[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/) * [Japanese](https://unit42.paloaltonetworks.com/ja/two-campaigns-by-north-korea-bad-actors-target-job-hunters/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 17 min read Related Products [![Advanced Threat Prevention icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced Threat Prevention](https://unit42.paloaltonetworks.com/product-category/advanced-threat-prevention/ "Advanced Threat Prevention")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Next-Generation Firewall icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Unit 42](https://unit42.paloaltonetworks.com/author/unit42/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:November 21, 2023 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Nation-State Cyberattacks](https://unit42.paloaltonetworks.com/category/nation-state-cyberattacks/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Advanced Persistent Threat](https://unit42.paloaltonetworks.com/tag/advanced-persistent-threat/) * [BeaverTail](https://unit42.paloaltonetworks.com/tag/beavertail/) * [Contagious Interview](https://unit42.paloaltonetworks.com/tag/contagious-interview/) * [DPRK](https://unit42.paloaltonetworks.com/tag/dprk/) * [North Korea](https://unit42.paloaltonetworks.com/tag/north-korea/) * [Wagemole](https://unit42.paloaltonetworks.com/tag/wagemole/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/?pdf=download&lg=en&_wpnonce=dc23a6ba65 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/?pdf=print&lg=en&_wpnonce=dc23a6ba65 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Hacking%20Employers%20and%20Seeking%20Employment:%20Two%20Job-Related%20Campaigns%20Bear%20Hallmarks%20of%20North%20Korean%20Threat%20Actors&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Ftwo-campaigns-by-north-korea-bad-actors-target-job-hunters%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Ftwo-campaigns-by-north-korea-bad-actors-target-job-hunters%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Ftwo-campaigns-by-north-korea-bad-actors-target-job-hunters%2F&title=Hacking%20Employers%20and%20Seeking%20Employment:%20Two%20Job-Related%20Campaigns%20Bear%20Hallmarks%20of%20North%20Korean%20Threat%20Actors "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Ftwo-campaigns-by-north-korea-bad-actors-target-job-hunters%2F&text=Hacking%20Employers%20and%20Seeking%20Employment:%20Two%20Job-Related%20Campaigns%20Bear%20Hallmarks%20of%20North%20Korean%20Threat%20Actors "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Ftwo-campaigns-by-north-korea-bad-actors-target-job-hunters%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Hacking%20Employers%20and%20Seeking%20Employment:%20Two%20Job-Related%20Campaigns%20Bear%20Hallmarks%20of%20North%20Korean%20Threat%20Actors%20https%3A%2F%2Funit42.paloaltonetworks.com%2Ftwo-campaigns-by-north-korea-bad-actors-target-job-hunters%2F "Share in Mastodon") ## **Executive Summary** Unit 42 researchers recently discovered two separate campaigns targeting job-seeking activities linked to state-sponsored threat actors associated with the Democratic People's Republic of Korea (DPRK), commonly known as North Korea. We call the first campaign "Contagious Interview," where threat actors pose as employers (often anonymously or with vague identities) to lure software developers into installing malware through the interview process. This malware creates the potential for various types of theft. We attribute with moderate confidence that Contagious Interview is run by a North Korea state-sponsored threat actor. We call the second campaign "Wagemole," where threat actors seek unauthorized employment with organizations based in the US and other parts of the world, with potential for both financial gain and espionage. We attribute with high confidence that Wagemole is a North Korea state-sponsored threat. Activity from both campaigns remains an ongoing active threat. We nicknamed the first campaign Contagious Interview because the threat actor attempts to infect software developers with malware through a fictitious job interview. We originally discovered Contagious Interview through customer telemetry, and our research indicates it started as early as December 2022. Some of the infrastructure supporting this campaign remains active, and this activity remains a consistent threat. The first campaign's objective is likely cryptocurrency theft and using compromised targets as a staging environment for additional attacks. We track Contagious Interview as CL-STA-0240. While pivoting on indicators from Contagious Interview, we discovered exposed files on a different threat actor-controlled infrastructure. These files indicate fraudulent job-seeking activity targeting a wide variety of United States (US) companies. This trove of information includes resumes with different technical skill sets and multiple identities impersonating individuals from various nations. It also includes common job interview questions and answers, scripts for interviews and downloaded job postings from US companies. We call this separate campaign "Wagemole" and track it as CL-STA-0241. While we cannot determine the objective of this campaign, the US Department of Justice and Federal Bureau of Investigation (FBI) have reported that North Korea [uses remote workers to funnel wages to its weapons programs](https://www.state.gov/guidance-on-the-democratic-peoples-republic-of-korea-information-technology-workers/). During our investigation of Contagious Interview, we discovered two new families of malware we named BeaverTail and InvisibleFerret. BeaverTail is JavaScript-based malware hidden inside Node Package Manager ([NPM](https://docs.npmjs.com/about-npm)) packages. InvisibleFerret is a simple but powerful Python-based backdoor. Both are cross-platform malware that can run on Windows, Linux and macOS. This article provides an overview of these two campaigns, and we examine the two new malware families, BeaverTail and InvisibleFerret. This