[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/unit42-how-to-track-actors-behind-keyloggers-using-embedded-credentials/) * [Japanese](https://unit42.paloaltonetworks.com/ja/unit42-how-to-track-actors-behind-keyloggers-using-embedded-credentials/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # How to Track Actors Behind Keyloggers Using Embedded Credentials ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 8 min read * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Jeff White](https://unit42.paloaltonetworks.com/author/jeff-white/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:July 12, 2016 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [FTP](https://unit42.paloaltonetworks.com/tag/ftp/) * [HawkEye](https://unit42.paloaltonetworks.com/tag/hawkeye/) * [HTTP](https://unit42.paloaltonetworks.com/tag/http/) * [ISpy](https://unit42.paloaltonetworks.com/tag/ispy/) * [KeyBase](https://unit42.paloaltonetworks.com/tag/keybase/) * [Keylogger](https://unit42.paloaltonetworks.com/tag/keylogger/) * [PredatorPain](https://unit42.paloaltonetworks.com/tag/predatorpain/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/unit42-how-to-track-actors-behind-keyloggers-using-embedded-credentials/?pdf=download&lg=en&_wpnonce=64814e76fb "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/unit42-how-to-track-actors-behind-keyloggers-using-embedded-credentials/?pdf=print&lg=en&_wpnonce=64814e76fb "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=How%20to%20Track%20Actors%20Behind%20Keyloggers%20Using%20Embedded%20Credentials&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-how-to-track-actors-behind-keyloggers-using-embedded-credentials%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-how-to-track-actors-behind-keyloggers-using-embedded-credentials%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-how-to-track-actors-behind-keyloggers-using-embedded-credentials%2F&title=How%20to%20Track%20Actors%20Behind%20Keyloggers%20Using%20Embedded%20Credentials "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-how-to-track-actors-behind-keyloggers-using-embedded-credentials%2F&text=How%20to%20Track%20Actors%20Behind%20Keyloggers%20Using%20Embedded%20Credentials "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-how-to-track-actors-behind-keyloggers-using-embedded-credentials%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=How%20to%20Track%20Actors%20Behind%20Keyloggers%20Using%20Embedded%20Credentials%20https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-how-to-track-actors-behind-keyloggers-using-embedded-credentials%2F "Share in Mastodon") ### Mo' key loggers, mo' problems This past year Unit 42 has seen a resurgence of keylogger activity and it seems like every week a new research blog comes out talking about one of four popular families: [KeyBase](https://blog.paloaltonetworks.com/2015/06/keybase-keylogger-malware-family-exposed/), [iSpy](https://www.proofpoint.com/tw/threat-insight/post/two-threats-for-price-of-one-credential-phishing-leads-to-ispy-keylogger), [HawkEye](https://www.isightpartners.com/2015/06/hawkeye-keylogger-campaigns-affect-multiple-industries/), or [PredatorPain](https://blog.paloaltonetworks.com/2015/10/surveillance-malware-trends-tracking-predator-pain-and-hawkeye/). These blogs usually delve into the technical workings of the threats, discuss their relationship to each other, and explain how they evolved from one another through new ownership or branding of the tools. The intent of this blog is not to rehash what has already been discussed, but instead to shift the focus to the actors behind these keylogger threats and show a practical technique for identification. To be of any value, keyloggers must transmit data back to the