[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/)  
[![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/)  
Menu

* [Tools](https://unit42.paloaltonetworks.com/tools/)
* [ATOMs](https://unit42.paloaltonetworks.com/atoms/)
* [Security Consulting](https://www.paloaltonetworks.com/unit42)
* [About Us](https://unit42.paloaltonetworks.com/about-unit-42/)
* [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html)
* [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research")
* [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research")
* [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware")  
  [Malware](https://unit42.paloaltonetworks.com/category/malware/)

# Ewind -- Adware in Applications' Clothing

![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 10 min read  
Related Products  
[![Advanced DNS Security icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced DNS Security](https://unit42.paloaltonetworks.com/product-category/advanced-dns-security/ "Advanced DNS Security")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")

* ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg)  
  By:
  
  * [Yaron Samuel](https://unit42.paloaltonetworks.com/author/yaron-samuel/)
  * [Simon Conant](https://unit42.paloaltonetworks.com/author/simon-conant/)

* ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg)  
  Published:April 11, 2017

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg)  
  Categories:
  
  * [Malware](https://unit42.paloaltonetworks.com/category/malware/)
  * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/)

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg)  
  Tags:
  
  * [Adware](https://unit42.paloaltonetworks.com/tag/adware/)
  * [Android](https://unit42.paloaltonetworks.com/tag/android/)
  * [Ewind](https://unit42.paloaltonetworks.com/tag/ewind/)
  * [Russia](https://unit42.paloaltonetworks.com/tag/russia/)

* [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/unit42-ewind-adware-applications-clothing/?pdf=download&lg=en&_wpnonce=af535c9c4e "Click here to download")

* [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/unit42-ewind-adware-applications-clothing/?pdf=print&lg=en&_wpnonce=af535c9c4e "Click here to print")

Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg)

* ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg)
* [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Ewind%20–%20Adware%20in%20Applications’%20Clothing&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-ewind-adware-applications-clothing%2F "Share in email")
* [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-ewind-adware-applications-clothing%2F "Share in Facebook")
* [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-ewind-adware-applications-clothing%2F&title=Ewind%20–%20Adware%20in%20Applications’%20Clothing "Share in LinkedIn")
* [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-ewind-adware-applications-clothing%2F&text=Ewind%20–%20Adware%20in%20Applications’%20Clothing "Share in Twitter")
* [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-ewind-adware-applications-clothing%2F&ts=markdown "Share in Reddit")
* [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Ewind%20–%20Adware%20in%20Applications’%20Clothing%20https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-ewind-adware-applications-clothing%2F "Share in Mastodon")
  Since mid-2016 we have observed multiple new samples of the Android Adware family "Ewind". The actors behind this adware utilize a simple yet effective approach -- they download a popular, legitimate Android application, decompile it, add their malicious routines, then repackage the Android application package (APK). They then distribute the trojanized application using their own, Russian-language-targeted Android Application sites.

Some of the popular Android applications that Ewind targets include GTA Vice City, AVG cleaner, Minecraft - Pocket Edition, Avast! Ransomware Removal, VKontakte, and Opera Mobile.

Although Ewind is fundamentally adware, monetization through displaying advertising on the victim device, it also includes other functionality such as collecting device data, and forwarding SMS messages to the attacker. The adware Trojan in fact potentially allows full remote access to the infected device.

The applications, injected advertising, application sites -- and, we believe, the attacker, are all Russian.

### Initial observation

We observed in [AutoFocus](https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/autofocus) a large number of repackaged APKs, signed with the same suspicious certificate. Using the command line tool "keytool" we identify some unique signing-certificate elements. The certificate resides in "META-INF/APP.RSA" in all of the samples:

owner=CN=app  
issuer=CN=app  
md5=962C0C32705B3623CBC4574E15649948  
sha1=405E03DF2194D1BC0DDBFF8057F634B5C40CC2BD  
sha256=F9B5169DEB4EAB19E5D50EAEAB664E3BCC598F201F87F3ED33DF9D4095BAE008

Our suspicions were further raised noting that many of the APKs included the application name of Anti-Virus and other well-known applications.

### Technical Analysis

While there are some variants to Ewind, we analyzed the sample that repackaged "AVG Cleaner".

9c61616a66918820c936297d930f22df5832063d6e5fc2bea7576f873e7a5cf3

This specific sample was downloaded from IP address 88.99.112\[.\]169 which hosts multiple Android application stores.

