[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/) * [Japanese](https://unit42.paloaltonetworks.com/ja/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # New Techniques to Uncover and Attribute Cobalt Gang Commodity Builders and Infrastructure Revealed ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 11 min read Related Products [![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Unit 42](https://unit42.paloaltonetworks.com/author/unit42/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:October 25, 2018 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/) * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Cobalt Gang](https://unit42.paloaltonetworks.com/tag/cobalt-gang/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/?pdf=download&lg=en&_wpnonce=edee969a51 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/?pdf=print&lg=en&_wpnonce=edee969a51 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=New%20Techniques%20to%20Uncover%20and%20Attribute%20Cobalt%20Gang%20Commodity%20Builders%20and%20Infrastructure%20Revealed&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed%2F&title=New%20Techniques%20to%20Uncover%20and%20Attribute%20Cobalt%20Gang%20Commodity%20Builders%20and%20Infrastructure%20Revealed "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed%2F&text=New%20Techniques%20to%20Uncover%20and%20Attribute%20Cobalt%20Gang%20Commodity%20Builders%20and%20Infrastructure%20Revealed "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=New%20Techniques%20to%20Uncover%20and%20Attribute%20Cobalt%20Gang%20Commodity%20Builders%20and%20Infrastructure%20Revealed%20https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed%2F "Share in Mastodon") Nowadays, it's very easy for an advanced attacker to use commodity tools and malware along with very simple initial delivery methods to keep a low profile and stay away from possible attribution. One of the most common approaches is the use of spear phishing emails employing social engineering or commonly used exploits (such as [CVE-2017-0199](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0199) or the [ThreadKit builder](https://www.proofpoint.com/us/threat-insight/post/unraveling-ThreadKit-new-document-exploit-builder-distribute-The-Trick-Formbook-Loki-Bot-malware)) to trick the employees of organizations of interest. Once the initial infection has occurred is when the attacker becomes more sophisticated, deploying advanced custom pieces of malware, more advanced tools, and/or using living-off-the land tools (such as the use of PowerShell, or tools like [CMSTP](https://attack.mitre.org/wiki/Technique/T1191) or [Regsvr32](https://attack.mitre.org/wiki/Technique/T1117)). This approach makes it more difficult for threat hunters and defenders to find those needles in the haystack necessary to identify a campaign and its objectives. However even if an attacker uses commodity builders and tools, there is always a chance to find specific signals or characteristics that help to identify and track an actor's infrastructure. One of the groups well known for following these TTPs is the Cobalt Gang, which is still active even after the [arrest](https://www.europol.europa.eu/newsroom/news/mastermind-behind-eur-1-billion-cyber-bank-robbery-arrested-in-spain) of their alleged leader in Spain this year. During October 2018, Unit 42 has been investigating ongoing Cobalt Gang campaigns, as well as leveraging the latest information publicly reported in research reports, such as the ones described by [Talos](https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html) or [Morphisec](https://blog.morphisec.com/cobalt-gang-2.0), to help discover and tie new infrastructure to this attack group. As a result, we have been able to identify both the use of a common macro builder as