[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/the-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks/) * [Japanese](https://unit42.paloaltonetworks.com/ja/the-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # The Fractured Statue Campaign: U.S. Government Agency Targeted in Spear-Phishing Attacks ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 9 min read Related Products [![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:January 23, 2020 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [CARROTBALL](https://unit42.paloaltonetworks.com/tag/carrotball/) * [CARROTBAT](https://unit42.paloaltonetworks.com/tag/carrotbat/) * [Fractured Statue](https://unit42.paloaltonetworks.com/tag/fractured-statue/) * [KONNI](https://unit42.paloaltonetworks.com/tag/konni/) * [Phishing](https://unit42.paloaltonetworks.com/tag/phishing/) * [Syscon](https://unit42.paloaltonetworks.com/tag/syscon/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/the-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks/?pdf=download&lg=en&_wpnonce=614a722d38 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/the-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks/?pdf=print&lg=en&_wpnonce=614a722d38 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=The%20Fractured%20Statue%20Campaign:%20U.S.%20Government%20Agency%20Targeted%20in%20Spear-Phishing%20Attacks&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fthe-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fthe-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fthe-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks%2F&title=The%20Fractured%20Statue%20Campaign:%20U.S.%20Government%20Agency%20Targeted%20in%20Spear-Phishing%20Attacks "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fthe-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks%2F&text=The%20Fractured%20Statue%20Campaign:%20U.S.%20Government%20Agency%20Targeted%20in%20Spear-Phishing%20Attacks "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fthe-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=The%20Fractured%20Statue%20Campaign:%20U.S.%20Government%20Agency%20Targeted%20in%20Spear-Phishing%20Attacks%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fthe-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks%2F "Share in Mastodon") ## Executive Summary Between July and October 2019, Unit 42 observed several malware families typically associated with the Konni Group (see [Attribution](#Attribution) section below for more details) used to primarily target a US government agency, using the ongoing and heightened geopolitical relations issues surrounding North Korea to lure targets into opening malicious email attachments. The malware families used in this campaign consisted mainly of malicious documents featuring CARROTBAT downloaders with SYSCON payloads, but also included a new malware downloader Unit 42 has dubbed CARROTBALL. CARROTBALL, initially discovered in an attack during October 2019, is a simple FTP downloader utility which facilitates the installation of SYSCON, a full-featured Remote Access Trojan (RAT) which leverages FTP for Command and Control (C2). It was found embedded in a malicious Word document sent as a phishing lure to a US government agency and two non-US foreign nationals professionally associated with North Korea. Throughout the course of the campaign, Unit 42 ultimately observed a total of six unique malicious document lures being sent as attachments from four unique Russian email addresses to 10 unique targets. The subject matter of the lures featured articles written in Russian pertaining to ongoing geopolitical relations issues surrounding North Korea. Of those malicious documents, five contained CARROTBAT downloaders, and one contained a CARROTBALL downloader. All malicious second stage payloads were SYSCON. While this campaign does demonstrate some evolution in the actor's tactics, techniques and procedures (TTPs) with the use of a new downloader family and new malicious code in the form of Word Document macros, the majority of its attributes bear a strong resemblance to the Fractured Block campaign [previously reported by Unit 42 in November 2018](https://unit42.paloaltonetworks.com/unit42-the-fractured-block-campaign-carrotbat-malware-used-to-deliver-malware-targeting-southeast-asia/). As such, Unit 42 has dubbed this campaign Fractured Statue. The Adversary Playbook for the activity described in this blog can be found [here](https://pan-unit42.github.io/playbook_viewer/?pb=konni). ![](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/word-image-118.png) *Figure 1. Fractured Statue Campaign Timeline* ### Opening Wave of Attacks Between July 15th, 2019 and July 17th, 2019, spear phishing emails were sent to a total of five individuals at a US government agency from the email addresses 0tdelkorei@mail\[.