[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/)  
[![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/)  
Menu

* [Tools](https://unit42.paloaltonetworks.com/tools/)
* [ATOMs](https://unit42.paloaltonetworks.com/atoms/)
* [Security Consulting](https://www.paloaltonetworks.com/unit42)
* [About Us](https://unit42.paloaltonetworks.com/about-unit-42/)
* [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html)  
  English
* [English](https://unit42.paloaltonetworks.com/unit42-ransomware-locky-teslacrypt-other-malware-families-use-new-tool-to-evade-detection/)
* [Japanese](https://unit42.paloaltonetworks.com/ja/unit42-ransomware-locky-teslacrypt-other-malware-families-use-new-tool-to-evade-detection/)
* [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research")
* [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research")
* [Ransomware](https://unit42.paloaltonetworks.com/category/ransomware/ "Ransomware")  
  [Ransomware](https://unit42.paloaltonetworks.com/category/ransomware/)

# Ransomware: Locky, TeslaCrypt, Other Malware Families Use New Tool To Evade Detection

![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 5 min read

* ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg)  
  By:
  
  * [Jeff White](https://unit42.paloaltonetworks.com/author/jeff-white/)
  * [Chris Astacio](https://unit42.paloaltonetworks.com/author/chris-astacio/)
  * [Micah Yates](https://unit42.paloaltonetworks.com/author/micah-yates/)

* ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg)  
  Published:April 8, 2016

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg)  
  Categories:
  
  * [Ransomware](https://unit42.paloaltonetworks.com/category/ransomware/)
  * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/)

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg)  
  Tags:
  
  * [Andromeda](https://unit42.paloaltonetworks.com/tag/andromeda/)
  * [Locky](https://unit42.paloaltonetworks.com/tag/locky/)
  * [TeslaCrypt](https://unit42.paloaltonetworks.com/tag/teslacrypt/)

* [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/unit42-ransomware-locky-teslacrypt-other-malware-families-use-new-tool-to-evade-detection/?pdf=download&lg=en&_wpnonce=ac4b3be3b8 "Click here to download")

* [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/unit42-ransomware-locky-teslacrypt-other-malware-families-use-new-tool-to-evade-detection/?pdf=print&lg=en&_wpnonce=ac4b3be3b8 "Click here to print")

Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg)

* ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg)
* [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Ransomware:%20Locky,%20TeslaCrypt,%20Other%20Malware%20Families%20Use%20New%20Tool%20To%20Evade%20Detection&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-ransomware-locky-teslacrypt-other-malware-families-use-new-tool-to-evade-detection%2F "Share in email")
* [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-ransomware-locky-teslacrypt-other-malware-families-use-new-tool-to-evade-detection%2F "Share in Facebook")
* [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-ransomware-locky-teslacrypt-other-malware-families-use-new-tool-to-evade-detection%2F&title=Ransomware:%20Locky,%20TeslaCrypt,%20Other%20Malware%20Families%20Use%20New%20Tool%20To%20Evade%20Detection "Share in LinkedIn")
* [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-ransomware-locky-teslacrypt-other-malware-families-use-new-tool-to-evade-detection%2F&text=Ransomware:%20Locky,%20TeslaCrypt,%20Other%20Malware%20Families%20Use%20New%20Tool%20To%20Evade%20Detection "Share in Twitter")
* [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-ransomware-locky-teslacrypt-other-malware-families-use-new-tool-to-evade-detection%2F&ts=markdown "Share in Reddit")
* [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Ransomware:%20Locky,%20TeslaCrypt,%20Other%20Malware%20Families%20Use%20New%20Tool%20To%20Evade%20Detection%20https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-ransomware-locky-teslacrypt-other-malware-families-use-new-tool-to-evade-detection%2F "Share in Mastodon")
  Today we identified a new tool actively being used by the Locky ransomware family to evade detection and potentially infect endpoints. Unit 42 identified slight changes in Locky detonations through the AutoFocus threat intelligence service, correlating global data to discover a new tool being used to pack multiple ransomware families. Adversaries are constantly seeking new techniques to bypass security controls, and based on data from AutoFocus, this represents a widespread update to their tradecraft.

In our analysis, multiple malware samples stood out due to what seemed like obfuscated API calls coming from a dictionary of embedded terms to resolve system functions and hide their true capabilities from commonly used static analysis tools.

[![Locky\_Word of the Day 1](http://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Locky_Word-of-the-Day-1.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Locky_Word-of-the-Day-1.png)

(Oddly named variables passed to API calls)

Tampering with the API calls takes away the ability to classify based on key names, thus increasing the likelihood that the malware will go undetected. This, however, is where it gets interesting, as it appears this was just the first in a series of misdirections designed to throw off analysts.