It is simple to identify the added Trojan components in the AndroidManifest.xml, as they all are prepended with "b93478b8cdba429894e2a63b70766f91":

b93478b8cdba429894e2a63b70766f91.ads.Receiver  
b93478b8cdba429894e2a63b70766f91.ads.admin.AdminReceiver  
b93478b8cdba429894e2a63b70766f91.ads.AdDialogActivity  
b93478b8cdba429894e2a63b70766f91.ads.AdActivity  
b93478b8cdba429894e2a63b70766f91.ads.admin.AdminActivity  
b93478b8cdba429894e2a63b70766f91.ads.services.MonitorService  
b93478b8cdba429894e2a63b70766f91.ads.services.SystemService

Ewind registers ads.Receiver for the following events:

Boot completion ("android.intent.action.BOOT\_COMPLETED")  
Screen off ("android.intent.action.SCREEN\_OFF")  
User-present ("android.intent.action.USER\_PRESENT")

The first time that ads.Receiver is invoked, it collects environmental information from the device, and sends it to a Command-and-Control (C2) server. The information that is collected can be seen in Figure 1 below. Ewind generates a unique ID per installation, transmitting it as a URL parameter. The URL parameter "type=init" indicates first-run.

[![ewind\_1](https://unit42.paloaltonetworks.com/wp-content/uploads/2017/04/ewind_1.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2017/04/ewind_1.png)

*Figure 1- Ewind transmits victim information to C2*

The C2 responds over plain-text HTTP using the following command syntax:  
\[{"id":"0","command":"OK"}, {"id":15826273,"command":"changeMonitoringApps","params":{"apps":\["com.android.chrome","com.yandex.browser","com.UCMobile.intl","org.mozilla.firefox","com.opera.mini.native","com.opera.browser","com.opera.mini.native.beta","com.uc.browser.en","com.ksmobile.cb","com.speedupbrowser4g5g","com.gl9.cloudBrowser","appweb.cloud.star"\]}}, {"id":15826274,"command":"wifiToMobile","params":{"enable":true}}, {"id":15826275,"command":"sleep","params":{"time":720}}, {"id":15826276,"command":"adminActivate","params":{"tryCount":3}}\]

|-----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 | \[{"id":"0","command":"OK"}, {"id":15826273,"command":"changeMonitoringApps","params":{"apps":\["com.android.chrome","com.yandex.browser","com.UCMobile.intl","org.mozilla.firefox","com.opera.mini.native","com.opera.browser","com.opera.mini.native.beta","com.uc.browser.en","com.ksmobile.cb","com.speedupbrowser4g5g","com.gl9.cloudBrowser","appweb.cloud.star"\]}}, {"id":15826274,"command":"wifiToMobile","params":{"enable":true}}, {"id":15826275,"command":"sleep","params":{"time":720}}, {"id":15826276,"command":"adminActivate","params":{"tryCount":3}}\] |

Ewind stores each received command inside a local SQLite database named "main", then processes each sequentially. After completing each command, Ewind reports the result to the C2. The results are tagged with URL parameter "type=response" (Figure 2).

[![ewind\_2](https://unit42.paloaltonetworks.com/wp-content/uploads/2017/04/ewind_2.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2017/04/ewind_2.png)

*Figure 2- Victim response to C2 command*

We observe that the command "adminActivate" is received only in the initialization stage. This command instructs Ewind to open "AdminActivity" which attempts to trick the victim into granting Ewind device admin access. The translation of the message is "*Click "Activate" to the application to complete the installation correctly*" (Figure 3).

[![ewind\_3](https://unit42.paloaltonetworks.com/wp-content/uploads/2017/04/ewind_3.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2017/04/ewind_3.png)

*Figure 3- Ewind attempts to trick the using into granting admin rights*

It is not clear why Ewind attempts to get device admin privilege. One advantage gained by being device admin is that for a non-technical user, it is somewhat harder to uninstall the trojanized application. Another technique observed is that upon clicking on deactivate in the device admin screen, Ewind uses its capability to lock the screen for 5 seconds, switching the screen back to the regular settings screen upon unlock.

While this should make it harder to uninstall Ewind, in this specific sample a bug prevents calling the "lock screen" function. In order to lock the screen, Ewind creates AsyncTask, which sticks in an infinite loop. Ewind can't execute this AsyncTask again until the first one is completed (an Android Platform restriction).

It is interesting to note that although Ewind checks if the phone is jail-broken, we didn't observe any code path exploiting such functionality.

