[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/ "Threat Actor Groups") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # Stately Taurus Activity in Southeast Asia Links to Bookworm Malware ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 10 min read Related Products [![Advanced DNS Security icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced DNS Security](https://unit42.paloaltonetworks.com/product-category/advanced-dns-security/ "Advanced DNS Security")[![Advanced Threat Prevention icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced Threat Prevention](https://unit42.paloaltonetworks.com/product-category/advanced-threat-prevention/ "Advanced Threat Prevention")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Cortex icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex](https://unit42.paloaltonetworks.com/product-category/cortex/ "Cortex")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Cortex XSIAM icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XSIAM](https://unit42.paloaltonetworks.com/product-category/cortex-xsiam/ "Cortex XSIAM")[![Next-Generation Firewall icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Robert Falcone](https://unit42.paloaltonetworks.com/author/robert-falcone/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:February 20, 2025 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Bookworm](https://unit42.paloaltonetworks.com/tag/bookworm/) * [DLL Sideloading](https://unit42.paloaltonetworks.com/tag/dll-sideloading/) * [Stately Taurus](https://unit42.paloaltonetworks.com/tag/stately-taurus/) * [ToneShell](https://unit42.paloaltonetworks.com/tag/toneshell/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/?pdf=download&lg=en&_wpnonce=279fa6c5e6 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/?pdf=print&lg=en&_wpnonce=279fa6c5e6 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Stately%20Taurus%20Activity%20in%20Southeast%20Asia%20Links%20to%20Bookworm%20Malware&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fstately-taurus-uses-bookworm-malware%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fstately-taurus-uses-bookworm-malware%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fstately-taurus-uses-bookworm-malware%2F&title=Stately%20Taurus%20Activity%20in%20Southeast%20Asia%20Links%20to%20Bookworm%20Malware "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fstately-taurus-uses-bookworm-malware%2F&text=Stately%20Taurus%20Activity%20in%20Southeast%20Asia%20Links%20to%20Bookworm%20Malware "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fstately-taurus-uses-bookworm-malware%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Stately%20Taurus%20Activity%20in%20Southeast%20Asia%20Links%20to%20Bookworm%20Malware%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fstately-taurus-uses-bookworm-malware%2F "Share in Mastodon") ## Executive Summary While analyzing infrastructure related to [Stately Taurus](https://unit42.paloaltonetworks.com/chinese-apts-target-asean-entities/) activity targeting organizations in countries affiliated with the Association of Southeast Asian Nations (ASEAN), Unit 42 researchers observed overlaps with infrastructure used by a variant of the Bookworm malware. We also found open-source intelligence that revealed additional Stately Taurus activity in the region during the same timeframe, including a [January 2024 CSIRT CTI post](https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/) detailing attacks in Myanmar. The earlier Stately Taurus attacks delivered the PubLoad malware and used the DLL sideloading technique to execute the malware. Stately Taurus commonly uses DLL sideloading as a technique to execute its payloads and Unit 42 believes that the PubLoad malware family is unique to this threat group as well. Before discovering these overlaps with known Stately Taurus infrastructure, we hadn't associated any threat actor with Bookworm, which we first [published about in 2015](https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/). After nearly a decade, we can now confidently state that Stately Taurus uses this malware. Palo Alto Networks customers are better protected through the following