[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/)  
[![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/)  
Menu

* [Tools](https://unit42.paloaltonetworks.com/tools/)
* [ATOMs](https://unit42.paloaltonetworks.com/atoms/)
* [Security Consulting](https://www.paloaltonetworks.com/unit42)
* [About Us](https://unit42.paloaltonetworks.com/about-unit-42/)
* [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html)
* [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research")
* [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research")
* [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware")  
  [Malware](https://unit42.paloaltonetworks.com/category/malware/)

# Review of Regional Malware Trends in EMEA: Part 1

![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 10 min read

* ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg)  
  By:
  
  * [Alex Hinchliffe](https://unit42.paloaltonetworks.com/author/alex-hinchliffe/)

* ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg)  
  Published:December 23, 2016

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg)  
  Categories:
  
  * [Malware](https://unit42.paloaltonetworks.com/category/malware/)
  * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/)

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg)  
  Tags:
  
  * [EMEA](https://unit42.paloaltonetworks.com/tag/emea/)
  * [Threat research](https://unit42.paloaltonetworks.com/tag/threat-research/)

* [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/unit42-regional-malware-trends-emea-part-1/?pdf=download&lg=en&_wpnonce=5f0cc26d8b "Click here to download")

* [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/unit42-regional-malware-trends-emea-part-1/?pdf=print&lg=en&_wpnonce=5f0cc26d8b "Click here to print")

Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg)

* ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg)
* [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Review%20of%20Regional%20Malware%20Trends%20in%20EMEA:%20Part%201&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-regional-malware-trends-emea-part-1%2F "Share in email")
* [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-regional-malware-trends-emea-part-1%2F "Share in Facebook")
* [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-regional-malware-trends-emea-part-1%2F&title=Review%20of%20Regional%20Malware%20Trends%20in%20EMEA:%20Part%201 "Share in LinkedIn")
* [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-regional-malware-trends-emea-part-1%2F&text=Review%20of%20Regional%20Malware%20Trends%20in%20EMEA:%20Part%201 "Share in Twitter")
* [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-regional-malware-trends-emea-part-1%2F&ts=markdown "Share in Reddit")
* [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Review%20of%20Regional%20Malware%20Trends%20in%20EMEA:%20Part%201%20https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-regional-malware-trends-emea-part-1%2F "Share in Mastodon")

### Introduction

As we head towards the end of the year it's common to reflect on the year almost behind us and to [predict what the new year approaching will bring in terms of security challenges](https://blog.paloaltonetworks.com/2016/11/2017-cybersecurity-predictions-year-get-serious-iot-security/). This blog is part of a series that describe malware trends seen in the EMEA (Europe Middle East and Africa) region over the last six months of 2016.

Not long after joining Palo Alto Networks and the Unit 42 Threat Research team I was tasked with authoring and publishing monthly regional threat reports for internal use that focused on the EMEA region using data from our AutoFocus Threat Intelligence Service. The report contents and structure are fluid but some constants exist too, such as tips, take-aways and tools described for readers to learn and act upon to improve their security posture. We are working towards making the reports themselves public, meanwhile, this blog, and future blogs in the series, serve to publish summary information from each of the reports. This blog refers to data extracted from the June and July reports.

EMEA is the largest region on earth in terms of land mass spanning 4 continents from Greenland in the North and West, to the Cape of Good Hope in the South of Africa and as far as Iran in the East but location is pretty much where the commonality ends. The EMEA region is incredibly diverse with more countries than other regions, more languages, arguably more ethnicities and vastly contrasting GDP (Gross Domestic Product) figures as well as population sizes. Despite EMEA accounting for approximately one third of the world's GDP, per capita, it also includes both the richest and poorest countries. All this amounts to the region being a great place to conduct business however, unfortunately, cyber criminals also believe the same and find it a lucrative market. The malware seen here is not necessarily unique to the region but like the region it is diverse!

Breaking-down the EMEA region into sub-regions is necessary to create digestible threat reports with meaningful data, however even that is not simple due to disparate cybersecurity postures and policies, maturity levels and, indeed, social and economic aspects of each country. That being said, the reports thus far cover segments of the region that are somewhat similar in terms of most of those aspects. For example, the first report covers countries in western Europe with similar GDP (Gross Domestic Product) amount. The second report covers some countries that are located in the Middle East region and are considered as emerging markets.

### United Kingdom, Germany and France

These three countries top the GDP list for the EMEA region and thus the European sub-region as well with most of their wealth coming from the services sector.

#### Highlights:

* Information stealing Trojans are rife in all three countries most likely due to their large service sectors with companies that store and process customer data.
* Low-points in malware sessions were around Brexit referendum voting time.
* Higher than usual H1N1 downloader Trojan activity

[![trend\_1](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/12/Trend_1.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/12/Trend_1.png) The United Kingdom had the highest amount of malicious sessions of all three countries, as seen in our next-generation security platform and, as the three-month\*\* trend shows, much of this traffic [![trend\_2](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/12/Trend_2.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/12/Trend_2.png)

was during April and May, peaking on May 27^th^. Most of this peak consisted of [Locky](https://autofocus.paloaltonetworks.com/#/tag/Unit42.Locky) ransomware campaigns but also included more than one hundred samples in over 7,000 sessions affecting Government and Higher Education.

