[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/plugx-variants-in-usbs/) * [Japanese](https://unit42.paloaltonetworks.com/ja/plugx-variants-in-usbs/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Ransomware](https://unit42.paloaltonetworks.com/category/ransomware/ "Ransomware") [Ransomware](https://unit42.paloaltonetworks.com/category/ransomware/) # Chinese PlugX Malware Hidden in Your USB Devices? ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 12 min read Related Products [![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Mike Harbison](https://unit42.paloaltonetworks.com/author/mike-harbison/) * [Jen Miller-Osborn](https://unit42.paloaltonetworks.com/author/jen-miller-osborn/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:January 26, 2023 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Ransomware](https://unit42.paloaltonetworks.com/category/ransomware/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Black Basta ransomware](https://unit42.paloaltonetworks.com/tag/black-basta-ransomware/) * [Brute ratel c4](https://unit42.paloaltonetworks.com/tag/brute-ratel-c4/) * [Dark Scorpius](https://unit42.paloaltonetworks.com/tag/dark-scorpius/) * [GootLoader](https://unit42.paloaltonetworks.com/tag/gootloader/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/plugx-variants-in-usbs/?pdf=download&lg=en&_wpnonce=279fa6c5e6 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/plugx-variants-in-usbs/?pdf=print&lg=en&_wpnonce=279fa6c5e6 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Chinese%20PlugX%20Malware%20Hidden%20in%20Your%20USB%20Devices?&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fplugx-variants-in-usbs%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fplugx-variants-in-usbs%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fplugx-variants-in-usbs%2F&title=Chinese%20PlugX%20Malware%20Hidden%20in%20Your%20USB%20Devices? "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fplugx-variants-in-usbs%2F&text=Chinese%20PlugX%20Malware%20Hidden%20in%20Your%20USB%20Devices? "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fplugx-variants-in-usbs%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Chinese%20PlugX%20Malware%20Hidden%20in%20Your%20USB%20Devices?%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fplugx-variants-in-usbs%2F "Share in Mastodon") ## Executive Summary Recently, our Unit 42 incident response team was engaged in a Black Basta breach response that uncovered several tools and malware samples on the victim's machines, including [GootLoader](https://www.cyber.nj.gov/alerts-advisories/gootloader-malware-platform-uses-sophisticated-techniques-to-deliver-malware)malware, [Brute Ratel C4](https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/) red-teaming tool and an older [PlugX](https://unit42.paloaltonetworks.com/thor-plugx-variant/)malware sample. The PlugX malware stood out to us as this variant infects any attached removable USB media devices such as floppy, thumb or flash drives and any additional systems the USB is later plugged into. This PlugX malware also hides actor files in a USB device using a novel technique that works even on the most recent Windows operating systems (OS) at the time of writing this post. This means the malicious files can only be viewed on a Unix-like (\*nix) OS or by mounting the USB device in a forensic tool. We also discovered a similar variant of PlugX in VirusTotal that infects USB devices and copies all Adobe PDF and Microsoft Word files from the host. It places these copies in a hidden folder on the USB device that is created by the malware. PlugX is a second-stage implant used not only by multiple groups with a Chinese nexus but also by several cybercrime groups. It has been around for over a decade and has been observed in some high-profile cyberattacks, including the [U.S. Government Office of Personnel Management (OPM)](https://www.wired.com/2016/10/inside-cyberattack-shocked-us-government/) breach in 2015. It is a modular malware framework, supporting an evolving set of capabilities throughout the years. Palo Alto Networks customers receive protections against the types of threats discussed in this blog by products including [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) and [WildFire](https://www.paloaltonetworks.com/network-security/wildfire). | **Related Unit 42 Topics** | [PlugX](https://unit42.paloaltonetworks.com/thor-plugx-variant/)**,** [Brute Ratel C4](https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/) | |----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------| ## Introduction It's not uncommon for multiple malware samples to be discovered during an investigation, as occurred in this situation with GootLoader, Brute Ratel C4 and PlugX. Numerous threat actors compromise targets and can coexist simultaneously on the affected machine. Because we can't conclusively say whether these malware samples were left by one group