\]ru and kargarnova@mail\[.\]ru. The spear phishing emails utilized three different email subjects with malicious macro documents attached with the same name; all file names were written in Russian. Further, all of the malicious documents contained articles written in Russian pertaining to ongoing geopolitical relations issues surrounding North Korea. The documents themselves were rather generic and had no embedded image enticements to enable macros. They did, however, leverage second-stage downloader components consistent with known CARROTBAT samples, and almost all of them featured SYSCON payloads. The first pages of each of these documents are shown below: [![](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/Figure-2.-First-page-of-initial-malicious-document-observed-in-the-campaign.-788x1024.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/Figure-2.-First-page-of-initial-malicious-document-observed-in-the-campaign..png) *Figure 2. First page of initial malicious document observed in the campaign.* *Associated with CARROTBAT.* |------------------------------------------------------------------|-------------------------------------------------------------------------------|------------------------|-----------------------------------------------------------------------------------------------------|-------------------------|-------------------------------|----------------------| | SHA256 | Subject | Sender | Translated Subject | File name | Translated File Name | Initial C2 Domain | | 4c201f9949804e90f94fe91882cb8aad3e7daf496a7f4e792b9c7fed95ab0726 | О ситуации на Корейском полуострове и перспекти вах диалога между США и К НДР | 0tdelkorei@mail\[.\]ru | On the situation on the Korean Peninsula and the prospects for dialogue between the USA and the PDR | О ситуации на Корейском | About the situation in Korean | handicap.eu5\[.\]org | *Table 1. First phishing attempt details.* [![](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/Figure-3.-First-page-of-second-malicious-document-observed-in-the-campaign.-741x1024.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/Figure-3.-First-page-of-second-malicious-document-observed-in-the-campaign..png) *Figure 3. First page of second malicious document observed in the campaign.* *Associated with CARROTBAT.* |------------------------------------------------------------------|-------------------------------------------------------------------|------------------------|--------------------------------------------------------------------|--------------------------|----------------------------|----------------------| | SHA256 | Subject | Sender | Translated Subject | File name | Translated File Name | Initial C2 Domain | | 63c3817a5e9984aaf59e8a61ddd54793ffed11ac5becef438528447f6b2823af | Продлится ли мирная пауз а на Корейском полуостро ве до 2024 года | 0tdelkorei@mail\[.\]ru | Will there be a peaceful pause on the Korean Peninsula until 2024? | Продлится ли мирная пауз | Will the peace breaks last | handicap.eu5\[.\]org | *Table 2. Second phishing attempt details.* [![](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/Figure-4.-First-page-of-third-malicious-document-observed-in-the-campaign.-794x1024.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/Figure-4.-First-page-of-third-malicious-document-observed-in-the-campaign..png) *Figure 4. First page of third malicious document observed in the campaign.* *Associated with CARROTBAT.* |------------------------------------------------------------------|----------------------------------------------------------------------|------------------------|-------------------------------------------------------------------|-----------------------------|--------------------------|----------------------| | SHA256 | Subject | Sender | Translated Subject | File name | Translated File Name | Initial C2 Domain | | 9dfe3afccada40a05b8b34901cb6a63686d209e2b92630596646dba8ee619225 | Россия -- КНДР -- РК -- тор гово-экономические связ и -- инвестиции. | kargarnova@mail\[.\]ru | "Russia - DPRK - RK - trade and economic ties and - investments." | Россия -- КНДР -- РК -- тор | Russia - DPRK - RK - tor | handicap.eu5\[.\]org | *Table 3. Third phishing attempt details.