article also provides insight on how these threat actors are both seeking jobs and targeting job seekers to accomplish their goals. We provide recommendations for both job applicants and employers to consider when interviewing or applying for remote jobs. For example: * Don't use company-issued computers for personal activities. * Be wary of GitHub accounts with few repositories or updates. * Confirm the legitimacy of companies you're applying for. * Thoroughly vet the identity of job applicants. Palo Alto Networks customers receive protection from the malware discussed in this article through our [Next-Generation Firewall](https://www.paloaltonetworks.com/network-security/next-generation-firewall) with [Cloud-Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions), including [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire), [DNS Security](https://www.paloaltonetworks.com/network-security/dns-security) and [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering). | **Related Unit 42 Topics** | **[Contagious Interview](https://unit42.paloaltonetworks.com/tag/contagious-interview/)** , **[DPRK](https://unit42.paloaltonetworks.com/tag/dprk/)** , **[North Korea](https://unit42.paloaltonetworks.com/tag/north-korea/)** , **[Wagemole](https://unit42.paloaltonetworks.com/tag/wagemole/), [Invisible Ferret](https://unit42.paloaltonetworks.com/tag/invisible-ferret/), [**BeaverTail**](https://unit42.paloaltonetworks.com/tag/beavertail/)** | |----------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| ## **CL-STA-0240: Contagious Interview** While investigating our telemetry, we discovered suspicious activity as early as March 2023 related to previously unidentified malware samples. Our investigation revealed two new malware families, and tactics used in this campaign align with previously reported activity by North Korean threat actors, [as noted in our Attribution section](#post-131292-_xkx0jjh1l9jy). We track this campaign as Contagious Interview or CL-STA-0240, and infrastructure for this campaign was established as early as December 2022. Through advertisements on job search platforms, the threat actor behind CL-STA-0240 targets software developers by posing as a prospective employer. The advertisements we can tie to this campaign are often anonymous or purposefully vague, with no real indicator of the employer they represent. Based on some of the file names of malware associated with this campaign, we believe this threat actor might also impersonate legitimate AI, cryptocurrency and NFT-related companies or recruitment agencies. Like other threat actors, this threat actor could also reach potential victims through email, social media platforms, or chat channels on community forums used by software developers. After establishing contact, the threat actor invites the victim to participate in an online interview. The threat actor likely uses video conferencing or other online collaboration tools for the interview. During the interview, the threat actor convinces the victim to download and install an [NPM](https://docs.npmjs.com/about-npm)-based package hosted on GitHub. The threat actor likely presents the package to the victim as software to review or analyze, but it actually contains malicious JavaScript designed to infect the victim's host with backdoor malware. Below, Figure 1 summarizes the chain of events for CL-STA-0240. ![Image 1 is the attack chain for CL-STA-0240. Threat actor poses as prospective employer. Victim conducts online job interview. Victim downloads malicious amp package from GitHub. Victim installs malicious npm package. Npm package retrieves and runs backdoor malware. Backdoor malware establishes access on a victim’s host.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131292-1.png) Figure 1. Simplified chain of events for a CL-STA-0240 attack. To better understand this chain of events, we should first understand how the threat actor abused GitHub for this campaign. ### GitHub Abuse for Contagious Interview Designed as a collaborative space for software developers, [GitHub](https://docs.github.com/en/get-started/quickstart/hello-world#introduction) is attractive to many developers because its basic service option is free. This also makes GitHub attractive to criminals. The threat actor behind Contagious Interview is one of many criminals who have used GitHub's free service plan to host innocent-looking [repositories](https://docs.github.com/en/repositories/creating-and-managing-repositories/about-repositories) and use them as powerful tools for compromise. The threat actor behind Contagious Interview created different identities to host a number of GitHub repositories, establishing an infrastructure to inspire trust by its intended victims. However, a closer examination reveals that these GitHub repositories are not as trustworthy as they might initially appear. The free GitHub accounts used for Contagious Interview have only one repository that is not updated, while many legitimate software developers host multiple repositories with several updates. Further examination of suspicious repositories found during our investigation confirmed our initial assessment. A GitHub repository's [Issues](https://docs.github.com/en/issues/tracking-your-work-with-issues/about-issues) section often provides clues. Below, Figure 2 shows comments in the Issues section of a repository used in Contagious Interview. The repository named react-ecommerce was established under a GitHub user account named brainjobs35. This repository and account are no longer active. ![Image 2 is a screenshot of GitHub user comment page for brainjobs35 react-ecommerce. Milagro Martinez #1. There is a conversation between user watasm and user 0xpaluco where they discuss Milagro and how to find the code author.