[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [German](https://unit42.paloaltonetworks.com/de/slow-pisces-new-custom-malware/) * [English](https://unit42.paloaltonetworks.com/slow-pisces-new-custom-malware/) * [Spanish (LATAM)](https://unit42.paloaltonetworks.com/es-la/slow-pisces-new-custom-malware/) * [French](https://unit42.paloaltonetworks.com/fr/slow-pisces-new-custom-malware/) * [Italian](https://unit42.paloaltonetworks.com/it/slow-pisces-new-custom-malware/) * [Japanese](https://unit42.paloaltonetworks.com/ja/slow-pisces-new-custom-malware/) * [Korean](https://unit42.paloaltonetworks.com/ko/slow-pisces-new-custom-malware/) * [Portuguese](https://unit42.paloaltonetworks.com/pt-br/slow-pisces-new-custom-malware/) * [Chinese (Traditional)](https://unit42.paloaltonetworks.com/zh-hant/slow-pisces-new-custom-malware/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/ "Threat Actor Groups") * [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/ "Cybercrime") [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/) # Slow Pisces Targets Developers With Coding Challenges and Introduces New Customized Python Malware ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 11 min read Related Products [![Advanced DNS Security icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced DNS Security](https://unit42.paloaltonetworks.com/product-category/advanced-dns-security/ "Advanced DNS Security")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Next-Generation Firewall icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Prashil Pattni](https://unit42.paloaltonetworks.com/author/prashil-pattni/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:April 14, 2025 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/) * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Cryptocurrency](https://unit42.paloaltonetworks.com/tag/cryptocurrency/) * [DPRK](https://unit42.paloaltonetworks.com/tag/dprk/) * [GitHub](https://unit42.paloaltonetworks.com/tag/github/) * [Infostealer](https://unit42.paloaltonetworks.com/tag/infostealer/) * [JavaScript Malware](https://unit42.paloaltonetworks.com/tag/javascript-malware/) * [Slow Pisces](https://unit42.paloaltonetworks.com/tag/slow-pisces/) * [Social engineering](https://unit42.paloaltonetworks.com/tag/social-engineering/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/slow-pisces-new-custom-malware/?pdf=download&lg=en&_wpnonce=21f1e90c03 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/slow-pisces-new-custom-malware/?pdf=print&lg=en&_wpnonce=21f1e90c03 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Slow%20Pisces%20Targets%20Developers%20With%20Coding%20Challenges%20and%20Introduces%20New%20Customized%20Python%20Malware&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fslow-pisces-new-custom-malware%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fslow-pisces-new-custom-malware%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fslow-pisces-new-custom-malware%2F&title=Slow%20Pisces%20Targets%20Developers%20With%20Coding%20Challenges%20and%20Introduces%20New%20Customized%20Python%20Malware "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fslow-pisces-new-custom-malware%2F&text=Slow%20Pisces%20Targets%20Developers%20With%20Coding%20Challenges%20and%20Introduces%20New%20Customized%20Python%20Malware "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fslow-pisces-new-custom-malware%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Slow%20Pisces%20Targets%20Developers%20With%20Coding%20Challenges%20and%20Introduces%20New%20Customized%20Python%20Malware%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fslow-pisces-new-custom-malware%2F "Share in Mastodon") ## Executive Summary Slow Pisces (aka Jade Sleet, TraderTraitor, PUKCHONG) is a North Korean state-sponsored threat group primarily focused on generating revenue for the DPRK regime, typically by targeting large organizations in the cryptocurrency sector. This article analyzes their campaign that we believe is connected to recent cryptocurrency heists. In this campaign, [Slow Pisces]() engaged with cryptocurrency developers on LinkedIn, posing as potential employers and sending malware disguised as coding challenges. These challenges require developers to run a compromised project, infecting their systems using malware we have named RN Loader and RN Stealer. The group reportedly stole over [$1 billion USD from the cryptocurrency sector in 2023](https://www.microsoft.com/en-us/security/security-insider/microsoft-digital-defense-report-2023). They have achieved this using