* ### Second Wave Roughly one month later, beginning on August 15, 2019 and ending on September 14, 2019, the second wave of CARROTBAT attacks occurred against three additional email addresses at the same government agency. One attack featured the same sender and malicious document but had a different subject and filename. The other two emails contained a previously unseen malicious document and featured a mix of Russian and English languages in both the document lures and the email correspondence. |------------------------------------------------------------------|--------------------------------------------------------------------------------------------|------------------------|--------------------------------------------|----------------------| | SHA256 | Subject | Sender | File name | Initial C2 Domain | | 9dfe3afccada40a05b8b34901cb6a63686d209e2b92630596646dba8ee619225 | Russia -- North Korea -- Republic of Korea -- trade and economic relations -- investments. | kargarnova@mail\[.\]ru | Russia -- North Korea -- Republic of Korea | handicap.eu5\[.\]org | *Table 4. Fourth phishing attempt details.* [![](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/Figure-5.-First-page-of-fourth-malicious-document-observed-in-the-campaign.-Associated-with-CARROTBAT.-794x1024.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/Figure-5.-First-page-of-fourth-malicious-document-observed-in-the-campaign.-Associated-with-CARROTBAT..png) *Figure 5. First page of fourth malicious document observed in the campaign. Associated with CARROTBAT.* |------------------------------------------------------------------|--------------------------------------------------------|---------------------------|------------------------------------------------------------|-----------------------| | SHA256 | Subject | Sender | File name | Initial C2 Domain | | ed63e84985e1af9c4764e6b6ca513ec1c16840fb2534b86f95e31801468be67a | Republic of Korea, the Russian Federation and the DPRK | rusrnirasaf@yandex\[.\]ru | Republic of Korea, the Russian Federation and the DPRK.doc | panda2019.eu5\[.\]org | *Table 5. Fifth phishing attempt details.* [![](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/Figure-6.-First-page-of-fifth-malicious-document-observed-in-the-campaign.-Associated-with-CARROTBAT.-786x1024.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/Figure-6.-First-page-of-fifth-malicious-document-observed-in-the-campaign.-Associated-with-CARROTBAT..png) *Figure 6. First page of the fifth malicious document observed in the campaign. Associated with CARROTBAT.* |------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------|------------------------|---------------------------------------------------------------------------------------|---------------|----------------------|-----------------------| | SHA256 | Subject | Sender | Translated Subject | File name | Translated File Name | Initial C2 Domain | | a4f858c6b54683d3b7455c9adcf2bb6b7ddc1f4d35d0f8f38a0f131c60d1790f | Корейский полуостров в глобальных и региональныхизмерениях. Безопасность ивозможностивзаимодействия | kargarnova@mail\[.\]ru | The Korean Peninsula in global and regional dimensions. Security and Interoperability | материалы.doc | materials.doc | panda2019.eu5\[.\]org | *Table 6. Sixth phishing attempt details.* ### Final Attempt On October 29, 2019, one of the same individuals targeted in the second wave of attacks was targeted again with a malicious document, though in this attack the sender was different and the document lure did not feature CARROTBAT. Also of note is that the lure in this attack did feature a more traditional "enable macro" cover page, but was then followed by additional pages in Russian that thematically matched with the documents found in the rest of the campaign. ![](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/word-image-124.png) *Figure 7. First page of sixth malicious document observed in the campaign. Associated with CARROTBALL.* |------------------------------------------------------------------|---------------------------------------|--------------------------|------------------------------------------|-------------------------|----------------------|-----------------------| | SHA256 | Subject | Sender | Translated Subject | File name | Translated File Name | Initial C2 Domain | | c1a9b923fc1f81d69bd0494d296c75887e4a0f9abfc1cdfbfa9c0f4ab6c95db7 | Инвестиционный климат Северной Кореи. | pryakhin20l0@mail\[.\]ru | "The investment climate of North Korea." | Инвестиционный климат С | Investment climate C | downplease.c1\[.\]biz | *Table 7. Seventh phishing attempt details.