or several, we can't attribute these tools to the Black Basta ransomware group. However, the version of Brute Ratel C4 used in this case is the same one reported by [Trend Micro](https://www.trendmicro.com/en_ca/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html), which also involved the Black Basta ransomware group. ## PlugX Malware Infection Historically, a PlugX infection begins by hijacking a known and trusted, digitally signed software application to load an actor-created encrypted payload. This technique has been used since 2010 and is listed in the MITRE ATT\&CK techniques as [Hijack execution flow DLL-Side loading](https://attack.mitre.org/techniques/T1574/002/) ID: T1574.002 Sub-technique T1574. In this case, the threat actors decided to hijack a popular and free open source debugging tool for Windows called [x64dbg](https://x64dbg.com/), which is used by the malware analysis/reverse engineering community. X64dbg applications are digitally signed by "Open Source Developer Duncan Ogilvie." The developers of this tool offer two types of debugger applications: x64 for 64-bit applications and x32 for 32-bit applications. In this case, the actors used x32dbg.exe, which is the 32-bit debugger of x64dbg. Upon execution of x32dbg.exe, Microsoft Windows will attempt to resolve any dependency files necessary to run the application. That search starts locally (i.e., in the current working directory). If found, the necessary files are loaded and executed. X32bridge.dll is a Windows Dynamic Link Library (DLL) dependency file of x32dbg.exe. A legitimate x32bridge.dll also carries the same digital signature. In this case, the file is not signed. Once loaded, the malware searches locally for an actor-created encrypted payload file: x32bridge.dat (SHA256: e72e49dc1d95efabc2c12c46df373173f2e20dab715caf58b1be9ca41ec0e172). X32bridge.dat was first submitted to VirusTotal on Jan. 22, 2021. As of Dec. 15, 2022, it has a detection score of eight out of 61 engines. None of the engines identify the file as PlugX malware. Once loaded and decrypted in memory, the malware infects the host and any removable USB devices attached with the PlugX malware. Figure 1 below illustrates PlugX DLL side loading using x64dbg DLL hijacking. ![Image 1 is a diagram of the process whereby the PlugX DLL sideloading.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/01/word-image-126789-1.png) Figure 1. PlugX DLL sideloading using x64dbg. Both the hijacking of x64dbg and the association of this behavior with the PlugX malware were reported by Sophos back in [November 2020](https://news.sophos.com/en-us/2020/11/04/a-new-apt-uses-dll-side-loads-to-killlsomeone/). Their blog refers to this malware as *KilllSomeOne*, based on a Program Database (PDB) string found in one of the binaries. Sophos performed an excellent analysis of the samples and touched on the USB infection. We confirmed that our sample matched the behaviors described in their report. From there, we wanted to expand our research by focusing on the USB infection, other USB variants in the wild and links to the PlugX malware. ## PlugX Malware USB Overview The technique used by the PlugX malware to hide files in a USB device involves using a certain Unicode character. This hinders Windows Explorer and the command shell (cmd.exe) from displaying the USB directory structure and any files, concealing them from the victim. The Unicode character used by this PlugX malware for the directories is 00A0 (a whitespace character called a no-break space). The whitespace character prevents the Windows Operating System from rendering the directory name, concealing it rather than leaving a nameless folder in Explorer. To achieve code execution of the malware from the hidden directory, a Windows shortcut (.lnk) file is created on the root folder of the USB device. The shortcut path to the malware contains the Unicode whitespace character, which is a space that does not cause a line break, but this is not visible when viewed via Windows Explorer, as shown below in Figure 2. ![Image 2 is a screenshot of Windows Explorer, showing the Shortcut tab in the USB drive properties (named TESTDRIVE). It lists the target type, location and Target, where the target shows the hidden directory with extended ASCII characters.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/01/word-image-126789-2.png) Figure 2. Windows shortcut properties for accessing the hidden directory. When the shortcut file is viewed in a hex editor, the hex representation of these characters is shown as highlighted below in Figure 3. ![Image 3 is a screenshot of a hex editor where the extended ASCII characters are highlighted. There are two, and both are “A0”.