various methods, including [fake trading applications](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-108a), malware distributed via the [Node Package Manager (NPM)](https://github.blog/security/vulnerability-research/security-alert-social-engineering-campaign-targets-technology-industry-employees/) and [supply chain compromises](https://cloud.google.com/blog/topics/threat-intelligence/north-korea-supply-chain). In December 2024, [the FBI attributed](https://www.fbi.gov/news/press-releases/fbi-dc3-and-npa-identification-of-north-korean-cyber-actors-tracked-as-tradertraitor-responsible-for-theft-of-308-million-from-bitcoindmmcom) the theft of $308 million from a Japan-based cryptocurrency company to Slow Pisces. More recently, the group made headlines for its alleged involvement in the [theft of $1.5 billion](https://www.ic3.gov/PSA/2025/PSA250226) from a Dubai cryptocurrency exchange. We have shared our threat intelligence with analysts at GitHub and LinkedIn to take down the relevant accounts and repositories. They provided the following statement in response: *GitHub and LinkedIn removed these malicious accounts for violating our respective terms of service. Across our products we use automated technology, combined with teams of investigation experts and member reporting, to combat bad actors and enforce terms of service. We continue to evolve and improve our processes and encourage our customers and members to report any suspicious activity.* ***Additional information*** * *GitHub users can find more information in our* [*Acceptable Use Policies*](https://docs.github.com/en/site-policy/acceptable-use-policies/github-acceptable-use-policies)*and* [*report abuse and spam*](https://docs.github.com/en/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam)*pages.* * *LinkedIn users can learn more about identifying and reporting abuse here:* [*Recognize and report spam, inap* *propriate, and abusive content*](https://www.linkedin.com/help/linkedin/answer/a1344213) This report details how Slow Pisces conceals malware within its coding challenges and describes the group's subsequent tooling, aiming to provide the wider industry with a better understanding of this threat. Palo Alto Networks customers are better protected from the threats discussed in this article through our [Next-Generation Firewall](https://docs.paloaltonetworks.com/ngfw) with [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering/administration) and [Advanced DNS Security](https://docs.paloaltonetworks.com/dns-security) subscriptions. If you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html). | **Related Unit 42 Topics** | [**Cryptocurrency**](https://unit42.paloaltonetworks.com/tag/cryptocurrency/), **[DPRK](https://unit42.paloaltonetworks.com/tag/dprk/)** | |----------------------------|------------------------------------------------------------------------------------------------------------------------------------------| ## Technical Analysis Our visibility of this campaign broadly follows three steps, illustrated below in Figure 1. ![Diagram illustrating cybersecurity threats involving PDF lures, GitHub repositories, and a C2 server. It shows: 1) PDF files like job descriptions and question sheets acting as lures, 2) GitHub JavaScript and Python repositories with multiple external APIs, potentially fetching malicious data, and 3) a C2 server configured to send benign data or a malicious payload under certain conditions. Palo Alto Networks and UNIT 42 logos are included.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/03/word-image-576381-138780-1.png) Figure 1. Overview of Slow Pisces "coding challenges" campaign. ### Stage 1 - PDF Lures ​​Slow Pisces began by impersonating recruiters on LinkedIn and engaging with potential targets, sending them a benign PDF with a job description as shown below in Figure 2. If the potential targets applied, attackers presented them with a coding challenge consisting of several tasks outlined in a question sheet. ![Image displaying two documents side by side. On the left is a 'Job Description' for a UX Design Team Coordinator. On the right is a 'Question Sheet' containing technical and general questions related to user experience (UX) design.