[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/)  
[![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/)  
Menu

* [Tools](https://unit42.paloaltonetworks.com/tools/)
* [ATOMs](https://unit42.paloaltonetworks.com/atoms/)
* [Security Consulting](https://www.paloaltonetworks.com/unit42)
* [About Us](https://unit42.paloaltonetworks.com/about-unit-42/)
* [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html)  
  English
* [English](https://unit42.paloaltonetworks.com/unit42-prince-of-persia-game-over/)
* [Japanese](https://unit42.paloaltonetworks.com/ja/unit42-prince-of-persia-game-over/)
* [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research")
* [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research")
* [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware")  
  [Malware](https://unit42.paloaltonetworks.com/category/malware/)

# Prince of Persia -- Game Over

![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 7 min read

* ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg)  
  By:
  
  * [Tomer Bar](https://unit42.paloaltonetworks.com/author/tomer-bar/)
  * [Lior Efraim](https://unit42.paloaltonetworks.com/author/lior-efraim/)
  * [Simon Conant](https://unit42.paloaltonetworks.com/author/simon-conant/)

* ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg)  
  Published:June 28, 2016

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg)  
  Categories:
  
  * [Malware](https://unit42.paloaltonetworks.com/category/malware/)
  * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/)

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg)  
  Tags:
  
  * [C2](https://unit42.paloaltonetworks.com/tag/c2/)
  * [Infy](https://unit42.paloaltonetworks.com/tag/infy/)

* [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/unit42-prince-of-persia-game-over/?pdf=download&lg=en&_wpnonce=92524fc9d4 "Click here to download")

* [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/unit42-prince-of-persia-game-over/?pdf=print&lg=en&_wpnonce=92524fc9d4 "Click here to print")

Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg)

* ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg)
* [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Prince%20of%20Persia%20–%20Game%20Over&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-prince-of-persia-game-over%2F "Share in email")
* [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-prince-of-persia-game-over%2F "Share in Facebook")
* [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-prince-of-persia-game-over%2F&title=Prince%20of%20Persia%20–%20Game%20Over "Share in LinkedIn")
* [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-prince-of-persia-game-over%2F&text=Prince%20of%20Persia%20–%20Game%20Over "Share in Twitter")
* [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-prince-of-persia-game-over%2F&ts=markdown "Share in Reddit")
* [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Prince%20of%20Persia%20–%20Game%20Over%20https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-prince-of-persia-game-over%2F "Share in Mastodon")

### Summary

Unit 42 published a [blog](https://blog.paloaltonetworks.com/2016/05/prince-of-persia-infy-malware-active-in-decade-of-targeted-attacks/) at the beginning of May titled "Prince of Persia," in which we described the discovery of a decade-long campaign using a formerly unknown malware family, Infy, that targeted government and industry interests worldwide.

Subsequent to the publishing of this article, through cooperation with the parties responsible for the C2 domains, Unit 42 researchers successfully gained control of multiple C2 domains. This disabled the attacker's access to their victims in this campaign, provided further insight into the targets currently victimized in this operation, and enabled the notification of affected parties.

### Post Publication

In the week following the publication of the original blog, we observed no unusual changes to the C2 infrastructure. Existing domains did move to new IP addresses, as we had previously seen periodically. Some new install domains were added, adhering to naming conventions of current domains (see appendix for new IOCs).

The attackers developed a new version (31), and we observed this deployed against a single Canadian target.

The file descriptions remained essentially the same ("CLMediaLibrary Dynamic Link Library V3"). Most importantly, there was **no change to the encoding key** (now using offset 20, and offset 11 for second pass against URL encoding) that we had observed being used for the entire decade-long campaign, and documented in our previous blog. From this we conclude that the attackers were unaware of our initial report.

### Sinkhole

Through cooperation with the parties responsible for the C2 domains, we took control of all but one of them, transferring the A records to a server we controlled. This prevented the attackers from being able to subsequently make any further changes to the domain configurations, issue commands to victims, or capture any further data for the majority of victims. An analysis of connections after transfer suggests that the attackers may have used a third-party service to try to understand why they had suddenly lost almost all of their traffic. Figure 1 shows that tool, a geographic representation of victim-C2 traffic, with all but one at that time now communicating with our sinkhole server.