attacker. There are three well-established methods for doing this: HTTP, SMTP, and FTP. HTTP transmission usually involves a simple POST request with a body containing the stolen data; however, for SMTP and FTP, more often than not these protocols require authentication to log into a service before transferring the data from the compromised system. This presents a valuable data point, because all of the big four keylogger families embed their credentials inside of their binaries. This further provides an analyst with a remote server address, username, and password for each sample analyzed. Couple this with the increase of keyloggers [found in the wild](https://blog.paloaltonetworks.com/2016/02/keybase-threat-grows-despite-public-takedown-a-picture-is-worth-a-thousand-words/) and we find ourselves with a very large data set that can be used for correlation. By using Palo Alto Networks AutoFocus, I was able to quickly identify 500 recent samples of HawkEye and iSpy, which exhibited either FTP or SMTP activity during dynamic analysis. After downloading the samples and their respective network activity, I parsed out all successful FTP and SMTP activity to build a data set for Maltego. We'll use these embedded credentials to try to uncover patterns and find actor-identifiable data through our research. Before getting into the correlation, some general statistics on the data: * 207 FTP connections were caught with active credentials, e.g., the malware successfully logged into the FTP server to upload data from our virtual test machines * 53 SMTP connections were made with active credentials * 37 unique drop destinations were identified for stolen data * 96 unique accounts used to log into these drop sites After collecting all of the data from PCAPs and loading it into Maltego, we can visually see multiple organic clusters standout along the top, which will be the topic for discussion. [![Keylogger 1](http://blog.paloaltonetworks.com/wp-content/uploads/2016/07/Keylogger-1-500x259.png)](https://blog.paloaltonetworks.com/2016/07/unit42-how-to-track-actors-behind-keyloggers-using-embedded-credentials/keylogger-1/) *Figure 1. Key logger clusters* [](https://blog.paloaltonetworks.com/2016/07/unit42-how-to-track-actors-behind-keyloggers-using-embedded-credentials/untitled-22/) ### Actor 01 ("Kramer") Starting from right to left, the first cluster shows a heavy concentration of samples communicating with IP address, **108.179.196\[.\]24** . This FTP drop site was the most utilized across our sample set, with 71 unique samples and 18 unique FTP accounts being used to drop data. [![Keylogger 2](http://blog.paloaltonetworks.com/wp-content/uploads/2016/07/Keylogger-2-500x290.png)](https://blog.paloaltonetworks.com/2016/07/unit42-how-to-track-actors-behind-keyloggers-using-embedded-credentials/keylogger-2/) *Figure 2. The "Kramer" cluster* Looking a little closer, there is a smaller cluster of accounts on the left of the graph that warrants further investigation. [![Keylogger 3](http://blog.paloaltonetworks.com/wp-content/uploads/2016/07/Keylogger-3.png)](https://blog.paloaltonetworks.com/2016/07/unit42-how-to-track-actors-behind-keyloggers-using-embedded-credentials/keylogger-3/) *Figure 3. Unique password reuse in the "Kramer" cluster* While all the stolen data being dropped on one FTP server is a solid relational indicator, what's even stronger is that 14 usernames all used the same password, "**joinkrama2**". When you look at the actual accounts as well, we see usernames are formatted like e-mail addresses and some of the local parts of the address get shared across domains. The below list highlights some of these shared local parts across domains in the username. The domains themselves have been truncated. * chekube@her * chima@min * **daniel@her** * **daniel@oma** * dubem@sam * golden@sam * okumen@oma * **oni@pea** * **oni@sas** * udobata@sam * victor@sam * **wizzy@pea** * **wizzy@sas** This correlation provides strong evidence that the actor behind these accounts is the same. We're also able to pivot from the unique password to another account hanging off the bottom in the first image, which shares a local name with the above local, "**dubem** ". The sample in question is also seen dumping key logged data to a separate server at **68.171.217\[.