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/03/word-image-581400-138780-2.png) Figure 2. Benign PDF lures. We have observed Slow Pisces impersonating several organizations with these lures, primarily in the cryptocurrency sector. The question sheets include generic software development tasks and a "real project" coding challenge, which links to a GitHub repository shown in Figure 3 below. ![Screenshot of a document titled "Coding and Problem-Solving Skills With Real Project." It includes a link to a GitHub repository and outlines a coding task involving Bitcoin and Ethereum exchange rates from API sources. The text requests enhancements to the project by adding more market APIs and improving the network communication in the code.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/03/word-image-585781-138780-3.png) Figure 3. "Real project" coding challenge contained in the PDF lure. ### Stage 2 - GitHub Repositories Slow Pisces presented targets with so-called coding challenges as projects from GitHub repositories. The repositories contained code adapted from open-source projects, including applications for viewing and analyzing: * Stock market data * Statistics from European soccer leagues * Weather data * Cryptocurrency prices The group primarily used projects in either Python or JavaScript, likely depending on whether the target applied for a front-end or back-end development role. We also saw Java-based repositories in this campaign, though they were far less common, with only two instances impersonating a cryptocurrency application called jCoin. This scarcity suggests attackers might have created repositories on demand, based on a target's preferred programming language. Consequently the group more frequently used languages more popular in the cryptocurrency sector, such as JavaScript and Python. Likewise, undiscovered repositories might also exist for other programming languages. ### Stage 3a - Python Repository In late 2024, the group used a project shown below in Figure 4 titled "Stocks Pattern Analyzer" adapted from a [legitimate repository](https://github.com/gaborvecsei/Stocks-Pattern-Analyzer). ![Screenshot of a GitHub repository named "Stocks Pattern Analyzer" showing file structure on the left and README file content on the right explaining how to run the application directly and with Docker.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/03/word-image-590203-138780-4.png) Figure 4. "Stocks Pattern Analyzer" Python repository. Most of the code in the repository is benign. When targets attempt to run the project according to the question sheet, data is fetched from three remote locations: * hxxps://en.wikipedia\[.\]org/wiki/List\_of\_S%26P\_500\_companies * hxxps://en.wikipedia\[.\]org/wiki/Currency\_pair * hxxps://en.stockslab\[.\]org/symbols/sp500 Two of the URLs pull data from Wikipedia. The third URL uses a domain controlled by Slow Pisces. This pattern --- using multiple data sources, most legitimate but one malicious --- is common in the group's Python repositories. The malicious command-and-control (C2) server is configured to mimic the format of the legitimate sources. In this case, it uses the .en subdomain and .org top-level domain (TLD) like we see for the legitimate Wikipedia domain above. #### YAML Deserialization Slow Pisces could simply place malware directly in the repository or execute code from the C2 server using Python's built-in [eval](https://docs.python.org/3/library/functions.html#eval) or [exec](https://docs.python.org/3/library/functions.html#exec) functions. However, these techniques are easily detected, both by manual inspection and antivirus solutions. Instead, Slow Pisces first ensures the C2 server responds with valid application data. For example, the repository mentioned above expects a list of S\&P 500 company symbols. The C2 URL initially replies with this data in a JSON-formatted list. The threat actors only send a malicious payload to validated targets, likely based on IP address, geolocation, time and HTTP request headers. Focusing on individuals contacted via LinkedIn, as opposed to broad phishing campaigns, allows the group to tightly control the later stages of the campaign and deliver payloads only to expected victims. To avoid the suspicious eval and exec functions, Slow Pisces uses [YAML deserialization](https://net-square.com/yaml-deserialization-attack-in-python.html) to execute its payload as shown in Figure 5. ![Screenshot of Python code defining a function 'fetch\_symbols' which retrieves stock symbols from the S\&P 500 using an API call, handles different content types, and processes responses based on their content type. The last line has a section highlighted in a red box.