part of Operation Falcon.](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/01/word-image-44.png) Figure 3. Photo of Oyebade Fisayo from social media. **Aliases:** EncryptionCode, Fyzee, Fyzeeconnect **Domains** : This actor supports several other Nigerian BEC actors with roughly 250 domains directly linked to his aliases or email accounts. The majority of these domains have impersonated logistics companies. Some examples include: atlanticexpresslogistics\[.\]com, clarionsshipping\[.\]com, dpdexpressuk\[.\]com, dynamicparceldelivery\[.\]com and shipatlanticlogistics.co\[.\]uk. **Malware:** ISRStealer, Pony, LuminosityLink, NanoCore, LokiBot, Keybase, Adwind, Agent Tesla, PredatorPain, ImminentMonitor \*\*Oldest Activity:\*\*2015 **Interesting Notes:** In addition to supporting BEC schemes directly, this actor has historically offered free advice to his Facebook friends on how to use remote access trojans. ![Facebook message from Oyebade Fisayo.](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/01/word-image-47.png) Figure 4. Facebook message from Oyebade Fisayo. ### Kevin Anyanwu ![Photo from Markens Clothing’s social media account. Recently arrested as part of joint operations related to Operation Falcon, seeking to stop business email compromise threat actors.](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/01/word-image-49.png) Figure 5. Photo from Markens Clothing's social media account. **Aliases:** Markens Clothing **Domains** : In 2015 this actor registered the domain hsbctelex\[.\]net. HSBC is one of the largest financial institutions in the world. Telex, on the other hand, is an abbreviation for Telegraphic Transfers, which are used to process international and domestic payments. When registering this domain, the actor used the same phone number that is advertised as being associated with a personal (not business) Facebook page called Markens Clothing. **Malware:** We have not identified any malware calling back to domains owned by this actor. However, we believe that this domain was likely used for fraudulent purposes in support of BEC campaigns. \*\*Oldest Activity:\*\*2015 **Interesting Notes:** This actor is an associate of Onuegbu Ifeanyi Ephraim. ### Onukwubiri Ifeanyi Kingsley ![Photo of Onukwubiri Kingsley from social media. Recently arrested as part of joint operations related to Operation Falcon, seeking to stop business email compromise threat actors.](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/01/word-image-51.png) Figure 6. Photo of Onukwubiri Kingsley from social media. **Aliases:** Soja Rex, Ifeanyi Soja, Soja TMT, Richard Manson **Domains** : This actor's email address is directly linked to 20 domain registrations. These include domains that impersonate financial institutions such as PNCFinancial\[.\]ca and PrimeFCU\[.\]com. Pivoting on domain registration phone numbers and street addresses reveals an additional 370 fraudulent domains that were likely used by this actor and his associates. For example, his phone number is also linked to five domains that were registered for an individual or alias of Uwe Martin (UweTMT). Two of these domains were qatarairways\[.\]pw and cokepromo\[.\]asia. **Malware:** Pony, LokiBot \*\*Oldest Activity:\*\*2016 **Interesting Notes:** This actor is strongly branded as being part of "The Money Team," abbreviated as TMT. This organization appears to have several legitimate business entities including [TMT Cakes](https://www.facebook.com/tmtcakesacademy/) and [TMT Travel and Tours Limited](https://www.facebook.com/tmttravelsandtourslimited/) -- the latter of which claims to be Nigeria's leading travel company with deals on visas and scholarships. However, despite the seemingly benign function of these entities, this actor's fraudulent domain registrations, malware activities and personal associations call into question the true legitimacy of these organizations and his activities. For example, this actor is friends with Onwuka Emmanuel Chidiebere (aka CeeCeeBoss TMT) and Onuegbu Ifeanyi Ephraim (aka SSGToolz), both of whom were arrested by INTERPOL and The Nigeria Police Force in November 2019 for BEC schemes. Additionally, this actor is friends with Darlington Nduku, Markens Clothing and several other BEC actors. ### Kennedy Ikechukwu Afurobi ![Photo of Kennedy Afurobi from social media. Recently arrested as part of Operation Falcon.](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/01/word-image-53.png) Figure 7. Photo of Kennedy Afurobi from social media. **Aliases:** Chidi Ibeh, Big Boss **Domains** : This actor is associated with 97 domains, including wemacreditb\[.