products and services: * [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) and [XSIAM](https://www.paloaltonetworks.com/resources/infographics/xsiam-product-tour) * [Cloud-Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) for the [Next-Generation Firewall](https://www.paloaltonetworks.com/network-security/next-generation-firewall), including [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire), [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention), [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering/administration) and [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) If you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html). | **Related Unit 42 Topics** | [**Stately Taurus**](https://unit42.paloaltonetworks.com/tag/stately-taurus/), **[Bookworm](https://unit42.paloaltonetworks.com/tag/bookworm/)** | |----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------| ## Stately Taurus Ties, Years in the Making The Stately Taurus activity impacting Myanmar used a legitimate executable signed by an automation organization to load a malicious payload with a filename of BrMod104.dll (2a00d95b658e11ca71a8de532999dd33ddee7f80432653427eaa885b611ddd87). This malicious payload is a variant of PubLoad, which is stager malware that communicates with its command and control (C2) server to obtain a second shellcode-based payload. This particular PubLoad payload communicates with its C2 server by directly connecting to the IP address 123.253.32\[.\]15. The payload then issues an HTTP request that looks like that shown in Figure 1. ![Screenshot of an HTTP request header showing interaction with a Microsoft Windows server, including fields for Host, User-Agent, Accept, Connection, and Content-Length. Some of the information is redacted.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/02/word-image-177797-138311-1.png) Figure 1. HTTP POST request sent from PubLoad to its C2. The HTTP request includes www.asia.microsoft.com within the host field as an attempt to masquerade as a legitimate request associated with the Windows operating system. Also, the URL pattern seen in these HTTP requests appears to be an attempt to mimic legitimate URLs accessed by Windows update, one of which looks like the following: * http://download.microsoft\[.\]com/v11/2/windowsupdate/redir/v6-win7sp1-wuredir.cab We compared the legitimate URL to that used by PubLoad. The PubLoad's URL uses v6-winsp1-wuredir, which differs from v6-win7sp1-wuredir used by the legitimate Windows update URL. We used this anomaly along with the rest of the URL structure to pivot to several archive files, described in more detail in the [Indicators of Compromise section](#post-138311-_2p02acr49vwt). These files were likely used in the delivery phase of the threat actor's operations. Lab52 discussed these archives within their article [discussing Mustang Panda's targeting of Australia in 2023](https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/), which provided another linkage between the stated activity and the Stately Taurus actor. In addition to these archives, we found three older payloads that had not been previously discussed publicly, shown in Table 1. These files communicated with their C2 servers using the same URL structure. |---------------|------------------------------------------------------------------|--------------|------------------------------------------------------------------------|------------------------| | **Compiled** | **SHA256** | **Filename** | **Debug Symbol Path** | **C2** | | Dec. 23, 2021 | cf61b7a9bdde2a39156d88f309f230a7d44e9feaf0359947e1f96e069eca4e86 | anhlab.exe | C:\\Users\\hack\\Desktop\\uuid\\uu\\Release\\uu.pdb | www.fjke5oe\[.\]com | | Nov. 9, 2022 | 5064b2a8fcfc58c18f53773411f41824b7f6c2675c1d531ffa109dc4f842119b | ltdis13n.dll | E:\\WhiteFile\\LTDIS13n\\Release\\LTDIS13n.pdb | www.fjke5oe\[.\]com | | Oct. 26, 2022 | fbc67446daaa0a0264ed7a252ab42413d6a43c2e5ab43437c2b3272daec85e81 | ltdis13n.dll | C:\\Users\\hack\\Documents\\WhiteFile\\LTDIS13n\\Release\\LTDIS13n.pdb | update.fjke5oe\[.