* Also interesting to note is that the sender added multiple recipients to their email; one was an individual at a US government agency, and the other two individuals were non-US foreign nationals professionally associated with ongoing activities in North Korea. ### Technical Analysis With the exception of the October 2019 attack, all of the malicious documents found in this campaign featured the following macro code snippet of interest: [![](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/Figure-8.-Macro-from-malicious-documents-associated-with-CARROTBAT..png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/Figure-8.-Macro-from-malicious-documents-associated-with-CARROTBAT..png) *Figure 8. Macro from malicious documents associated with CARROTBAT.* When executed, this code will: * Determine whether the victim's host machine is running Windows with an x86 or x64 architecture. * Parse the contents of a corresponding textbox within the document and convert it to a command line argument specific to the Windows architecture on the victim's machine. * Execute the command. * Clear the contents of the textboxes and save the document. As previously mentioned, all samples featuring the macros above also featured CARROTBAT as a second stage downloader. The October 2019 attack, however, differed significantly from the previous ones. Instead of reading from the contents of the document itself, the macros leveraged an embedded Windows executable in the form of hex bytes delimited via the '|' character that ultimately acted as a dropper. When the macro was executed, the hex bytes were split, converted to binary, and dropped onto disk as an executable. The first few lines of this functionality are shown below: [![](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/Figure-9.-Macro-from-malicious-documents-associated-with-CARROTBALL.-2-1024x657.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/Figure-9.-Macro-from-malicious-documents-associated-with-CARROTBALL.-2.png) *Figure 9. Macro from malicious documents associated with CARROTBALL.* In this case, the dropped binary was a new type of downloader we have dubbed CARROTBALL. Its sole purpose was to serve as the main mechanism to facilitate the download and installation of the SYSCON backdoor. This is very similar to the CARROTBAT samples observed earlier on in this campaign and in the previous Fractured Block campaign (see technical analysis [here](https://unit42.paloaltonetworks.com/unit42-the-fractured-block-campaign-carrotbat-malware-used-to-deliver-malware-targeting-southeast-asia/)). Additionally, of novel interest in this attack was the use of two separate FTP credential pairs to conduct active C2 operations. One credential pair was hardcoded in the dropped CARROTBALL binary and used to connect to the domain downplease.c1\[.\]biz to retrieve a CAB file renamed with a generic .dat extension. [![](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/Figure-10.-Observed-CARROTBALL-FTP-interaction..png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/Figure-10.-Observed-CARROTBALL-FTP-interaction..png) *Figure 10. Observed CARROTBALL FTP interaction.* When extracted, the .cab file was found to contain two malicious batch files, two malicious dlls (one of which contained a custom base64 alphabet), and a second domain (lookplease.c1\[.\]biz) with a set of FTP login credentials encoded in the custom base64 alphabet. The contents of the cab file are as follows: [![](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/Figure-11.-Converted-CAB-file-contents-extracted-from-observed-CARROTBALL-FTP-interaction..png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/Figure-11.-Converted-CAB-file-contents-extracted-from-observed-CARROTBALL-FTP-interaction..png) *Figure 11. Converted CAB file contents extracted from observed CARROTBALL FTP interaction.* |------------------------------------------------------------------|------------|--------------------------------------------------------------------------------------------------------------------------------| | SHA256 | File Name | Functionality | | 42e874d96cb9046cd4113d04c1c5463b1d43a4e828ca872de11c08cd314e650f | alive.bat | Install and establish persistence for core SYSCON backdoor component. | | a761b47ab25dc2aa66b2f8ad4ab9636e40ebbcaf67f8a34f3524456c09f47d76 | bpu.dll | UPX-packed system process injection mechanism to gain execution of alive.bat. Reserved for use against non-admin users. | | c3ac29e4b0c5e1a991d703769b94c0790fbf81fd38cf6acdb240c5246c2517ca | mama.bat | Batch file to delete assorted host based artifacts of malware. Deletes bpu.dll if running as Admin. Runs bpu.dll if not Admin. | | ad63b8677c95792106f5af0b99af04e623146c6206125c93cf1ec9fbfeafaac9 | syssec.bin | Custom base64 encoded FTP credentials and C2 domain. | | bdd90ed7e40c8324894efe9600f2b26fd18b22dcbf3c72548fee647a81d3c099 | syssec.dll | Core SYSCON backdoor component. | *Table 8. CAB file contents.