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131292-2.png) Figure 2. User comments in the Issues section of a suspicious GitHub repository. GitHub's [Insights](https://github.com/git-insights/git-insights) feature also provides clues. Below Figure 3 shows GitHub users commenting through the Insights feature about a malicious file named ServiceWorker.js related to the Contagious Interview campaign. ![Image 3 is a screenshot of a GitHub user comment page for Virus Alert #1. Toufique-imam comments that the repo is a scam and cautions other users to stay safe. A reply to their comment by Xeth4rth says that the repo was given to them as a job offer and also declares it a scam.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131292-3.png) Figure 3. Comments on GitHub Insights related to Contagious Interview. ### NPM, Open Source and Supply Chain Attacks Software developers increasingly rely on third-party packages and libraries to streamline their projects. These provide an avenue for [supply chain attacks](https://www.cloudflare.com/learning/security/what-is-a-supply-chain-attack/). Among these packages, NPM is a central hub for countless projects using JavaScript, with 17 million developers worldwide according to the [NPM website](https://www.npmjs.com/). The [open-source nature of NPM](https://docs.github.com/en/repositories/creating-and-managing-repositories/cloning-a-repository) helps malicious actors find ways to inject harmful code in legitimate NPM packages and distribute these packages through GitHub. Once installed, these compromised NPM packages act as subtle backdoors, granting threat actors unauthorized access into targeted networks. [GitHub](https://github.blog/2023-07-18-security-alert-social-engineering-campaign-targets-technology-industry-employees/) and [Phylum](https://blog.phylum.io/junes-sophisticated-npm-attack-attributed-to-north-korea/) have recently reported similar attacks. Malicious NPM packages help the threat actor elude most traditional detection techniques, because: * Most [static](https://en.wikipedia.org/wiki/Static_program_analysis) and [dynamic analysis](https://d3fend.mitre.org/technique/d3f:DynamicAnalysis/) detection engines cannot execute an NPM package in a [Node.js](https://nodejs.org/en) runtime environment because this is not a supported file type. * [Cloning a repository](https://docs.github.com/en/repositories/creating-and-managing-repositories/cloning-a-repository) and running Node.js code is a normal, allowed operation in most software development teams that will not be considered suspicious. As a result, malicious JavaScript files in these NPM packages have a low or zero detection rate when submitting to a service like VirusTotal. Furthermore, NPM can be easily [installed](https://docs.npmjs.com/downloading-and-installing-node-js-and-npm) on multiple operating systems, allowing threat actors to maximize their attack surface when distributing a malicious NPM package. ### The Act of Compromise During the interview process, victims prepare their development environment. In the attacks we investigated, most developers used [Visual Studio Code](https://visualstudio.microsoft.com/) with a set of plugins like [Code Helper](https://marketplace.visualstudio.com/items?itemName=JohnJane.code-helper), along with [Git](https://gitextensions.github.io/) and [Node.js extensions](https://code.visualstudio.com/docs/nodejs/nodejs-tutorial). This includes NPM. After these basic system requirements are met, the threat actor asks the victim to install the malicious NPM package posing as legitimate software on GitHub. This malicious NPM package contains JavaScript for newly discovered malware we have named BeaverTail. BeaverTail steals information, and it retrieves additional malware as its second-stage payload. This payload is a cross-platform backdoor we have named InvisibleFerret. The next section provides analysis and insight into the loader, BeaverTail. ### BeaverTail Analysis Distributed as JavaScript inside NPM packages, BeaverTail serves two purposes. * Information stealer * Loader As an information stealer, BeaverTail targets cryptocurrency wallets and credit card information stored in the victim's web browsers. As a loader, BeaverTail retrieves and runs the next stage of malware, InvisibleFerret. The BeaverTail JavaScript file inside an NPM package is heavily obfuscated to evade detection. The threat actor might upload an entire malicious NPM package to GitHub or they might also inject BeaverTail code into other developer's legitimate NPM projects. Figure 4 shows [an example](https://www.virustotal.com/gui/file/de42155e14a3c9c4d919316d6ba830229533de5063fcd110f53e2395ef3aa77a/) of this injected script. ![Image 4 is a split-image screenshot where the image on top is a Commit page on GitHub. The image on the bottom is the obfuscated JavaScript of BeaverTail.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131292-4.png) Figure 4. BeaverTail's obfuscated JavaScript, injected into the NPM file of a legitimate developer's project. In addition to the heavily obfuscated code illustrated in Figure 4, the BeaverTail also requires human interaction to execute due to its dependency on the Node.js environment. These characteristics help the malware to evade detection. Once the malicious NPM package is successfully installed on a Windows, Linux or macOS host, BeaverTail collects basic system information. This threat also searches the victim's web browser for extensions associated with cryptocurrency wallets, like Binance and Coinbase. Table 1 shows the full list below. |----------------------------------|----------------------------|--------------------| | **Browser Extension ID** | **Browser Extension Name** | **Target Browser** | | fhbohimaelbohpjbbldcngcnapndodjp | Binance Wallet | Chrome | | aeachknmefphepccionboohckonoeemg | Coin98 Wallet | Chrome | | hnfanknocfeofbddgcijnmhnfnkdnaad | Coinbase Wallet | Chrome | | hifafgmccdpekplomjjkcfgodnhcellj | Crypto.com Wallet | Chrome | | nkbihfbeogaeaoehlefnkodbefgpgknn | Metamask Wallet | Chrome | | ejbalbakoplchlghecdalmeeeajnimhm | MetaMask Wallet | Microsoft Edge | | bfnaelmomeimhlpmgjnjophhpkkoljpa | Phantom Wallet | Chrome | | fnjhmkhhmkbjkkabndcnnogagogbneec | Ronin Wallet | Chrome | | ibnejdfjmmkpcnlpebklmnkoeoihofec | TRON Wallet | Chrome | *Table 1. Browser extensions for cryptocurrency wallets BeaverTail searches for.