When looking at the new samples, the import tables for libraries to load on execution would differ significantly and not actually be used at all during execution. This prevented any sort of meaningful detection by import hashing. Additionally, looking at the executable version information showed varying information per sample but a clear pattern that can be used for future identification.

|-----------------|--------------------------|
| LegalCopyright  | Copyright \\xa9 2017     |
| InternalName    | Phoneticist              |
| FileVersion     | 218, 158, 104, 112       |
| CompanyName     | Cyber Power Systems Inc. |
| ProductName     | Nesting Punk             |
| ProductVersion  | 221, 202, 46, 180        |
| FileDescription | Skittles                 |

|-----------------|-------------------------|
| LegalCopyright  | Copyright \\xa9 2015    |
| InternalName    | Grated                  |
| FileVersion     | 82, 233, 256, 103       |
| CompanyName     | SafeNet Inc.            |
| ProductName     | Geomagnetic Espadrilles |
| ProductVersion  | 176, 194, 91, 229       |
| FileDescription | Connectivity            |

Within each sample of malware we found different embedded strings, some used and some unused.

[![Locky\_Word of the Day 2](http://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Locky_Word-of-the-Day-2-1-500x259.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Locky_Word-of-the-Day-2-1.png)

(Word list)

Upon closer inspection, it appears that the author uses a lot of the terms to generate noise and pointless instructions in an attempt to make analysis more difficult. In the below picture, highlighted in red, is where this sample begins to get serious about unpacking and walks the PEB structure to identify the base address of kernel32.dll.

[![Locky\_Word of the Day 3](http://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Locky_Word-of-the-Day-3-1-500x186.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Locky_Word-of-the-Day-3-1.png)

(Start of the PEB walk)

On every run, it advances forward one DWORD and eventually compares a value that is XOR'd against 0x958B9963 to see if it's found kernel32.dll.

[![Locky\_Word of the Day 4](http://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Locky_Word-of-the-Day-4-1-500x96.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Locky_Word-of-the-Day-4-1.png)

(Upon finding the intended target DLL it saves it into a register)

Now that it has the base address for kernel32.dll, it begins to enumerate functions, continually changing the variables on the stack during this process to further misdirect their intentions.

[![Locky\_Word of the Day 5](http://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Locky_Word-of-the-Day-5-1-500x199.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Locky_Word-of-the-Day-5-1.png)

(Function iteration)

[![Locky\_Word of the Day 6](http://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Locky_Word-of-the-Day-6-1-500x356.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Locky_Word-of-the-Day-6-1.png)

(Finding the target)

Once it identifies the location of the VirtualAlloc function within kernel32, it begins to position the necessary variables to call on the stack while continuing to try and hide within the noise. As shown below, once the stack is setup, it does a direct JMP to VirtualAlloc, providing a return address that eventually leads to a couple of decoding routines.

[![Locky\_Word of the Day 7](http://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Locky_Word-of-the-Day-7-1-500x267.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Locky_Word-of-the-Day-7-1.png)

(JMP to VirtualAlloc to allocate space for the encoded data)

[![Locky\_Word of the Day 8](http://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Locky_Word-of-the-Day-8-500x555.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Locky_Word-of-the-Day-8.png)

(Decoding data into allocated space)

Once finished with this phase, the malware shifts execution into the newly decoded data and continues to modify itself through multiple iterations.

[![Locky\_Word of the Day 9](http://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Locky_Word-of-the-Day-9-500x256.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Locky_Word-of-the-Day-9.png)

(Self-modifying its code at run-time)

Recall from the beginning of this post that abnormal arguments passed to API calls were the first clue something had changed. In this phase, you can follow the self-modification to the next set of red herrings before it gets down to business again.

[![Locky\_Word of the Day 10](http://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Locky_Word-of-the-Day-10-500x147.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Locky_Word-of-the-Day-10.png)

(Code continues to JMP to new offsets, modifying all subsequent instructions)

[![Locky\_Word of the Day 11](http://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Locky_Word-of-the-Day-11-500x167.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Locky_Word-of-the-Day-11.png)

(JMP after JMP, with one actual instruction hidden deep within)

This will eventually lead to a call for LoadLibraryA with bogus names that do not map, which end-up failing and return a NULL result effectively serving no purpose but to confuse.

![Locky\_Word of the Day 12](http://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Locky_Word-of-the-Day-12-500x33.png)

(More red herrings)

Once this all completes, it will allocate another region of memory and then copy over and decode the actual malware, similar to the above process.

[![Locky\_Word of the Day 13](http://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Locky_Word-of-the-Day-13-500x530.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Locky_Word-of-the-Day-13.png)

(The final payload of the packer)

When we extract the payload, we can validate that it is indeed Locky and accurately gets detected.