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/03/word-image-594232-138780-5.png) Figure 5. Python code showing the entry point of Slow Pisces' malware using YAML deserialization. This code fetches data from the C2 server via HTTPS and checks the Content-Type response header. If the header indicates JSON data (application/json), the code parses and returns the JSON to the application. If the response indicates YAML data (application/yaml), the code uses the yaml.load() function from the [PyYAML](https://github.com/yaml/pyyaml) library to parse the data. This function is inherently unsafe and the PyYAML documentation [explicitly recommends](https://github.com/yaml/pyyaml) yaml.safe\_load() for untrusted input. YAML is typically used for configuration files, like the example shown below: username: slow password: pisces api: key: supersecret url: example.com |-------------------|------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 | username: slow password: pisces api: key: supersecret url: example.com | However, yaml.load() can serialize and deserialize arbitrary Python objects, not just valid YAML data. For example, the following Python code prints the numbers 0-4: range(0, 5) |---|-------------| | 1 | range(0, 5) | If this code was serialized using yaml.dump() it would become the following: !!python/object/apply:builtins.range - 0 - 5 - 1 |---------------|--------------------------------------------------| | 1 2 3 4 5 6 7 | !!python/object/apply:builtins.range - 0 - 5 - 1 | Finally, when this data is passed to yaml.load() it will execute the original code: range(0, 5). This highlights a potential detection point as payloads for the Python repository, and malware using YAML deserialization in general, contains !!python/object/apply:builtins if the payload uses a [built-in Python function](https://docs.python.org/3/library/functions.html). The following stages in Table 1 exist primarily in memory and generally have no footprint on disk. To aid the community in detection and awareness, we have uploaded these payloads to VirusTotal. The YAML deserialization payload executes malware we have named RN Loader and RN Stealer based on the C2 token format we observed in RN Stealer, which we discuss in the following sections. |------------------------------|------------------------------------------------------------------| | **Stage** | **SHA256 Hash** | | YAML Deserialization Payload | 47e997b85ed3f51d2b1d37a6a61ae72185d9ceaf519e2fdb53bf7e761b7bc08f | | RN Loader | 937c533bddb8bbcd908b62f2bf48e5bc11160505df20fea91d9600d999eafa79 | | RN Stealer | e89bf606fbed8f68127934758726bbb5e68e751427f3bcad3ddf883cb2b50fc7 | Table 1. Python repository payloads. Slow Pisces' YAML deserialization payload begins by creating the folder Public in the victim's home directory and creating a new file in that directory named **init**.py. Embedded Base64 data is decoded and written to this file, containing the next infection stage (RN Loader), which is then executed. #### RN Loader This newly created file for RN Loader at ~/Public/**init**.py deletes itself after execution, ensuring that it exists solely in memory. It sends basic information about the victim machine and operating system over HTTPS to the same C2 at en.stockslab\[.\]org, followed by a command loop with the following options in Table 2. |----------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Code** | **Description** | | 0 | Sleep for 20 seconds | | 1 | Base64-decodes sent content and saves it to the file init.dll for Windows or init for all other operating systems. Sets an environment variable X\_DATABASE\_NAME to an empty string. Loads and executes the downloaded DLL using [ctypes.cdll.LoadLibrary](https://docs.python.org/3/library/ctypes.html#ctypes.CDLL). | | 2 | Base64-decodes sent content and executes it using the Python built-in exec. | | 3 | Base64-decodes sent content and a parameter. Content is saved to the file dockerd, while the parameter is saved as docker-init. dockerd is then executed in a new process, with docker-init supplied as a command-line argument. | | 9 | Terminates execution. | Table 2. RN Loader command table. The payloads of the command loop from Table 2 using options **1** and **3** are currently unknown and are likely triggered by specific conditions. However, we recovered a Python-based infostealer delivered by option **2**, and we track this malware as RN Stealer. #### RN Stealer RN Stealer first generates a random victim ID, subsequently used as a cookie in all communications to the C2 server. It then requests an XOR key from the server for encrypting exfiltrated data. Communication with the C2 server occurs over HTTPS, using Base64-encoded tokens to identify request and response types. The analyzed payload includes