* BeaverTail also checks for a Solana cryptocurrency wallet, searching for ~/.config/solana/id.json. While performing data exfiltration and loading InvisibleFerret, BeaverTail generates the following web traffic as described below in Table 2. |------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------|------------------------------------| | **URL Pattern** | **Description** | **Save Location** | | hxxp://\:1224/keys | HTTP POST request sends data collected by BeaverTail | Not applicable | | hxxp://\:1224/uploads | HTTP POST request sends other collected information like Solana cryptocurrency wallet data | Not applicable | | hxxp://\:1224/node/\ | HTTP GET request for helper DLL files when decrypting credentials stored in Chrome, if needed | %USERPROFILE%\\store.node | | hxxp://\:1224/pdown | HTTP GET request for Python executable and associated libraries | %TEMP%\\p.zi or %HOMEPATH%\\.pyp\\ | | hxxp://\:1224/client/\ | HTTP GET request for InvisibleFerret | %HOMEPATH%\\.npl or ~/.npl | *Table 2. Infection traffic generated by BeaverTail malware.* At this stage, the threat actor has been able to successfully drop a silent, simple and cross-platform backdoor on the victim machine. ### InvisibleFerret: A Cross-Platform Python Backdoor InvisibleFerret is newly discovered malware retrieved and executed by BeaverTail NPM packages. Cross-platform malware written in Python, InvisibleFerret consists of various components with the following functions: * Fingerprinting * Remote control * Keylogging * Data exfiltration * Browser stealing capabilities * Downloading the AnyDesk client if required for additional control Figure 5 presents a diagram that reveals the modular nature of InvisibleFerret, showing an initial script and two additional components that perform different functions. ![Image 5 is a diagram of how InvisibleFerret works. From the BeaverTail GitHub the .npl initial script branches into two: one is the .n2/pay with the fingerprint, remote control and information-stealer component. This branch ends with .n2/adc, AnyDesk. The second branch is .n2/bow, or the browser-stealer component.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131292-5.png) Figure 5. Diagram revealing the initial script and two components of InvisibleFerret. #### **Initial Script** BeaverTail downloads the InvisibleFerret script using the URL structure from the final row in Table 2. An example of a URL to download InvisibleFerret follows: * hxxp://\:1224/client/\ The initial script for InvisibleFerret is saved under the user's home directory, named .npl and executed using Python. An example of the command line to run this file on a Windows host is: * C:\\Users\\$USER$\\.pyp\\python.exe C:\\Users\\$USER$\\.npl The initial script for InvisibleFerret uses obfuscated data. [An example](https://www.virustotal.com/gui/file/8d8bdbb31bfdb0540b6a79fad3b89695e9751c98b39bc99b0c6a64de10ae2dae) is shown below in Figure 6. ![Image 6 is a screenshot of many lines of code.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131292-6.png) Figure 6. Example of Python script for InvisibleFerret. The bottom section of Figure 6 shows a decoding routine that is consistent across all script files used for InvisibleFerret and its components: * The first eight characters of the temp string represent a key for decoding. * The remainder of the temp string is converted from Base64. * The result is processed through an XOR loop using the eight character key. This initial script installs the required Python modules using [pip](https://pypi.org/project/pip/), and it also defines variables, establishing values to identify the command and control (C2) server and port. The main objective of the initial script is to retrieve and run two different components of InvisibleFerret. These components are downloaded and saved as shown in Table 3. |---------------------------------------------------|-------------------------| | **Request for Component** | **Save Location** | | hxxp://\:1224/payload/\ | Local file path .n2/pay | | http://\:1224/bow/\ | Local file path .n2/bow | *Table 3. Infection traffic generated by BeaverTail malware.* Of note, the second component is only downloaded when the operating system is **not** macOS. ### **InvisibleFerret Components** The first component for InvisibleFerret collects system data to create a fingerprint, then sends this data to a C2 server. The first component collects: * Internal IP address * IP geolocation information * System information including OS version, release, host and user information It sends this information to the server in JSON format. The second component for InvisibleFerret deploys remote control and information stealing capabilities. Once executed, it prepares the environment by installing the following Python packages, if they are not already present on the system: * [pyWinhook](https://pypi.org/project/pyWinhook/): Python wrapper for out-of-context input hooks in Windows that provides callbacks for global mouse and keyboard events. * [pyperclip](https://pypi.org/project/pyperclip/): Cross-platform Python module for copy and paste clipboard functions. * [psutil](https://pypi.org/project/psutil/): Cross-platform Python library for process and system monitoring. * [pywin32](https://pypi.org/project/pywin32/): Python for 32-bit Windows extensions. ### **C2 Communications** InvisibleFerret establishes a connection with the C2 server over TCP traffic and periodically checks in and waits for further instructions. This traffic consists of JSON messages. The infected host checks in using [heartbeat messages](https://cwiki.apache.org/confluence/display/MINIFI/C2+Design#C2Design-Heartbeats) with JSON content using code and args keys with a code value of 0 as illustrated below in Figure 7. This heartbeat message also contains a campaign identifier (sType) and the victim's hostname (sHost). ![Image 7 is a diagram of the heartbeat command and control message. Victim symbolized by icon of bugged laptop within target. JSON sent over TCP port 1245. Arrow pointing to command and control server symbolized by icon of server and laptop on puppet strings. Below the JSON text is a code snippet.