well as specific document metadata which have allowed us to track and cluster new activity and infrastructure associated with the Cobalt Gang. A Recent Effective Example of Delivery One of the latest examples related to the campaign under analysis was used in attacks just a few days ago. It shows the simplicity of the attack delivery employed by this group. The attack reinforces the fact that email is still one of the primary attack vectors we continuously observe. This attack begins by targeting employees at several banking entities across the globe using an email with subject "Confirmations on October 16, 2018". The sample shown in Figure 1 can already be found in popular public online malware repositories. (SHA256: 5765ecb239833e5a4b2441e3a2daf3513356d45e1d5c311baeb31f4d503703e). ![](https://blog.paloaltonetworks.com/wp-content/uploads/2018/10/Cobalt_1.png) *Figure 1. Example of Email delivery* The attachment is just a PDF document without any kind of code or exploit. Instead it seeks to use social engineering to convince the user click a link to download a malicious macro. This is a method used before by the Cobalt Gang and discussed in previous research as for example by [Talos](https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html). ![](https://blog.paloaltonetworks.com/wp-content/uploads/2018/10/Cobalt_2.png) *Figure 2. PDF sample with embedded link* The PDF is simple and embeds a link that will open a legitimate Google location, and redirect the browser to a malicious document from there: ![](https://blog.paloaltonetworks.com/wp-content/uploads/2018/10/Cobalt_3.png) *Figure 3. Malicious doc browser redirect* In order to be effective against static analysis tools, the PDF that attackers crafted the PDF to seem more authentic: it contains empty pages as well as some text pages that help in not raising red flags during analysis, shown in Figures 4 and 5. Keep in mind that PDFs with low number of pages or high entropy in the content can raise suspicious flags in static analysis. ![](https://blog.paloaltonetworks.com/wp-content/uploads/2018/10/Cobalt_4.png) *Figure 4. PDF static analysis* ![](https://blog.paloaltonetworks.com/wp-content/uploads/2018/10/Cobalt_5.png) *Figure 5. PDF text used to fill pages* By employing these two techniques the PDF avoids almost all traditional AV detection, resulting in a very effective transport of the first stage of the attack via email. If the attack progresses, the user will be taken to the download of an MS Word document containing malicious macros that has very low detection rate at the moment of this campaign delivery. From a metadata standpoint, the document does not include any specific signal or characteristic that would help us tracking documents from the same author, as shown in Figure 6. ![](https://blog.paloaltonetworks.com/wp-content/uploads/2018/10/Cobalt_6.png) *Figure 6. Doc102018.doc metadata* The downloaded malicious macro uses cmstp.exe to run a "scriptlet", a technique well known to [bypass AppLocker](https://attack.mitre.org/wiki/Technique/T1191), and continues with the next stages of the payload delivery. The objective of this research is not the payload analysis, but to focus on all possible aspects of the attack delivery for further tracking on the actors' campaign and its associated infrastructure. So, the question is now... how can this simple delivery method help identify the campaign and objectives? Macro Builder Identification The attack also achieves quite low detection results with its macro code, so one of the first focuses of the investigation is the identification of a possible underlying builder. By looking into the macro code for "Doc102018.doc", we can posit multiple theories. The macro code is over 1500 lines in length, and starts declaring a set of variables with