\]com, orionshippingx\[.\]com and fdralgrantagency\[.\]com. **Malware:** Pony, PredatorPain, Azorult \*\*Oldest Activity:\*\*2014 **Interesting Notes:** According to his social media accounts, his favorite quotes come from the Bible, Ralph W. Emerson and Niccolò Machiavelli. This actor is also friends with Onwuka Emmanuel Chidiebere (aka CeeCeeBoss TMT), who was arrested by INTERPOL and the Nigeria Police Force in November 2019 for BEC schemes. ## Protections and Mitigations The best defense against BEC campaigns is a security posture that favors prevention. We recommend that organizations implement preventative practices including: 1. Review network security policies, focusing on the types of files (portable executables, documents with macros, etc.) that employees can download and open on devices attached to company networks. Additionally, as a best practice, URL filtering rules should be established to restrict access by default to the following categories of domains: Newly Registered, Insufficient Content, Dynamic DNS, Parked and Malware. 2. Routinely review mail server configurations, employee mail settings and connection logs. Focus efforts on identifying employee mail-forwarding rules and identifying foreign or abnormal connections to mail servers. When possible, consider implementing geo-IP blocking. For example, small local businesses do not need to allow logon attempts from foreign countries where they have no employees. 3. Conduct employee training. Routine cyberthreat awareness training is one component; however, organizations should also consider tailored training focused on their sales and finance components. Such training should require all wire transfer requests to be validated using verified and established points of contact for suppliers, vendors and partners. 4. Conduct tabletop exercises and rehearsal investigations with the intent of determining sources of evidence, as well as gaps in the types of evidence needed, and establishing reporting points of contact for the appropriate authorities. Additionally, rehearsals should validate familiarity with the financial fraud kill chain and make clear that staff know which personnel are responsible for enacting it. 5. Conduct compromise assessments on an annual or more frequent basis to test organizational controls and validate that there is no unauthorized activity occurring in the environment. By reviewing mailbox rules and user login patterns on a regular basis, these assessments can verify that controls are functioning as expected and that unwanted behaviors are being effectively blocked throughout the environment. Finally, for Palo Alto Networks customers, our products and services provide several capabilities designed to thwart BEC attempts, including: |------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | ![Cortex XDR logo](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/01/word-image-54.png) | [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) protects endpoints from all malware, exploits and fileless attacks associated with SilverTerrier actors. | | ![WildFire logo](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/01/word-image-55.png) | [WildFire®](https://www.paloaltonetworks.com/products/secure-the-network/wildfire) cloud-based threat analysis service accurately identifies samples associated with information stealers, RATs and document packaging techniques used by these actors. | | ![Threat Prevention logo](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/01/word-image-56.png) | [Threat Prevention](https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/threat-prevention) provides protection against the known client and server-side vulnerability exploits, malware and command and control infrastructure used by these actors. | | ![Advanced URL Filtering logo](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/01/word-image-57.png) | [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) identifies all phishing and malware domains associated with these actors and proactively flags new infrastructure associated with these