[![Locky\_Word of the Day 14](http://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Locky_Word-of-the-Day-14-500x295.png)](https://blog.paloaltonetworks.com/wp-content/uploads/2016/04/Locky_Word-of-the-Day-14.png)

Palo Alto Networks has identified this technique being picked up recently by the Locky ransomware, but we have also identified samples of TeslaCrypt and Andromeda malware families, dating back to March 14, 2016, that exhibit the technique. It is important to note that this obfuscation can be detected by dynamic analysis, which is used in combination with static analysis by WildFire service to protect Palo Alto Networks customers from this threat.

WildFire is able to detect this new packing technique being utilized across the malware families described in this post, as well as detect each family after unpacking. Users of AutoFocus can find more information on impacted malware families with the [Locky](https://autofocus.paloaltonetworks.com/#/tag/Unit42.Locky), [TeslaCrypt](https://autofocus.paloaltonetworks.com/#/tag/Unit42.TeslaCrypt) and [Andromeda](https://autofocus.paloaltonetworks.com/#/tag/Unit42.Andromeda) tags.

We observe Locky exhibiting this technique:

4b9a525a80cdba0d827b52d1e19c0b74e055b9afacfa2910dd32230826f91a7a  
7fe3c82165fa2fad745c337325eaa99bbbc1ca7b89479a52d64af7813b47e1e4  
d958c6f0a5208a6040e06ab71decbed47f3ac7e8235a13c918a0b68eb5ae5748  
6715765a36d6e6cb6f2e8b159e21d914aa0bdf433f2ece3032535e9ea0382f80  
38774f2381c0d62b522604e66d42d4b320b6a10a229f25c129e96ad6d62c57c1  
afcaa1b0e7864a3e471b5d6ffb66816d2def62c363aa0d8a23cdf96684d4960d  
5d29dbf3f854457b71a502d4487d620986924582f5c8997ef9f55c6ba038b6b5  
64d51aaf4abe4e87013056277277f05c55c6554d2a7005374f254983ac846c4d  
127c4c0437af192ad9b216b7dc3daf7b8b20e04f39559487ff5bf6d29e7b624d  
24e330f05b3fd86761969037cfd384a044b81c05bd3626b2d74dbacb2d18972b  
00fba93cee17df9d76475c4a07ecbc4663917990d5175284f4ec9fd5e9de9314  
94cfc072d57250f5da4409682bab75f655ac70bf384885b008b785357e0cc256  
85e22edb58902c1c087103f1be083f3fbdd1f6b2737efb32b229c92eb1fbf30f  
a83824d43c04893a3c0563f4bc8ca9adde5ad2d4f8b9eddd7e8521f3c36be0e0  
c7d9b7e3cc672d0bb588d247b5860527d8e48eb0ae642ab4454ff12cb921d8e3  
9fec0efb432f7ab3dc68c2e9913492d5e640084eb2e94226837a896dc1a3ea8e

We observe TeslaCrypt exhibiting this technique:

9651d0cbca5c0affc47229c33be182b67e7bfbc09d08fd2d1c3eb2185bb29cdf  
9fff99c289db327d2ed6b65c199c3424f85b013ecb9826a47f368841386f1f42  
8b30a779db7a22a48ec923c2e0f2277be777ebb196487d15872e2df4a3742fda  
e08fec9f5a41f47c66531755a6f229b1066d475abf3f36d87f8901358b475c26  
d7cacf0b6c8ed4f0dfb0666e9fb7cc0bfe44da540db0ac613b920229681d2d9a  
b00ce6a6107f0ace12878c3636fd42494bc387ba494f87c094c3597eb1dd4943  
ae006b6c9d03e3e5ee0a98cf82fa517ac361f04d66ebf98029e12569e1f467be  
e12617985ebb160e6e6e02ecaad83adfda37df66722002f63fd0804f45f7ff09  
c2d4f240122354a6db5edc428dba1b6d6540dc10818d5561128690d57388c508  
84b5d49183870ec8adaea182bdcb857e503720a4e656ad580397ec98bc7bc6cf  
af5bc5a9d2dc6f0c5e6321a7b760867d7c52f6701212e1ac0ad667dd5bee94b3  
bb002ddcc4ef252d0d9457f5e91589933ee99ee9142656a8b37e02be7b90742f  
ad6bfc0b940aa142ec925b54ff3feabbfab60751034a102f8a7a5ee84f5eda51  
bbd8a4b1d60547638c67c325a3ce1b449758146c3e3a49731c3ddaf8f987c0d3  
8ca7583fc45500e4f02955022350c9b64c1ce774eeca2d7684fe0118d2f469ff  
99a3457f10de4b4e33fd65ec341e0f4cc543a1c076c2f3eefca8d41ef56c93b7  
83427ffa553f49bb627045c609b5d4e505f7129616cccce9958f61c084985676  
961ac867a29c0afe193aedc279d95a08872e524e8ac1b6d62f83644ba1db5692  
8d342e16a1ab0b33c666e86b03f9580f25be2eb1067d590a8c21545f9e5247a7  
b76dde85793d4f8ea23957f9cf9fac790c18968429aab3a9024cefcead7db309  
b3f8a863a7ab9d14510e83424a1a4b8ace18d7e0997102ed6731880aad9859bf  
a70a192bbe3fd9126b138d16bb70ee2f941756be8b695f450355e1fa1aaa05aa  
7f862e66f96764eff67d06ee7edfb086e5c871720681c5d7caed7df2c9734f8c  
d9934d3cf498e08fe39bfb070545b010b1888f85716db9aca7f5b20134a7437a  
a677620dfe3676d80cbb655e5a28eab477256a1023418c225002e6cd2e886e3f  
8e8ce12b7d5efd2315ea11516d17f503772d306b106713a505d7bdfc658ff564  
8f53da2f01194680b7ec2fa848b7e3d438f4bf1d3cef72e6b4094b00a1a877cc  
9b0939fa4c00061cb9588ae8d30679fe92d46e38f48af6c7bad1317c5e93d2e0  
8537361d63e80f5479ad8e36c61c2f8dc798eff9bc364ef4f4e74bee035f1820  
8f8a91dc0b525da0aa81ceda682aaf4580300f3c2fb63da545646a1c2f088bf1  
e0449abe02aa3ec49f98e900685d0bab920fdab5012588a7892f4b992fa86b28  
b27336bf97cc72499336ba3c5f0ba8134d6aeb95225a17342379bea74e9dc758  
b3fe8b423dfb28b0b505259efc28e567c4b2adeae550d0fd214dbf4368806f1a  
db0654584870e3c7e701cd8a35b8267728db0dacaa9c411cf18e335ae062196e  
7d7f02a051696bc706cc9b07b115a11c89093ccb22a37fc27b825486e7ff0a0d  
97c6d884eb61dba0f0798464351d69ce24b528b24f68e668e81af52582a9a0ab  
af20e170ae290df4f0b34909c51d18e0ea1ce6fea47adb29d858df42d4d50750  
86ed651308c6c04d4ad2b2eecae31637a70f0d9b6d2fb04726f3bd07fbc5ad4a  
7aed6b832bb58adebeb560ce532840edfeee65d8e18c1a0be61b264cf74c1e47  
93d16b2b5a3fefa578ffec2f2bd2e3b818702b0988a6bd14050e485fcef5cf06  
a670f6fc15074e1fd79b26fee28d48eebce25fe6608b00dc23e1386dacca9442  
ab035382f8dfe6fc13374d1e9cc92ebf3d44e32e1d757485568545f92dae5005  
d70c74726a8ab6c4dd2ee530795267a409f0504ed1384537241f5bc0fd77d65d  
ac4b81c115787ea2724a48a6ccd36ea11f62336fe4cac01d7b8e6dd05c318b69  
cba3f4d1b73b5be52a4a79de875b1fda7d6cb58c0b6782f9a03e0562940eab7d  
ad970a3a893b5b67f4b805606bb3ea04f0552e2cda6adaa38a4ebfa323a67838  
add5534feeee9fdeb962d2bf55baddda8854d9e3b43103cc2007d6a75860774a  
dd2998e204f7179c550728c77ed05290bde36dd897d851ce323b6b84800bfe80  
c0f1da5ef339a0f47734704ea77611a43232fad5819ae9dab04178380e38aec3  
7fa1ed71fda8accb83ca520957c985019b7e43947b4bee47c8d71a826cd50035  
bdf819317a9e7fe8d5c1b337625230391a91f30449979b9b786f43f5c840d485  
52ddbadeb560819500f031406ed629ea53f7ccdb0feccb43968fa3be668c45a1  
58dabaefe317881362df1e13d190505285c38a0e2fe353d2784defde4c709f92  
75336c9de17b7444ac5220360b5a0766d3898d81eb77ba01cd2bbef95975797b  