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/01/word-image-126789-3.png) Figure 3. Windows shortcut properties shown in a hex editor display. The PlugX malware uses the Component Object Model (COM) interface to create the .lnk files and includes the Unicode character 00A0. It does this by creating an instance of a shell desktop to create the associated Windows shortcut files. The ShellLink SetArguments method is used to set the command line arguments, which include the white space no break Unicode character, as shown in Figure 4 below. ![Image 4 is a screenshot of the COM ShellLink command line arguments.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/01/word-image-126789-4.png) Figure 4. COM ShellLink::SetArguments. Finally, the *ShellLink::Save* method saves the shortcut file with all the changes. ## PlugX Malware USB Infection The PlugX malware x32bridge.dll loads x32bridge.dat, which is responsible for implanting the host with malware and infecting any attached removable media USB devices such as floppy, thumb or flash drives. If a removable media device is found, the following steps are performed: 1. It creates the following directory structure: *\*:\\u00A0\\u00A0\\RECYCLER.BIN\\files. Example: *F:\\ \\ \\RECYCLER.BIN\\files*. 2. It creates a hidden file named desktop.ini in each folder, which specifies the icon for the folder. This file contains the following data: \[.ShellClassInfo\] IconResource=%systemroot%\\system32\\SHELL32.dll,7 The Windows OS uses a single file to retrieve icon images that are displayed on the desktop as shortcuts or from Windows Explorer files and folders. The Shell32.dll file contains a list of icons and a unique number. In this case, the drive icon and the number 7 are used, as shown below in Figure 5. ![Image 5 is a screenshot of the drive icon, showing a drive with a green light against a blue background. The number 7 is at the bottom.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/01/word-image-126789-5.png) Figure 5. Drive icon number 7. The use of this drive icon makes the directories appear as drives within Windows Explorer when viewed with hidden files enabled. If deleted, the directories appear as folders. 3. In the second directory, it creates a subfolder named RECYLER.BIN. This directory acts as a recycle bin. In that directory is a subdirectory named files and a hidden desktop.ini file. This desktop.ini file contains the following data: \[.ShellClassInfo\] CLSID = {645FF040-5081-101B-9F08-00AA002F954E} This CLSID instructs Windows Explorer to display the created RECYCLER.BIN folder as a recycle bin directory by giving it the recycle bin icon. This is shown in Figure 11 as an example. 4. The files subfolder contains copies of the PlugX malware x32dbg.exe, any encrypted actor .dat files and the actor's malicious DLL. An example of this is shown in Figure 6 below. ![Image 6 is a screenshot of the program WinHex displaying the name, extensions, size, created date, bodied date, accessed date, attribution, and sector number in the files subfolder.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/01/word-image-126789-6.png) Figure 6. Infected UBS removable device displayed via WinHex. It should be noted that pre-infection of the USB device, existing files or directories on the root of the removable device are moved to the second hidden folder on the USB device, as shown below in Figure 7. ![Image 7 is a side-by-side root directory comparison of a non-infected (left) versus an infected (right) USB device.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/01/word-image-126789-7.png) Figure 7. Side-by-side comparison of the root directories of a non-infected versus infected USB device. 5. Whenever the shortcut file from the infected USB device is clicked, the PlugX malware launches Windows Explorer and passes the directory path as a parameter. This then displays the files on the USB device from within the hidden directories and also infects the host with the PlugX malware. The victim sees their files and assumes all is working as expected. Figure 8 below illustrates how an infected USB thumb drive would appear to a victim in Windows Explorer using default settings (i.e., not displaying hidden files). ![Image 8 is a screenshot of Windows Explorer showing the infected USB drive. Show hidden files is not enabled in this instance.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/01/word-image-126789-8.png) Figure 8. Windows Explorer showing infected USB Removable Device. (Show hidden files not enabled.) An infected PlugX USB device has no files or directories in the root folder and contains only a .lnk file. Figure 9 shows that the shortcut file is TESTDRIVE, which matches the USB device name. The shortcut file is responsible for infecting the host and navigating to the hidden directory on the USB device each time it is clicked. For example, the shortcut file referenced in Figure 9 contains the following data: %comspec% /q /c " \\ \\RECYCLER.BIN\\files\\x32dbg.exe" Once the target clicks the shortcut, x32dbg.exe is launched via cmd.exe from the hidden files directory on the USB device. The host the USB is attached to is now infected with the PlugX malware. When viewing the contents of the infected USB device with Windows Explorer and hidden items enabled, a victim would see the following images: ![Image 9 is a screenshot of Windows Explorer showing the root folder of the USB drive.