[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/ukraine-cyber-conflict-cve-2021-32648-whispergate/) * [Japanese](https://unit42.paloaltonetworks.com/ja/ukraine-cyber-conflict-cve-2021-32648-whispergate/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/ "High Profile Threats") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # Threat Brief: Ongoing Russia and Ukraine Cyber Activity ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 8 min read Related Products [![Advanced Threat Prevention icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced Threat Prevention](https://unit42.paloaltonetworks.com/product-category/advanced-threat-prevention/ "Advanced Threat Prevention")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cortex icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex](https://unit42.paloaltonetworks.com/product-category/cortex/ "Cortex")[![Next-Generation Firewall icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Mike Harbison](https://unit42.paloaltonetworks.com/author/mike-harbison/) * [Robert Falcone](https://unit42.paloaltonetworks.com/author/robert-falcone/) * [Josh Grunzweig](https://unit42.paloaltonetworks.com/author/josh-grunzweig/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:January 20, 2022 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Vulnerabilities](https://unit42.paloaltonetworks.com/category/vulnerabilities/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [CVE-2021-32648](https://unit42.paloaltonetworks.com/tag/cve-2021-32648/) * [OctoberCMS](https://unit42.paloaltonetworks.com/tag/octobercms/) * [Russia](https://unit42.paloaltonetworks.com/tag/russia/) * [Ukraine](https://unit42.paloaltonetworks.com/tag/ukraine/) * [WhisperGate](https://unit42.paloaltonetworks.com/tag/whispergate/) * [Windows](https://unit42.paloaltonetworks.com/tag/windows/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/ukraine-cyber-conflict-cve-2021-32648-whispergate/?pdf=download&lg=en&_wpnonce=7ff144eb5f "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/ukraine-cyber-conflict-cve-2021-32648-whispergate/?pdf=print&lg=en&_wpnonce=7ff144eb5f "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Threat%20Brief:%20Ongoing%20Russia%20and%20Ukraine%20Cyber%20Activity&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fukraine-cyber-conflict-cve-2021-32648-whispergate%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fukraine-cyber-conflict-cve-2021-32648-whispergate%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fukraine-cyber-conflict-cve-2021-32648-whispergate%2F&title=Threat%20Brief:%20Ongoing%20Russia%20and%20Ukraine%20Cyber%20Activity "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fukraine-cyber-conflict-cve-2021-32648-whispergate%2F&text=Threat%20Brief:%20Ongoing%20Russia%20and%20Ukraine%20Cyber%20Activity "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fukraine-cyber-conflict-cve-2021-32648-whispergate%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Threat%20Brief:%20Ongoing%20Russia%20and%20Ukraine%20Cyber%20Activity%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fukraine-cyber-conflict-cve-2021-32648-whispergate%2F "Share in Mastodon") ## Executive Summary Beginning on Jan. 14, 2022, reports began emerging about a series of attacks targeting numerous Ukrainian government websites. As a result of these attacks, numerous government websites were found to be either defaced or inaccessible. As a result of this, the government of Ukraine [formally accused Russia](https://thehackernews.com/2022/01/ukrainian-government-officially-accuses.html) of masterminding these attacks against their websites. A day later, public reporting outlined new malware called [WhisperGate](https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/) that originally was observed on Jan. 13, 2022. This malware disables Windows Defender Threat Protection, is destructive in nature and was discovered to have targeted multiple organizations in Ukraine. Microsoft has publicly attributed the use of this custom malware to a threat actor they refer to as DEV-0586. Though both attacks have targeted Ukrainian organizations, the two threats have so far been implemented in separate situations. As a result of these events, Palo Alto Networks researchers took immediate action to ensure that customers anywhere in the world can be appropriately protected against these reported threats, however they may be exploited. These attacks ultimately resulted in the investigation of the following two threats: 1. [CVE-2021-32648](https://nvd.nist.gov/vuln/detail/CVE-2021-32648), a vulnerability in the OctoberCMS content management system (CMS) platform, which is believed to be behind the attacks against Ukrainian government websites. 