\]com | Table 1. Payloads seen using the same URL pattern for C2 communications as Stately Taurus. The payloads shown in Table 1 are loaders that contain embedded shellcode formatted and ultimately executed in an interesting way by following these steps: 1. Using ASCII or decoded Base64 strings that represent UUID strings 2. Calling UuidFromStringA to convert the decoded UUIDs to binary data, each of which represents 16 bytes of shellcode 3. Creating a buffer on the heap using HeapCreate and HeapAlloc 4. Copying shellcode to buffer on the heap 5. Using a callback function of a legitimate API function, such as EnumChildWindows or EnumSystemLanguageGroupsA to execute the shellcode on the heap While the process to load and run shellcode seems quite unique, the [NCC group thoroughly documented it](https://research.nccgroup.com/2021/01/23/rift-analysing-a-lazarus-shellcode-execution-method/) in their January 2021 analysis of a macro-enabled document the Lazarus group used in [Operation In(ter)ception](https://twitter.com/_CPResearch_/status/1352310521752662018). We do not believe Stately Taurus is related to Operation In(ter)ception. However, the NCC group included source code of the [shellcode loading process written in C](https://gist.github.com/rxwx/c5e0e5bba8c272eb6daa587115ae0014) within their article. We believe Stately Taurus developers used this as a basis to create the three samples in Table 1 above. The decoded shellcode decrypts and loads dynamic-link libraries (DLLs) that comprise the Bookworm malware, which we will discuss further in the [next section](#post-138311-_4utf1zt5egsc). The Bookworm module responsible for communicating with its C2 server will issue HTTP POST requests to either www.fjke5oe\[.\]com or update.fjke5oe\[.\]com with the URL path previously seen in the PubLoad sample, as shown in Figure 2. ![Screenshot of a computer network HTTP request with text showing technical details such as connection type, user agent, and host address.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/02/word-image-180737-138311-2.png) Figure 2. HTTP POST to Bookworm C2 from fbc67446daaa0a0264ed7a252ab42413d6a43c2e5ab43437c2b3272daec85e81. ## Overlaps Between Bookworm and ToneShell While analyzing the Bookworm samples, we found a variant of the ToneShell backdoor (b382cc85eee95a620fc11370309ff76de9a3bcaefb645790434d8251a3b9fce1) that had the same debug symbol path as the Bookworm loader. Its developers compiled the two samples 8 weeks apart. The ToneShell variant was compiled Sep. 1, 2022, and the Bookworm sample was compiled on Oct. 26, 2022. The close proximity in compile times and the shared debug path between the two samples suggests that the same developer could have created samples of the two malware families. The debug path seen in both the ToneShell and Bookworm variants was C:\\Users\\hack\\Documents\\WhiteFile\\LTDIS13n\\Release\\LTDIS13n.pdb. In addition to this debug symbol overlap, we also observed an infrastructure overlap. This overlap included the Bookworm samples shown in Table 1 and the ToneShell variant used in the [targeted attack on the government organizations in Southeast Asia](https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/) that we discussed in our August 2023 article. The Bookworm payloads in Table 1 communicate with either www.fjke5oe\[.\]com or update.fjke5oe\[.\]com, both of which resolved to 103.27.202\[.\]80. The latter URL switched to 103.27.202\[.\]68 in December 2022. Earlier in January 2022, the IP address 103.27.202\[.\]68 resolved to the domain www.uvfr4ep\[.\]com. This domain hosted the C2 server for a ToneShell sample (a08e0d1839b86d0d56a52d07123719211a3c3d43a6aa05aa34531a72ed1207dc) installed by Stately Taurus at the Southeast Asian government compromise discussed in our previous post. This reinforces the link between the two malware families and their use by Stately Taurus. Further strengthening this connection, the ToneShell C2 domain www.uvfr4ep\[.\]com also resolved to 103.27.202\[.\]87, an IP address linked to the known Bookworm C2 domain www.hbsanews\[.