four token types: * R0 -- requesting XOR key * R64 -- exfiltrating data * R128 -- exfiltrating compressed data * R256 -- infostealer complete The format of these token types --- the letter R followed by an integer N --- led to our names for this payload. We call the payload RN Stealer and the preceding stage RN Loader. We recovered the script for this RN Stealer sample from a macOS system. As such, threat authors tailored this sample to steal information specific to macOS devices, including: * Basic victim information: Username, machine name and architecture * Installed applications * A directory listing and the top-level contents of the victim's home directory * The login.keychain-db file that stores saved credentials in macOS systems * Stored SSH keys * Configuration files for AWS, Kubernetes and Google Cloud The data gathered by RN Stealer likely determines whether persistent access is necessary. If so, we can infer the following steps for this Python infection chain: 1. The C2 server checks beaconing victims against unknown criteria. Valid victims receive a YAML deserialization payload. Invalid victims receive benign JSON data. 2. The deserialization payload establishes a command loop with the C2 server, exfiltrating basic victim information and delivering a custom Python infostealer via option code **2** in Table 2. 3. The infostealer gathers more detailed victim information, which attackers likely used to determine whether they needed continued access. 1. If continued access is required, the C2 server delivers a payload via option codes **1** or **3**. 2. If access is no longer needed, option code **9** terminates the malware's execution, removing all access since the payload resides solely in memory. ### Stage 3b - JavaScript Repository If the targeted victims applied for a JavaScript role, they might instead encounter a "Cryptocurrency Dashboard" project, similar to the example in Figure 6 below. ![Screenshot of a GitHub repository named "Cryptocurrency Dashboard," featuring a README.md file displayed. This README includes sections: Features, Installation, Usage, Project Structure, Configuration, Dependencies, and License. It describes the project as an application built with Node.js, Express, and EJS that displays real-time and historical data for various cryptocurrencies.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/03/word-image-598004-138780-6.png) Figure 6. JavaScript repository. This application contains a .env file with the C2 and legitimate data source: * PORT=3000 * COINGECKO\_API\_URL=hxxps://api.coingecko\[.\]com/api/v3 * JQUERY\_API\_URL=hxxps://update.jquerycloud\[.\]io/api/v1 The COINGECKO\_API\_URL value is used to fetch data for the Cryptocurrency Dashboard while the JQUERY\_API\_URL value represents a C2 server controlled by Slow Pisces. Similar to the Python repository, the JavaScript C2 server only delivers payloads to validated targets, otherwise it responds with a version number. The repository uses the [Embedded JavaScript (EJS) templating tool](https://ejs.co/), passing responses from the C2 server to the ejs.render() function, shown below in Figure 7. ![Screenshot showing a code snippet in JavaScript. It includes a comment and a function call to render a homepage with settings and items per page. res.render is highlighted in a red box.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/03/word-image-602043-138780-7.png) Figure 7. JavaScript code showing the entry point of Slow Pisces' malware using the EJS render function. Like the use of yaml.load(), this is another technique Slow Pisces employs to conceal execution of arbitrary code from its C2 servers, and this method is perhaps only apparent when viewing a valid payload. The EJS render function accepts various parameters, one of which is called view options. Within this, arbitrary JavaScript code can be supplied and executed through the key escapeFunction. A Taiwanese researcher who goes by the handle Huli discussed the technical details of how this results in arbitrary code execution [in a CTF post](https://blog.huli.tw/2023/06/22/en/ejs-render-vulnerability-ctf/). However, we can sufficiently understand that a payload structured as shown in Figure 8 will result in the code contained in escapeFunction being executed when passed to ejs.render(). ![Screenshot of a JavaScript code snippet involving functions with "escapeFunction" highlighted in a red box.