It appears that Ewind is used for more than just displaying ads. Ewind has a service named "ads.Monitor" which monitors the foreground application (this functionality works only in Android 4.4 and lower, as Android restricts the usage of "getRunningTasks" API in more advanced versions). If the package name of the application is matched to one of the packages listed in Ewind's "targeted apps" (list available [here](https://github.com/pan-unit42/iocs/blob/master/ewind/apps.csv)), Ewind sends a "type=event" to the C2 (Figure 4). Ewind will also send a "stopApp" event if the application is no longer in the foreground. Other events include "userPresent" , "screenOff", "install" (of a package already on the device), "uninstall", "adminActivated" and "adminDisabled", "click" (when the user clicks on the displayed ad), "receive.sms" and "sms.filter".

[![ewind\_4](https://unit42.paloaltonetworks.com/wp-content/uploads/2017/04/ewind_4.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2017/04/ewind_4.png)

*Figure 4- Ewind reports application activity to C2*

The server can respond (Figure 5), instructing Ewind to perform an action -- usually to display an ad. The server also supplies the URL of the ad to display. The ad is displayed using a simple webview.

[![ewind\_5](https://unit42.paloaltonetworks.com/wp-content/uploads/2017/04/ewind_5.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2017/04/ewind_5.png)

*Figure 5- C2 commands victim to display advert*

During our tests, only when finance-related applications were in the foreground, did the victim receive a command to display an advert (none of the targeted browsers received commands upon being in the foreground). In addition, regardless of an application starting or stopping, it always triggers the command "showFullScreen". The Parameters of this command are "URL" (of the advert) and "delay" (how long Ewind waits until it displays the advert (seconds)).

The only advert sent to our test victims was from the URL mobincome\[.\]org/banners/banner-720x1184-24.html (Figure 6). When clicked, it attempts to download the application "mobCoin" from the application store androidsky\[.\]ru. At the time we analyzed the Ewind sample, download link wasn't working. We found an Ewind Trojanized sample of the MobCoin application (393ffeceae27421500c54e1cf29658869699095e5bca7b39100bf5f5ca90856b), though it's not clear if this is the same file that was previously served by androidsky\[.\]ru.

[![ewind\_6](https://unit42.paloaltonetworks.com/wp-content/uploads/2017/04/ewind_6.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2017/04/ewind_6.png)

*Figure 6- Advertisement displayed by Ewind*

The last type of communication is "type=timer", which serves as a keep alive function. Ewind transmits at pre-defined intervals (usually 180 plus/minus a random number of seconds), the request show in Figure 7 below. Usually this request is of little interest apart from the keep-alive function, but we observe that once a day the server will responds to this request with an updated list of target applications.

[![ewind\_7](https://unit42.paloaltonetworks.com/wp-content/uploads/2017/04/ewind_7.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2017/04/ewind_7.png)

*Figure 7- Keep-alive request sent by Ewind*

### SMS stealing

Ewind can be instructed using the "smsFilters" command to forward to the C2 any SMS messages meeting a certain filter criteria. The filter includes matching a phone number or message text. If a message is received from a matching phone number or with matching text, Ewind sends the C2 a request with the event "receive.sms", including the full SMS text and sending phone number. If both a phone number and text filter match, Ewind informs the C2 with event "sms.filter".

This functionality is likely intended to defeat two-factor authentication by SMS. We have not observed the actors using this command, but we were able to observe it in operation when we manually inserted filters into a victim Ewind database.

[![ewind\_8](https://unit42.paloaltonetworks.com/wp-content/uploads/2017/04/ewind_8.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2017/04/ewind_8.png)

### Targeted Apps

If a package name matches the list of targeted applications, every time that application is sent to foreground or background, Ewind notifies the C2. The C2 can respond with a command for Ewind to execute, usually displaying an advert. This list of targeted applications is initialized by the server upon the first execution of Ewind, and is updated daily. The list is stored in {data\_dir\_of\_the\_app}/shared\_prefs/a5ca9525-c9ff-4a1d-bb42-87fed1ea0117.xml.

As far as we have seen, the targeted application list contains mainly browsers and financially-related applications. We also noted that the C2 doesn't appear (at least for now) to send commands to Ewind upon browser execution, but only when financial applications are reported.