a very specific nomenclature (in this sample, letXX(num)): ![](https://blog.paloaltonetworks.com/wp-content/uploads/2018/10/Cobalt_7.png) *Figure 7. Example of format of macro variables* Some of the variables are used in long encoding / decoding routines based on individual character assignations: ![](https://blog.paloaltonetworks.com/wp-content/uploads/2018/10/Cobalt_8.png) *Figure 8. Using specific variable format in decoding routines* Procedures and functions are also defined using the same nomenclature (in this sample, letXX()): ![](https://blog.paloaltonetworks.com/wp-content/uploads/2018/10/Cobalt_9.png) *Figure 9. Procedures and Functions in VBA code* And it makes use of the API call "CallByName" to invoke methods at runtime: ![](https://blog.paloaltonetworks.com/wp-content/uploads/2018/10/Cobalt_10.png) *Figure 10. Use of CallByName in VBA code* If we analyze some previous samples linked to Cobalt Gang, such as the ones depicted by [Morphisec](https://blog.morphisec.com/cobalt-gang-2.0), this pattern is also observable (in this case, using PkXX instead of letXX): ![](https://blog.paloaltonetworks.com/wp-content/uploads/2018/10/Cobalt_11.png) *Figure 11. VBA pattern in other documents* One initial approach to hunt for the pattern can be based on the following regular expressions for the different areas: |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Variable definitions **/\[A-Za-z\]k\[0-9\]{2}(\[0-9\]{1})/** Function definitions **/Private Function \[A-Za-z\]{2,5}\[0-9\]{2,3}\\(/** Procedure definitions **/Sub \[A-Za-z\]{2,5}\[0-9\]{2,5}\\(/** | In order to test our hypothesis for the builder we created the following Yara rules: rule cmstp\_macro\_builder\_rev\_a { meta: description="CMSTP macro builder based on variable names and runtime invoke" author="Palo Alto Networks Unit42" strings: $method="CallByName" $varexp=/\[A-Za-z\]k\[0-9\]{2}(\[0-9\]{1})/ condition: $method and #method == 2 and #varexp \> 10 } rule cmstp\_macro\_builder\_rev\_b { meta: description="CMSTP macro builder based on routines and functions names and runtime invoke" author="Palo Alto Networks Unit42" strings: $func=/Private Function \[A-Za-z\]{1,5}\[0-9\]{2,3}\\(/ $sub=/Sub \[A-Za-z\]{1,5}\[0-9\]{2,5}\\(/ $call="CallByName" condition: $call and #func \> 1 and #sub \> 1 } |----------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 | rule cmstp\_macro\_builder\_rev\_a { meta: description="CMSTP macro builder based on variable names and runtime invoke" author="Palo Alto Networks Unit42" strings: $method="CallByName" $varexp=/\[A-Za-z\]k\[0-9\]{2}(\[0-9\]{1})/ condition: $method and #method == 2 and #varexp \> 10 } rule cmstp\_macro\_builder\_rev\_b { meta: description="CMSTP macro builder based on routines and functions names and runtime invoke" author="Palo Alto Networks Unit42" strings: $func=/Private Function \[A-Za-z\]{1,5}\[0-9\]{2,3}\\(/ $sub=/Sub \[A-Za-z\]{1,5}\[0-9\]{2,5}\\(/ $call="CallByName" condition: $call and #func \> 1 and #sub \> 1 } | Hunting with these Yara rules leads to very positive results identifying this builder as well as a set of malicious documents using it. But the documents identified are not always targeting the finance or banking industries, and so, we cannot guarantee that this builder is only used by this specific Cobalt Gang group and its campaigns against those industries. However, using this in combination with other aspects such as the target, payload, or dropper characteristics, becomes very useful in tracking this group's campaigns, as we will see in the following sections. Let's focus then on the first stage of the delivery, the PDF documents. Common Signals in PDF Documents As we have seen, the use of a commodity PDF file with an embedded Google redirect link results in a very effective social engineering artifact. As