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131292-7.png) Figure 7. Diagram for a heartbeat C2 message. The C2 server returns JSON data instructing the backdoor with the next actions to take. The JSON response contains the same two main keys: * code: A value specifying an action or command * args: A string or JSON dictionaries with multiple key value pairs containing the required arguments for the specified command InvisibleFerret implements a total of eight commands described below in Table 4. |-------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Command** | **Description** | | ssh\_cmd | Checks if the args value is equal to delete and if so, closes the session. To notify the C2 server, it sends the message string \[close\]. | | ssh\_obj | Command execution. Extracts the command value from args\['cmd'\] and runs it. JSON results sent to the C2 server with code value 1 and args indicating the results. | | ssh\_clip | Send contents of keylogger buffer and clipboard data. Reports to C2 server with JSON code value 3 and args containing the collected data. | | ssh\_run | Downloads and runs the browser stealer component. Reports to C2 server with JSON code value 4 and args containing the file path for this component. | | ssh\_upload | Upload data to a C2 server. Subcommands include: \* Upload all contents of a specific directory. \* Upload specific files. \* Upload files matching a given pattern looking recursively in a given folder. Contents are uploaded to an actor-controlled FTP server, provided in the JSON response using the following args: \* hn: FTP host. \* un: Username. \* pw: Password. The logic contains exclusion lists for specific files and folders as well as a list of paths that are specifically uploaded when found. These paths show focus not only in documents (.xls, .doc, etc.) but also in cryptocurrency specific file paths (metamask, wallet, etc.). While uploading contents, the backdoor keeps sending requests with JSON data with code value 5 and args value indicating the state of the upload. | | ssh\_kill | Kill Chrome and Brave browser processes. When done, send JSON with code value 6 and args value indicating these processes are terminated. | | ssh\_any | Download and run a malicious binary for AnyDesk. Before downloading AnyDesk, send JSON containing code value 7 and args value to indicate the victim's OS. | | ssh\_env | Collect content specific folders ("Documents" and "Downloads" for Windows, /home and /Volumes for others) and upload these files to the FTP server. | *Table 4. Commands for InvisibleFerret.* When InvisibleFerret finishes its tasks, it reports the results to the C2 server. This report uses the same JSON code and args parameters with specific values outlined above in Table 4. #### **Keylogger Functionality** InvisibleFerret also starts a keylogger to continually collect keyboard, mouse and clipboard data in a buffer that can be requested at any time from the C2 server using the command ssh\_clip described above. #### **Browser Stealer Functionality** Based on Python, InvisibleFerret targets popular web browsers on Windows, Linux and macOS to steal login credentials and other sensitive data. This functionality includes retrieving a browser's login data, decrypting the information and stealing the victim's login credentials. InvisibleFerret can also retrieve credit card information used by the victim through a web browser. After collecting this information, InvisibleFerret sends the data to a C2 server using the JSON format with various keys representing the content, as shown below in Figure 8. ![Image 8 is a screenshot of the JSON format used for sending stolen browser data.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131292-8.png) Figure 8. JSON format used for sending stolen browser data. #### **Follow-Up Malware: AnyDesk** When the ssh\_any command is received, InvisibleFerret downloads an additional script using the following URL pattern: * http://\:1224/adc/\ This script is stored on the C2 server with the following filename: * any\_\.py InvisibleFerret stores the file on disk for execution under the following directory. * .n2/adc This file uses the same obfuscation seen in other scripts used for InvisibleFerret. This script retrieves an AnyDesk binary from the C2 server if it is not already present on the victim's host. This process updates AnyDesk's configuration and restarts the program if it was already running. While pivoting on infrastructure associated with this Contagious Interview campaign, we discovered files used for a separate activity. We have nicknamed this separate campaign "Wagemole" and track it as CL-STA-0241. ## **CL-STA-0241: Wagemole** While pivoting on GitHub infrastructure associated with Contagious Interview (CL-STA-0240), we discovered files accidentally exposed on a GitHub repository on a different GitHub account. These files include: * Resumes with fake identities, impersonating individuals of various nationalities * Frequently asked job interview questions and answers * Self-introduction scripts including personal information of the impersonated identity * Copies of IT job opening posts from US companies * Scanned copy of a stolen US Permanent Resident Card * A list of unidentified account seller contacts Timestamps on the files indicate this campaign started as early as August 2022, and the timestamps run through early December 2022. While we have not noticed further updates for this batch of files, this activity remains an ongoing threat. These files indicate another campaign applying for remote IT jobs using fake identities, which we are calling Wagemole. Information from some of the documents indicate [this threat actor is associated with North Korea](#post-131292-_xkx0jjh1l9jy). Resumes from these files indicate targets include a wide range of US companies and freelance job marketplaces. This activity is likely related to a recent report that North Korea [uses remote workers to funnel wages to its weapons programs](https://apnews.com/article/north-korea-weapons-program-it-workers-f3df7c120522b0581db5c0b9682ebc9b). Below, Figure 9 shows one of the resumes. ![Image 9 is an example resume with some information redacted including the face of the job seeker. There is a list of skills and a full profile where the seeker indicates they want a blockchain developer role.