[![PoP - Game Over 1](http://blog.paloaltonetworks.com/wp-content/uploads/2016/06/PoP-Game-Over-1-500x275.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/06/PoP-Game-Over-1.png)

*Figure 1 Graphical representation of victim traffic to C2*

We have since transferred sinkhole control to [Shadowserver](https://www.shadowserver.org/wiki/), whom we thank for subsequent victim notification \& remediation ([https://www.shadowserver.org/wiki/pmwiki.php/Involve/GetReportsOnYourNetwork](https://www.shadowserver.org/wiki/pmwiki.php/Involve/GetReportsOnYourNetwork)).

### Victims

We were able to analyze victim C2 traffic to understand who were victims of the Infy campaign. We identified 456 malware agents installed on 326 victim systems, in 35 countries. Figure 2 shows a geographical breakdown of victim locations. We noted in our original blog the large amount of targeting of Iranian citizens in this campaign, we observed almost one-third of all victims to be Iranian. Also of note was the low overall volume of victims, compared to, for example, crimeware campaigns.

[![PoP - Game Over 2](http://blog.paloaltonetworks.com/wp-content/uploads/2016/06/PoP-Game-Over-2-500x259.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/06/PoP-Game-Over-2.png)

*Figure 2 Geographic location of victims. Please note that New Zealand has been omitted from this map only because we observed no victim activity there.*

### Versions

In our original blog, we noted two distinct primary variants of the Infy malware. In addition to the original "Infy" variant, we also see the newer, more sophisticated, interactive, and fuller-featured "Infy M" variant deployed against apparently-higher-value targets. Overall, 93% of all victims were infected with Infy, and 60% with Infy "M" (Figure 3). Combined with the low total number of victims, this suggests a great deal of care given to each individual campaign target. The large number of victims with both variants may relate to their complimentary feature set, or represent an "upgrade" path on victims from the original variant infection, later adding the "M" variant as targets appeared more compelling to the attackers.

[![PoP - Game Over 3](http://blog.paloaltonetworks.com/wp-content/uploads/2016/06/PoP-Game-Over-3-500x474.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/06/PoP-Game-Over-3.png)

*Figure 3 Breakdown of Infy vs. Infy "M" infections*

For the Infy "M" variant, we note that the majority of targets are using the latest version (7.8), and that none are using the older 6.x versions at all (Figure 4). This suggests that these higher-value targets are paid much more attention, being kept up-to-date with the latest version.

In contrast, for the more basic original Infy variant, we note a full spectrum of versions installed (Figure 5), with many victims on older versions -- including the original, decade-old V1 - suggesting much less concern is paid to these individual targets (note that we did observe a small number of the older 6.x versions but these do not announce their version when connecting).

[![PoP - Game Over 4](http://blog.paloaltonetworks.com/wp-content/uploads/2016/06/PoP-Game-Over-4.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/06/PoP-Game-Over-4.png)

*Figure 4 Infy "M" Victim versions*

[![PoP - Game Over 5](http://blog.paloaltonetworks.com/wp-content/uploads/2016/06/PoP-Game-Over-5.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/06/PoP-Game-Over-5.png)

*Figure 5 Infy"Original" Victim versions*

### Game Over

Shortly after the takedown, as well as a new Infy version (31), we also observed the registration of multiple domains using a previously-seen pattern, against known campaign IP addresses. Almost every domain in the pattern-range box4035\[.\]net -- box4090\[.\]net (138.201.0.134). These were not observed in any sample C2 lists however. Bestwebstat\[.\]com was sinkholed by another operator.