actors before it is weaponized. | | ![AutoFocus logo](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/01/word-image-58.png) | Users of [AutoFocus™](https://www.paloaltonetworks.com/cortex/autofocus) contextual threat intelligence service can view malware associated with these attacks using the[SilverTerrier](https://autofocus.paloaltonetworks.com/#/tag/Unit42.SilverTerrier) tag. | ## Conclusion While BEC schemes remain the most profitable and widespread form of cybercrime on the internet, private/public collaborative efforts continue to make tremendous strides in combating these threats on a global scale. The most recent joint operations championed by The Nigeria Police Force and INTERPOL serve as an inspiring example. These operations drew on insights and collaboration from multiple industry partners and law enforcement entities from more than six nations in order to achieve positive outcomes. Those outcomes include disruption of BEC networks within Nigeria, improved international coordination and most importantly, the arrest of 11 actors, who for the better half of a decade have avoided prosecution while providing the technical expertise, malware and malicious domains used in countless BEC campaigns. Palo Alto Networks was the first cybersecurity company to sign a partnership agreement with INTERPOL in 2017. This agreement served as the foundation for our collaborative efforts in combating criminal trends in cyberspace and other cyberthreats globally. Since then the partnership has continued to evolve, and today Palo Alto Networks remains a proud contributing member of INTERPOL's Gateway program. ## Additional Resources 2021 - [Interpol Operation Falcon II](https://www.interpol.int/News-and-Events/News/2022/Nigerian-cybercrime-fraud-11-suspects-arrested-syndicate-busted) 2021 -- [Credential Harvesting at Scale Without Malware](https://unit42.paloaltonetworks.com/credential-harvesting/) 2020 - [Interpol Operation Falcon](https://www.interpol.int/en/News-and-Events/News/2020/Three-arrested-as-INTERPOL-Group-IB-and-the-Nigeria-Police-Force-disrupt-prolific-cybercrime-group) 2020 -- [SilverTerrier: New COVID-19 Themed Business Email Compromise Schemes](https://unit42.paloaltonetworks.com/silverterrier-covid-19-themed-business-email-compromise/) 2019 -- [SilverTerrier: 2019 Nigerian Business Email Compromise Update](https://unit42.paloaltonetworks.com/silverterrier-2019-update/) 2018 -- [SilverTerrier: 2018 Nigerian Business Email Compromise Update](https://unit42.paloaltonetworks.com/silverterrier-2018-nigerian-business-email-compromise/) 2017 -- [SilverTerrier: The Rise of Nigerian Business Email Compromise](https://www.paloaltonetworks.com/resources/whitepapers/unit42-silverterrier-rise-of-nigerian-business-email-compromise.html) 2016 -- [SilverTerrier: The Next Evolution in Nigerian Cybercrime](https://www.paloaltonetworks.com/resources/research/silverterrier-next-evolution-nigerian-cybercrime) 2014 -- [419 Evolution](https://unit42.paloaltonetworks.com/unit-42-new-era-threat-intelligence/) [Mitre: SilverTerrier Group](https://attack.mitre.org/groups/G0083/) [Unit 42 - Business Email Compromise - Response Services](https://www.paloaltonetworks.com/unit42/incident-response/business-email-compromise) [Unit 42 - Business Email Compromise - Readiness Assessment](https://www.paloaltonetworks.com/bec-readiness-assessment) *\*Image at the top of post is an arrest photo provided by INTERPOL.* Back to top ### Tags * [Nigeria](https://unit42.paloaltonetworks.com/tag/nigeria/ "Nigeria") * [SilverTerrier](https://unit42.paloaltonetworks.com/tag/silverterrier/ "SilverTerrier") * [Syndicate Orion](https://unit42.paloaltonetworks.com/tag/syndicate-orion/ "Syndicate Orion") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: The Year in Web Threats: Web Skimmers Take Advantage of Cloud Hosting and More](https://unit42.paloaltonetworks.com/web-threats-trends-web-skimmers/ "The Year in Web Threats: Web Skimmers Take Advantage of Cloud Hosting and More") ### Table of Contents * ### Related Articles * [Operation Delilah: Unit 42 Helps INTERPOL Identify Nigerian Business Email Compromise Actor](https://unit42.paloaltonetworks.com/operation-delilah-business-email-compromise-actor/ "article - table of contents") * [SilverTerrier -- Nigerian Business Email Compromise](https://unit42.paloaltonetworks.com/silverterrier-nigerian-business-email-compromise/ "article - table of contents") * [SilverTerrier: New COVID-19 Themed Business Email Compromise Schemes](https://unit42.paloaltonetworks.com/silverterrier-covid-19-themed-business-email-compromise/ "article - table of contents") ## Related Resources ![Pictorial representation of Russian global webmail espionage campaign. A digital illustration of a world map in a network style, highlighting continents with glowing lines and connectivity points in a red and blue theme.