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131292-9.png) Figure 9. Example of a resume from this infrastructure. Each fake resume has a different US phone number for personal contact, specifically using Voice over Internet Protocol (VoIP) numbers. Some resumes include links to a LinkedIn profile and links to GitHub content. Figure 10 shows a GitHub repository one of the job seekers has maintained. ![Image 10 is a screenshot of the GitHub repo maintained by one of the job seekers. They have 1,108 contributions total. Their profile picture is a generic jewel. Some personal info is redacted.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131292-10.png) Figure 10. GitHub repository maintained by one of the fraudulent job seekers. These GitHub accounts appear well maintained and have a lengthy activity history. These accounts indicate frequent code updates and socialization with other developers. As a result, these GitHub accounts are nearly indistinguishable from legitimate accounts. A portion from one of the phone interview preparation scripts is shown below in Figure 11. This document indicates the target is a job that requires at least some on-site presence. As indicated in Figure 11, the job seeker claims to be based in the US and tells the interviewer they are currently out of the country visiting family overseas due to COVID but can start working remotely. ![Image 11 is a screenshot of a document to prepare for an interview. Common Questions. I flied to \[redacted\] several weeks ago. My parents got Covid and I decide to be with family members for awhile. Now, I am planning to go back to Los Angeles in 3 months. I am thinking that I could start work remotely right now, then I will be on board when I go back to LA.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131292-11.png) Figure 11. Part of the interview preparation script. These documents are not limited to remote IT jobs at US-based companies. Some of the documents indicate this threat actor also seeks freelance jobs in multiple marketplaces, targeting a broader scale of global markets that include Africa. These fraudulent job seekers have maintained multiple accounts for email, freelance websites, source code repositories and job agency platforms. As a tactic to win job bids and hide their true identity, these job seekers have also sought to purchase or borrow accounts with a high reputation in account seller marketplaces. Figure 12 shows a message on a freelance job platform from one of the job seekers used in this campaign. Figure 13 shows message activity with an underground marketplace seeking to purchase or rent high reputation accounts on freelance job platforms. ![Image 12 is s screenshot of a worker message. Some information has been redacted. Dear client. I have checked your job description and I am really interested in your project. As a senior developer, I have 5+ years of experience of python development. As you can see my profile, I have finished very difficult type of app a few days ago and other developers can't solve this app but I have done. I have already published 10+ apps like you want to so I am sure that I can finish your job perfectly. If you want to hire a reliable developer, please contact me. I am waiting for your contact. I'll do my best for you. Thank you. Best regards. Some of the other language in the screenshot is in Spanish.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131292-12.png) Figure 12. Actor seeking work on a freelance job platform. ![Image 13 is a screenshot of messages from an underground market that sells accounts. Some information is redacted. They are all posted by Andrew JackSon on February 9, 2023.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131292-13.png) Figure 13. Messages from an underground market for freelance platform accounts. Among the copies of US job postings hosted on this infrastructure, the largest portion is for IT and recruiting. Jobs for IT services and solutions might provide the threat actor behind Wagemole additional opportunities for downstream supply chain attacks. Recruiting jobs could provide more personal identity materials such as job applicant IDs, resumes and other personal data that attackers could further use in the Wagemole campaign. ## **Attribution** The tactics, techniques and procedures (TTPs) observed in both Contagious Interview (CL-STA-0240) and Wagemole (CL-STA-0241) align with previous activity attributed to North Korea state-sponsored APTs. However, the confidence level of our attribution is different for the two campaigns. For Wagemole activity, several of the documents we discovered contain information that more definitively points to North Korea. Many of the passwords associated with these documents were made through Korean language typed on a US keyboard, and some passwords include words only used in North Korea. Furthermore, Korean keyboard language settings were found on computers used by threat actors behind these campaigns. These documents indicate similar activity as reported by numerous media outlets based on [US government](https://www.state.gov/guidance-on-the-democratic-peoples-republic-of-korea-information-technology-workers/) and [FBI announcements](https://ofac.treasury.gov/media/923126/download?inline). For these reasons, we assess with high confidence that Wagemole can be attributed to a North Korea-sponsored