Some victims infected with Infy versions 15-24 still used the C2 server us1s2\[.\]strangled\[.\]net, which remained in the hands of the attacker. In early June the attackers used this C2 to issue instructions to download new Infy "M" version 8.0 from us1s2\[.\]strangled\[.\]net/bdc.tmp. This was the first time we had observed an Infy variant being directly updated to Infy "M". This used camouflage name "Macromedia v4", changed from "v3" seen in Infy v31. They also removed the voice recording capability in this version.

uvps1\[.\]cotbm\[.\]com was used for data exfiltration, previously at 138.201.47.150, after publishing of our original blog moving to 144.76.250.205. It was also hosting malware updates at /themes/u.php.

They also added a curious C2 entry "hxxp://box" (note: defanged for publishing). It's unclear how this should function; possibly a compromised victim intranet device, or the attackers have modified the HOSTS file on the victim computer.

After the take-down, the attackers began to add server IP addresses as well as domain names to their malware C2 list. They also slightly modified their ZIP password from "Z8(2000\_2001ul" to "Z8(2000\_2001uIEr3". Their new malware version added antivirus checks for Kaspersky Labs, Avast, and Trend Micro. The malware data capture now searches for file extensions:

*.doc, .docx, .xls, .xlsx, .xlr, .pps, .ppt, .pptx, .mdb, .accdb, .db, .dbf, .sql, .jpg, .jpeg, .psd, .tif, .mp4, .3gp, .txt, .rtf, .odt, .htm, .html, .pdf, .wps, .contact, .csv, .nbu, .vcf, .pst, .zip, .rar, .7z, .zipx, .pgp, .tc, .vhd, .p12, .crt.pem,.key.pfx, .asc, .cer, .p7b, .sst, .doc, .docx, .xls, .xlsx, .xlr, .pps, .ppt, .pptx.*

and folder locations:

*:\\$recycle.bin, :\\documents and settings, :\\msocache, :\\program files, :\\program files (x86), :\\programdata, :\\recovery, :\\system volume information:\\users, :\\windows, :\\boot, :\\inetpub, :\\i386.*

The malware continued to use the **identical decryption key** seen over the entire history of this campaign.

Mid-June, through cooperation with the parties responsible for the C2 domains and law enforcement, we were able to get the remaining C2 domains null-routed and the directly-IP-addressed server disabled. This is the end of a decade-long campaign, though we naturally expect to see this actor back in some other guise before long.

Thanks to the Malware research team - Yaron Samuel, Artiom Radune, Mashav Sapir, Netanel Rimer -- for assistance in the takedown.

### Appendix 1 -- Exfiltration Algorithm

The malware uses a different algorithm than that used for encrypting the malware strings to encrypt the exfiltration data, including:

1. Keylogger data + language.
2. Malware logs - installation time, DLL path and name, log path, number of downloads, number of successful/failed connections.
3. Information about the victim computer: Time zone, list of drives and types, running processes, disk info.

First the malware adds 1 to all bytes, then an encryption key is initialized based on the victim computer name (the offset in the key is calculated by sum of the computer name letters %key length). Then the key is used to encrypt the data (see decrypt function). The encrypted data is then base64 encoded.