\]250** . Finally, one of the "**oni** " accounts from the above list was also seen using the password "**pereyikelamo2** ", which was tied to one other account using the same domain, "**atus@sas**". By following these links we can slowly begin mapping out part of the infrastructure utilized by this actor and collect multiple indicators to identify them. Top Indicators for Actor 01 "Kramer": * **108.179.196\[.\]24** * **68.171.217\[.\]250** * **Chimaeze12** * **LAURINA12** * **chimaeze12** * **joinkrama2** * **pereyikelamo2** * **pokerdick123** * **dubem** * **oni** * **wizzy** * **atus** * **uzochi** ### Actor 02 ("OpSec") The next cluster we'll take a look at also uses one server and, similar to the previous actor, the usernames take the format of e-mail addresses. [![Keylogger 4](http://blog.paloaltonetworks.com/wp-content/uploads/2016/07/Keylogger-4.png)](https://blog.paloaltonetworks.com/2016/07/unit42-how-to-track-actors-behind-keyloggers-using-embedded-credentials/keylogger-4/) *Figure 4. The "Opsec" cluster* Only one domain is used, **nayyabgroup\[.\]com** and, as the image above illustrates, each account uses a unique password. For this particular actor, the complexity of their FTP passwords was a good linking indicator, as it deviates from what is seen throughout most of the embedded credentials captured during this analysis. * **P!{Xwn{eEV$T** * **?G34p}b);w** * **k\*wsOH\*P\]!up** * **C7,5#dg4X1b?** * **QsvGK8H9XGJ8** * **0gZ3I%dmpXi5** The passwords appear to be auto-generated by a tool and might successfully protect against brute force attempts or unauthorized access. While the actor's password policy appears strong, he or she seems to be disregarding the fact that credentials are embedded in malware that employs plaintext transport mechanisms. A final indicator to attribute to this actor is the usage of the local name "**sirvor** " followed by three numbers, for example "**sirvor123**" -- there are four different variants of this across the 11 samples using the FTP server. Top Indicators for Actor 02 "Opsec": * **243.113\[.\]211** * **sirvor** * **nayyabgroup\[.\]com** * **P!{Xwn{eEV$T** * **?G34p}b);w** * **k\*wsOH\*P\]!up** * **C7,5#dg4X1b?** * **QsvGK8H9XGJ8** * **0gZ3I%dmpXi5** ### Actor 03 ("LogAllTheThings") For the third cluster, we again have one FTP server being used by the actor to drop their data. However, one unique attribute about this cluster is that the actor is using three different key loggers across 46 samples to dump data here -- HawkEye, iSpy (coupled with Galaxy Botkiller), and PredatorPain. [![Keylogger 5](http://blog.paloaltonetworks.com/wp-content/uploads/2016/07/Keylogger-5.png)](https://blog.paloaltonetworks.com/2016/07/unit42-how-to-track-actors-behind-keyloggers-using-embedded-credentials/keylogger-5/) *Figure 5. The "LogAllTheThings" cluster* This use of multiple different key loggers could be determined by looking at the file names being stored on the FTP server. [![Keylogger\_hawkeye\_ftp](http://blog.paloaltonetworks.com/wp-content/uploads/2016/07/Keylogger_hawkeye_ftp-500x68.png)](https://blog.paloaltonetworks.com/2016/07/unit42-how-to-track-actors-behind-keyloggers-using-embedded-credentials/keylogger_hawkeye_ftp/) (HawkEye log -- 23.229.206\[.