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/01/word-image-126789-9.png) Figure 9. Windows Explorer showing infected USB Removable Device (root folder). They would then see the following, as shown in Figure 10, within the first hidden directory: ![Image 10 is a screenshot of Windows Explorer showing the root folder of the infected USB drive, displaying the first hidden directory.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/01/word-image-126789-10.png) Figure 10. Windows Explorer showing an infected USB removable device (hidden directory number one). As shown in Figure 11, Windows Explorer displays another hidden directory along with a shortcut file. The shortcut file has the same properties to launch x32dbg.exe and will infect the host with the USB device attached. When viewing the contents of the next hidden folder, Windows Explorer shows the following directory structure: ![Image 11 is a screenshot of Windows Explorer showing the root folder of the infected USB drive, displaying the second hidden directory with a folder disguised as a recycling bin.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/01/word-image-126789-11.png) Figure 11. Windows Explorer showing infected USB Removable Device (hidden directory number two). This directory contains a RECYLER.BIN folder that masquerades as a Windows recycle bin, along with any files or directories that existed in the root folder of the USB device at the time of infection. When viewing the contents of the RECYLER.BIN with Windows Explorer, a victim will see what's shown in Figure 12: ![Image 12 is a screenshot of Windows Explorer showing the contents of the RECYCLER.BIN folder. There are hidden malware files that cannot be detected outside of the use of specialized tools.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/01/word-image-126789-12.png) Figure 12. Windows Explorer showing infected USB Removable Device (RECYLER.BIN folder). Since the default setting for Windows Explorer is not to show hidden items, the only item visible to the victim is the shortcut file, as shown in Figure 8. Even with hidden files enabled, Windows Explorer or cmd.exe cannot show the malware files that reside in the files subdirectory. The malware files can only be viewed on a \*nix OS or by mounting the USB device in a forensic tool. Figure 13 shows how the USB device looks once it's mounted in Ubuntu, browsing to it via File Explorer. ![Image 13 is a screenshot of how the USB drive looks while browsing its contents in Ubuntu’s File Explorer.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/01/word-image-126789-13.png) Figure 13. Ubuntu File Explorer viewing an infected USB device. ## PlugX Malware Post USB Infection When a host is infected with this variant of the PlugX malware, the malware continuously monitors for USB removable devices. Once a USB device is discovered and infected, any new files written to the USB device root folder post-infection are moved to the hidden folder within the USB device. Since the Windows shortcut file resembles that of a USB device and the malware displays the victim's files, they unwittingly continue to spread the PlugX malware. ## PlugX Malware USB Variant Two Armed with this knowledge, we wondered if other similar PlugX USB infection malware existed in the wild. File SHA256: 5b496972a86cea66aeecaac6e3f67a92e22f35cd5d2a98d54a2f1218fcd5dfc5 in VirusTotal matches the behaviors of x32bridge.dat, specifically the creation of the Windows Scheduled Task and PDB string referenced in the Sophos blog. This file is a Windows x86 PE file (DLL), the in-memory equivalent of x32bridge.dat. Our analysis shows the runtime behavior is identical to the x32bridge.dat USB infection detailed earlier, but it has an added capability. It copies documents from the host machine to a new hidden USB subfolder named da520e5. The malware specifically copies all Adobe PDF and Microsoft Word documents from the host to this directory. Figure 14 below shows an example of the directory and files copied from our host. ![Image 14 is a screenshot of Drive F displaying the PlugX malware variant with two exfil files. It shows their names, extensions, size, creation and modification dates, access dates, attribution, and sector.