\]com. We also found a recent ToneShell sample compiled on Jan. 24, 2024, that used the UUID format to represent its shellcode. This sample also used the same publicly available source code created by the [NCC group](https://research.nccgroup.com/2021/01/23/rift-analysing-a-lazarus-shellcode-execution-method/) as the Bookworm samples mentioned in the previous section. The main difference between the ToneShell loader using UUIDs from the Bookworm samples is the legitimate API functions whose callback functions they used to execute the shellcode. The Bookworm samples used either EnumSystemLanguageGroupsA or EnumChildWindows to run their shellcode from the API function's callback function, while the ToneShell sample used the legitimate API EnumSystemLocalesA instead. Table 2 shows the ToneShell and Bookworm samples that used the UUID technique to represent their respective shellcode, along with the API function they use to run the shellcode. This technique is not unique to this actor as the source code of the technique is publicly available. We include it in our analysis to increase our confidence in the relationship between Bookworm and ToneShell. It's believed that only Stately Taurus uses ToneShell. |------------------------------------------------------------------|------------|---------------------------------|-----------------| | **SHA256** | **Family** | **Callback Function Called By** | **UUID Format** | | ab9d8f1021f2a99c74aa66f8ddb52996ac2337da9de2676d090b87e19ce93033 | ToneShell | EnumSystemLocalesA | ASCII | | cf61b7a9bdde2a39156d88f309f230a7d44e9feaf0359947e1f96e069eca4e86 | Bookworm | EnumSystemLanguageGroupsA | ASCII | | 5064b2a8fcfc58c18f53773411f41824b7f6c2675c1d531ffa109dc4f842119b | Bookworm | EnumChildWindows | Base64 | | fbc67446daaa0a0264ed7a252ab42413d6a43c2e5ab43437c2b3272daec85e81 | Bookworm | EnumChildWindows | Base64 | Table 2. ToneShell and Bookworm samples using UUID to represent their shellcode and the API functions used to run the shellcode. ## Updates to Bookworm In our [first public post on Bookworm](https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/), we did a thorough analysis of the malware family and its unique modular design. We will reference this analysis in this section, and we suggest referencing the previous post for additional context. At a high level, the Bookworm malware has had minimal changes from the original samples analyzed in 2015 and those mentioned in the previous section. Its developers compiled these samples in late 2021 and in the fall of 2022. In our original analysis, the Bookworm family used DLL sideloading to load an actor-developed DLL called Loader.dll to decrypt and run shellcode within a file named readme.txt. In contemporary Bookworm samples, the malware no longer uses the Loader.dll and readme.txt files. Rather, the Bookworm shellcode within readme.txt is now the shellcode represented as UUID parameters as discussed in the previous sections of this post. The reuse of the shellcode in a different form factor shows the flexibility of Bookworm. This flexibility allows the actor to continue using this malware family years after public exposure. The Bookworm malware family consists of multiple modules, each of which support the main Leader.dll module by providing additional functionality. Older Bookworm modules had an exported function named ProgramStartup that the Leader module would call to obtain a data structure that acted as a list of available functions within the module. The Leader.dll module would use this data structure to call specific functions within the supporting modules to carry out specific functionality. Contemporary Bookworm modules no longer have the ProgramStartup exported function. Instead, each module's DllEntryPoint function returns a pointer to a function that is identical to the ProgramStartup function, which the Leader module will call to obtain the data structure with the module's functions. Figure 3 shows a comparison of the original ProgramStartup function for the AES.dll module on the right. The function returned by the DllEntryPoint of the contemporary AES.dll module is on the left. ![Two side-by-side images of computer code in editors labeled "primary" (left) and "secondary" (right) highlighting differences in script lines between the two versions.