APT, which we track as CL-STA-0241. Contagious Interview also bears the hallmarks of a North Korean threat actor. For example, a North Korean group previously [posed as job recruiters for Meta](https://www.pcmag.com/news/north-korean-hackers-posing-as-facebook-recruiters-hit-job-hunters-with) using similar tactics to infect job seekers with malware. [Operation Dream Job](https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lazarus-dream-job-chemical) run by the North Korean APT Lazarus Group reportedly used social media to trick victims into [installing a trojanized VNC app](https://thehackernews.com/2023/10/lazarus-group-targeting-defense-experts.html) as part of a fake job interview. North Korea-sponsored APT groups have often [posed as job recruiters](https://www.menlosecurity.com/blog/template-injection-attacks-part-3-following-the-bread-crumbs-to-north-korea/) to infect potential victims with backdoor malware. In the course of our research into Contagious Interview, we also observed indicators that the developer of BeaverTail and InvisibleFerret corresponded or collaborated with other GitHub accounts, where we found direct association with Wagemole. We track the threat actor behind Contagious Interview as CL-STA-0240, and attribute with moderate confidence that this is also a North Korea state-sponsored threat actor. In light of this analysis, we attribute with a moderate level of confidence that both campaigns trace to North Korea state-sponsored threat actors. ## **Conclusion** Unit 42 researchers investigated suspicious activity from our telemetry and discovered these two campaigns, Contagious Interview and Wagemole, which we track as CL-STA-0240 and CL-STA-0241 respectively. In the process, we discovered two new malware families we have named BeaverTail and InvisibleFerret used in the Contagious Interview campaign. Software developers are [often the weakest link](https://blog.sonatype.com/why-developers-are-becoming-the-weakest-link-in-supply-chain-attacks) for supply chain attacks, and [fraudulent job offers](https://www.shrm.org/hr-today/news/hr-news/pages/beware-fraudulent-job-postings-aim-to-steal-your-money-identity-.aspx) are an ongoing concern, so we expect continued activity from Contagious Interview. Furthermore, Wagemole represents an opportunity to embed insiders in targeted companies. We will continue to monitor our telemetry for further activity from these and other campaigns. ## Recommendations and Protections What is an effective strategy against these threats? For Contagious Interview and many other threats, software developers should not use a company-issued computer for personal or non-work related activities like job interviews. Personal activity on a company-issued computer can provide opportunities for threat actors to access a company's network through malware. Developers should also be suspicious of GitHub accounts containing a single repository with little or no updates. Threat actors frequently abuse free services like GitHub to distribute malware. Also, no one should install unknown files from unverified sources on their work or home computers. Job applicants should exercise due diligence to confirm the existence and legitimacy of companies offering job interviews, and also confirm that prospective interviewers actually work for the companies they claim to represent. It is also wise to be cautious of downloading and installing unusual types of communications software or of downloading software packages as a prerequisite for obtaining an interview. For Wagemole, employers should thoroughly vet all job applicants. Fake identities are an [increasing concern on job-related social media platforms](https://www.npr.org/2022/03/27/1088140809/fake-linkedin-profiles), and threat actors can easily generate an alias for remote work. If in-person interviews are not an option, use teleconferencing to interview job applicants. Be aware of anyone who applies for an on-site job, states they are currently out of the area and then offers immediate availability for remote work. For remote-only roles, employers should be suspicious of anything that seems unusual with any job applicant during the hiring process. Palo Alto Networks customers receive protection from malware discussed in this article through products like [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) and our [Next-Generation Firewall](https://www.paloaltonetworks.com/network-security/next-generation-firewall) with [Cloud-Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) that include [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire), [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) and [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering). [Next-Generation Firewall](https://docs.paloaltonetworks.com/ngfw) with the Advanced Threat Prevention security subscription can help block the malware's C2 traffic with best practices via the following Threat Prevention signatures: [86817](https://threatvault.paloaltonetworks.com/?query=86817), [86818](https://threatvault.paloaltonetworks.com/?query=86818), [86819](https://threatvault.paloaltonetworks.com/?query=86819). If you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call: * North America Toll-Free: 866.486.4842 (866.4.UNIT42) * EMEA: +31.20.299.3130 * APAC: +65.6983.8730 * Japan: +81.50.1790.0200 Palo Alto Networks has shared our findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org/). ## **Indicators of Compromise** SHA256 hashes for files associated with BeaverTail: * 09a508e99b905330a3ebb7682c0dd5712e8eaa01a154b45a861ca12b6af29f86 * 0ce264819c7af1c485878ce795fd4727952157af7ffdea5f78bfd5b9d7806db1 * 104926c2c937b4597ea3493bccb7683ae812ef3c62c93a8fb008cfd64e05df59 * 1123fea9d3a52989ec34041f791045c216d19db69d71e62aa6b24a22d3278ef9 * 121ca625f582add0527f888bb84b31920183e78c7476228091ff2199ec5d796b * 12c0f44a931b9d0d74a2892565363bedfa13bec8e48ff5cd2352dec968f407ee * 1b21556fc8ecb9f8169ba0482de857b1f8a5cb120b2f1ac7729febe76f1eea83 * 