### String obfuscation

Ewind obfuscates some of its strings using a simple XOR with the filename of its shared preferences -- "a5ca9525-c9ff-4a1d-bb42-87fed1ea0117". After de-obfuscation we get the following json split into an array of strings:  
\["internal: close","internal: too many redirects","click: ","send: ","http", "Referer","javascript:","internal: timeout","null","internal: timeoutconnect", "receive.sms","web.click.end","sms.filter","js.data","phone","text","phoneExp", "textExp","loadProgress","errorUrl","errorDescription","id","timeout","data","filters" ,"\[%d\].","invalid, null or empty","invalid regular expression","invalid, null", "test","enable","already enabled","already disabled","end","\[%d\]", "actions","urlExp","js","start","turnOffWifi","userAgent"\]

|---------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 6 7 | \["internal: close","internal: too many redirects","click: ","send: ","http", "Referer","javascript:","internal: timeout","null","internal: timeoutconnect", "receive.sms","web.click.end","sms.filter","js.data","phone","text","phoneExp", "textExp","loadProgress","errorUrl","errorDescription","id","timeout","data","filters" ,"\[%d\].","invalid, null or empty","invalid regular expression","invalid, null", "test","enable","already enabled","already disabled","end","\[%d\]", "actions","urlExp","js","start","turnOffWifi","userAgent"\] |

### Commands

The list of commands in Ewind includes both functions we saw in action, and other abilities that we did not observe used:

* showFullscreen -- display advertisement
* showDialog -- display a dialog that upon clicking will opens an advertisement
* showNotification -- display a notification in the notification bar
* createShortcut -- download an APK and create a shortcut to it
* openUrl -- open an URL using webview
* changeTimerInterval -- change interval between keep-alive pings
* sleep -- sleep for a supplied period of time
* getInstalledApps -- retrieve a list of installed applications
* changeMonitoringApps -- define the list of targeted applications
* wifiToMobile -- enable/disable connectivity, although seems to do nothing
* openUrlInBackground -- open a URL in the background
* webClick -- execute supplied javascript in a webview for a specific web page
* receiveSms -- enable/disable incoming SMS monitoring
* smsFilters -- define phone number and SMS text filters to trigger upload to C2
* adminActivate -- display activity to activate device admin
* adminDeactivate -- deactivate device admin

### Other samples

Further investigation identified over a thousand other samples of Ewind, also communicating with the same C2 mobincome\[.\]org, but using a different identifying APK service name string "com.maxapp". Other samples using "com.maxapp" but not communicating with the C2 appear to be by the same actor, but different families.

### Infrastructure and Attribution

We initially did not assume any link existed between the Trojan author, and the Android application sites that the Trojanized applications were hosted on. Bad actors often upload Trojanized applications to websites that simply enable the sharing of "cracked" apps, but in this case there appears to be a stronger connection.

Our analyzed sample was downloaded from 88.99.112\[.\]169. The sample communicates with the C2 server mobincome\[.\]org. We noticed that the C2 is on 88.99.71\[.\]89 -- the same /16 netblock as the sample was downloaded from. A /16 network is relatively large, so this link is relatively weak -- however it did get our attention.

We then noted that the WHOIS record for mobincome\[.\]org is currently anonymized, but historically, with apparently-consistent ownership, was registered to a "Maksim Mikhailovskii" of Volgograd. We note the actor uses the name "Max" in some APK service names.

Mobincome\[.\]org has a resource link (img src) to the domain apkis\[.\]net. Apkis\[.\]net is also registered to "Maksim Mikhailovskii". Apkis\[.\]net is hosted on 88.99.112\[.\]168 -- not only the same /16 netblock, but immediately adjacent to the IP address the sample was downloaded from. We additionally find Ewind samples downloaded from 88.99.112\[.\]168 . This demonstrates a much stronger link between the C2 mobincome\[.\]org, and the download I.P. 88.99.112\[.\]169, and a possible actor behind the activity.

88\.99.112\[.\]169 hosts only a handful of domains, all Android application stores:

mob-corp\[.\]com  
appdecor\[.\]org  
playlook\[.\]ru  
android-corp\[.\]ru  
androiddecor\[.\]ru

These all have anonymized WHOIS records, but based upon the above connections and further infrastructure analysis (Figure 8), we determine that the actor behind the trojanized applications is hosting these at application stores under his own control. Another app store "apptoup\[.\]com", on the same /16 at 88.99.99\[.\]25, while recently changed to an anonymized WHOIS, until then also displayed a "Maksim Mikhailovskii" registration.