Exfiltration data decryption python code:  
import os,sys import string import base64 import fileinput FIRST\_PHASE = "OQTJEqtsK0AUB9YXMwr8idozF7VWRPpnhNCHI6Dlkaubyxf5423jvcZ1LSGmge" SECOND\_PHASE = "PqOwI1eUrYtT2yR3p4E5o6WiQu7ASlDkFj8GhHaJ9sKdLfMgNzBx0ZcXvCmVnb" global FULL\_KEY FULL\_KEY= "" def sub\_1\_for\_hex(str\_input): str\_output = "" for letter in str\_input: try: str\_output += chr(ord(letter)-1) except: print "sub\_1\_for\_hex func problem" continue return str\_output def sum\_comp\_name(comp\_name): sum = 0 for letter in comp\_name: sum+= ord(letter) return sum def init\_key(comp): comp\_name\_sum = sum\_comp\_name(comp) carry = divmod(comp\_name\_sum, 62) index = carry\[1\] -1 end\_key = FIRST\_PHASE\[:index\] key = FIRST\_PHASE\[index:\] key = key + end\_key key = key + key return key def decrypt(num\_list,offset): global FULL\_KEY input = "" for num\_str in num\_list: try: input += num\_str.decode('hex') except: input += ')' result = "" for i, c in enumerate(input): i = i % 62 +1 try: index = FULL\_KEY.index(c)-1 except ValueError: result += c continue translated = SECOND\_PHASE\[(index - i +offset) % len(SECOND\_PHASE)\] result += translated return result def found\_infy\_enc\_data(line): found\_infy\_str = "show=\\"---------- Administration Reporting Service " found\_infy\_index = line.find(found\_infy\_str) if not found\_infy\_index==-1: return True,found\_infy\_index else: return False,found\_infy\_index def extract\_comp\_name(line): comp = r"\\xd\\xa-----" comp\_index = line.find(comp) comp\_name = line\[comp\_index+len(comp):\] comp\_name = comp\_name\[:comp\_name.find("-----")\] print "(((=)))" + comp\_name return comp\_name def extract\_enc\_data(line): header = r"\\xd\\xa\_\_\_\_\_" start\_index = line.find(header)+len(header) line = line\[start\_index:\] endindex = line.index("\_\_\_\_\_\\" value=") line = line\[:endindex\] return line def write\_enc\_infy\_data\_to\_file(dec\_line,comp\_name,filename): file1 = open(filename + "\\\\" + comp\_name + ".txt",'ab') file1.writelines(dec\_line) file1.close() def enc\_wrapper(enc,comp\_name): global FULL\_KEY print FULL\_KEY FULL\_KEY = init\_key(comp\_name) enc\_final = "" for letter in enc: if len(hex(ord(letter))\[2:\])==1: enc\_final += "0" + hex(ord(letter))\[2:\] elif len(hex(ord(letter))\[2:\])==2: enc\_final += hex(ord(letter))\[2:\] else: print "not good hex length" exit() enc = enc\_final.upper() enc = enc.replace("2E","21") enc = enc.replace("C5DC5A","") enc = enc.replace("D03D00","") enc = enc.replace("0B0E","2121") enc = enc.replace("01","21") enc\_len = len(enc) enc\_rev = "" num\_list = \[\] enc\_print ="" for i in range(0,enc\_len/2): enc\_rev = enc\[-2:\] if not enc\_rev=="0B" and not enc\_rev=="0E" and not enc\_rev=="00" and not enc\_rev=="D0": enc\_print +=enc\_rev num\_list.append(enc\_rev) enc= enc\[:-2\] #the first part is always ok dec\_str = decrypt(num\_list,0) final = sub\_1\_for\_hex(dec\_str) index = final.find("OK: Sent") if index==-1: print comp\_name + " - did not found OK: Sent !!!!\\n\\n\\n\\n" #exit() decrypt\_data = comp\_name + " ++==++ " + str(i) + ": " + final + "\\n" final\_start = final\[0:500\] if final\_start in UNIQUE\_DATA: print comp\_name + " already have this data" return UNIQUE\_DATA.append(final\_start) index = final.find("Installed Date:") if index==-1: for i in range(1,61): dec\_str = decrypt3(num\_list,i) final = sub\_1\_for\_hex(dec\_str) ##print all 62 options index2 = final.find("PROGRAM START:") index3 = final.find("Installed Date:") if not index2 ==-1 or not index3 ==-1: decrypt\_data += str(i) + ": " + final + "\\n" write\_enc\_infy\_data\_to\_file(decrypt\_data,comp\_name,FILE\_OUTPUT\_NAME) def read\_enc\_data\_files(): for root,dir,files in os.walk(PDML\_PATH): for file in files: filename = root+ "\\\\" + file if os.path.isfile(filename): print filename for line in fileinput.input(\[filename\]): line = line.strip() is\_found,found\_infy\_index= found\_infy\_enc\_data(line) if not is\_found: continue line = line\[found\_infy\_index:\] #get computer name (for use in init\_key() later) comp\_name = extract\_comp\_name(line) UNIQUE\_COMP.append(comp\_name) #get the infy encrypted data line = extract\_enc\_data(line) #base64 decode enc\_data dec\_line = line.decode('base64') #append enc\_data to file write\_enc\_infy\_data\_to\_file(dec\_line,comp\_name,FILE\_ENC\_OUTPUT\_NAME) enc\_wrapper(dec\_line,comp\_name) try: read\_enc\_data\_files() except: print "exception!!!!"