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/03/word-image-605478-138780-8.png) Figure 8. Partial EJS render payload. Unfortunately, we were not able to recover the full portion of this payload. As such, we can only surmise that a new directory .jql is created under the user's home directory where a file called helper.js is dropped, containing Base64-encoded data. ### Infrastructure The timeline below in Figure 9 details the C2 infrastructure used in this campaign from February 2024-February 2025, grouped by the type of repository served (JavaScript or Python). ![Timeline of infrastructure tracking the JavaScript command and controls (top, yellow label) and the Python command and controls (bottom, orange label). The timeline starts at the end of Q1 of 2024 and continues to Q2 of 2025.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/03/word-image-609427-138780-9.png) Figure 9. C2 infrastructure timeline. As mentioned earlier, the domains in the infrastructure of this campaign can mimic the format of the legitimate sources used alongside them, frequently using subdomains like .api or .cdn. We have discovered infrastructure associated with this campaign up to the time of this article. ## Conclusion This report has covered Slow Pisces' most recent campaign, impersonating recruiters over LinkedIn to target developers in the cryptocurrency sector with malicious coding challenges. While we were not able to recover the full attack chain for JavaScript repositories, the Python version of the campaign delivered two new payloads that we have named RN Loader and RN Stealer. Using LinkedIn and GitHub in this manner is not unique. Multiple DPRK-affiliated groups have used similar tactics such as [Alluring Pisces](https://www.reversinglabs.com/blog/fake-recruiter-coding-tests-target-devs-with-malicious-python-packages) and [Contagious Interview](https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/). These groups feature no operational overlaps. However, these campaigns making use of similar initial infection vectors is noteworthy. Slow Pisces stands out from their peers' campaigns in operational security. Delivery of payloads at each stage is heavily guarded, existing in memory only. And the group's later stage tooling is only deployed when necessary. In particular, the group made use of two techniques to conceal functionality: * YAML deserialization * EJS escapeFunction Both of these techniques greatly hinder analysis, detection and hunting. Similarly, relatively new or inexperienced developers in the cryptocurrency sector would have difficulty identifying these repositories as malicious. Based on public reports of cryptocurrency heists, this campaign appears highly successful and likely to persist in 2025. While this article highlighted two potential detection opportunities for YAML deserialization and EJS escapeFunction payloads, the most effective mitigation remains strict segregation of corporate and personal devices. This helps prevent the compromise of corporate systems from targeted social engineering campaigns. ### Palo Alto Networks Protection and Mitigation Palo Alto Networks customers are better protected from the threats discussed above through the following products: * [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering/administration) and [Advanced DNS Security](https://docs.paloaltonetworks.com/dns-security) If you think you may have been compromised or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call: * North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) * UK: +44.20.3743.3660 * Europe and Middle East: +31.20.299.3130 * Asia: +65.6983.8730 * Japan: +81.50.1790.0200 * Australia: +61.2.4062.7950 * India: 00080005045107 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org). ## Indicators of Compromise |--------------------------------|---------------------|----------------|---------------|----------------| | **Domain** | **IP Address** | **First Seen** | **Last Seen** | **Repository** | | getstockprice\[.\]com | 70.34.245\[.\]118 | 2025-02-03 | 2025-02-20 | Python | | cdn\[.\]clubinfo\[.\]io | 5.206.227\[.\]51 | 2025-01-21 | 2025-02-19 | Python | | getstockprice\[.\]info | 131.226.2\[.\]120 | 2025-01-21 | 2025-01-23 | Python | | api\[.\]stockinfo\[.\]io | 136.244.93\[.\]248 | 2024-10-30 | 2024-11-11 | Python | | cdn\[.\]logoeye\[.\]net | 54.39.83\[.\]151 | 2024-10-29 | 2024-11-03 | Python | | en\[.\]wfinance\[.\]org | 195.133.26\[.\]32 | 2024-10-12 | 2024-11-01 | Python | | en\[.\]stocksindex\[.\]org | 185.236.231\[.\]224 | 2024-09-11 | 2024-10-04 | Python | | cdn\[.\]jqueryversion\[.\]net | 194.11.226\[.\]16 | 2024-08-23 | 2024-09-23 | JavaScript | | en\[.\]stockslab\[.\]org | 91.103.140\[.