0712e38624f0cf75f79245326108b754efbc318545ef8e1c685b3306369d2384  
70a443f84aae5e88824df72d39f797b7aa5ba00aa82940f16c23d1b5bcee5cce  
356b11753cde7d628406f61580bc823300bc4b954eb79c0766224bd4b8dad05f  
2d44dd2dd4d4d5ef835ce8a1cde4a45ab39119196a6fe26ab4c9ee8a3b790228  
1dcdc62763c4d77f8ea9d64eca310fceb74194efb8700b365028862b44d7e8df  
76a3883da15069287c8972099fc922477e41f3160599eb86de4ad9377a3f43ed  
3af0c37ab942960fc642665e36644a5cc0ac2d0e779172bc1d5233cb3ecff710  
3efd082e3aed3a42d7a16825201153928787cfd6438e7a5f5ecddc9c15efdaf1  
288a00387f76046c1598f21bb54dcfbc6a499499f4117c39e7645c54d350c130  
25e233b41022d6fa9a3fcb5c723229065a499ea77a4f4eb6e33d185b131e27d0  
6345af00608caadb29b82ed03674a6e889a3c33e6b76e1434052ca5e65e64c7d  
42ab4fdff74592bf0097efda55b0f0529d6579dd8c83e9fb79d81dd8f4d76376  
01c814fa5b67317b083e87c0e94bfb78333d4841f24d3d95ecb992700542b87f  
794b32f5d08cf7f7e9faff39707c0652f35a5cf1992135e8930863d9bcac4f0f  
464e8d4903536ea7f99c7bf8ddabf3ffe568e11e490dbd773c4fae5e552fd311  
3d4c955e9a5d2aafbb359b5ebefa8173f73862600809204a969bc4b1b30fe27d  
05cc2952f76d3d273ed3eb97dcd537c82cc1afdec44817712cd088a40bbe7003  
6400a149d316df356f9d1ad490e69f3d6eacadfa4b835ea180b50b5a9023a267  
58b50c39b70c9b55aa6ac34a548f9c076034e75ff08885e2cb44cc1a1a7187de  
416c5e3cc4771a78317249eb8745dcf16081d9126c5f6b7a4ebf750f512c64b7  
100049de5895a7f96204f86aaae14d5f271d8e4c3cd918a51efe30103f33e7b2  
0a1f05a1aa720ad600aedc0cbc0c19f662159075447c188c2642f5b64f63da7f  
79cb69fef2f0ef73f26e4cfcbb3f959f0f85f6a1de52d2c3202cbe00aea75d41  
500a371e28cc97fa29e649a082c8eae7a64cedee8b17505a088977dbf9dce68e  
3c573e5994285957e8d12376b7187173945a6395b2bc59197492c70a2e3382e2  
61ee0172985612fb1e85c6707671cda79dacb982cf4a15851b6c655f5799b884  
783e77cca5a20da0285c472d334b3da47995c2c838f67eacb220491e6459b0cd  
1d975e692a7596e37ce5ef812b420fd6915f2461fec7f460413e018e4cd3a03c  
37b154bb5dc1aeda58972fef4380da2f0d63c8c358cb4e2b36f9f177dc0afc4f  
620be6db60593855d9a190b3a05e6d4d3103879b0d3eee75056dfec1d169ddbf  
34275d0fb73575447c5016a519ccf0bed9ca292ab4a2f1908226521d0594a139  
69b7b58065ea977e66c9adf161a7c70d35533d97e9d8c6ea5957e01869077402  
5e03297fea99d6d397a1298724e49aa0390e3c0686be5028ca5c923a66d12b20  
415e27f3b6e4cd02a77d656a852c8de9a1dc911f5b1c51e0c2d50c356832838f  
6f90dd4223c979615f55b7a6a6c88370052b96cc4309cde2048a00d8fab60b17  
50978d98135917773ba1117bff918ac66a30a4dce742c645dbd68c1b8f02a281  
001261336f0190c366f05cc20a5c01062d5f25cddf98019e0674c28b86c4227e  
357a241a37ee9578174872084a3a3a25ca03074878986d55617ae9ba216e2a39  
3a892a2b223e90cc9017c5245e0a7b32c902056ab5f1ffc1ac5fc18f788a35cd  
68fd79b623b1dec65ad10691ac8cb4877c000faa022de809c48f5a419d1eff6e  
0255f33108708f136034ca2fce1496cf37b3d9ebf4bda9a7c00ceb44a6c1955f  
4aca6fa3401813f88d9111079a0d81af128093c12b8519e3fd4def47a81d4710  
77ce4ba2a605e22b8699eef874d075fb585d259ed6cade2e503e6dbf58020aa0  
65a92ba86259e051cbb721ff5b13cd89cc9b76845f531180afe2feb416635cd1  
4ba6b18edc0099936dbfc444fd2b089271a398bf03d78372456ac7f631ccee36  
6d4be5072e052e4c4aa1b59da379a8e4e01fe166d5ce6084cf86448bfe2370d0  
2a9e9e279b6bae67efe101614cbf7ca00b10cd2ad1f713c07b393861bdb9a3f1  
3f2eb88bc86235f47470cf741f0adef5016492e99956ec87b5ab2896e0dd5ca2  
4132ab07b9273a1ed5d4ca979500e7cb541c33029775f7be795f94f43980e5ea  
78741b5bbe94903ce22a9db5fb578fd3af4f2cad48142480a1354d156943a4fd  
0ed6bbbb6f372723be1ed38e2bacd8f7d81a96b71d11ba0f46071c14e628016b  
4630cb47542259b71e006560ce9a88244b1be6256ee1f2f4767e1e1e47618430  
5dd1c647b4cbe9700809bfd35ae4537573659324c8f1ace006b4fac481e16148  
213661084774b4352fcd644617462bf7c0ccf21838e15dd081b3cf0cfbb11144  
0914e974e20c187a43807e91b95621e5ad0c14c54f6958546a60d84c0c777d29