|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 | import os,sys import string import base64 import fileinput FIRST\_PHASE = "OQTJEqtsK0AUB9YXMwr8idozF7VWRPpnhNCHI6Dlkaubyxf5423jvcZ1LSGmge" SECOND\_PHASE = "PqOwI1eUrYtT2yR3p4E5o6WiQu7ASlDkFj8GhHaJ9sKdLfMgNzBx0ZcXvCmVnb" global FULL\_KEY FULL\_KEY= "" def sub\_1\_for\_hex(str\_input): str\_output = "" for letter in str\_input: try: str\_output += chr(ord(letter)-1) except: print "sub\_1\_for\_hex func problem" continue return str\_output def sum\_comp\_name(comp\_name): sum = 0 for letter in comp\_name: sum+= ord(letter) return sum def init\_key(comp): comp\_name\_sum = sum\_comp\_name(comp) carry = divmod(comp\_name\_sum, 62) index = carry\[1\] -1 end\_key = FIRST\_PHASE\[:index\] key = FIRST\_PHASE\[index:\] key = key + end\_key key = key + key return key def decrypt(num\_list,offset): global FULL\_KEY input = "" for num\_str in num\_list: try: input += num\_str.decode('hex') except: input += ')' result = "" for i, c in enumerate(input): i = i % 62 +1 try: index = FULL\_KEY.index(c)-1 except ValueError: result += c continue translated = SECOND\_PHASE\[(index - i +offset) % len(SECOND\_PHASE)\] result += translated return result def found\_infy\_enc\_data(line): found\_infy\_str = "show=\\"---------- Administration Reporting Service " found\_infy\_index = line.find(found\_infy\_str) if not found\_infy\_index==-1: return True,found\_infy\_index else: return False,found\_infy\_index def extract\_comp\_name(line): comp = r"\\xd\\xa-----" comp\_index = line.find(comp) comp\_name = line\[comp\_index+len(comp):\] comp\_name = comp\_name\[:comp\_name.find("-----")\] print "(((=)))" + comp\_name return comp\_name def extract\_enc\_data(line): header = r"\\xd\\xa\_\_\_\_\_" start\_index = line.find(header)+len(header) line = line\[start\_index:\] endindex = line.index("\_\_\_\_\_\\" value=") line = line\[:endindex\] return line def write\_enc\_infy\_data\_to\_file(dec\_line,comp\_name,filename): file1 = open(filename + "\\\\" + comp\_name + ".txt",'ab') file1.writelines(dec\_line) file1.close() def enc\_wrapper(enc,comp\_name): global FULL\_KEY print FULL\_KEY FULL\_KEY = init\_key(comp\_name) enc\_final = "" for letter in enc: if len(hex(ord(letter))\[2:\])==1: enc\_final += "0" + hex(ord(letter))\[2:\] elif len(hex(ord(letter))\[2:\])==2: enc\_final += hex(ord(letter))\[2:\] else: print "not good hex length" exit() enc = enc\_final.upper() enc = enc.replace("2E","21") enc = enc.replace("C5DC5A","") enc = enc.replace("D03D00","") enc = enc.replace("0B0E","2121") enc = enc.replace("01","21") enc\_len = len(enc) enc\_rev = "" num\_list = \[\] enc\_print ="" for i in range(0,enc\_len/2): enc\_rev = enc\[-2:\] if not enc\_rev=="0B" and not enc\_rev=="0E" and not enc\_rev=="00" and not enc\_rev=="D0": enc\_print +=enc\_rev num\_list.append(enc\_rev) enc= enc\[:-2\] #the first part is always ok dec\_str = decrypt(num\_list,0) final = sub\_1\_for\_hex(dec\_str) index = final.find("OK: Sent") if index==-1: print comp\_name + " - did not found OK: Sent !!!!\\n\\n\\n\\n" #exit() decrypt\_data = comp\_name + " ++==++ " + str(i) + ": " + final + "\\n" final\_start = final\[0:500\] if final\_start in UNIQUE\_DATA: print comp\_name + " already have this data" return UNIQUE\_DATA.append(final\_start) index = final.find("Installed Date:") if index==-1: for i in range(1,61): dec\_str = decrypt3(num\_list,i) final = sub\_1\_for\_hex(dec\_str) ##print all 62 options index2 = final.find("PROGRAM START:") index3 = final.find("Installed Date:") if not index2 ==-1 or not index3 ==-1: decrypt\_data += str(i) + ": " + final + "\\n" write\_enc\_infy\_data\_to\_file(decrypt\_data,comp\_name,FILE\_OUTPUT\_NAME) def read\_enc\_data\_files(): for root,dir,files in os.walk(PDML\_PATH): for file in files: filename = root+ "\\\\" + file if os.path.isfile(filename): print filename for line in fileinput.input(\[filename\]): line = line.strip() is\_found,found\_infy\_index= found\_infy\_enc\_data(line) if not is\_found: continue line = line\[found\_infy\_index:\] #get computer name (for use in init\_key() later) comp\_name = extract\_comp\_name(line) UNIQUE\_COMP.append(comp\_name) #get the infy encrypted data line = extract\_enc\_data(line) #base64 decode enc\_data dec\_line = line.decode('base64') #append enc\_data to file write\_enc\_infy\_data\_to\_file(dec\_line,comp\_name,FILE\_ENC\_OUTPUT\_NAME) enc\_wrapper(dec\_line,comp\_name) try: read\_enc\_data\_files() except: print "exception!!!!" |