2. The WhisperGate malware, attributed to the DEV-0586 threat actor. Palo Alto Networks customers can use [Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) or [Threat Prevention](https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/threat-prevention) for the Next-Generation Firewall to identify vulnerable and/or internet-facing instances of OctoberCMS. Protections against WhisperGate malware have been included in [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr), as well as in the WildFire and Advanced URL Filtering [subscriptions for the Next-Generation Firewall](https://www.paloaltonetworks.com/network-security/security-subscriptions). There is a [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) pack available to assist with detecting and mitigating both threats. |---------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Threats targeting Ukraine discussed** | **Relevant CVEs/malware/affected software** | | Attacks against Ukrainian government websites | [CVE-2021-32648](https://nvd.nist.gov/vuln/detail/CVE-2021-32648), affecting OctoberCMS | | Attacks against multiple organizations in Ukraine | [WhisperGate](https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/) malware, disabling Windows Defender Threat Protection | ## CVE-2021-32648 Vulnerability The CVE-2021-32648 vulnerability lies within the OctoberCMS platform prior to version 1.0.472 and results in an attacker gaining access to any account via a specially crafted account password reset request. This vulnerability is believed to have allowed threat actors to gain access to the underlying websites leveraged by the Ukraine government. Once the vulnerability was discovered, Palo Alto Networks threat researchers quickly began reverse-engineering the patch that remediated this vulnerability and were able to produce a working proof of concept (PoC) in a very short time. Later that day, a [public PoC surfaced](https://github.com/Immersive-Labs-Sec/CVE-2021-32648/blob/main/cve-2021-32648.py), allowing organizations to better understand this vulnerability and how it is exploited. Using our PoC, we created the following demonstration video of how a malicious actor would exploit the CVE-2021-32648 vulnerability, log into the compromised OctoberCMS account and to deface a web page hosted by the server: To determine how this vulnerability was exploited, we analyzed the patch that developers added to OctoberCMS version 1.0.472 to mitigate the CVE-2021-32648 vulnerability. We discovered that the vulnerable code existed in the [Auth/Models/User.php](https://github.com/octobercms/library/blob/v1.0.471/src/Auth/Models/User.php) file within the [October Rain library](https://github.com/octobercms/library) of OctoberCMS. The code that exposes this vulnerability is within a function named checkResetPasswordCode, specifically, line 281 in [User.php](https://github.com/octobercms/library/blob/v1.0.471/src/Auth/Models/User.php#L281). The following line of code attempts to validate the inbound password reset request by comparing the reset code submitted within the HTTP request with the reset code generated by OctoberCMS during a legitimate reset process: ![This line of code exploits CVE-2021-32648 by attempting to validate the inbound password reset request by comparing the reset code submitted within the HTTP request with the reset code generated by OctoberCMS during a legitimate reset process.](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/01/word-image-63.png) To exploit this vulnerability, the actor would simply supply a boolean true value as the reset code within a custom-crafted HTTP request to reset the password of an account. By supplying the boolean true, the comparison between boolean true and the reset code string results in a boolean true, even though the two variables have different types. This effectively validates the actor's inbound password reset request, which allows the actor to then change the password To fix this vulnerability in version 1.0.472, the OctoberCMS developer changed the line of code above to use === instead of == when comparing the values of the reset code provided by the user via an HTTP POST request. The difference between === and == involves the === comparing the value and type of value of the variable, not just the value, as happens when using ==. To demonstrate the difference, the following two commands run PHP code to show that a comparison of the string code with boolean true using == results in a boolean true, while the same comparison using === results in a boolean false: ![To demonstrate the difference between the version of OctoberCMS vulnerable to CVE-2021-32648 and the fixed version, the following two commands run PHP code to show that a comparison of the string code with boolean true using == results in a boolean true, while the same comparison using === results in a boolean false](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/01/word-image-64.png) As a result of the analysis of the CVE-2021-32648 vulnerability, various product protections were created or