We observe Andromeda exhibiting this technique:

9b84c2ef77b3c645bb643ee79de02a8a77eb81d79874cd6606edccd56314235b  
a87c12714badd54395e075d3c695397044a8a4aee740dd4f9657df524803b1ed  
b193f37721919e75e617173962e47153c05e303598e637764c837b3ac0a710d8  
c9a81f89d566683e540914df1cb1541ae69ed734f3d0c7e7ba81c0ad9de947f6  
88e661f55cbd241fce827df7de9c6eb5bd36bfb6dfe25a49dc0c88de167c0c8e  
cfd76af3f5df83b3b94bced9644f85b8496a6dd58227c4af24632e184cd814d2  
e2b36fc0e35c27723fdf623916368101af37543d63c6bcf0de737cec24d1e2e6  
b855a01cfce787a505cdd5785c4f511ea7fbc1fb6a9e27d60677cc033e505de3  
db5db710abf26674254383cdb7c4fc7c1308418b667341bf4a439541db71b427  
d5dfc305cf41d744d21aeb8432d286aa9288a26563f358306602cf809863d92c  
8ba8132621d462feb6f649a8f24506570c604acb5f5d607b7f6a675475db4f06  
bebc5dd62e0680b1f56a6b4e41231857da2842ace224bf88cc1c5365538a8fa9  
14f805e9f8ebd2b81ee4ee3c6a2e4b960039d8d99d13cf87d0da692947a02c91  
20928d79dccb0338a113529cc1652892e79f560b98b52909ec2037a6088a7fdf  
3fc9253bb1deac49b9889fb9cd1a90238239bd4e2db4d693ab99f29d08f029d3  
678f2a8b9bfa585f42429ed452f2a9c39266fc10f5bdc4decd0bdc2613601c8f  
78deed3fc6ccfa8bc6116c02d763a22a76e80bbfdce263158c366945d73af1c2  
5392b97ef98462d31e1c07bc064dafac254f246ebb7131e364a9ec82b5b48b20  
0594deb0b33ebb816fb27d4f0bf4d3ee7fce2146489cc152bd0894226840ef0c  
2bec223894f14670c737b1f7ab766790cc9bf7490354d1e17ffb7e9defcaeb3a  
33669080a8e8ae2ba43fd13887d3ee5cd9d686187c7d3ba82eb1da2b538fd63f  
7a82a933650600bab70a85ff329a52329f5fadf64c05a86d1122298e1aaa9081  
74bbceabb3ec583f7b92d55d0556aa1d0c0f302485649045bd2667b4959f62cc

Back to top

### Tags

* [Andromeda](https://unit42.paloaltonetworks.com/tag/andromeda/ "Andromeda")
* [Locky](https://unit42.paloaltonetworks.com/tag/locky/ "Locky")
* [TeslaCrypt](https://unit42.paloaltonetworks.com/tag/teslacrypt/ "TeslaCrypt")  
  [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Don't Be an April Fool: Inside a Common Phone Scam](https://unit42.paloaltonetworks.com/unit42-dont-be-an-april-fool-inside-a-common-phone-scam/ "Don’t Be an April Fool: Inside a Common Phone Scam")

### Related Articles

* [Everybody Gets One: QtBot Used to Distribute Trickbot and Locky](https://unit42.paloaltonetworks.com/unit42-everybody-gets-one-qtbot-used-distribute-trickbot-locky/ "article - table of contents")
* [Review of Regional Malware Trends in EMEA: Part 2](https://unit42.paloaltonetworks.com/unit42-review-of-regional-malware-trends-in-emea-part-2/ "article - table of contents")
* [Regional Malware Trends in Latin America: July - December 2016](https://unit42.paloaltonetworks.com/unit42-regional-malware-trends-latin-america-july-december-2016/ "article - table of contents")

## Related Ransomware Resources

![Pictorial representation of Iran cyber attacks. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/12_Security-Technology_Category_1920x900-786x368.jpg)  
[![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) April 17, 2026 [#### Threat Brief: Escalation of Cyber Risk Related to Iran (Updated April 17)](https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/)

* [APK](https://unit42.paloaltonetworks.com/tag/apk/ "APK")

* [DDoS attacks](https://unit42.paloaltonetworks.com/tag/ddos-attacks/ "DDoS attacks")

* [GenAI](https://unit42.paloaltonetworks.com/tag/genai/ "GenAI")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/ "Threat Brief: Escalation of Cyber Risk Related to Iran (Updated April 17)")  
  ![Pictorial representation of RaaS RansomHouse. Digital representation of cybersecurity concept with a padlock superimposed over computer circuit boards, symbolizing data protection and encryption technologies.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/12/06_Ransomware_Category_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) December 17, 2025 [#### From Linear to Complex: An Upgrade in RansomHouse Encryption](https://unit42.paloaltonetworks.com/ransomhouse-encryption-upgrade/)