### Appendix 2 --IoCs

Infy version 31: f07e85143e057ee565c25db2a9f36491102d4e526ffb02c83e580712ec00eb27

Infy "M" version 8.0: 583349B7A2385A1E8DE682A43351798CA113CBBB80686193ECF9A61E6942786A

5\.9.94.34  
138\.201.0.134  
138\.201.47.150  
144\.76.250.205  
138\.201.47.158  
138\.201.47.153  
us1s2\[.\]strangled\[.\]net  
uvps1\[.\]cotbm\[.\]com  
gstat\[.\]strangled\[.\]net  
secup\[.\]soon\[.\]it  
p208\[.\]ige\[.\]es  
lu\[.\]ige\[.\]es  
updateserver1\[.\]com  
updateserver3\[.\]com  
updatebox4\[.\]com  
bestupdateserver\[.\]com  
bestupdateserver2\[.\]com  
bestbox3\[.\]com  
safehostline\[.\]com  
youripinfo\[.\]com  
bestupser\[.\]awardspace\[.\]info  
box4035\[.\]net  
box4036\[.\]net  
box4037\[.\]net  
box4038\[.\]net  
box4039\[.\]net  
box4040\[.\]net  
box4041\[.\]net  
box4042\[.\]net  
box4043\[.\]net  
box4044\[.\]net  
box4045\[.\]net  
box4046\[.\]net  
box4047\[.\]net  
box4048\[.\]net  
box4049\[.\]net  
box4050\[.\]net  
box4051\[.\]net  
box4052\[.\]net  
box4053\[.\]net  
box4054\[.\]net  
box4055\[.\]net  
box4056\[.\]net  
box4057\[.\]net  
box4058\[.\]net  
box4059\[.\]net  
box4060\[.\]net  
box4061\[.\]net  
box4062\[.\]net  
box4063\[.\]net  
box4064\[.\]net  
box4065\[.\]net  
box4066\[.\]net  
box4067\[.\]net  
box4068\[.\]net  
box4069\[.\]net  
box4070\[.\]net  
box4071\[.\]net  
box4072\[.\]net  
box4075\[.\]net  
box4078\[.\]net  
box4079\[.\]net  
box4080\[.\]net  
box4081\[.\]net  
box4082\[.\]net  
box4083\[.\]net  
box4084\[.\]net  
box4085\[.\]net  
box4086\[.\]net  
box4087\[.\]net  
box4088\[.\]net  
box4089\[.\]net  
box4090\[.\]net
Back to top