enhanced. More information about these protections can be found within the [Mitigation Actions](#mitigation-actions) section of the briefing. ## WhisperGate Malware First observed by Microsoft on Jan. 13, 2022, [WhisperGate](https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/) malware is computer network attack (CNA) malware aimed at deleting Microsoft Windows Defender and corrupting files on the target. It consists of two samples: One appears as ransomware while the other is a beaconing implant used to deliver an in-memory Microsoft Intermediate Language (MSIL) payload. The in-memory code uses Living Off the Land Binaries (LOLBINs) to evade detection and also performs anti-analysis techniques, as it will fail to detonate when certain monitoring tools exist. At the time of writing, there are two known samples identified as WhisperGate: Stage1.exe and Stage2.exe. Stage1.exe purports to be ransomware, as it overwrites the target's master boot record with 512 bytes and upon reboot displays the following ransom note: ![A ransom note dropped by a sample of WhisperGate malware.](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/01/word-image-65.png) Figure 1. Stage 1 ransom note. Stage2.exe is a beaconing implant that performs an HTTPS connection to download a JPG file hosted on Discord's content delivery network (CDN). Discord's CDN is a user-created service that allows users to host attachments and is not malicious. The hosted file is retrieved from the following URL: hxxps://cdn.discordapp\[.\]com/attachments/928503440139771947/930108637681184768/Tbopbh.jpg File Tbopbh.jpg is the malicious payload that is in-memory loaded and kicks off the destructive capabilities. The following patterns of activities are associated with this payload: 1. File InstallUtil.exe is copied to the host's %TEMP% directory, e.g. C:\\Users\\\[USERNAME\]\\AppData\\Local\\Temp. This file is a legitimate Microsoft Windows binary. 2. Two instances of PowerShell are spawned with an encoded command to sleep for 10 seconds, e.g. C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwAA== 3. A Visual Basic Script (VBS) is created in C:\\Users\\\[USERNAME\]\\AppData\\Local\\Temp named: Nmddfrqqrbyjeygggda.vbs 4. Process wscript.exe is used to execute the VBS script in step 3. The VBS script is used to call PowerShell to set Windows Defender exclusion path to C:\\ e.g. C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" Set-MpPreference -ExclusionPath 'C:\\' 5. [AdvancedRun.exe](https://www.nirsoft.net/utils/advanced_run.html) is created and written to the C:\\Users\\\[USERNAME\]\\AppData\\Local\\Temp directory. 6. AdvancedRun.exe is used to execute PowerShell.exe to delete and stop Windows Defender. The following command parameters are passed to AdvancedRun: "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" /WindowState 0 /CommandLine "rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse" /StartDirectory "" /RunAs 8 /Run "C:\\Users\\USERNAME\]AppData\\Local\\Temp\\AdvancedRun.exe" /EXEFilename "C:\\Windows\\System32\\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run 7. PowerShell process used to delete Windows Defender, e.g. C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse 8. File InstallUtil.exe running from C:\\Users\\\[USERNAME\]\\AppData\\Local\\Temp directory. The in-memory payload (Tbopbh.jpg) is running within the context of the InstallUtil.exe process 9. Multiple instances of cmd.exe calling Ping.exe to delete file InstallUtil.exe, e.g. cmd.exe /min /C ping 111.111.111\[.\]111 -n 5 -w 10 \> Nul \& Del /f /q %TEMP%\\InstallUtil.exe 10. File AdvancedRun.exe is deleted from the C:\\Users\\\[USERNAME\]\\AppData\\Local\\Temp directory by the stage2.exe binary. 11. ICMP traffic to host: 111.111.111\[.\]111 12. All files and directories, including those on mounted USB drives, excluding the floppy drive (A:) are targeted. The following file extensions are overwritten with a one-byte value of 0xCC. ![A list of file extensions targeted by WhisperGate malware.](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/01/word-image-66.png) Figure 2. Targeted file extensions. 13. Targeted files greater than one megabyte are truncated to one megabyte when overwritten. 