* [ESXi](https://unit42.paloaltonetworks.com/tag/esxi/ "ESXi")

* [Jolly Scorpius](https://unit42.paloaltonetworks.com/tag/jolly-scorpius/ "Jolly Scorpius")

* [RansomHouse](https://unit42.paloaltonetworks.com/tag/ransomhouse/ "RansomHouse")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ransomhouse-encryption-upgrade/ "From Linear to Complex: An Upgrade in RansomHouse Encryption")  
  ![Pictorial representation of 01flip ransomware written in Rust. Digital artwork of a pixelated U.S. dollar bill disintegrating into small blocks against a blue data matrix background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/12/05_Ransomware_Category_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) December 10, 2025 [#### 01flip: Multi-Platform Ransomware Written in Rust](https://unit42.paloaltonetworks.com/new-ransomware-01flip-written-in-rust/)

* [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin")

* [CL-CRI-103](https://unit42.paloaltonetworks.com/tag/cl-cri-103/ "CL-CRI-103")

* [Cryptocurrency](https://unit42.paloaltonetworks.com/tag/cryptocurrency/ "Cryptocurrency")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/new-ransomware-01flip-written-in-rust/ "01flip: Multi-Platform Ransomware Written in Rust")  
  ![Pictorial representation of malicious LLMs. Close-up view of a digital wall displaying various glowing icons, representing a high-tech network interface.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/11/AdobeStock_1270203474-786x440.jpeg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) November 25, 2025 [#### The Dual-Use Dilemma of AI: Malicious LLMs](https://unit42.paloaltonetworks.com/dilemma-of-ai-malicious-llms/)

* [Credential Harvesting](https://unit42.paloaltonetworks.com/tag/credential-harvesting/ "Credential Harvesting")

* [Data exfiltration](https://unit42.paloaltonetworks.com/tag/data-exfiltration/ "data exfiltration")

* [LLM](https://unit42.paloaltonetworks.com/tag/llm/ "LLM")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/dilemma-of-ai-malicious-llms/ "The Dual-Use Dilemma of AI: Malicious LLMs")  
  ![Constellation image representing the constellation schema used by Palo Alto Networks Unit 42 to track nation-state and cybercrime threat actor groups](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/Generic-B-1920x900-1-786x368.png)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/threat-actor-groups.svg)Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/) August 1, 2025 [#### Threat Actor Groups Tracked by Palo Alto Networks Unit 42 (Updated Aug. 1, 2025)](https://unit42.paloaltonetworks.com/threat-actor-groups-tracked-by-palo-alto-networks-unit-42/)

* [Academic Serpens](https://unit42.paloaltonetworks.com/tag/academic-serpens/ "Academic Serpens")

* [Agent Serpens](https://unit42.paloaltonetworks.com/tag/agent-serpens/ "Agent Serpens")

* [Agonizing Serpens](https://unit42.paloaltonetworks.com/tag/agonizing-serpens/ "Agonizing Serpens")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/threat-actor-groups-tracked-by-palo-alto-networks-unit-42/ "Threat Actor Groups Tracked by Palo Alto Networks Unit 42 (Updated Aug. 1, 2025)")  
  ![Pictorial representation of Unit 42 threat attribution system. Illustration featuring a white triangle centered within an abstract cosmic background of purple and blue swirls and stars.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/07/Generic-A-1920x900-1-786x368.png)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/threat-actor-groups.svg)Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/) July 31, 2025 [#### Introducing Unit 42's Attribution Framework](https://unit42.paloaltonetworks.com/unit-42-attribution-framework/)

* [Advanced Persistent Threat](https://unit42.paloaltonetworks.com/tag/advanced-persistent-threat/ "Advanced Persistent Threat")

* [Bookworm](https://unit42.paloaltonetworks.com/tag/bookworm/ "Bookworm")

* [Nomenclature](https://unit42.paloaltonetworks.com/tag/nomenclature/ "nomenclature")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/unit-42-attribution-framework/ "Introducing Unit 42’s Attribution Framework")  
  ![Pictorial representation of the ransomware landscape. Digital artwork of a disintegrating U.S. dollar bill with pixelated effects on a cyber-inspired background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/04/05_Ransomware_Category_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-report-white-1.svg)Trend Reports](https://unit42.paloaltonetworks.com/category/trend-reports/) April 23, 2025 [#### Extortion and Ransomware Trends January-March 2025](https://unit42.paloaltonetworks.com/2025-ransomware-extortion-trends/)

* [BianLian](https://unit42.paloaltonetworks.com/tag/bianlian/ "BianLian")

* [Akira ransomware](https://unit42.paloaltonetworks.com/tag/akira-ransomware/ "Akira ransomware")