[![ewind\_9](https://unit42.paloaltonetworks.com/wp-content/uploads/2017/04/ewind_9.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2017/04/ewind_9.png)

*Figure 8- Infrastructure Analysis*

Figure 8 highlights the connects between the download domain and C2, and the registrant "Maksim", along with infrastructure connections to other Android app store domains.

The predominant C2 used by the actor is, by far, mobincome\[.\]org, although we do also observe a handful of samples connecting to androwr\[.\]ru (88.99.99\[.\]25, same IP as apptoup\[.\]com, above) as C2. Searching in [AutoFocus](https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/autofocus), we find thousands of other Adware and/or Trojan Android samples connecting to these domains.

We link tens of thousands of non-Ewind samples dating back several years to this actor based upon the infrastructure, APK signing key hashes, and/or use of the unique APK service name strings (in addition, "com.max.mobcoin"). These all appear to, in some fashion or another, monetize Android apps though advertising.

The WHOIS email address links to several other domains, with contextual names:

Appwarm\[.\]com  
mobcoin\[.\]org  
android-corp\[.\]su  
z-android\[.\]com  
apkis\[.\]net

Investigation of the IP addresses used by domains linked to this actor turns up a list of further domains sharing the same infrastructure, again also seemingly contextually linked too:

appdisk\[.\]ru  
vipsmart\[.\]org  
vipandroid\[.\]ru  
vipandroid\[.\]org  
1lom\[.\]com  
mobcompany\[.\]com  
greenrobot-apps\[.\]net  
9apps.ru\[.\]com  
ontabs\[.\]com  
ontabfile\[.\]com  
andromobi\[.\]ru  
bammob\[.\]com  
apkforward\[.\]ru  
mobrudiment\[.\]ru  
mob0esd\[.\]ru  
mob1leprof\[.\]ru  
mob4ad\[.\]ru  
mob2ads\[.\]ru  
mob1lihelp\[.\]ru  
mob1help\[.\]ru

The sharing of these IP addresses seems to be limited in each case to a small number of contextually-named domains, suggesting that we're looking at "dedi" dedicated hosting rather than shared, and a single owner for all of the domains on those IP addresses.

### Summary

Ewind is more than simply Adware. Ewind is, at very least, an actual Trojan -- subverting genuine Android apps. The functionality to forward SMS messages to a C2 hints at possible intentions beyond just delivering adware. Of real concern is that although we've only observed these Trojans being used to deliver advertising to victims, as our analysis shows, with device-admin access and the functionality to download and execute any file on the device, the actor behind this activity can easily take full control of the victim device.

While identifying a Malware author as Russian is not at all surprising, usually Russian actors avoid targeting Russian subjects. Deliberate targeting of Russians, in this case -- by an apparently Russian actor -- is therefore somewhat unusual.

We have here an actor not only developing malware for monetization, but responsible for a network of Android App Store infrastructure which has over the years been used to serve tens of thousands of Android downloads in support of his advertising-supported monetization schemes.

Palo Alto Networks customers are protected from the Ewind Trojan:

* WildFire properly classifies Ewind samples as malicious.
* C2 servers associated with this activity are blocked through Threat Prevention DNS signatures.
* Download sites associated with this actor are categorized as Malware.
* AutoFocus customers can monitor this activity using the "[Ewind](https://autofocus.paloaltonetworks.com/#/tag/Unit42.ewind)" tag.

### Indicators of Compromise

Ewind C2 Domains:

mobincome\[.\]org  
androwr\[.\]ru

Unique string (APK Defined service):

b93478b8cdba429894e2a63b70766f91

We cannot categorically state that all Android apps downloaded from the mentioned app store domains are Ewind, or even necessarily malicious. However, given the connection to this actor and his known activity, it may be appropriate to consider these low-reputation.

[![ignite17-social-cover-img-facebook-820x340](https://unit42.paloaltonetworks.com/wp-content/uploads/2017/03/ignite17-social-cover-img-facebook-820x340.png)](https://go.paloaltonetworks.com/ignite2017)

**Ignite '17 Security Conference: Vancouver, BC June 12--15, 2017**

Ignite '17 Security Conference is a live, four-day conference designed for today's security professionals. Hear from innovators and experts, gain real-world skills through hands-on sessions and interactive workshops, and find out how breach prevention is changing the security industry. Visit the [Ignite website](https://www.paloaltonetworksignite.com) for more information on tracks, workshops and marquee sessions.
Back to top