14. Virus \& Threat protection is no longer available from Windows Security. ![A screenshot showing how WhisperGate malware removes Virus \& Threat Protection from Windows Security.](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/01/word-image-67.png) Figure 3. Virus \& Threat Protection removed. ## Mitigation Actions Organizations running OctoberCMS prior to Build 472 and v1.1.5 are encouraged to update to the latest version. Additionally, in order for this vulnerability to be exploited, the web server must be running PHP below 7.4. Palo Alto Networks customers receive protections against the OctoberCMS vulnerability in the following ways: * Threat ID [92199](https://threatvault.paloaltonetworks.com/?query=92199) was released to identify this vulnerability * Xpanse has a policy that customers can enable to detect internet-facing instances of OctoberCMS Palo Alto Networks customers receive protections against WhisperGate malware in the following ways: * [WildFire](https://www.paloaltonetworks.com/products/secure-the-network/wildfire) appropriately identifies WhisperGate samples as malicious. * All observed malicious Discord URLs have been flagged as malicious. * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) prevents this malware from executing using machine learning-based local analysis, the Behavioral Threat Protection module and the ransomware protection module. The Cortex XSOAR "WhisperGate \& CVE-2021-32648'' pack can help automatically detect and mitigate the two threats. Read more on the [XSOAR marketplace](https://xsoar.pan.dev/marketplace/details/WhisperGateCVE202132648). If you think you may have been compromised or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call North America Toll-Free: 866.486.4842 (866.4.UNIT42), EMEA: +31.20.299.3130, APAC: +65.6983.8730, or Japan: +81.50.1790.0200. ## Hunting for WhisperGate Palo Alto Networks Cortex XDR customers may leverage the following XQL queries, written by the Cortex Managed Threat Hunting service experts, to hunt their datasets for indicators related to WhisperGate malware: // Description: WhisperGate - Self Delete config case\_sensitive = false |dataset = xdr\_data |filter event\_type = ENUM.PROCESS and event\_sub\_type = ENUM.PROCESS\_START |filter (action\_process\_image\_name = "cmd.exe" OR action\_process\_image\_name = "ping.exe") and action\_process\_image\_command\_line contains "111.111.111.111 -n 5 -w 10" |fields \_time, agent\_hostname, actor\_effective\_username, actor\_process\_image\_path, actor\_process\_image\_sha256,action\_process\_image\_path, action\_process\_image\_command\_line, action\_process\_image\_sha256 // Description: WhisperGate - PowerShell Sleep config case\_sensitive = false |dataset = xdr\_data |filter event\_type = ENUM.PROCESS and event\_sub\_type = ENUM.PROCESS\_START |filter action\_process\_image\_name = "powershell.exe" and action\_process\_image\_command\_line contains "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwAA==" |fields \_time, agent\_hostname, actor\_effective\_username, actor\_process\_image\_path, actor\_process\_image\_sha256,action\_process\_image\_path, action\_process\_image\_command\_line, action\_process\_image\_sha256 // Description: WhisperGate - InstallUtil (Wiper) config case\_sensitive = false |dataset = xdr\_data |filter (event\_type = FILE and (event\_sub\_type = ENUM.FILE\_WRITE or event\_sub\_type = ENUM.FILE\_CREATE\_NEW) and (action\_file\_name = "installutil.exe" AND action\_file\_path contains "\\appdata\\local\\temp\\installutil.exe")) or ((event\_type = ENUM.PROCESS and event\_sub\_type = ENUM.PROCESS\_START) and action\_process\_image\_name = "installutil.exe" and action\_process\_image\_path contains "\\appdata\\local\\temp\\installutil.exe") |dedup agent\_id, actor\_process\_image\_command\_line, actor\_process\_image\_sha256, action\_file\_path, action\_file\_sha256, action\_process\_image\_sha256, action\_process\_image\_command\_line |fields \_time, agent\_id,agent\_hostname, actor\_effective\_username, action\_file\_name, action\_file\_path, action\_file\_sha256, actor\_process\_image\_path, actor\_process\_image\_command\_line, actor\_process\_image\_sha256, action\_process\_image\_path, action\_process\_image\_command\_line, action\_process\_image\_sha256 // Description: WhisperGate - Disable Defender config case\_sensitive = false |dataset = xdr\_data |filter ((event\_type = ENUM.PROCESS and event\_sub\_type = ENUM.PROCESS\_START) and (action\_process\_image\_name = "advancedrun.exe" and (action\_process\_image\_command\_line contains "stop windefend" OR action\_process\_image\_command\_line contains "mdir 'c:\\programdata\\microsoft\\windows defender")) or (action\_process\_image\_name = "wscript.exe" and action\_process\_image\_command\_line contains "nmddfrqqrbyjeygggda.vbs")) or (event\_type = FILE and (event\_sub\_type = ENUM.FILE\_WRITE or event\_sub\_type = ENUM.FILE\_CREATE\_NEW) and (action\_file\_name = "nmddfrqqrbyjeygggda.vbs")) |dedup agent\_id, actor\_process\_image\_command\_line, actor\_process\_image\_sha256, action\_file\_path, action\_file\_sha256, action\_process\_image\_sha256, action\_process\_image\_command\_line |fields \_time, agent\_id,agent\_hostname, actor\_effective\_username, action\_file\_name, action\_file\_path, action\_file\_sha256, actor\_process\_image\_path, actor\_process\_image\_command\_line, actor\_process\_image\_sha256, action\_process\_image\_path, action\_process\_image\_command\_line, action\_process\_image\_sha256 |-------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 | // Description: WhisperGate - Self Delete config case\_sensitive = false |dataset = xdr\_data |filter event\_type = ENUM.PROCESS and event\_sub\_type = ENUM.PROCESS\_START |filter (action\_process\_image\_name = "cmd.exe" OR action\_process\_image\_name = "ping.exe") and action\_process\_image\_command\_line contains "111.111.111.111 -n 5 -w 10" |fields \_time, agent\_hostname, actor\_effective\_username, actor\_process\_image\_path, actor\_process\_image\_sha256,action\_process\_image\_path, action\_process\_image\_command\_line, action\_process\_image\_sha256 // Description: WhisperGate - PowerShell Sleep config case\_sensitive = false |dataset = xdr\_data |filter event\_type = ENUM.PROCESS and event\_sub\_type = ENUM.PROCESS\_START |filter action\_process\_image\_name = "powershell.exe" and action\_process\_image\_command\_line contains "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwAA==" |fields \_time, agent\_hostname, actor\_effective\_username, actor\_process\_image\_path, actor\_process\_image\_sha256,action\_process\_image\_path, action\_process\_image\_command\_line, action\_process\_image\_sha256 // Description: WhisperGate - InstallUtil (Wiper) config case\_sensitive = false |dataset = xdr\_data |filter (event\_type = FILE and (event\_sub\_type = ENUM.FILE\_WRITE or event\_sub\_type = ENUM.FILE\_CREATE\_NEW) and (action\_file\_name = "installutil.exe" AND action\_file\_path contains "\\appdata\\local\\temp\\installutil.exe")) or ((event\_type = ENUM.PROCESS and event\_sub\_type = ENUM.PROCESS\_START) and action\_process\_image\_name = "installutil.exe" and action\_process\_image\_path contains "\\appdata\\local\\temp\\installutil.exe") |dedup agent\_id, actor\_process\_image\_command\_line, actor\_process\_image\_sha256, action\_file\_path, action\_file\_sha256, action\_process\_image\_sha256, action\_process\_image\_command\_line |fields \_time, agent\_id,agent\_hostname, actor\_effective\_username, action\_file\_name, action\_file\_path, action\_file\_sha256, actor\_process\_image\_path, actor\_process\_image\_command\_line, actor\_process\_image\_sha256, action\_process\_image\_path, action\_process\_image\_command\_line, action\_process\_image\_sha256 // Description: WhisperGate - Disable Defender config case\_sensitive = false |dataset = xdr\_data |filter ((event\_type = ENUM.PROCESS and event\_sub\_type = ENUM.PROCESS\_START) and (action\_process\_image\_name = "advancedrun.exe" and (action\_process\_image\_command\_line contains "stop windefend" OR action\_process\_image\_command\_line contains "mdir 'c:\\programdata\\microsoft\\windows defender")) or (action\_process\_image\_name = "wscript.exe" and action\_process\_image\_command\_line contains "nmddfrqqrbyjeygggda.vbs")) or (event\_type = FILE and (event\_sub\_type = ENUM.FILE\_WRITE or event\_sub\_type = ENUM.FILE\_CREATE\_NEW) and (action\_file\_name = "nmddfrqqrbyjeygggda.vbs")) |dedup agent\_id, actor\_process\_image\_command\_line, actor\_process\_image\_sha256, action\_file\_path, action\_file\_sha256, action\_process\_image\_sha256, action\_process\_image\_command\_line |fields \_time, agent\_id,agent\_hostname, actor\_effective\_username, action\_file\_name, action\_file\_path, action\_file\_sha256, actor\_process\_image\_path, actor\_process\_image\_command\_line, actor\_process\_image\_sha256, action\_process\_image\_path, action\_process\_image\_command\_line, action\_process\_image\_sha256 | ## Conclusion The Unit 42 Threat Intelligence team remains vigilant in monitoring this evolving situation, is actively hunting for known indicators from recent events and is ready to put protections in place to thwart attacks against our customers. Product-specific protections have been implemented as a result of research performed in recent days, and those protections will be augmented as needed as more details come to light. Palo Alto Networks will update this Threat Brief with new information and recommendations as they become available. ## Additional Resources ### **CVE-2021-32648 Information** * [CVE-2021-32648](https://nvd.nist.gov/vuln/detail/CVE-2021-32648) - NIST * [CVE-2021-32648](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32648) - MITRE * [OctoberCMS library](https://github.com/OctoberCMS/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374) * [CVE-2021-32648](https://cyber.vumetric.com/vulns/CVE-2021-32648/improper-authentication-vulnerability-in-octobercms-october/) - Vumetric Cyber Portal * [Account Takeover in OctoberCMS](https://github.com/advisories/GHSA-mxr5-mc97-63rc) - GitHub Advisory * [OctoberCMS as you know it is Dead](https://wintercms.com/blog/post/october-cms-you-know-it-dead) - Winter CMS ### **WhisperGate Information** * [Destructive malware targeting Ukrainian organizations](https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/) * [What We Know and Don't Know About the Cyberattacks Against Ukraine](https://zetter.substack.com/p/what-we-know-and-dont-know-about) *Updated March 4, 2022, at 6:15 a.m. PT.