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/02/word-image-183351-138311-3.png) Figure 3. Code comparison between the original AES.dll ProgramStartup function to its contemporary. Besides the lack of a ProgramStartup exported function, the Bookworm modules themselves are very similar from a functionality perspective. The module identifier numbers used by Bookworm's loader line up exactly between the original Bookworm modules and their contemporary counterparts. However, the malware authors changed all but two of the DLL names extracted from the module's export address table (EAT) between old and new Bookworm modules. For instance, while the Leader.dll and Coder.dll module names remained the same from old to new Bookworm, the developers changed from legible module names like Resolver.dll to illegible names like dafdsafdsaa3. The developer also removed the timestamps from the EAT as well to make it difficult to determine when they created the module. However, a notable exception involves the Coder.dll module that had a timestamp of 2017-08-04 05:24:49. This suggests that the contemporary Bookworm modules are using a module created in August 2017. Table 3 shows the modules within contemporary Bookworm samples with their module identifier, module name and the original name of the module compared to those of older Bookworm samples. |------------------------------------------------------------------|-------------------------|-----------------------------|-----------------------| | **SHA256** | **Current Module Name** | **Related Bookworm Module** | **Current Module ID** | | f7b024196ac50bd0f7ed362a532e83edf154bb60fcf24d0ab5297d0c6beaca0f | Leader.dll | Leader.dll | 0x0 | | bbf12ee2cd71dbcf2948adf64f354ad7c69d6b6ff0b78ea76b3df2d02b08ed0f | dafdsafdsaa3 | Resolver.dll | 0x1 | | fa739724a4b6f7a766a2d7695d7da7b33a6ac834672c1b544dd555c93600a637 | fjdasljguafa | KBLogger.dll | 0x5 | | d7dbfb2b755418842fea4fca5628f0b36bbd128a71ddcd858b4b3c67ba78f516 | Coder.dll | Coder.dll | 0xA | | 6804b10aefe8fdb2b33ecf3bc5a93f49413ef66001b561e6fc121990d703d780 | 999999.000 | Digest.dll | 0xB | | 72aa72a4a4bdb09146c587304c6639eae65900cb2ea26911540a77d1f9b7acf6 | AES.dll | AES.dll | 0xC | | fb25a69ffc18b79ee664462e0717cf5e70820948d5d2ca4c192fac8b1ede91c2 | yyrtytr.565 | Network.dll | 0xE | | dcc349a1b624f6b949f181a7dd859a82715b4d3b6c37c7e5be1b729cd8e6f01f | feareade | HTTP.dll | 0x13 | | 51bf329ba04a042789bad3b395092488a3d89130dc72818985cde11fb85f8389 | fdafgravfdrafra | WinINetwork.dll | 0x17 | Table 3. Contemporary Bookworm modules, their names and the modules they relate to in original Bookworm samples. Table 3 shows that none of the more recent Bookworm samples have the Mover.dll module, which our previous post described as being responsible for moving Bookworm files to a new location upon initial installation. While this module is no longer included as part of the installation, the main module (Leader.dll) in contemporary Bookworm samples contains artifacts that suggest it still supports use of a Mover.dll module. For instance, current Leader.dll modules still attempt to resolve an exported function named iar, which is the exported function name within the original Mover.dll modules that carries out its functionality. ## Conclusion Stately Taurus remains highly active in targeting organizations associated with ASEAN. Based on overlaps sourced from this recent activity to the Bookworm malware family, Unit 42 has associated previously unattributed attacks on government organizations in Southeast Asia from nine years ago. Developers appear to have created these related Bookworm samples in 2021 and 2022, which show only slight changes from the core components from the Bookworm samples analyzed in 2015. Bookworm's use of shellcode to load additional modules allows the actors to package it in different form factors, which were the main difference seen between samples from 2015 and 2021-2022. The Bookworm malware has proven to be very versatile and a threat actor can repackage it to meet their operational requirements. This versatility suggests Bookworm will show up again in future attacks, which reiterates the same parting words from the conclusion from the [Bookworm Trojan: A Model of Modular Architecture](https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/) article from 2015. However this time we can reference the threat actor by name: *"We believe that it is likely that Stately Taurus will continue developing Bookworm and will continue to use it for the foreseeable future."