\]191 | 2024-08-19 | 2024-09-12 | Python | | update\[.\]jquerycloud\[.\]io | 192.236.199\[.\]57 | 2024-07-03 | 2024-08-22 | JavaScript | | cdn\[.\]soccerlab\[.\]io | 146.70.124\[.\]70 | 2024-08-07 | 2024-08-21 | Python | | api\[.\]coinpricehub\[.\]io | 45.141.58\[.\]40 | 2024-05-06 | 2024-08-06 | Java | | cdn\[.\]leaguehub\[.\]net | 5.133.9\[.\]252 | 2024-07-15 | 2024-07-21 | Python | | cdn\[.\]clublogos\[.\]io | 146.19.173\[.\]29 | 2024-06-24 | 2024-07-12 | Python | | api\[.\]jquery-release\[.\]com | 146.70.125\[.\]120 | 2024-06-10 | 2024-06-28 | JavaScript | | cdn\[.\]logosports\[.\]net | 185.62.58\[.\]74 | 2024-05-08 | 2024-06-23 | Python | | skypredict\[.\]org | 80.82.77\[.\]80 | 2024-05-06 | 2024-06-16 | JavaScript | | api\[.\]bitzone\[.\]io | 192.248.145\[.\]210 | 2024-04-25 | 2024-05-13 | Python | | weatherdatahub\[.\]org | 194.15.112\[.\]200 | 2024-04-05 | 2024-05-03 | JavaScript | | api\[.\]ethzone\[.\]io | 91.234.199\[.\]90 | 2024-04-16 | 2024-04-24 | Python | | api\[.\]fivebit\[.\]io | 185.216.144\[.\]41 | 2024-04-08 | 2024-04-14 | Python | | blockprices\[.\]io | 91.193.18\[.\]201 | 2024-03-15 | 2024-04-09 | JavaScript | | api\[.\]coinhar\[.\]io | 185.62.58\[.\]122 | 2024-03-26 | 2024-04-09 | Python | | mavenradar\[.\]com | 23.254.230\[.\]253 | 2024-02-21 | 2024-03-26 | JavaScript | | indobit\[.\]io | 146.70.88\[.\]126 | 2024-03-19 | 2024-03-20 | Python | | api\[.\]thaibit\[.\]io | 79.137.248\[.\]193 | 2024-03-07 | 2024-03-09 | Python | | chainanalyser\[.\]com | 38.180.62\[.\]135 | 2024-02-23 | 2024-03-06 | JavaScript | ## Additional Resources * [North Korea Responsible for $1.5 Billion Bybit Hack](https://www.ic3.gov/PSA/2025/PSA250226) -- Internet Crime Complaint Center (IC3) * [FBI, DC3, and NPA Identification of North Korean Cyber Actors, Tracked as TraderTraitor, Responsible for Theft of $308 Million USD from Bitcoin.DMM.com](https://www.fbi.gov/news/press-releases/fbi-dc3-and-npa-identification-of-north-korean-cyber-actors-tracked-as-tradertraitor-responsible-for-theft-of-308-million-from-bitcoindmmcom) -- FBI * [Security alert: social engineering campaign targets technology industry employees](https://github.blog/security/vulnerability-research/security-alert-social-engineering-campaign-targets-technology-industry-employees/) -- GitHub Blog * [North Korea Leverages SaaS Provider in a Targeted Supply Chain Attack](https://cloud.google.com/blog/topics/threat-intelligence/north-korea-supply-chain) -- Mandiant, Google Cloud Back to top ### Tags * [Cryptocurrency](https://unit42.paloaltonetworks.com/tag/cryptocurrency/ "Cryptocurrency") * [DPRK](https://unit42.paloaltonetworks.com/tag/dprk/ "DPRK") * [GitHub](https://unit42.paloaltonetworks.com/tag/github/ "GitHub") * [Infostealer](https://unit42.paloaltonetworks.com/tag/infostealer/ "Infostealer") * [JavaScript Malware](https://unit42.paloaltonetworks.com/tag/javascript-malware/ "JavaScript Malware") * [Slow Pisces](https://unit42.paloaltonetworks.com/tag/slow-pisces/ "Slow Pisces") * [Social engineering](https://unit42.paloaltonetworks.com/tag/social-engineering/ "social engineering") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: How Prompt Attacks Exploit GenAI and How to Fight Back](https://unit42.paloaltonetworks.com/new-frontier-of-genai-threats-a-comprehensive-guide-to-prompt-attacks/ "How Prompt Attacks Exploit GenAI and How to Fight Back") ### Table of Contents * ### Related Articles * [Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "article - table of contents") * [Inside the Modern SOC: The Identity Front Door](https://unit42.paloaltonetworks.com/soc-identity-front-door/ "article - table of contents") * [ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "article - table of contents") ## Related Resources ![Pictorial representation of a magnifying glass illuminating a glowing orange circular digital circuit interface on a dark, high-tech background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Myth-Busting_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) September 16, 2026 [#### Atomic macOS (AMOS) Stealer Activity](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/) * [MacOS](https://unit42.paloaltonetworks.com/tag/macos/ "macOS") * [Threat intelligence](https://unit42.paloaltonetworks.com/tag/threat-intelligence/ "threat intelligence") * [Unit 42](https://unit42.paloaltonetworks.com/tag/unit-42/ "Unit 42") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/ "Atomic macOS (AMOS) Stealer Activity") ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/content/pan/en_US/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)