* Back to top ### Tags * [CVE-2021-32648](https://unit42.paloaltonetworks.com/tag/cve-2021-32648/ "CVE-2021-32648") * [OctoberCMS](https://unit42.paloaltonetworks.com/tag/octobercms/ "OctoberCMS") * [Russia](https://unit42.paloaltonetworks.com/tag/russia/ "Russia") * [Ukraine](https://unit42.paloaltonetworks.com/tag/ukraine/ "Ukraine") * [WhisperGate](https://unit42.paloaltonetworks.com/tag/whispergate/ "WhisperGate") * [Windows](https://unit42.paloaltonetworks.com/tag/windows/ "Windows") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Operation Falcon II: Unit 42 Helps INTERPOL Identify Nigerian Business Email Compromise Ring Members](https://unit42.paloaltonetworks.com/operation-falcon-ii-silverterrier-nigerian-bec/ "Operation Falcon II: Unit 42 Helps INTERPOL Identify Nigerian Business Email Compromise Ring Members") ### Table of Contents * ### Related Articles * [Understanding the Russian Cyberthreat to the 2026 Winter Olympics](https://unit42.paloaltonetworks.com/russian-cyberthreat-2026-winter-olympics/ "article - table of contents") * [01flip: Multi-Platform Ransomware Written in Rust](https://unit42.paloaltonetworks.com/new-ransomware-01flip-written-in-rust/ "article - table of contents") * [You Thought It Was Over? Authentication Coercion Keeps Evolving](https://unit42.paloaltonetworks.com/authentication-coercion/ "article - table of contents") ## Related Resources ![Pictorial representation of CVE-2026-109618 and CVE-2026-109619 in PHP. Digital illustration of a global network featuring interconnected lines and nodes over a map of the world, highlighted with neon lights and digital elements.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/03_Vulnerabilities_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) October 23, 2026 [#### Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 23)](https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/) * [CVE-2026-109618](https://unit42.paloaltonetworks.com/tag/cve-2026-109618/ "CVE-2026-109618") * [CVE-2026-109619](https://unit42.paloaltonetworks.com/tag/cve-2026-109619/ "CVE-2026-109619") * [PHP2Shell](https://unit42.paloaltonetworks.com/tag/php2shell/ "PHP2Shell") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/ "Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 23)") ![Pictorial representation of TLS Certificate compromise. A person typing on a laptop with digital graphics of binary code and light beams emanating from the screen, representing data transfer or cyber activity.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/07_Security-Technology_Category_1920x900-1-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) October 22, 2026 [#### EMudhra Intermediate CA Certificates Compromised](https://unit42.paloaltonetworks.com/emudhra-certificate-compromise/) * [Certificates](https://unit42.paloaltonetworks.com/tag/certificates/ "certificates") * [Compromise](https://unit42.paloaltonetworks.com/tag/compromise/ "Compromise") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/emudhra-certificate-compromise/ "EMudhra Intermediate CA Certificates Compromised") ![](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/AdobeStock_1246251272-2-1-786x369.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) October 21, 2026 [#### "Next Exploit Opportunities": How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities](https://unit42.paloaltonetworks.com/ai-assisted-cybercrime-analysis/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Data exfiltration](https://unit42.paloaltonetworks.com/tag/data-exfiltration/ "data exfiltration") * [DeepSeek](https://unit42.paloaltonetworks.com/tag/deepseek/ "DeepSeek") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-assisted-cybercrime-analysis/ "“Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities") ![Pictorial representation of PAN-OS CVE-2026-0257. A vibrant city skyline at night, with tall skyscrapers and glowing digital beams extending into the sky, suggesting advanced technology and connectivity.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/07_Vulnerabilities_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) October 20, 2026 [#### Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20)](https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/) * [CVE-2026-0257](https://unit42.paloaltonetworks.com/tag/cve-2026-0257/ "CVE-2026-0257") * [Vulnerability](https://unit42.paloaltonetworks.com/tag/vulnerability/ "vulnerability") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/ "Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20)") ![Pictorial representation of AI-powered campaign targeting government infrastructure. A glowing, blue, brain-shaped structure floats above a central microchip on a circuit board. The scene is futuristic, with neon lights illuminating the interconnected pathways and components.