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/06_Nation-State-cyberattacks_1920x900-1-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) July 23, 2026 [#### Russian Global Webmail Espionage](https://unit42.paloaltonetworks.com/russian-webmail-espionage/) * [CL-STA-1114](https://unit42.paloaltonetworks.com/tag/cl-sta-1114/ "CL-STA-1114") * [JavaScript](https://unit42.paloaltonetworks.com/tag/javascript/ "JavaScript") * [Javascript injection](https://unit42.paloaltonetworks.com/tag/javascript-injection/ "javascript injection") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/russian-webmail-espionage/ "Russian Global Webmail Espionage") ![Pictorial representation of a woman standing in a server room holding a laptop that projects a digital code overlay.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/06_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) May 28, 2026 [#### 2026 World Cup: Discussing The World's Biggest Game's Attack Surface](https://unit42.paloaltonetworks.com/fifa-world-cup-attack-surface/) * [Fiddling Scorpius](https://unit42.paloaltonetworks.com/tag/fiddling-scorpius/ "Fiddling Scorpius") * [Fighting Ursa](https://unit42.paloaltonetworks.com/tag/fighting-ursa/ "Fighting Ursa") * [Muddled Libra](https://unit42.paloaltonetworks.com/tag/muddled-libra/ "Muddled Libra") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/fifa-world-cup-attack-surface/ "2026 World Cup: Discussing The World’s Biggest Game’s Attack Surface") ![Pictoral representation of a man holding a cellphone with a bokeh skyline in the background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/05_Listicle_Category_1505x922-718x440.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) May 27, 2026 [#### Out of the Crypt: The Evolving Cyber Extortion Economy](https://unit42.paloaltonetworks.com/cyber-extortion-economy/) * [Bling Libra](https://unit42.paloaltonetworks.com/tag/bling-libra/ "Bling Libra") * [Extortion](https://unit42.paloaltonetworks.com/tag/extortion/ "Extortion") * [Frontier AI](https://unit42.paloaltonetworks.com/tag/frontier-ai/ "Frontier AI") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/cyber-extortion-economy/ "Out of the Crypt: The Evolving Cyber Extortion Economy") ![Pictorial representation of the APT Boggy Serpens. An illustrated blue snake is highlighted by a red circle against a night sky. The constellation serpens.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/Boggy-Serpens-1920x900-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) March 16, 2026 [#### Boggy Serpens Threat Assessment](https://unit42.paloaltonetworks.com/boggy-serpens-threat-assessment/) * [Advanced Persistent Threat](https://unit42.paloaltonetworks.com/tag/advanced-persistent-threat/ "Advanced Persistent Threat") * [Boggy Serpens](https://unit42.paloaltonetworks.com/tag/boggy-serpens/ "Boggy Serpens") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/boggy-serpens-threat-assessment/ "Boggy Serpens Threat Assessment") ![Pictorial representation of Muddled Libra, aka Scattered Spider. A vibrant illustration of the Libra zodiac sign, featuring a stylized balance scale overlaid with a prominent Libra symbol. The background is a starry night sky with shades of purple and blue, suggesting a cosmic theme.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/03-1-Muddle-Libra-1920x900-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/threat-actor-groups.svg)Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/) February 10, 2026 [#### A Peek Into Muddled Libra's Operational Playbook](https://unit42.paloaltonetworks.com/muddled-libra-ops-playbook/) * [Muddled Libra](https://unit42.paloaltonetworks.com/tag/muddled-libra/ "Muddled Libra") * [PowerShell](https://unit42.paloaltonetworks.com/tag/powershell/ "PowerShell") * [Scattered Spider](https://unit42.paloaltonetworks.com/tag/scattered-spider/ "Scattered Spider") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/muddled-libra-ops-playbook/ "A Peek Into Muddled Libra’s Operational Playbook") ![Pictorial representation of a group of individuals discussing an idea with a whiteboard.