1c905fa3a108f4c9bc0578882ce7af9682760b80af5232f130aa4f6463156b25 * 1f9169492d18bffacebe951a22495d5dec81f35b0929da7783b5f094efef7b48 * 2618a067e976f35f65aee95fecc9a8f52abea2fffd01e001f9865850435694cf * 40645f9052e03fed3a33a7e0f58bc2c263eeae02cbc855b9308511f5dc134797 * 41a912d72ba9d5db95094be333f79b60cae943a2bd113e20cc171f86ebcb86cf * 4c465e6c8f43f7d13a1b887ff26d9a30f77cf65dd3b6f2e9f7fe36c8b6e83003 * 4c605c6ef280b4ed5657fe97ba5b6106b10c4de02a40ae8c8907683129156efd * 592769457001374fac7a44379282ddf28c2219020c88150e32853f7517896c34 * 61dff5cbad45b4fe0852ac95b96b62918742b9c90dd47c672cbe0d1dafccb6c5 * 6465f7ddc9cf8ab6714cbbd49e1fd472e19818a0babbaf3764e96552e179c9af * 6b3fce8f2dad7e803418edd8dfc807b0252705c11ec77114498b01766102e849 * 700a582408cbda7ee79723b3969b8d10d67871ea31bb17c8ca3c0d94b481aa8c * 709820850127201a17caab273e01bb36ce185b4c4f68cd1099110bb193c84c42 * 72ebfe69c69d2dd173bb92013ab44d895a3367f91f09e3f8d18acab44e37b26d * 75f9f99295f86de85a8a2e4d73ed569bdb14a56a33d8240c72084f11752b207e * 785f65f1853a08b0e86db5638fbd76e8cad5fe1359655716166a76035261c0be * 7b718a46ae4de09ed4f2513df6e989afe1fbb1a0f59511a4689fac5e1745547d * 7f8bb754f84a06b3e3617dd1138f07a918d11717cc63acaef8eb5c6d10101377 * 845d7978682fa19161281a35b62f4c447c477082a765d6fedb219877d0c90f31 * 9867f99a66e64f6bce0cfca18b124194a683b8e4cb0ced44f7cb09386e1b528d * 9ae24a1912e4b0bab76ae97484b62ea22bdc27b7ea3e6472f18bf04ca66c87de * a2f8de3c5f5f6ecbf29c15afd43a7c13a5bf60023ecb371d39bcca6ceef1d2b7 * b5f151f0a4288e148fd10e19c78399f5b7bdff2ad66940fadd20d6eae4b7518b * b833f40b2f3439f317cf95980b29bddd2245d2acc2d5c11e9690dd2fa4289585 * c8c11f9b308ea5983eebd8a414684021cc4cc1f67e7398ff967a18ae202fb457 * ceb59dbaf58a8de02f9d5e9b497321db0a19b7db4affd5b8d1a7e40d62775f96 * d8f065d264b1112d6ee3cf34979289e89d9dcb30d2a3bd78cc797a81d3d56f56 * db6e75987cabdbfc21d0fdcb1cdae9887c492cab2b2ff1e529601a34a2abfd99 * de42155e14a3c9c4d919316d6ba830229533de5063fcd110f53e2395ef3aa77a * e2a940c7d19409e960427749519dc02293abe58a1bef78404a8390f818e40d08 * fc9bb03998a89524ce5a0f859feb45806983aa4feb5f4d436107198ca869ff6f * ff620bd560485c13a58a0de941bd3e52943036e6a05306e928f7c626998822fb SHA256 hashes for DLL files downloaded by BeaverTail: * da6d9c837c7c2531f0dbb7ce92bfceba4a9979953b6d49ed0862551d4b465adc * 2d8a5b637a95de3b709780898b7c3957f93d72806e87302f50c40fe850471a44 * c5a73896dc628c23a0b6210f50019445e2b8bfc9770f4c81e1fed097f02dfade SHA256 hashes for files associated with InvisibleFerret: * 35434e903bc3be183fa07b9e99d49c0b0b3d8cf6cbd383518e9a9d753d25b672 * 305de20b24e2662d47f06f16a5998ef933a5f8e92f9ecadf82129b484769bbac * 39e7f94684129efce4d070d89e27508709f95fa55d9721f7b5d52f8b66b95ceb * ab198c5a79cd9dedb271bd8a56ab568fbd91984f269f075d8b65173e749a8fde * 444f56157dfcf9fc2347911a00fe9f3e3cb7971dccf67e1359d2f99a35aed88e * 4f50051ae3cb57f10506c6d69d7c9739c90ef21bfb82b14da6f4b407b6febac0 * 276863ee7b250419411b39c8539c31857752e54b53b072dffd0d3669f2914216 * 617c62da1c228ec6d264f89e375e9a594a72a714a9701ed3268aa4742925112b * c547b80e1026d562ac851be007792ae98ddc1f3f8776741a72035aca3f18d277 * 03185038cad7126663550d2290a14a166494fdd7ab0978b98667d64bda6e27cc * 2d300410a3edb77b5f1f0ff2aa2d378425d984f15028c35dfad20fc750a6671a * 92aeea4c32013b935cd8550a082aff1014d0cd2c2b7d861b43a344de83b68129 Domain and IPs associated with the Contagious Interview campaign: * blocktestingto\[.\]com * 144\.172.74\[.\]48 * 144\.172.79\[.\]23 * 167\.88.168\[.\]152 * 167\.88.168\[.\]24 * 172\.86.123\[.\]35 * 45\.61.129\[.\]255 * 45\.61.130\[.\]0 * 45\.61.160\[.\]14 * 45\.61.169\[.\]187 *Updated Dec. 1, 2023, at 2:40 p.m. PT to expand product protections.* *Updated Aug. 23, 2024, at 12:20 p.m. PT to correct numbering in Attribution section.* *Updated Aug 28, 2024, at 7:43 a.m. PT to correct number in Table 3.* Back to top ### Tags * [Advanced Persistent Threat](https://unit42.paloaltonetworks.com/tag/advanced-persistent-threat/ "Advanced Persistent Threat") * [BeaverTail](https://unit42.paloaltonetworks.com/tag/beavertail/ "BeaverTail") * [Contagious Interview](https://unit42.paloaltonetworks.com/tag/contagious-interview/ "Contagious Interview") * [DPRK](https://unit42.paloaltonetworks.com/tag/dprk/ "DPRK") * [North Korea](https://unit42.paloaltonetworks.com/tag/north-korea/ "North Korea") * [Wagemole](https://unit42.paloaltonetworks.com/tag/wagemole/ "Wagemole") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Stately Taurus Targets the Philippines As Tensions Flare in the South Pacific](https://unit42.paloaltonetworks.com/stately-taurus-targets-philippines-government-cyberespionage/ "Stately Taurus Targets the Philippines As Tensions Flare in the South Pacific") ### Table of Contents * ### Related Articles * [Tracking Iranian APT Screening Serpens' 2026 Espionage Campaigns](https://unit42.paloaltonetworks.com/tracking-iran-apt-screening-serpens/ "article - table of contents") * [Boggy Serpens Threat Assessment](https://unit42.paloaltonetworks.com/boggy-serpens-threat-assessment/ "article - table of contents") * [Suspected China-Based Espionage Operation Against Military Targets in Southeast Asia](https://unit42.paloaltonetworks.com/espionage-campaign-against-military-targets/ "article - table of contents") ## Related Resources ![Pictorial representation of a magnifying glass illuminating a glowing orange circular digital circuit interface on a dark, high-tech background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Myth-Busting_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) September 16, 2026 [#### Atomic macOS (AMOS) Stealer Activity](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/) * [MacOS](https://unit42.paloaltonetworks.com/tag/macos/ "macOS") * [Threat intelligence](https://unit42.paloaltonetworks.com/tag/threat-intelligence/ "threat intelligence") * [Unit 42](https://unit42.paloaltonetworks.com/tag/unit-42/ "Unit 42") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/ "Atomic macOS (AMOS) Stealer Activity") ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/content/pan/en_US/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)