### Tags

* [Adware](https://unit42.paloaltonetworks.com/tag/adware/ "Adware")
* [Android](https://unit42.paloaltonetworks.com/tag/android/ "Android")
* [Ewind](https://unit42.paloaltonetworks.com/tag/ewind/ "Ewind")
* [Russia](https://unit42.paloaltonetworks.com/tag/russia/ "Russia")  
  [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: The Blockbuster Sequel](https://unit42.paloaltonetworks.com/unit42-the-blockbuster-sequel/ "The Blockbuster Sequel")

### Related Articles

* [Tracking TamperedChef Clusters via Certificate and Code Reuse](https://unit42.paloaltonetworks.com/tracking-tampered-chef-clusters/ "article - table of contents")
* [Understanding the Russian Cyberthreat to the 2026 Winter Olympics](https://unit42.paloaltonetworks.com/russian-cyberthreat-2026-winter-olympics/ "article - table of contents")
* [LANDFALL: New Commercial-Grade Android Spyware in Exploit Chain Targeting Samsung Devices](https://unit42.paloaltonetworks.com/landfall-is-new-commercial-grade-android-spyware/ "article - table of contents")

## Related Malware Resources

![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg)  
[![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/)

* [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel")

* [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2")

* [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure")  
  ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/)

* [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI")

* [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT")

* [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America")  
  ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/)

* [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa")

* [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID")

* [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams")  
  ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/)

* [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor")

* [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin")

* [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution")  
  ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/)

* [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication")

* [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft")

* [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels")  
  ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/)

* [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK")

* [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum")

* [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet")  
  ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/)

* [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum")

* [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain")

* [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications")  
  ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/)

* [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain")

* [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop")

* [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm")  
  ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/)

* [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API")

* [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway")

* [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources")  
  ![Pictorial representation of malware bypassing DNS and communicating directly to IP addresses. Futuristic digital cityscape with glowing blue and orange geometric structures, resembling skyscrapers.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_DNS_Overview_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 4, 2026 [#### Almost Half of Malware Samples Communicate Direct to IP](https://unit42.paloaltonetworks.com/malware-bypass-dns-direct-to-ip/)

* [Command and Control](https://unit42.paloaltonetworks.com/tag/command-and-control/ "Command and Control")

* [D2IP](https://unit42.paloaltonetworks.com/tag/d2ip/ "D2IP")

* [Exfiltration](https://unit42.paloaltonetworks.com/tag/exfiltration/ "exfiltration")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/malware-bypass-dns-direct-to-ip/ "Almost Half of Malware Samples Communicate Direct to IP")

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)  
  ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]()  
  ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png)  
  ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42

## Peace of mind comes from staying ahead of threats. Subscribe today.

Your Email

Subscribe for email updates to all Unit 42 threat research.  
By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement")

This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.

Invalid captcha!
Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg)  
{#footer} Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security)

* [Secure AI by Design](https://www.paloaltonetworks.com/ai-security)

* [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase)

* [Prisma SASE](https://www.paloaltonetworks.com/sase)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam)

* [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira)

* [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management)

* [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management)

* [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager)

* [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance)

* [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management)

* [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic)

* [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management)

* [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance)

* [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery)

* [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42)

* [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess)

* [Incident Response](https://www.paloaltonetworks.com/unit42/respond)

* [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform)

* [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners)  
  Company

* [About Us](https://www.paloaltonetworks.com/about-us)

* [Careers](https://jobs.paloaltonetworks.com/en/)

* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales)

* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility)

* [Customers](https://www.paloaltonetworks.com/customers)

* [Investor Relations](https://investors.paloaltonetworks.com/)

* [Location](https://www.paloaltonetworks.com/about-us/locations)

* [Newsroom](https://www.paloaltonetworks.com/company/newsroom)  
  Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/)

* [Communities](https://www.paloaltonetworks.com/communities)

* [Content Library](https://www.paloaltonetworks.com/resources)

* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia)

* [Event Center](https://events.paloaltonetworks.com/)

* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)

* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z)

* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications)

* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure)

* [Sitemap](https://www.paloaltonetworks.com/sitemap)

* [Tech Docs](https://docs.paloaltonetworks.com/)

* [Unit 42](https://unit42.paloaltonetworks.com/)

* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)

* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy)

* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center)

* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use)

* [Documents](https://www.paloaltonetworks.com/legal)

Copyright © 2026 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* EN  
  Select your language  
  ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg)

### Default Heading

Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg)  
Seekbar

![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg)  
![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg)  
Volume
![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)