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/01/word-image-126789-14.png) Figure 14. PlugX malware variant with two exfil files. This PlugX USB malware variant was designed to exfiltrate specific files from its target that could be retrieved later, as this directory and files are not used by the malware or displayed to the victim. ## Association With PlugX Malware In addition to USB infection, both x32bridge.dat and the second PlugX malware variant discovered in VirusTotal check the target for specific running processes. If found, it terminates them and deletes the directories from which they were executed. X32bridge.dat seeks out process names starting with AAM and, if found, terminates the process and deletes specific directories associated with the process. The Sophos blog speculated that this behavior likely removed older PlugX malware variants. Previous variants attributed to PlugX started with AAM file names (i.e., AAM Updates.exe). The second variant we discovered in VirusTotal also performs this check, including one for the specific process file name AAM Updates.exe. Additionally, if AAM Updates.exe is found, it deletes the directory AAM UpdatesikB, which is a folder that has also been associated with the PlugX malware family. Since both x32bridge.dat and the second PlugX malware variant discovered in VirusTotal share the same USB infection method along with other runtime behaviors, we can conclusively state that it is indeed associated with PlugX. ## Conclusion PlugX malware has been used for over a decade and was historically extensively associated with Chinese nation-state APT groups. Over the years, it has been adopted and used by other threat groups, from nation-states to ransomware actors. The typical tradecraft of PlugX uses benign files to achieve code execution, also known as DLL side loading, that many security vendors now detect and prevent. This might be part of why the actors added the capability to infect any attached removable media USB devices such as floppy, thumb or flash drives as well as any additional systems the USB is later plugged into. Any host infected with this variant of the PlugX malware will continuously monitor for new USB removable devices to infect. This PlugX malware also hides attacker files in a USB device with a novel technique, which makes the malicious files only viewable on a \*nix OS or by mounting the USB device in a forensic tool. Because of this ability to evade detection, the PlugX malware can continue to spread and potentially jump to air-gapped networks. Additionally, we discovered a similar variant of PlugX in VirusTotal with the added capability of copying all Adobe PDF and Microsoft Word documents from the infected host to the USB device's hidden folder created by the PlugX malware. The discovery of these samples indicates PlugX development is still alive and well among at least some technically skilled attackers, and it remains an active threat. For Palo Alto Networks customers, our products and services provide the following coverage associated with this campaign: * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) customers receive protection at the endpoints from the malware techniques described in this blog. * [WildFire](https://www.paloaltonetworks.com/network-security/wildfire) cloud-based threat analysis service accurately identifies the malware described in this blog as malicious. If you think you may have been compromised or have an urgent matter, contact the[Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call: * North America Toll-Free: 866.486.4842 (866.4.UNIT42) * EMEA: +31.20.299.3130 * APAC: +65.6983.8730 * Japan: +81.50.1790.0200 Palo Alto Networks has shared these findings, including file samples and indicators of compromise, with our fellow Cyber Threat Alliance members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://cyberthreatalliance.org/). ## Unit 42 Managed Threat Hunting Queries // Detecting potential DLL side loading config case\_sensitive = false timeframe = 30d | dataset = xdr\_data | filter event\_type = ENUM.LOAD\_IMAGE and action\_module\_signature\_status = 3 and ((action\_module\_path contains "mpsvc.dll" and actor\_process\_image\_name = "aug.exe") or (action\_module\_path contains "dismcore.dll" and actor\_process\_image\_name = "aug.exe" ) or (action\_module\_path contains "\\hex.dll" and actor\_process\_image\_name = "SafeGuard.exe") or (action\_module\_path contains "x32bridge.dll" and actor\_process\_image\_name = "x32dbg.exe") or (action\_module\_path contains "x32bridge.dll" and actor\_process\_image\_name = "Mediae.exe")) | comp count() as counter by actor\_process\_image\_path , action\_module\_path , action\_module\_sha256 |-------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 | // Detecting potential DLL side loading config case\_sensitive = false timeframe = 30d | dataset = xdr\_data | filter event\_type = ENUM.LOAD\_IMAGE and action\_module\_signature\_status = 3 and ((action\_module\_path contains "mpsvc.dll" and actor\_process\_image\_name = "aug.exe") or (action\_module\_path contains "dismcore.dll" and actor\_process\_image\_name = "aug.exe" ) or (action\_module\_path contains "\\hex.dll" and actor\_process\_image\_name = "SafeGuard.exe") or (action\_module\_path contains "x32bridge.dll" and actor\_process\_image\_name = "x32dbg.exe") or (action\_module\_path contains "x32bridge.dll" and actor\_process\_image\_name = "Mediae.exe")) | comp count() as counter by actor\_process\_image\_path , action\_module\_path , action\_module\_sha256 | // Adding registry persistence config case\_sensitive = false timeframe = 30d | dataset = xdr\_data | filter event\_type = ENUM.REGISTRY and event\_sub\_type = ENUM.REGISTRY\_SET\_VALUE and action\_registry\_key\_name contains "Microsoft\\Windows\\CurrentVersion\\Run" and (action\_registry\_data contains "x32dbg.exe" or action\_registry\_data contains "aug.exe" or action\_registry\_data contains "SafeGuard.exe") | fields action\_registry\_data , action\_registry\_file\_path , action\_registry\_key\_name , actor\_process\_command\_line , agent\_hostname |-------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 | // Adding registry persistence config case\_sensitive = false timeframe = 30d | dataset = xdr\_data | filter event\_type = ENUM.REGISTRY and event\_sub\_type = ENUM.REGISTRY\_SET\_VALUE and action\_registry\_key\_name contains "Microsoft\\Windows\\CurrentVersion\\Run" and (action\_registry\_data contains "x32dbg.exe" or action\_registry\_data contains "aug.exe" or action\_registry\_data contains "SafeGuard.exe") | fields action\_registry\_data , action\_registry\_file\_path , action\_registry\_key\_name , actor\_process\_command\_line , agent\_hostname | // Payload execution with rundll32.exe config case\_sensitive = false timeframe = 30d | dataset = xdr\_data | filter event\_type = ENUM.PROCESS and action\_process\_image\_path contains "rundll32" and (action\_process\_image\_command\_line contains "\\akm.dat" or action\_process\_image\_command\_line contains "\\precious.dat") | fields action\_process\_image\_command\_line , actor\_process\_image\_command\_line , agent\_hostname |-------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 | // Payload execution with rundll32.exe config case\_sensitive = false timeframe = 30d | dataset = xdr\_data | filter event\_type = ENUM.PROCESS and action\_process\_image\_path contains "rundll32" and (action\_process\_image\_command\_line contains "\\akm.dat" or action\_process\_image\_command\_line contains "\\precious.dat") | fields action\_process\_image\_command\_line , actor\_process\_image\_command\_line , agent\_hostname | ## Indicators of Compromise ### Known PlugX Samples: 8ec37dac2beaa494dcefec62f0bf4ae30a6ce44b27a588169d8f0476bbc94115 e72e49dc1d95efabc2c12c46df373173f2e20dab715caf58b1be9ca41ec0e172 0e9071714a4af0be1f96cffc3b0e58520b827d9e58297cb0e02d97551eca3799 39280139735145ba6f0918b684ab664a3de7f93b1e3ebcdd071a5300486b8d20 41a0407371124bcad7cab56227078ccd635ba6e6b4374b973754af96b7f58119 02aa5b52137410de7cc26747f26e07b65c936d019ee2e1afae268a00e78a1f7f 2a07877cb53404888e1b6f81bb07a35bc804daa1439317bccde9c498a521644c 5d98d1193fcbb2479668a24697023829fc9dc1f7d31833c3c42b8380ef859ff1 ### Known File Directories C:\\ProgramData\\UsersDate\\Windows\_NT\\Windows\\user\\Desktop\\ C:\\Users\\Public\\Public Mediae\\ \:\\u00A0\\u00A0\\RECYCLER.BIN\\files \:\\u00A0\\u00A0\\RECYCLER.BIN\\files\\da520e5 ### Known Windows Mutex Names LKU\_Test\_0.1 LKU\_Test\_0.2 TCP\_0.1 ### Known PlugX Encrypted Payload File Names akm.dat precious.dat x32bridge.dat Groza\_1.dat ### Known Windows Scheduled Task Names LKUFORYOU\_1 PRECIOUS\_0.1 ### Known Windows Process Names (Observed Abused Benign Files) x32dbg.exe x32dbge.exe Mediae.exe Aug.exe Precious.exe SafeGuard.exe Dism.exe ### MITRE ATT\&CK Techniques [ATOM PlugX Malware](https://unit42.paloaltonetworks.com/atoms/plugx-malware/) ## Additional Resources * [THOR: Previously Unseen PlugX Variant Deployed During Microsoft Exchange Server Attacks by PKPLUG Group](https://unit42.paloaltonetworks.com/thor-plugx-variant/) * [Brute Ratel C4 Red Teaming Tool Being Abused by Malicious Actors](https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/) * [NJCCIC Alert Gootloader Malware Platform Uses Sophisticated Techniques to Deliver Malware](https://www.cyber.nj.gov/alerts-advisories/gootloader-malware-platform-uses-sophisticated-techniques-to-deliver-malware) * [A new APT uses DLL side-loads to "KilllSomeOne" -- Sophos News](https://news.sophos.com/en-us/2020/11/04/a-new-apt-uses-dll-side-loads-to-killlsomeone/) * [Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike (trendmicro.com)](https://www.trendmicro.com/en_ca/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html) * [Inside the OPM Hack, The Cyberattack that Shocked the US Government | WIRED](https://www.wired.com/2016/10/inside-cyberattack-shocked-us-government/) * [ASCII Codes](https://cplusplus.com/doc/ascii/) * [ASCII Table](https://www.asciitable.com/) Back to top ### Tags * [Black Basta ransomware](https://unit42.paloaltonetworks.com/tag/black-basta-ransomware/ "Black Basta ransomware") * [Brute ratel c4](https://unit42.paloaltonetworks.com/tag/brute-ratel-c4/ "brute ratel c4") * [Dark Scorpius](https://unit42.paloaltonetworks.com/tag/dark-scorpius/ "Dark Scorpius") * [GootLoader](https://unit42.paloaltonetworks.com/tag/gootloader/ "GootLoader") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Realtek SDK Vulnerability Attacks Highlight IoT Supply Chain Threats](https://unit42.paloaltonetworks.com/realtek-sdk-vulnerability/ "Realtek SDK Vulnerability Attacks Highlight IoT Supply Chain Threats") ### Table of Contents * ### Related Articles * [Threat Actor Groups Tracked by Palo Alto Networks Unit 42 (Updated Aug. 1, 2025)](https://unit42.paloaltonetworks.com/threat-actor-groups-tracked-by-palo-alto-networks-unit-42/ "article - table of contents") * [Ransomware Review: First Half of 2024](https://unit42.paloaltonetworks.com/unit-42-ransomware-leak-site-data-analysis/ "article - table of contents") * [Dissecting GootLoader With Node.js](https://unit42.paloaltonetworks.com/javascript-malware-gootloader/ "article - table of contents") ## Related Ransomware Resources ![Pictorial representation of Iran cyber attacks. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) April 17, 2026 [#### Threat Brief: Escalation of Cyber Risk Related to Iran (Updated April 17)](https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/) * [APK](https://unit42.paloaltonetworks.com/tag/apk/ "APK") * [DDoS attacks](https://unit42.paloaltonetworks.com/tag/ddos-attacks/ "DDoS attacks") * [GenAI](https://unit42.paloaltonetworks.com/tag/genai/ "GenAI") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/ "Threat Brief: Escalation of Cyber Risk Related to Iran (Updated April 17)") ![Pictorial representation of RaaS RansomHouse. Digital representation of cybersecurity concept with a padlock superimposed over computer circuit boards, symbolizing data protection and encryption technologies.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/12/06_Ransomware_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) December 17, 2025 [#### From Linear to Complex: An Upgrade in RansomHouse Encryption](https://unit42.paloaltonetworks.com/ransomhouse-encryption-upgrade/) * [ESXi](https://unit42.paloaltonetworks.com/tag/esxi/ "ESXi") * [Jolly Scorpius](https://unit42.paloaltonetworks.com/tag/jolly-scorpius/ "Jolly Scorpius") * [RansomHouse](https://unit42.paloaltonetworks.com/tag/ransomhouse/ "RansomHouse") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ransomhouse-encryption-upgrade/ "From Linear to Complex: An Upgrade in RansomHouse Encryption") ![Pictorial representation of 01flip ransomware written in Rust. Digital artwork of a pixelated U.S. dollar bill disintegrating into small blocks against a blue data matrix background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/12/05_Ransomware_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) December 10, 2025 [#### 01flip: Multi-Platform Ransomware Written in Rust](https://unit42.paloaltonetworks.com/new-ransomware-01flip-written-in-rust/) * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [CL-CRI-103](https://unit42.paloaltonetworks.com/tag/cl-cri-103/ "CL-CRI-103") * [Cryptocurrency](https://unit42.paloaltonetworks.com/tag/cryptocurrency/ "Cryptocurrency") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/new-ransomware-01flip-written-in-rust/ "01flip: Multi-Platform Ransomware Written in Rust") ![Pictorial representation of malicious LLMs. Close-up view of a digital wall displaying various glowing icons, representing a high-tech network interface.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/11/AdobeStock_1270203474-786x440.jpeg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) November 25, 2025 [#### The Dual-Use Dilemma of AI: Malicious LLMs](https://unit42.paloaltonetworks.com/dilemma-of-ai-malicious-llms/) * [Credential Harvesting](https://unit42.paloaltonetworks.com/tag/credential-harvesting/ "Credential Harvesting") * [Data exfiltration](https://unit42.paloaltonetworks.com/tag/data-exfiltration/ "data exfiltration") * [LLM](https://unit42.paloaltonetworks.com/tag/llm/ "LLM") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/dilemma-of-ai-malicious-llms/ "The Dual-Use Dilemma of AI: Malicious LLMs") ![Constellation image representing the constellation schema used by Palo Alto Networks Unit 42 to track nation-state and cybercrime threat actor groups](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/Generic-B-1920x900-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/threat-actor-groups.svg)Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/) August 1, 2025 [#### Threat Actor Groups Tracked by Palo Alto Networks Unit 42 (Updated Aug. 1, 2025)](https://unit42.paloaltonetworks.com/threat-actor-groups-tracked-by-palo-alto-networks-unit-42/) * [Academic Serpens](https://unit42.paloaltonetworks.com/tag/academic-serpens/ "Academic Serpens") * [Agent Serpens](https://unit42.paloaltonetworks.com/tag/agent-serpens/ "Agent Serpens") * [Agonizing Serpens](https://unit42.paloaltonetworks.com/tag/agonizing-serpens/ "Agonizing Serpens") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/threat-actor-groups-tracked-by-palo-alto-networks-unit-42/ "Threat Actor Groups Tracked by Palo Alto Networks Unit 42 (Updated Aug. 1, 2025)") ![Pictorial representation of Unit 42 threat attribution system. Illustration featuring a white triangle centered within an abstract cosmic background of purple and blue swirls and stars.