* Palo Alto Networks customers are better protected from the threats discussed above through the following products: * [Advanced WildFire](https://www.paloaltonetworks.com/products/secure-the-network/wildfire) cloud-delivered malware analysis service accurately identifies the known samples as malicious. * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) and [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/dns-security) identify known URLs and domains associated with this activity as malicious. * [Next-Generation Firewall](https://docs.paloaltonetworks.com/ngfw) with the [Advanced Threat Prevention](https://docs.paloaltonetworks.com/advanced-threat-prevention/administration) security subscription can help block the attacks with best practices. Advanced Threat Prevention has an inbuilt machine learning-based detection that can detect exploits in real time. * [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) and [XSIAM](https://docs-cortex.paloaltonetworks.com/p/XSIAM) are designed to: * Prevent the execution of known malicious malware, and also prevent the execution of unknown malware using Behavioral Threat Protection and machine learning based on the Local Analysis module. * Protect against credential gathering tools and techniques using the new Credential Gathering Protection available from Cortex XDR 3.4. * Protect from threat actors dropping and executing commands from web shells using Anti-Webshell Protection, newly released in Cortex XDR 3.4. * Protect against exploitation of different vulnerabilities including ProxyShell and ProxyLogon using the Anti-Exploitation modules as well as Behavioral Threat Protection. * Detect post-exploit activity, including credential-based attacks, with behavioral analytics, through Cortex XDR Pro. If you think you may have been compromised or have an urgent matter, get in touch with the[Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call: * North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) * UK: +44.20.3743.3660 * Europe and Middle East: +31.20.299.3130 * Asia: +65.6983.8730 * Japan: +81.50.1790.0200 * Australia: +61.2.4062.7950 * India: 00080005045107 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org). ## Indicators of Compromise ### Bookworm Samples * cf61b7a9bdde2a39156d88f309f230a7d44e9feaf0359947e1f96e069eca4e86 * fbc67446daaa0a0264ed7a252ab42413d6a43c2e5ab43437c2b3272daec85e81 * 5064b2a8fcfc58c18f53773411f41824b7f6c2675c1d531ffa109dc4f842119b * 243b92959cd9aa03482f3398fbe81b4874c50a5945fe6b0c0abb432a33db853f * a0887fa90f88dd002b025a97b3a57e4fdb7f5fdd725490d96776f8626f528ef2 * a2452456eb3a1a51116d9c2991aae3b0982acc1a9b30efee92a4f102dc4d2927 * 3e137da41cb509412ee230c6d7aac3d69361358b28c3a09ec851d3c0f3853326 * fdad627a21a95ea2a6136c264c6a6cc2f0910a24881118b6eabc2d6509dc8dd7 * ab54af1dbe6a82488db161a7f57cd74f2dd282a9522587f18313b4e9835dc558 * 3cef0b5f069cc1d15d36aa83d54d2a7be79b29b02081b6592dd4714639ad0a66 * 43de1831368e6420b90210e15f72cea9171478391e15efdd608ad22fe916cea8 * 2bae8b07f5098e1ca8fb5a5776eb874072ace4e19734cba4af4450eeccde7f89 * a229a2943cf8d1b073574f0c050ca06392d0525b2028f4b4b04d1e4b40110c66 * 9192a1c1ab42186a46e08b914d66253440af2d2be6b497c34fe4b1770c3b5e01 * 4a92fa725adc57d7b501f33e87230a8291cf8ad22d4d3a830293abcc0ac10d12 * da8ef50fe5e571d0143a758c7c66bb55653f1f2d04f16464fc857226441d79b2 * f0df09513dcf292264b3336269952c7e9ff685df8180a2035bee9f3143b36609 ### Bookworm Modules |------------------------------------------------------------------|-----------------| | **SHA256** | **Module** | | fa739724a4b6f7a766a2d7695d7da7b33a6ac834672c1b544dd555c93600a637 | KBLogger.dll | | fb25a69ffc18b79ee664462e0717cf5e70820948d5d2ca4c192fac8b1ede91c2 | Network.dll | | bbf12ee2cd71dbcf2948adf64f354ad7c69d6b6ff0b78ea76b3df2d02b08ed0f | Resolver.dll | | dcc349a1b624f6b949f181a7dd859a82715b4d3b6c37c7e5be1b729cd8e6f01f | HTTP.dll | | 51bf329ba04a042789bad3b395092488a3d89130dc72818985cde11fb85f8389 | WinINetwork.dll | | d7dbfb2b755418842fea4fca5628f0b36bbd128a71ddcd858b4b3c67ba78f516 | Digest.dll | | 6804b10aefe8fdb2b33ecf3bc5a93f49413ef66001b561e6fc121990d703d780 | Digest.dll | | 72aa72a4a4bdb09146c587304c6639eae65900cb2ea26911540a77d1f9b7acf6 | AES.dll | | f7b024196ac50bd0f7ed362a532e83edf154bb60fcf24d0ab5297d0c6beaca0f | Leader.dll | ### Bookworm Infrastructure * www.fjke5oe\[.