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/AdobeStock_637057734-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) October 15, 2026 [#### AI-Powered Espionage Campaign Targets Government Linux Infrastructure](https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/) * [Exfiltration](https://unit42.paloaltonetworks.com/tag/exfiltration/ "exfiltration") * [LLM](https://unit42.paloaltonetworks.com/tag/llm/ "LLM") * [Network security](https://unit42.paloaltonetworks.com/tag/network-security/ "network security") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/ "AI-Powered Espionage Campaign Targets Government Linux Infrastructure") ![Pictorial representation of PEERSTITCH, a FortiGate implant. A digital illustration depicting a circuit board with a prominent red warning triangle and exclamation mark in the center. The background is filled with various computer circuitry patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/09_Vulnerabilities_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) October 14, 2026 [#### Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/) * [Apache](https://unit42.paloaltonetworks.com/tag/apache/ "Apache") * [CL-STA-0954](https://unit42.paloaltonetworks.com/tag/cl-sta-0954/ "CL-STA-0954") * [Logging](https://unit42.paloaltonetworks.com/tag/logging/ "logging") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/ "Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant") ![Pictorial representation of operation blinder tunnel. Screen displaying code with a prominent alert symbol and the words 'VIRUS DETECTED' highlighted in red.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/05_Malware_Category_1920x900-1-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) October 6, 2026 [#### Blinder Tunnel Campaign Targets Iraqi Infrastructure](https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/) * [Advanced Persistent Threat](https://unit42.paloaltonetworks.com/tag/advanced-persistent-threat/ "Advanced Persistent Threat") * [Agent Serpens](https://unit42.paloaltonetworks.com/tag/agent-serpens/ "Agent Serpens") * [AppDomainManager](https://unit42.paloaltonetworks.com/tag/appdomainmanager/ "AppDomainManager") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/ "Blinder Tunnel Campaign Targets Iraqi Infrastructure") ![Pictorial representation of NetScaler zero days. Digital illustration of a map of North America with interconnected glowing lines and dots symbolizing network connections across the continent.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/06_Vulnerabilities_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) September 30, 2026 [#### Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)](https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/) * [Citrix](https://unit42.paloaltonetworks.com/tag/citrix/ "Citrix") * [CVE-2026-88771](https://unit42.paloaltonetworks.com/tag/cve-2026-88771/ "CVE-2026-88771") * [CVE-2026-88772](https://unit42.paloaltonetworks.com/tag/cve-2026-88772/ "CVE-2026-88772") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/ "Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)") ![Pictorial representation of how K8 operators betray your security posture. A close-up of a futuristic microchip with glowing circuits in vibrant colors, including blue, purple, and orange, reflecting light.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_652069707-1-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 29, 2026 [#### OperTraitors: How Kubernetes Operators Betray Your Security Posture](https://unit42.paloaltonetworks.com/agentic-ai-kubernetes-operator-risks/) * [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI") * [AI agents](https://unit42.paloaltonetworks.com/tag/ai-agents/ "AI agents") * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/agentic-ai-kubernetes-operator-risks/ "OperTraitors: How Kubernetes Operators Betray Your Security Posture") ![Pictorial representation of a magnifying glass illuminating a glowing orange circular digital circuit interface on a dark, high-tech background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Myth-Busting_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) September 16, 2026 [#### Atomic macOS (AMOS) Stealer Activity](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/) * [MacOS](https://unit42.paloaltonetworks.com/tag/macos/ "macOS") * [Threat intelligence](https://unit42.paloaltonetworks.com/tag/threat-intelligence/ "threat intelligence") * [Unit 42](https://unit42.paloaltonetworks.com/tag/unit-42/ "Unit 42") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/ "Atomic macOS (AMOS) Stealer Activity") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * Observability * [Cortex XCOR](https://www.paloaltonetworks.com/cortex/xcor) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center-subscribe.html) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)