* [Muddled Libra](https://unit42.paloaltonetworks.com/tag/muddled-libra/ "Muddled Libra")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/2025-ransomware-extortion-trends/ "Extortion and Ransomware Trends January-March 2025")  
  ![A pictorial representation of Akira ransomware, distributed by Howling Scorpius. A person's hand typing on a keyboard with a digital screen displaying the word "password" highlighted in blue, set against a backdrop of various cybersecurity interface graphics.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/09_Cybercrime_Category_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) December 2, 2024 [#### Threat Assessment: Howling Scorpius (Akira Ransomware)](https://unit42.paloaltonetworks.com/threat-assessment-howling-scorpius-akira-ransomware/)

* [Howling Scorpius](https://unit42.paloaltonetworks.com/tag/howling-scorpius/ "Howling Scorpius")

* [Leak site](https://unit42.paloaltonetworks.com/tag/leak-site/ "Leak site")

* [Torrenting](https://unit42.paloaltonetworks.com/tag/torrenting/ "torrenting")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/threat-assessment-howling-scorpius-akira-ransomware/ "Threat Assessment: Howling Scorpius (Akira Ransomware)")  
  ![Pictorial representation of a threat like BlackSuit ransomware. An illustration of a modern workspace with a laptop displaying cybersecurity icons, surrounded by stacks of coins and a credit card, all depicted in a neon, digital art style.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/04_Ransomware_Category_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) November 20, 2024 [#### Threat Assessment: Ignoble Scorpius, Distributors of BlackSuit Ransomware](https://unit42.paloaltonetworks.com/threat-assessment-blacksuit-ransomware-ignoble-scorpius/)

* [BlackSuit ransomware](https://unit42.paloaltonetworks.com/tag/blacksuit-ransomware/ "BlackSuit ransomware")

* [Construction](https://unit42.paloaltonetworks.com/tag/construction/ "construction")

* [Education](https://unit42.paloaltonetworks.com/tag/education/ "Education")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/threat-assessment-blacksuit-ransomware-ignoble-scorpius/ "Threat Assessment: Ignoble Scorpius, Distributors of BlackSuit Ransomware")  
  ![A representation of a threat group like Jumpy Pisces. Illustrative image featuring two fish and the Pisces constellation superimposed on a stylized, abstract background with flowing purple waves and a starry night sky.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/Pisces-NK-A-1920x900-1-786x368.png)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/threat-actor-groups.svg)Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/) October 30, 2024 [#### Jumpy Pisces Engages in Play Ransomware](https://unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/)

* [North Korea](https://unit42.paloaltonetworks.com/tag/north-korea/ "North Korea")

* [Jumpy Pisces](https://unit42.paloaltonetworks.com/tag/jumpy-pisces/ "Jumpy Pisces")

* [Fiddling Scorpius](https://unit42.paloaltonetworks.com/tag/fiddling-scorpius/ "Fiddling Scorpius")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/ "Jumpy Pisces Engages in Play Ransomware")

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)  
  ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]()  
  ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png)  
  ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42

## Peace of mind comes from staying ahead of threats. Subscribe today.

Your Email

Subscribe for email updates to all Unit 42 threat research.  
By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement")

This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.

Invalid captcha!
Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg)  
{#footer} Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security)

* [Secure AI by Design](https://www.paloaltonetworks.com/ai-security)

* [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase)

* [Prisma SASE](https://www.paloaltonetworks.com/sase)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/content/pan/en_US/cortex/managed-detection-and-response)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam)

* [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira)

* [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management)

* [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management)

* [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager)

* [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance)

* [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management)

* [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic)

* [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management)

* [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance)

* [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery)

* [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42)

* [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense)

* [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses)

* [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy)

* [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence)

* [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond)  
  Company

* [About Us](https://www.paloaltonetworks.com/about-us)

* [Careers](https://jobs.paloaltonetworks.com/en/)

* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales)

* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility)

* [Customers](https://www.paloaltonetworks.com/customers)

* [Investor Relations](https://investors.paloaltonetworks.com/)

* [Location](https://www.paloaltonetworks.com/about-us/locations)

* [Newsroom](https://www.paloaltonetworks.com/company/newsroom)  
  Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/)

* [Communities](https://www.paloaltonetworks.com/communities)

* [Content Library](https://www.paloaltonetworks.com/resources)

* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia)

* [Event Center](https://events.paloaltonetworks.com/)

* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)

* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z)

* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications)

* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure)

* [Sitemap](https://www.paloaltonetworks.com/sitemap)

* [Tech Docs](https://docs.paloaltonetworks.com/)

* [Unit 42](https://unit42.paloaltonetworks.com/)

* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)

* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy)

* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center)

* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use)

* [Documents](https://www.paloaltonetworks.com/legal)

Copyright © 2026 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* EN  
  Select your language  
  ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg)

### Default Heading

Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg)  
Seekbar

![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg)  
![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg)  
Volume
![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)