### Tags

* [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2")
* [Infy](https://unit42.paloaltonetworks.com/tag/infy/ "Infy")  
  [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Tracking Elirks Variants in Japan: Similarities to Previous Attacks](https://unit42.paloaltonetworks.com/unit42-tracking-elirks-variants-in-japan-similarities-to-previous-attacks/ "Tracking Elirks Variants in Japan: Similarities to Previous Attacks")

### Related Articles

* [Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "article - table of contents")
* [TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development](https://unit42.paloaltonetworks.com/tuxbot-v3-evolution-iot-botnet/ "article - table of contents")
* [Boggy Serpens Threat Assessment](https://unit42.paloaltonetworks.com/boggy-serpens-threat-assessment/ "article - table of contents")

## Related Malware Resources

![Pictorial representation of a magnifying glass illuminating a glowing orange circular digital circuit interface on a dark, high-tech background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Myth-Busting_Overview_1920x900-786x368.jpg)  
[![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) September 16, 2026 [#### Atomic macOS (AMOS) Stealer Activity](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/)

* [MacOS](https://unit42.paloaltonetworks.com/tag/macos/ "macOS")

* [Threat intelligence](https://unit42.paloaltonetworks.com/tag/threat-intelligence/ "threat intelligence")

* [Unit 42](https://unit42.paloaltonetworks.com/tag/unit-42/ "Unit 42")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/ "Atomic macOS (AMOS) Stealer Activity")  
  ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/)

* [API](https://unit42.paloaltonetworks.com/tag/api/ "API")

* [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic")

* [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE")  
  ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/)

* [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel")

* [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2")

* [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure")  
  ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/)

* [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI")

* [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT")

* [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America")  
  ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/)

* [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa")

* [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID")

* [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams")  
  ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/)

* [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor")

* [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin")

* [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution")  
  ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/)

* [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication")

* [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft")

* [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels")  
  ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/)

* [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK")

* [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum")

* [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet")  
  ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/)

* [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum")

* [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain")

* [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications")  
  ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/)

* [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain")

* [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop")

* [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm")

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)  
  ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]()  
  ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png)  
  ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42

## Peace of mind comes from staying ahead of threats. Subscribe today.

Your Email

Subscribe for email updates to all Unit 42 threat research.  
By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement")

This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.

Invalid captcha!
Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg)  
{#footer} Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security)

* [Secure AI by Design](https://www.paloaltonetworks.com/ai-security)

* [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase)

* [Prisma SASE](https://www.paloaltonetworks.com/sase)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam)

* [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira)

* [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management)

* [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management)

* [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager)

* [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance)

* [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management)

* [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic)

* [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management)

* [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance)

* [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery)

* [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42)

* [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense)

* [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses)

* [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy)

* [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence)

* [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond)  
  Company

* [About Us](https://www.paloaltonetworks.com/about-us)

* [Careers](https://jobs.paloaltonetworks.com/en/)

* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales)

* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility)

* [Customers](https://www.paloaltonetworks.com/customers)

* [Investor Relations](https://investors.paloaltonetworks.com/)

* [Location](https://www.paloaltonetworks.com/about-us/locations)

* [Newsroom](https://www.paloaltonetworks.com/company/newsroom)  
  Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/)

* [Communities](https://www.paloaltonetworks.com/communities)

* [Content Library](https://www.paloaltonetworks.com/resources)

* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia)

* [Event Center](https://events.paloaltonetworks.com/)

* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)

* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z)

* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications)

* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure)

* [Sitemap](https://www.paloaltonetworks.com/sitemap)

* [Tech Docs](https://docs.paloaltonetworks.com/)

* [Unit 42](https://unit42.paloaltonetworks.com/)

* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)

* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy)

* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center)

* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use)

* [Documents](https://www.paloaltonetworks.com/legal)

Copyright © 2026 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* EN  
  Select your language  
  ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg)

### Default Heading

Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg)  
Seekbar

![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg)  
![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg)  
Volume
![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)