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/07/Generic-A-1920x900-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/threat-actor-groups.svg)Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/) July 31, 2025 [#### Introducing Unit 42's Attribution Framework](https://unit42.paloaltonetworks.com/unit-42-attribution-framework/) * [Advanced Persistent Threat](https://unit42.paloaltonetworks.com/tag/advanced-persistent-threat/ "Advanced Persistent Threat") * [Bookworm](https://unit42.paloaltonetworks.com/tag/bookworm/ "Bookworm") * [Nomenclature](https://unit42.paloaltonetworks.com/tag/nomenclature/ "nomenclature") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/unit-42-attribution-framework/ "Introducing Unit 42’s Attribution Framework") ![Pictorial representation of the ransomware landscape. Digital artwork of a disintegrating U.S. dollar bill with pixelated effects on a cyber-inspired background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/04/05_Ransomware_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-report-white-1.svg)Trend Reports](https://unit42.paloaltonetworks.com/category/trend-reports/) April 23, 2025 [#### Extortion and Ransomware Trends January-March 2025](https://unit42.paloaltonetworks.com/2025-ransomware-extortion-trends/) * [BianLian](https://unit42.paloaltonetworks.com/tag/bianlian/ "BianLian") * [Akira ransomware](https://unit42.paloaltonetworks.com/tag/akira-ransomware/ "Akira ransomware") * [Muddled Libra](https://unit42.paloaltonetworks.com/tag/muddled-libra/ "Muddled Libra") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/2025-ransomware-extortion-trends/ "Extortion and Ransomware Trends January-March 2025") ![A pictorial representation of Akira ransomware, distributed by Howling Scorpius. A person's hand typing on a keyboard with a digital screen displaying the word "password" highlighted in blue, set against a backdrop of various cybersecurity interface graphics.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/09_Cybercrime_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) December 2, 2024 [#### Threat Assessment: Howling Scorpius (Akira Ransomware)](https://unit42.paloaltonetworks.com/threat-assessment-howling-scorpius-akira-ransomware/) * [Howling Scorpius](https://unit42.paloaltonetworks.com/tag/howling-scorpius/ "Howling Scorpius") * [Leak site](https://unit42.paloaltonetworks.com/tag/leak-site/ "Leak site") * [Torrenting](https://unit42.paloaltonetworks.com/tag/torrenting/ "torrenting") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/threat-assessment-howling-scorpius-akira-ransomware/ "Threat Assessment: Howling Scorpius (Akira Ransomware)") ![Pictorial representation of a threat like BlackSuit ransomware. An illustration of a modern workspace with a laptop displaying cybersecurity icons, surrounded by stacks of coins and a credit card, all depicted in a neon, digital art style.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/04_Ransomware_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) November 20, 2024 [#### Threat Assessment: Ignoble Scorpius, Distributors of BlackSuit Ransomware](https://unit42.paloaltonetworks.com/threat-assessment-blacksuit-ransomware-ignoble-scorpius/) * [BlackSuit ransomware](https://unit42.paloaltonetworks.com/tag/blacksuit-ransomware/ "BlackSuit ransomware") * [Construction](https://unit42.paloaltonetworks.com/tag/construction/ "construction") * [Education](https://unit42.paloaltonetworks.com/tag/education/ "Education") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/threat-assessment-blacksuit-ransomware-ignoble-scorpius/ "Threat Assessment: Ignoble Scorpius, Distributors of BlackSuit Ransomware") ![A representation of a threat group like Jumpy Pisces. Illustrative image featuring two fish and the Pisces constellation superimposed on a stylized, abstract background with flowing purple waves and a starry night sky.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/Pisces-NK-A-1920x900-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/threat-actor-groups.svg)Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/) October 30, 2024 [#### Jumpy Pisces Engages in Play Ransomware](https://unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/) * [North Korea](https://unit42.paloaltonetworks.com/tag/north-korea/ "North Korea") * [Jumpy Pisces](https://unit42.paloaltonetworks.com/tag/jumpy-pisces/ "Jumpy Pisces") * [Fiddling Scorpius](https://unit42.paloaltonetworks.com/tag/fiddling-scorpius/ "Fiddling Scorpius") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/ "Jumpy Pisces Engages in Play Ransomware") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)