\]com * update.fjke5oe\[.\]com * www.i5y3dl\[.\]com * www.hbsanews\[.\]com * www.b8pjmgd6\[.\]com * www.zimbra\[.\]page * www.ggrdl4\[.\]com * www.gm4rys\[.\]com ### Archives Related to PubLoad Using V6-winsp1-wuredir |------------------------------------------------------------------|-------------------------------------------------------------------------|--------------------| | **SHA256** | **Filename** | **C2** | | b7e042d2accdf4a488c3cd46ccd95d6ad5b5a8be71b5d6d76b8046f17debaa18 | analysis of the third meeting of ndsc.zip | 123.253.32\[.\]15 | | 41276827827b95c9b5a9fbd198b7cff2aef6f90f2b2b3ea84fadb69c55efa171 | april 27 updated party list.zip | 123.253.35\[.\]231 | | 167a842b97d0434f20e0cd6cf73d07079255a743d26606b94fc785a0f3c6736e | notice re uec, (04-25-2023 day).zip | 123.253.35\[.\]231 | | 4fbfbf1cd2efaef1906f0bd2195281b77619b9948e829b4d53bf1f198ba81dc5 | biography of senator the hon don farrell.zip | 123.253.35\[.\]231 | | 4e8717c9812318f8775a94fc2bffcf050eacfbc30ea25d0d3dcfe61b37fe34bb | analysisofthethirdmeetingofndsc.zip | 123.253.32\[.\]15 | | 98d6db9b86d713485eb376e156d9da585f7ac369816c4c6adb866d845ac9edc7 | 0228-2023.zip | 123.253.35\[.\]231 | | a02766b3950dbb86a129384cf9060c11be551025a7f469e3811ea257a47907d5 | national security priority programs.zip | 123.253.35\[.\]231 | | 4b6f0ae4abc6b73a68d9ee5ad9c0293baa4e7e94539ea43c0973677c0ee7f8cb | nsd.zip | 123.253.32\[.\]15 | | eb176117650d6a2d38ff435238c5e2a6d0f0bb2a9e24efed438a33d8a2e7a1ea | SAC has some instructional requirements for the general election(2).zip | 123.253.35\[.\]231 | ## Additional Resources * [Stately Taurus Targets the Philippines As Tensions Flare in the South Pacific](https://unit42.paloaltonetworks.com/stately-taurus-targets-philippines-government-cyberespionage/) -- Unit 42, Palo Alto Networks * [Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda](https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/) -- Unit 42, Palo Alto Networks * [Bookworm Trojan: A Model of Modular Architecture](https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/) -- Unit 42, Palo Alto Networks * [Threat Actor Groups Tracked by Palo Alto Networks Unit 42](https://unit42.paloaltonetworks.com/threat-actor-groups-tracked-by-palo-alto-networks-unit-42/) -- Unit 42, Palo Alto Networks * [Hunting for Unsigned DLLs to Find APTs](https://unit42.paloaltonetworks.com/unsigned-dlls/) -- Unit 42, Palo Alto Networks Back to top ### Tags * [Bookworm](https://unit42.paloaltonetworks.com/tag/bookworm/ "Bookworm") * [DLL Sideloading](https://unit42.paloaltonetworks.com/tag/dll-sideloading/ "DLL Sideloading") * [Stately Taurus](https://unit42.paloaltonetworks.com/tag/stately-taurus/ "Stately Taurus") * [ToneShell](https://unit42.paloaltonetworks.com/tag/toneshell/ "ToneShell") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Multiple Vulnerabilities Discovered in NVIDIA CUDA Toolkit](https://unit42.paloaltonetworks.com/nvidia-cuda-toolkit-vulnerabilities/ "Multiple Vulnerabilities Discovered in NVIDIA CUDA Toolkit") ### Table of Contents * ### Related Articles * [Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation](https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/ "article - table of contents") * [Tracking Iranian APT Screening Serpens' 2026 Espionage Campaigns](https://unit42.paloaltonetworks.com/tracking-iran-apt-screening-serpens/ "article - table of contents") * [Converging Interests: Analysis of Threat Clusters Targeting a Southeast Asian Government](https://unit42.paloaltonetworks.com/espionage-campaigns-target-se-asian-government-org/ "article - table of contents") ## Related Malware Resources ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/) * [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API") * [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway") * [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)