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/02_Listicle_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) February 3, 2026 [#### Why Smart People Fall For Phishing Attacks](https://unit42.paloaltonetworks.com/psychology-of-phishing/) * [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI") * [Phishing](https://unit42.paloaltonetworks.com/tag/phishing/ "phishing") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/psychology-of-phishing/ "Why Smart People Fall For Phishing Attacks") ![Pictorial representation of threat groups from Russia. The silhouette of a bear and the Ursa constellation inside an orange abstract planet. Abstract, stylized cosmic setting with vibrant blue and purple shapes, representing space and distant planetary bodies.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/01/Ursa-Russia-B-1920x900-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) January 29, 2026 [#### Understanding the Russian Cyberthreat to the 2026 Winter Olympics](https://unit42.paloaltonetworks.com/russian-cyberthreat-2026-winter-olympics/) * [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI") * [IoT](https://unit42.paloaltonetworks.com/tag/iot/ "IoT") * [Russia](https://unit42.paloaltonetworks.com/tag/russia/ "Russia") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/russian-cyberthreat-2026-winter-olympics/ "Understanding the Russian Cyberthreat to the 2026 Winter Olympics") ![Pictorial representation of 01flip ransomware written in Rust. Digital artwork of a pixelated U.S. dollar bill disintegrating into small blocks against a blue data matrix background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/12/05_Ransomware_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) December 10, 2025 [#### 01flip: Multi-Platform Ransomware Written in Rust](https://unit42.paloaltonetworks.com/new-ransomware-01flip-written-in-rust/) * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [CL-CRI-103](https://unit42.paloaltonetworks.com/tag/cl-cri-103/ "CL-CRI-103") * [Cryptocurrency](https://unit42.paloaltonetworks.com/tag/cryptocurrency/ "Cryptocurrency") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/new-ransomware-01flip-written-in-rust/ "01flip: Multi-Platform Ransomware Written in Rust") ![Pictorial representation of malicious LLMs. Close-up view of a digital wall displaying various glowing icons, representing a high-tech network interface.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/11/AdobeStock_1270203474-786x440.jpeg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) November 25, 2025 [#### The Dual-Use Dilemma of AI: Malicious LLMs](https://unit42.paloaltonetworks.com/dilemma-of-ai-malicious-llms/) * [Credential Harvesting](https://unit42.paloaltonetworks.com/tag/credential-harvesting/ "Credential Harvesting") * [Data exfiltration](https://unit42.paloaltonetworks.com/tag/data-exfiltration/ "data exfiltration") * [LLM](https://unit42.paloaltonetworks.com/tag/llm/ "LLM") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/dilemma-of-ai-malicious-llms/ "The Dual-Use Dilemma of AI: Malicious LLMs") ![Pictorial representation of Gh0st RAT malware. A woman analyzes code on a computer screen in an office setting, with another individual working in the background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/11/04_Security-Technology_Category_1505x922-718x440.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) November 14, 2025 [#### Digital Doppelgangers: Anatomy of Evolving Impersonation Campaigns Distributing Gh0st RAT](https://unit42.paloaltonetworks.com/impersonation-campaigns-deliver-gh0st-rat/) * [DLL Sideloading](https://unit42.paloaltonetworks.com/tag/dll-sideloading/ "DLL Sideloading") * [Gh0st Rat](https://unit42.paloaltonetworks.com/tag/gh0st-rat/ "Gh0st Rat") * [PDNS](https://unit42.paloaltonetworks.com/tag/pdns/ "PDNS") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/impersonation-campaigns-deliver-gh0st-rat/ "Digital Doppelgangers: Anatomy of Evolving Impersonation Campaigns Distributing Gh0st RAT") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)