there is no exploit or code executed, our research will now be focused on the metadata information from the document for further analysis. ![](https://blog.paloaltonetworks.com/wp-content/uploads/2018/10/Cobalt_12.png) *Figure 12. PDF Exiftool metadata* Our next hypothesis would be to check if the PDF documents could have been created based on a template document, where the author modifies the embedded link in the PDF and saves different document versions over time. Based on the [XMP specification](https://wwwimages2.adobe.com/content/dam/acom/en/devnet/xmp/pdfs/XMP%20SDK%20Release%20cc-2016-08/XMPSpecificationPart1.pdf), we will pay attention to the values of the "DocumentID" and "InstanceID" Media Management Properties: ![](https://blog.paloaltonetworks.com/wp-content/uploads/2018/10/Cobalt_13.png) *Figure 13. XMP Media Management Properties* In order to confirm this hypothesis, let's focus on the Document ID metadata field. Basically, saving the same template twice with 2 different links would produce the same Document ID but multiple Instance ID values (one per saved document). Searching our telemetry data for this metadata content produces interesting results. In order to help hunting for the content, the following Yara rule also could be used: rule cobaltgang\_pdf\_metadata\_rev\_a{ meta: description="Find documents saved from the same potential Cobalt Gang PDF template" author="Palo Alto Networks Unit 42" strings: $ = "\uuid:31ac3688-619c-4fd4-8e3f-e59d0354a338" ascii wide condition: any of them } |-------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 | rule cobaltgang\_pdf\_metadata\_rev\_a{ meta: description="Find documents saved from the same potential Cobalt Gang PDF template" author="Palo Alto Networks Unit 42" strings: $ = "\uuid:31ac3688-619c-4fd4-8e3f-e59d0354a338" ascii wide condition: any of them } | The results confirm our hypothesis (see Appendix for IOCs), and we have been able to find multiple PDF files that the attacker has saved with different contents but starting on the same "template", all of them sharing the same characteristics. (different content) ![](https://blog.paloaltonetworks.com/wp-content/uploads/2018/10/Cobalt_14.png) *Figure 14. Example PDF document* Further analysis on the subsequent stages of the attack will allow us to confirm if the samples are related to Cobalt Gang campaigns. For example, let's analyze the following document: |----------------------------|------------------------------------------------------------------| | **Observed File Name** | **SHA256** | | REMITTER REFERENCE PMT.pdf | 1d0aae6cff1f7a772fac67b74a39904b8b9da46484b4ae8b621a6566f7761d16 | The document was delivered by email, with the subject "Fund Transfer 08-October-2018", targeting banking customers: ![](https://blog.paloaltonetworks.com/wp-content/uploads/2018/10/Cobalt_15.png) *Figure 15. Email data associated to REMITTER REFERENCE PMT.pdf* And it contains the embedded link redirecting to the following URL: |--------------------------------------------| | hxxps://fundswp\[.\]com/Document082018.doc | Which downloads the document: |------------------------|------------------------------------------------------------------| | **Observed File Name** | **SHA256** | | Document082018.doc | 020ba5a273c0992d62faa05144aed7f174af64c836bf82009ada46f1ce3b6eee | By extracting the macro code, we can validate how it matches the macro builder described in the previous section. The following output shows how running the Yara rule searching for the macro builder against the extracted VBA contents of the document produces the expected match in its contents: ❯ yara cmstp\_macro\_builder.yar 020ba5a273c0992d62faa05144aed7f174af64c836bf82009ada46f1ce3b6eee\_subfiles cmstp\_macro\_builder\_2 