\]201) [![Keylogger\_ispy\_ftp](http://blog.paloaltonetworks.com/wp-content/uploads/2016/07/Keylogger_ispy_ftp-500x84.png)](https://blog.paloaltonetworks.com/2016/07/unit42-how-to-track-actors-behind-keyloggers-using-embedded-credentials/keylogger_ispy_ftp/) (iSpy log -- 23.229.206\[.\]201) [![Keylogger\_predator\_ftp](http://blog.paloaltonetworks.com/wp-content/uploads/2016/07/Keylogger_predator_ftp-500x86.png)](https://blog.paloaltonetworks.com/2016/07/unit42-how-to-track-actors-behind-keyloggers-using-embedded-credentials/keylogger_predator_ftp/) (PredatorPain log -- 23.229.206\[.\]201) Each of the families has its own unique capabilities and, more importantly, different ways of morphing itself to avoid detection. It's not surprising to see the usage of more than one type of keylogger by an actor, as actors constantly need to update and change tools to stay ahead of defenders. At the top right of this cluster you'll notice eight different accounts all share a common password, "**pentium12345**". [![Keylogger 6](http://blog.paloaltonetworks.com/wp-content/uploads/2016/07/Keylogger-6.png)](https://blog.paloaltonetworks.com/2016/07/unit42-how-to-track-actors-behind-keyloggers-using-embedded-credentials/keylogger-6/) *Figure 6. Password reuse by multiple accounts* While there were very few unique passwords, all of the credentials identified for this actor used a numeric suffix of either "**12345** ", "**1234** ", "**123** ", or "**@@123123** ". Similarly, the usernames were again formatted as e-mail addresses and the domain portions were all listed as **"@bigcountrywater\[.\]com** ", with seven of the 13 total accounts using "**office**" somewhere in the local portion. Tying these all together provides a strong indicator to identify this actor. Top Indicators Actor 03 "LogAllTheThings": * **229.206\[.\]201** * **pentium12345** * **bigcountrywater\[.\]com** * **@@123123** ### Actor 04 ("MailMan") Our last cluster in the top left was purely SMTP traffic to the e-mail server at "**web.arch\[.\]ai**", used for transferring HawkEye logged data. [![Keylogger 7](http://blog.paloaltonetworks.com/wp-content/uploads/2016/07/Keylogger-7-500x364.png)](https://blog.paloaltonetworks.com/2016/07/unit42-how-to-track-actors-behind-keyloggers-using-embedded-credentials/keylogger-7/) *Figure 7. The "MailMan" cluster* As evidenced by the image above, almost every account had a unique username and password. Across the majority of the accounts identified, the passwords were structured to take part of the username (e-mail format) and suffix it with five numbers, usually "**12345** " or "**54321** ". For example, if the username was "**username@email.com** ", the password might be "**user54321**", which provided a consistent indicator across the 45 samples identified. In addition, out of the 20 unique accounts identified sending data to this e-mail server, only two domains in the username field were seen during this analysis, "**shamaraholdinq\[.\]com** " and "**pmtlogisticsinc.co\[.\]uk**". A quick WHOIS search for these domains shows the same registrant, based out of Nigeria, with a number of other domains registered that can be used for further pivoting and analysis. [![Keylogger 8](http://blog.paloaltonetworks.com/wp-content/uploads/2016/07/Keylogger-8-500x211.png)](https://blog.paloaltonetworks.com/2016/07/unit42-how-to-track-actors-behind-keyloggers-using-embedded-credentials/keylogger-8/) *Figure 8. The man behind the mail* Looking at the domains, you can guess the type of phishing activities being carried out by this actor. [![Keylogger 9](http://blog.paloaltonetworks.com/wp-content/uploads/2016/07/Keylogger-9-500x293.png)](https://blog.paloaltonetworks.com/2016/07/unit42-how-to-track-actors-behind-keyloggers-using-embedded-credentials/keylogger-9/) *Figure 9. Masquerading as US Government sites* Top Indicators Actor 04 "MailMan": * **web.arch\[.