* While observing the malware's interaction with the second domain, lookplease.c1\[.\]biz, two text files were subsequently identified containing text encoded with the same custom base64 alphabet used previously. When decoded, these files were found to contain additional commands to be executed on the infected host. |------------------------------------------------------------------|-----------------|--------------------------------------------------|-------------------| | SHA256 | File Name | Raw FIle Contents | Decoded Command | | f3d3fa4c76adfabd239accb453512af33ae8667bf261758f402fff22d9df1f67 | Gei All (0).txt | Fg37eqye0ee2eqse0e3SeY8evg3Geqhecy3-eqAexf32eUAe | cmd /c systeminfo | | 4b8790e9cb2f58293c28e695bec0a35e2ebd2da8e151c7e8c4513a1508c8bc94 | Gei All (1).txt | Fg37eqye0ee2eqse0e3GeqOevg31eqge/y3SeYyeZfeD | cmd /c tasklist | *Table 9. SYSCON C2 file attributes.* At the time of the activity, both downplease.c1\[.\]biz and lookplease.c1\[.\]biz resolved to the IP address 185.176.43\[.\]94. ### Attribution ##### **Konni: Malware or Actor?** Originally, the name "Konni" was used to refer to a Remote Access Trojan utilized in targeted campaigns with strong links to North Korean interests. However, as additional campaigns began to appear with strongly overlapping TTPs yet did not feature the Konni RAT, specifically, some industry researchers simply began to adopt the "Konni" moniker to refer to the actors behind the aggregated set of activity. Unit 42 has followed this trend, and now refers to the "Konni Group" as such. ##### **Konni's Ties to Fractured Statue** As prominently [documented by Cisco Talos](https://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html), the first Konni Group activity was a sustained information stealing/RAT distribution campaign spanning between 2014 and 2017. Throughout 2018, Unit 42 released several blogs on Konni Group activity, and subsequently identified two new malware families the group was using in the attacks, dubbed [NOKKI](https://unit42.paloaltonetworks.com/unit42-new-konni-malware-attacking-eurasia-southeast-asia/) and [CARROTBAT](https://unit42.paloaltonetworks.com/unit42-the-fractured-block-campaign-carrotbat-malware-used-to-deliver-malware-targeting-southeast-asia/), respectively. Now, in 2019, Unit 42's continued observation of targeted CARROTBAT activity (in addition to the new malware CARROTBALL being used during the same campaign) could indicate that both are still in use by the Konni Group, as thematically linked elements of Konni Group TTPs include: * Targeting individuals/organizations who have interest in, are directly linked to, or conduct business in North Korea (corroborated by previous research by Unit 42). * Utilizing malicious document phishing lures containing subject matter pertaining to North Korea (corroborated by previous research by Unit 42). * Iteratively increasing the type and complexity of their payload delivery mechanisms (from their initial use of simple Base64 strings [as reported by Trend Micro](https://blog.trendmicro.com/trendlabs-security-intelligence/syscon-backdoor-uses-ftp-as-a-cc-channel/), then later leveraging CARROTBAT, and now leveraging CARROTBALL) However, there are non-trivial obstacles to obtaining a high-confidence attribution to the Konni Group, namely the fact that previous blogs produced by Unit 42 and other researchers contain a great deal of technical detail about the group's operations, and copycat actors may attempt to emulate previously observed TTPs to hinder attribution efforts or perform false-flag operations. In light of these factors, Unit 42 assesses with moderate confidence that this activity is related to the Konni Group. ## Conclusion Overall, the Fractured Statue campaign provides clear evidence that the TTPS discovered in Fractured Block are still relevant, and that the group behind the attacks still appears to be active. Additionally, development and use of the new downloader, CARROTBALL, alongside the more commonly observed malware delivery mechanism, CARROTBAT, may indicate that the previous methods employed by the group to successfully infect their targets are becoming less effective. The Adversary Playbook for the activity described in this blog can be found [here](https://pan-unit42.github.io/playbook_viewer/?pb=konni). Palo Alto Networks customers are protected from this threat in the following ways: \* AutoFocus customers can track these samples with the [FracturedStatue](https://autofocus.paloaltonetworks.com/#/tag/Unit42.FracturedStatue), [SYSCON](https://autofocus.paloaltonetworks.com/#/tag/Unit42.Syscon), [KONNI](https://autofocus.paloaltonetworks.com/#/tag/Unit42.KONNI), [CARROTBAT](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CARROTBAT) and [CARROTBALL](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CARROTBALL) tags. \* WildFire detects all files mentioned in this report with malicious verdicts. \* Cortex XDR blocks all of the files currently associated with the Fractured Block campaign. ### **IOCS:** ##### **Malicious Documents with CARROTBAT:** a4f858c6b54683d3b7455c9adcf2bb6b7ddc1f4d35d0f8f38a0f131c60d1790f ed63e84985e1af9c4764e6b6ca513ec1c16840fb2534b86f95e31801468be67a 9dfe3afccada40a05b8b34901cb6a63686d209e2b92630596646dba8ee619225 4c201f9949804e90f94fe91882cb8aad3e7daf496a7f4e792b9c7fed95ab0726 63c3817a5e9984aaf59e8a61ddd54793ffed11ac5becef438528447f6b2823af ##### **Malicious Document with CARROTBALL:** c1a9b923fc1f81d69bd0494d296c75887e4a0f9abfc1cdfbfa9c0f4ab6c95db7 ##### **CARROTBALL Downloader:** 56924402a17393e542f6bf5b02cd030cc3af73bc2e1c894a133cebb2ca9405ee ##### **SYSCON Samples:** ceb8093507911939a17c6c7b39475f5d4db70a9ed3b85ef34ff5e6372b20a73e 52ba17b90244a46e0ef2a653452b26bcb94f0a03b999c343301fef4e3c1ec5d2 4958fe8c106200da988c22957821513efd05803460e8e5fcfedb5cbca8d87a5b 7d2b1af486610a45f78a573af9a9ad00414680ff8e958cfb5437a1b140acb60c bdd90ed7e40c8324894efe9600f2b26fd18b22dcbf3c72548fee647a81d3c099 ##### **Associated SYSCON C2 Files:** f3d3fa4c76adfabd239accb453512af33ae8667bf261758f402fff22d9df1f67 4b8790e9cb2f58293c28e695bec0a35e2ebd2da8e151c7e8c4513a1508c8bc94 ad63b8677c95792106f5af0b99af04e623146c6206125c93cf1ec9fbfeafaac9 c3ac29e4b0c5e1a991d703769b94c0790fbf81fd38cf6acdb240c5246c2517ca a761b47ab25dc2aa66b2f8ad4ab9636e40ebbcaf67f8a34f3524456c09f47d76 42e874d96cb9046cd4113d04c1c5463b1d43a4e828ca872de11c08cd314e650f ### **Infrastructure:** Domain: handicap\[.\]eu5\[.\]org IP Resolution: 69.197.143\[.\]12 Domain: panda2019\[.\]eu5\[.\]org IP Resolution: 162.253.155\[.\]226 Domain: downplease\[.\]c1\[.\]biz IP Resolution: 185.176.43\[.\]94 Domain: lookplease\[.\]c1\[.\]biz IP Resolution: 185.176.43\[.\]94 ### **Additional CARROTBALL Samples Identified on VirusTotal:** 6fa895d0472e87dea3c5c5bd6774488d2d7fe409ff9ae83870be3740fdfd40e8 Domain: downyes\[.\]c1\[.\]biz IP Resolution: Unavailable/unknown 989c042ab9a07b11026bce78dc091f25fa51cb5e310c668904afc7939b197624 Domain: downplease\[.\]c1\[.\]biz IP Resolution: 185.176.43\[.\]94 Back to top ### Tags * [CARROTBALL](https://unit42.paloaltonetworks.com/tag/carrotball/ "CARROTBALL") * [CARROTBAT](https://unit42.paloaltonetworks.com/tag/carrotbat/ "CARROTBAT") * [Fractured Statue](https://unit42.paloaltonetworks.com/tag/fractured-statue/ "Fractured Statue") * [KONNI](https://unit42.paloaltonetworks.com/tag/konni/ "KONNI") * [Phishing](https://unit42.paloaltonetworks.com/tag/phishing/ "phishing") * [Syscon](https://unit42.paloaltonetworks.com/tag/syscon/ "Syscon") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Muhstik Botnet Attacks Tomato Routers to Harvest New IoT Devices](https://unit42.paloaltonetworks.com/muhstik-botnet-attacks-tomato-routers-to-harvest-new-iot-devices/ "Muhstik Botnet Attacks Tomato Routers to Harvest New IoT Devices") ### Table of Contents * ### Related Articles * [Russian Global Webmail Espionage](https://unit42.paloaltonetworks.com/russian-webmail-espionage/ "article - table of contents") * [Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector](https://unit42.paloaltonetworks.com/phantom-squatting-hallucinated-web-domains/ "article - table of contents") * [When "Hi, This Is IT" Comes Through Microsoft Teams](https://unit42.paloaltonetworks.com/microsoft-teams-phishing/ "article - table of contents") ## Related Malware Resources ![Pictorial representation of a magnifying glass illuminating a glowing orange circular digital circuit interface on a dark, high-tech background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Myth-Busting_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) September 16, 2026 [#### Atomic macOS (AMOS) Stealer Activity](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/) * [MacOS](https://unit42.paloaltonetworks.com/tag/macos/ "macOS") * [Threat intelligence](https://unit42.paloaltonetworks.com/tag/threat-intelligence/ "threat intelligence") * [Unit 42](https://unit42.paloaltonetworks.com/tag/unit-42/ "Unit 42") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/ "Atomic macOS (AMOS) Stealer Activity") ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)