020ba5a273c0992d62faa05144aed7f174af64c836bf82009ada46f1ce3b6eee\_subfiles/e657fe761effbe7e11e3cc343ba6845c2c9a6c989e7b805717d2e1417387528f.vba.decoded cmstp\_macro\_builder\_2 020ba5a273c0992d62faa05144aed7f174af64c836bf82009ada46f1ce3b6eee\_subfiles/8a6d2cccb6f2007cb7fa29d3f009f9fbe305bffc45dc35d3828f2dc3c41b3cb7.vba.raw |---------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 | ❯ yara cmstp\_macro\_builder.yar 020ba5a273c0992d62faa05144aed7f174af64c836bf82009ada46f1ce3b6eee\_subfiles cmstp\_macro\_builder\_2 020ba5a273c0992d62faa05144aed7f174af64c836bf82009ada46f1ce3b6eee\_subfiles/e657fe761effbe7e11e3cc343ba6845c2c9a6c989e7b805717d2e1417387528f.vba.decoded cmstp\_macro\_builder\_2 020ba5a273c0992d62faa05144aed7f174af64c836bf82009ada46f1ce3b6eee\_subfiles/8a6d2cccb6f2007cb7fa29d3f009f9fbe305bffc45dc35d3828f2dc3c41b3cb7.vba.raw | The pieces of our puzzle start to match for this campaign if we now put things in perspective: 1. Hunting for PDF files that are created with the same "DocumentID" management metadata field result in a set of files that have been used in email delivery against banking entities. 2. All of the PDF files embed a link based on a Google redirect, leading to the download of a Microsoft Office document file. 3. The Microsoft Office document files contain macros for code execution. Those macros match the characteristics of the builder that we have characterized. Discovering the Attacker's Infrastructure With these results obtained, we can start to move towards finding attacker infrastructure pieces based on multiple aspects, such as the hunting rules defined in previous sections, session data obtained by our telemetry, or public WHOIS registrar data. **Using our "hunting rules"** Based on the metadata and builder characteristics, we have tracked a set of malicious PDF and Office files (see Appendix) that provide us with domains and Office files in use by the attacker. Some examples of the PDF and embedded C2 links and document names are below in Table 1: |-------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------| | **SHA256** | **Embedded Link** | | 1fd9ba8eb97bf03cd4d3cbaac867595c920f1f36ebfbe9c1fc76558ea5e0ece5 | hxxp://www\[.\]pedidoslalacteo\[.\]com\[.\]ar/Proof-of-payment-19.09.2018.doc | | 5ac1612535b6981259cfac95efe84c5608cf51e3a49b9c1e00c5d374f90d10b2 | hxxps://s3\[.\]sovereigncars\[.\]org\[.\]uk/inv005189.pdf | | 07f60611836c0a679c0fb2e25f5caeb4d29cd970919d47f715666b80be46f45c | hxxps://alotile\[.\]biz/Document092018.doc | | 9d6fd7239e1baac696c001cabedfeb72cf0c26991831819c3124a0a726e8fe23 | hxxps://goo\[.\]gl/mn7iGj Which redirects to: hxxps://document\[.\]cdn-one\[.\]biz/doc000512.pdf | | 444c63bb794abe3d2b524e0cb2c8dcc174279b23b1bce949a7125df9fab25c1c | hxxps://safesecurefiles\[.\]com/doc041791.pdf | | a5f2ad08b5afdbd5317b51d0d2dd8f781903522844c786a11a0957a81abfd29e | hxxp://www\[.\]mky\[.\]com/Proof-of-payment-19.09.2018.doc | | df18e997a2f755159f0753c4e69a45764f746657b782f6d3c878afb8befe2b69 | hxxps://mail\[.\]halcyonih\[.\]com/uploads/doc004718538.pdf | *Table 1. Example PDF and embedded links* The PDF documents and URLs allowed us to discover multiple overlaps between this new infrastructure and the existing knowledge about Cobalt Gang attributed activity in previous research, corroborating new infrastructure belonging to the same attacker. Let's see a couple of examples of PDF documents from the list which belong to the same Document ID. |------------------------|------------------------------------------------------------------| | **Observed File Name** | **SHA256** | | inv005189.pdf | 5ac1612535b6981259cfac95efe84c5608cf51e3a49b9c1e00c5d374f90d10b2 | This sample has been already documented in previous campaigns, being related to s3\[.\]sovereigncars\[.\]org\[.