\]ai** * **shamaraholdinq\[.\]com** * **pmtlogisticsinc.co\[.\]uk** * **Nelson12345** * **abacom12345** * **abuchi12345** * **abuchi54321** * **alfred54321** * **bethel54321** * **bro54321** * **compu54321** * **ebuka12345** * **humble12345** * **immortal12345** * **kaycelaz5** * **kelechi12345** * **kunde54321** * **miraclebaby16** * **obi12345** * **opera54321** * **philip54321** * **shoki54321** * **spencer098765** * **sular54321** * **sular@54321** ### Conclusion In the grand scheme of keylogger activity, this was a small sample set. Despite this, it was enough to highlight that using embedded credentials at scale could be leveraged to gain insight into actor behavior and infrastructure. It's a practical technique and quickly identified at least four different actors actively utilizing keyloggers to steal data from compromised systems. It should be obvious, but it's worth stating: keyloggers aren't going anywhere and without a doubt they will only continue to evolve like every other type of malware. As this happens and we're left trying to protect our organizations, sometimes we can get lost in the analysis of minute details between various malware families, so it helps to change perspective now and again and take more of a macro look at the landscape in front of you. There is always a human element to these threats and, as evidenced throughout this blog and countless others, the people behind these threats can fall prey to the same issues that organizations do -- poor operational security. Palo Alto Networks customers are protected by these various threats through WildFire AV signatures. AutoFocus customers can further research these threats through the below tags. [AutoFocus Tag - iSpy Software](https://autofocus.paloaltonetworks.com/#/tag/Commodity.ISpySoftware)[AutoFocus Tag - PredatorPain/HawkEye](https://autofocus.paloaltonetworks.com/#/tag/Commodity.PredatorPain) [AutoFocus Tag - KeyBase](https://autofocus.paloaltonetworks.com/#/tag/Commodity.KeyBase) Below are additional indicators from the discussed sample set, including the ones shown above, that were observed by the malware. Please note that individually, these indicators may not be enough to determine whether something is good or bad, but the combination of multiple indicators can lead to actionable intelligence. Account names will not be included in an effort to prevent any potential abuse from the credential pairs. IP/Domains: * 107\.180.44\[.\]128 * 107\.180.57\[.\]26 * 108\.179.196\[.\]24 * 109\.234.36\[.\]216 * 134\.255.221\[.\]14 * 136\.243.113\[.\]211 * 142\.54.182\[.\]66 * 144\.76.222\[.\]41 * 176\.9.193\[.\]213 * 185\.26.122\[.\]38 * 185\.28.20\[.\]80 * 188\.40.207\[.\]191 * 192\.138.189\[.\]30 * 192\.185.143\[.\]215 * 198\.58.93\[.\]56 * 204\.236.238\[.\]164 * 208\.86.156\[.\]40 * 217\.149.52\[.\]111 * 23\.229.206\[.\]201 * 31\.170.165\[.\]170 * 31\.177.95\[.\]21 * 5\.153.10\[.\]228 * 50\.87.151\[.\]103 * 54\.228.213\[.\]93 * 64\.20.39\[.\]210 * 66\.7.201\[.\]36 * 68\.171.217\[.\]250 * 69\.27.174\[.\]4 * 69\.30.206\[.\]114 * 75\.101.155\[.\]12 * 81\.95.158\[.\]149 * 93\.189.45\[.\]35 * dallas125.mysitehosted\[.\]com * md-in-15.webhostbox\[.\]net * s2.dedicatedpanel\[.\]net * web.arch\[.\]ai * shamaraholdinq\[.\]com * pmtlogisticsinc.co\[.\]uk * adaata\[.\]com * affilor\[.\]org * al-nebaa\[.\]net * alexendriaairlines\[.\]com * american-petroleum\[.\]us * americanmilitary\[.\]co * armydepartment\[.\]us * armydept\[.\]us * atozcourierservices\[.\]com * aviatoncapital\[.\]com * ciafleasinq\[.\]com * conoilng\[.\]com * defencecourierservice\[.