\]uk domain. See the [Talos blog](https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html). |------------------------|------------------------------------------------------------------| | **Observed File Name** | **SHA256** | | doc000512.pdf | 9d6fd7239e1baac696c001cabedfeb72cf0c26991831819c3124a0a726e8fe23 | The sample embeds the URL hxxps://goo\[.\]gl/mn7iGj which is actually a shortened URL resolving to hxxps://document\[.\]cdn-one\[.\]biz/doc000512.pdf. Domain cdn-one\[.\]biz is a well-known Cobalt Gang attributed domain in previous analysis. The complete list of domains used by the PDF identified can be found in the Appendix section. **Pivoting on Email Sender Telemetry** Based on email delivery data, our telemetry helps us collecting samples related and indicators related to the campaign. Let's put a simple example of how tracking session data lead us to new infrastructure, by using some of the email sender data that is identified in malicious email sessions sending the PDF documents. For example, the following senders belong to the recent campaign and are spoofing both legitimate email domains and senders: |-------------------------------------------------------------------------------------------| | [dominique.denis-berube.1@ulaval.ca](mailto:dominique.denis-berube.1@ulaval.ca) | | [billb@verticalwebmedia.com](mailto:billb@verticalwebmedia.com)billb@verticalwebmedia.com | | [benoit.filion.2@ulaval.ca](mailto:benoit.filion.2@ulaval.ca)benoit.filion.2@ulaval.ca | | dominique.denis-berube.1@ulaval.ca | Some of the samples delivered by these senders and their embedded links are shown below in Table 2: |-------------------------------------------------------------------------|-------------------------------------------------| | **SHA256** | **Embedded link** | | 1c1a6bb0937c454eb397495eea034e00d1f7cf4e77481a04439afbc5b3503396 | hxxps://alotile.biz/Document092018.doc | | 187e0d911cd0393caad1364ded1c394257cd149898b31f9718c7c6319af79818 | hxxps://alotile.biz/Document042018.doc | | 988d430ce0e9f19634cf7955eac6eb03e3b7774b788010c2a9742b38016d1ebf | hxxps://fundsxe.com/Document09202018.doc | | 852f11e5131d3dab9812fd8ce3cd94c1333904f38713ff959f980a168ef0d4ce | hxxps://fundsxe.com/Document09222018.doc | *Table 2. Email sender associated PDFs and embedded links* These sample are delivered under the following file names: |--------------------------------| | REMITTER REFERENCE PMT.pdf | | Aml\_S0680260A79301.pdf | | CIT180126-000768.pdf | | AMENDMENT.pdf | | Citi720TEME171440008\_Query.pdf | | Query \_S-170526-005399.pdf | Both the domains and file names correlate with the results of the domains obtained based on hunting for PDFs metadata and macro builder structure, allowing us to keep tracking new activity over time. WHOIS Registrar Overlaps Two of the newly discovered domains used by the collected PDF documents have very interesting registrant information, pointing to a public registrant name, "grigoredanbadescu". ![](https://blog.paloaltonetworks.com/wp-content/uploads/2018/10/Cobalt_16.png) *Figure 16. Historical DNS data on safesecurefiles\[.\]com* **Domains:** safesecurefiles\[.\]com document\[.\]cdn-one\[.\]biz **WHOIS registrar information**: |----------------------------------------------------------------------------------------| | grigoredan@centrum.cz Grigoredanbadescu +4001289858474 (Romania) Brasov Romania | By pivoting on infrastructure related to the same registrant data we can obtain a very interesting set of domains: arubrabank\[.\]com outlook-368\[.\]com usasecurefiles\[.\]com safesecurefiles\[.\]com ms-server838\[.\]com msoffice-365\[.\]com total-share\[.\]biz bank-net\[.\]biz cdn-one\[.\]biz total-cloud\[.\]biz web-share\[.\]biz cloud-direct\[.\]biz n-document\[.\]biz my-documents\[.\]biz firstcloud\[.\]biz yourdocument\[.\]biz xstorage\[.\]biz safe-cloud\[.\]biz via24\[.\]biz zstorage\[.\]biz webclient1\[.\]biz bnet1\[.\]biz firstcloud\[.\]biz mycontent\[.\]biz total7\[.\]biz freecloud\[.\]biz contents\[.\]bz judgebin\[.\]bz Many of the domains listed are already known as malicious domains attributed to other Cobalt Gang campaigns. As an important note "arubrabank\[.\]com" is a new domain registered on 2019-09-18 and still not observed in an active campaign. The domain seems to be intended to mimic the legitimate Arubabank website for further activity: ![](https://blog.paloaltonetworks.com/wp-content/uploads/2018/10/Cobalt_17.png) *Figure 17. Arubabank legitimate site* Infrastructure Relationships Let's summarize all the pieces of our puzzle, now that we can put together all the relationships we observed. ![](https://blog.paloaltonetworks.com/wp-content/uploads/2018/10/Cobalt_18.png) *Figure 18. Maltego graph. Summary of relations and overlaps.* As it can be observed in the different clusters of activity: 1. The initial cluster of PDF documents, on the left, links to specific domains for the download of Microsoft Office files using the macro builder structure. 2. Some of the domains in use are publicly registered with the name of "grigoredanbanescu" and allow us to find other related domains, which are already linked to previous Cobalt Gang activity. 3. Some of the initial PDFs have relations with Microsoft Office files linked to "grigoredanbanescu" activity, confirming again the relationships. Conclusion Commodity attacks are widely used for both criminal and more targeted attacks, making identification difficult for networks defenders and threat hunters. One actor that makes extensive use of this approach to compromise victims is the Cobalt Gang. By focusing on specific aspects of the macro builders and metadata the actors left behind we were able to develop new mechanisms to track and hunt Cobalt Gang activity and infrastructure. Palo Alto Networks customers are protected in the following ways: * WildFire detects malware samples used by this campaign. * Traps prevents these attacks at the endpoint. * All involved malicious domains have been covered by PAN-DB URL Filtering. * An Autofocus tag has been created for tracking [CobaltGang](https://autofocus.paloaltonetworks.com/#/tag/Unit42.CobaltGang) actor group. Appendix -- Indicators of Compromise **Initial example** |---------------------------|------------------------------------------------------------------| | **Type** | **SHA256** | | Email | 2f74c8b55292d59ab66960f21a4413d4d54f8b7500bb385954e7ffe68d775443 | | PDF | 57f65ecb239833e5a4b2441e3a2daf3513356d45e1d5c311baeb31f4d503703e | | Microsoft Office Document | 07a3355f81ff69a197c792847d0783bfc336181d66d3a36e6b548d0dbd9f5a9a | | Domain | transef\[.\]biz | **Outlook messages** 477c432382c97648767ee45c264f0f2aaf8d3d9f9ed547d8418db12b7c140760 e0f1dbc10088b68f772ee73b0785c3d67b8e5f147b687911613d163ad5ebda6d e6a17617eaa98c49bfb2c9d3d090ffea69bb0c1864c43861bdf8d027339ea847 **Microsoft Office Document (Macro builder)** 020ba5a273c0992d62faa05144aed7f174af64c836bf82009ada46f1ce3b6eee 8004601c08983420408d2784e2a4aa79de426d41a09726a884edcb21f83ee7f8 d8a2384a51cd59f6390e6a4fcb04b51358cdbd5e04cae5be23daae548c306a73 161ba501b4ea6f7c2c8d224e55e566fef95064e1ed059d8287bc07e790f740e8 62a278119d732e4c839ee074553f087588a9040be027bdf9e617413c6fd2e9af 641d692386dab5ca60f4c6b1da0edecc5c3473c9a7d187dad6098786404780a3 07a3355f81ff69a197c792847d0783bfc336181d66d3a36e6b548d0dbd9f5a9a 161ba501b4ea6f7c2c8d224e55e566fef95064e1ed059d8287bc07e790f740e8 12ecb6b3780cd19ea84f6e84e816a701e8231441bf90145481baa0648139e001 a6f941fcec01fb006fc51df96396aeeb826cdf3864756669e19cb145fe41692f 19dc9b93870ddc3beb7fdeea2980c95edc489040e39381d89d0dfe0a825a1570 cb5644bd670dcd9caf5185ebe396996e514ed1d93982157186611135aea79bd3 a0111977c79f4eb30511f22055b54e4e973c0501240f3ba462691b1b4999d561 **PDF Documents** 3a7525ffa571775aca45551ebd2c192d9b8ed45db1a61bdd8398d91db885d7a2 1d0aae6cff1f7a772fac67b74a39904b8b9da46484b4ae8b621a6566f7761d16 1c1a6bb0937c454eb397495eea034e00d1f7cf4e77481a04439afbc5b3503396 187e0d911cd0393caad1364ded1c394257cd149898b31f9718c7c6319af79818 988d430ce0e9f19634cf7955eac6eb03e3b7774b788010c2a9742b38016d1ebf 852f11e5131d3dab9812fd8ce3cd94c1333904f38713ff959f980a168ef0d4ce 9d6fd7239e1baac696c001cabedfeb72cf0c26991831819c3124a0a726e8fe23 5ac1612535b6981259cfac95efe84c5608cf51e3a49b9c1e00c5d374f90d10b2 df18e997a2f755159f0753c4e69a45764f746657b782f6d3c878afb8befe2b69 a5f2ad08b5afdbd5317b51d0d2dd8f781903522844c786a11a0957a81abfd29e 66bd5e492531adf675897de5de8aee427b896c9b2c406daff006ce6a4e8aa810 1fd9ba8eb97bf03cd4d3cbaac867595c920f1f36ebfbe9c1fc76558ea5e0ece5 d5328e519daadaf1520619da1f24f6d81d23c84222640058bbb366752be93537 94c9fa812cebb733eda3a4eed33a0a49b60c207bb0f9153c0d08724c8b30f578 07f60611836c0a679c0fb2e25f5caeb4d29cd970919d47f715666b80be46f45c 7b9c183dc40c8d765e98024f8fb6565c69dee2bb97957c5ba754a23d2698bf7a 195580b78e144f66ac1f9be2b927d7828ed1dc3974dc1897e0ed59a96ac8f4e1 444c63bb794abe3d2b524e0cb2c8dcc174279b23b1bce949a7125df9fab25c1c 07f60611836c0a679c0fb2e25f5caeb4d29cd970919d47f715666b80be46f45c 7629dfcc9345578626a250afb67027955c6f78dd80b771c2968c5be0d4b11c59 195580b78e144f66ac1f9be2b927d7828ed1dc3974dc1897e0ed59a96ac8f4e1 b92707ebfaa15225064ff3a1a7d279b3dde1e70200e37d0074e9acc160cb16a7 ebf309ecd6c7a0911e1252d9e90fd302bfbd3e1d2679772025bdb9cc38bca141 57f65ecb239833e5a4b2441e3a2daf3513356d45e1d5c311baeb31f4d503703e **Domains** alotile\[.\]biz fundsxe\[.\]com s3\[.\]sovereigncars\[.\]org\[.\]uk safesecurefiles\[.\]com document\[.\]cdn-one\[.\]biz mail\[.\]halcyonih\[.\]com transef\[.\]biz **Domains registered by "grigoredanbanescu"** arubrabank\[.\]com outlook-368\[.\]com usasecurefiles\[.\]com safesecurefiles\[.\]com ms-server838\[.\]com msoffice-365\[.\]com total-share\[.\]biz bank-net\[.\]biz cdn-one\[.\]biz total-cloud\[.\]biz web-share\[.\]biz cloud-direct\[.\]biz n-document\[.\]biz my-documents\[.\]biz firstcloud\[.\]biz yourdocument\[.\]biz xstorage\[.\]biz safe-cloud\[.\]biz via24\[.\]biz zstorage\[.\]biz webclient1\[.\]biz bnet1\[.\]biz firstcloud\[.\]biz mycontent\[.\]biz total7\[.\]biz freecloud\[.\]biz contents\[.\]bz judgebin\[.\]bz **URLs** hxxp://www\[.\]pedidoslalacteo\[.\]com\[.\]ar/Proof-of-payment-19.09.2018.doc hxxps://s3\[.\]sovereigncars\[.\]org\[.\]uk/inv005189.pdf hxxps://alotile\[.\]biz/Document092018.doc hxxps://goo\[.\]gl/mn7iGj hxxps://document\[.\]cdn-one\[.\]biz/doc000512.pdf hxxps://safesecurefiles\[.\]com/doc041791.pdf hxxp://www\[.\]mky\[.\]com/Proof-of-payment-19.09.2018.doc hxxps://mail\[.\]halcyonih\[.\]com/uploads/doc004718538.pdf hxxps://e-dropbox\[.\]biz/doc058915654e.pdf hxxp://www\[.\]bit\[.\]do/etaYk hxxps://cloud-direct\[.\]biz/doc0047581678.pdf hxxps://transef\[.\]biz/Doc102018.doc **Observed File Names** Document082018.doc REMITTER REFERENCE PMT.pdf Aml\_S0680260A79301.pdf CIT180126-000768.pdf AMENDMENT.pdf Citi720TEME171440008\_Query.pdf Query \_S-170526-005399.pdf Document092018.doc Proof of payment 19.09.2018.doc Document092018.doc doc005681.doc Back to top ### Tags * [Cobalt Gang](https://unit42.paloaltonetworks.com/tag/cobalt-gang/ "Cobalt Gang") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Threat Brief: Embrace Mobile Banking with Caution](https://unit42.paloaltonetworks.com/unit42-threat-brief-embrace-mobile-banking-caution/ "Threat Brief: Embrace Mobile Banking with Caution") ### Related Articles ## Related Resources ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/) * [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API") * [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway") * [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)