\]com * defensecourierdelivery\[.\]org * defensecourierservice\[.\]com * duluxsecuritiesinc\[.\]com * edfenergy\[.\]us * fasttrackexpressdelivery\[.\]us * fbideptinvestigate\[.\]us * fcmbservices\[.\]com * felixairvvays\[.\]com * fifaregionalprojects\[.\]org * firstrepublicbkc\[.\]org * g-t-b-online\[.\]com * gaffrey-kroese\[.\]com * gcb-gh\[.\]com * gcb-gh\[.\]net * gcb-ghana\[.\]com * gcb-info\[.\]com * gh-consultant\[.\]com * ghobashco\[.\]com * horizons-us\[.\]com * hsbc-onlineservices\[.\]com * information-ny\[.\]com * investigateinterpol\[.\]net * librarytech\[.\]net * maincentralbnk\[.\]com * memconpjo\[.\]com * nawesservices\[.\]com * nicemachs\[.\]com * nigeria-custom\[.\]com * otizjo\[.\]com * pacificliife\[.\]com * pannoceanic\[.\]com * petronas-malaysia\[.\]com * qirnemhemrinco\[.\]com * qtps-inc\[.\]com * satanderonlineservices\[.\]com * sonozcape\[.\]net * standardbnkforex-za\[.\]com * techenica\[.\]com * tsa-bwi\[.\]com * ubacare\[.\]com * unfraudunit\[.\]com * unpf\[.\]us * usamilitarydept\[.\]us * usaphysicist\[.\]us * ushomeland-security\[.\]us * zs-dds\[.\]com Passwords: * 0Withgod1 * 0gZ3I%dmpXi5 * 238Wmi9cnJ * 4Z\*~uigF{mKD * 92z7nyy6CU * A.?G34p}b);w * ADmin7455\& * ATIba2001! * C7,5#dg4X1b? * Chimaeze12 * Confirmed1 * F:SBrjW1 * General123# * H;cLNBkHKO\&g * Kunde54321 * LAURINA12 * Nelson12345 * P!{Xwn{eEV$T * Pwd123456@@123 * QsvGK8H9XGJ8 * Team2318@ * Unbekannt88\_$(98) * Waly1981 * ZzZ\_#C0FA)^# * ^al3M@1cr.eW * a4def60f * abacom12345 * abuchi12345 * abuchi54321 * accounts1961 * alfred54321 * bathram0123 * bethel54321 * bro54321 * chibueze54321 * chimaeze12 * codin1234 * compu54321 * dogood11 * duracellgrief * ebuka12345 * humble12345 * immortal12345 * joinkrama2 * js123! * k\*wsOH\*P\]!up * kaluojuotta1234 * kaycelaz5 * kelechi12345 * kunde54321 * loco1234 * miraclebaby16 * nathaniel * nathaniel45 * nde10wp10 * nineslips09 * obi12345 * odichigo54321 * opera54321 * owerrisouth * pentium12345 * pereyikelamo2 * philip54321 * pokerdick123 * pwd12345 * shoki54321 * spencer098765 * sular54321 * sular@54321 * team2318 * victory45 * wp@@123123 * xpen2000 Back to top ### Tags * [FTP](https://unit42.paloaltonetworks.com/tag/ftp/ "FTP") * [HawkEye](https://unit42.paloaltonetworks.com/tag/hawkeye/ "HawkEye") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") * [ISpy](https://unit42.paloaltonetworks.com/tag/ispy/ "iSpy") * [KeyBase](https://unit42.paloaltonetworks.com/tag/keybase/ "KeyBase") * [Keylogger](https://unit42.paloaltonetworks.com/tag/keylogger/ "Keylogger") * [PredatorPain](https://unit42.paloaltonetworks.com/tag/predatorpain/ "PredatorPain") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Investigating the LuminosityLink Remote Access Trojan Configuration](https://unit42.paloaltonetworks.com/unit42-investigating-the-luminositylink-remote-access-trojan-configuration/ "Investigating the LuminosityLink Remote Access Trojan Configuration") ### Related Articles * [Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "article - table of contents") * [Gremlin Stealer: New Stealer on Sale in Underground Forum](https://unit42.paloaltonetworks.com/new-malware-gremlin-stealer-for-sale-on-telegram/ "article - table of contents") * [Recent Jailbreaks Demonstrate Emerging Threat to DeepSeek](https://unit42.paloaltonetworks.com/jailbreaking-deepseek-three-techniques/ "article - table of contents") ## Related Malware Resources ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/) * [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API") * [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway") * [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond) * [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform) * [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)