*\*\* The regional threat reports are monthly but often it's useful to review information and trends especially over a wider period for more context.*

[![trend\_3](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/12/Trend_3.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/12/Trend_3.png) Germany showed a similar peak to the [![trend\_4](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/12/Trend_4.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/12/Trend_4.png)

United Kingdom and also consisted mostly of Locky ransomware campaigns. However Germany saw fewer samples but over double the number of sessions. In contrast to the United Kingdom, the majority were seen in the Healthcare and High Tech industries. Locky, like many other variants of ransomware, is victim-agnostic because of the nature of the adversary's [attack and delivery method](https://blog.paloaltonetworks.com/2016/02/locky-new-ransomware-mimics-dridex-style-distribution/) that uses weaponized documents, containing macros to drop and execute the payload, attached to emails sent out in very large, wide-spread malspam campaigns a la [Dridex](https://autofocus.paloaltonetworks.com/#/tag/Unit42.Dridex). The evolution of Locky ransomware since early 2016 has seen various changes not only in the payload behavior but also the distribution methods [switching between](https://blog.paloaltonetworks.com/2016/03/locky-ransomware-installed-through-nuclear-ek/) various [Exploit Kits (EKs) and campaigns](https://blog.paloaltonetworks.com/2016/07/unit42-afraidgate-major-exploit-kit-campaign-switches-from-cryptxxx-ransomware-back-to-locky/) to infect users browsing compromised websites. Locky is ubiquitous: so much so other cybercriminals have [copied its traits](https://blog.paloaltonetworks.com/2016/07/unit42-powerware-ransomware-spoofing-locky-malware-family/), while using their often-recoverable malware to infect and encrypt as if it were Locky, probably to social engineer the victim into a quicker response and payment.

During the spike of Locky-related activity on May 27^th^ just under a quarter of samples seen in the United Kingdom contained a unique feature not present in any samples seen in Germany during the same activity. AutoFocus additionally tagged those samples as having a behavior indicating the malware queried the system BIOS (Basic Input Output System) information during execution in our WildFire™ cloud sandbox. The "BiosDiscovery" tag represents a method commonly used by malware to determine whether running in a virtual machine or not, which could indicate execution in a sandbox environment.

### Bolster your defenses:

Locky certainly is a formidable force with its aggressive distribution methods and sheer prevalence, which raises the probability of would be victims getting infected, however there are numerous points during the kill chain or attack lifecycle at which both an exploit delivering Locky or the Locky malware itself can be disrupted preventing its end game of encrypting your data. Interrupting network communications based on source and destination domain names, command \& control traffic and unknown TCP; on the end point exploit-related behavior in various applications can be blocked and further methods include detecting DLL and thread injection routines as well as suspicious static file attributes, such as lack of digital signatures.

Malware, including Ransomware, is often distributed by attackers using email but sometimes the method of delivery can differ. Many include the malware as a raw executable file (.EXE, .SCR, .CPL or other file types) as an attachment, which is quite a primitive technique but sadly one that still results in successful infections. Less amateurish are those attackers who obscure their payloads inside other file formats, such as documents containing macros capable of unpacking and executing the executable file embedded inside or downloaded from a remote host; using JavaScript attachments (either directly attached or masquerading inside an archive ZIP attachment) leads to similar results. Some file attachments include exploits capable of exploiting vulnerable applications or systems, or contain URLs pointing to sites hosting Exploit Kits that use more advanced and automated means to deploy the same exploits, however end-point protection with exploit prevention can stop these methods.

[![trend\_5](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/12/Trend_5.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/12/Trend_5.png) Based on this information it's possible to stop many of the low-hanging fruit malware attacks on your network and end-points. Start doing something different tomorrow - Block email file attachments such as document files containing macros, ZIP files containing JavaScript code (or JavaScript full stop,) and other suspicious file types. If you can't block exclusively, at least reduce who in the company can receive such email attachments to reduce the attack surface.

[![trend\_6](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/12/Trend_6.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/12/Trend_6.png) The landscape [![trend\_7](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/12/Trend_7.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/12/Trend_7.png)in France was a little different over the same time period with the peak volume occurring very early on comparatively. April 7^th^ saw over two hundred samples in more than 27,000 sessions using various applications including email-based and web-browsing, predominately affecting Government, High Tech and Service Provider sectors. [Rockloader](https://autofocus.paloaltonetworks.com/#/tag/Unit42.Rockloader) -- an intermediary downloader Trojan -- made up most of the malware samples, together with subsequent payloads including [Kegotip](https://autofocus.paloaltonetworks.com/#/tag/Commodity.Kegotip) and [Pony](https://autofocus.paloaltonetworks.com/#/tag/Commodity.Pony) Trojans capable of harvesting credentials or other data from victim systems as well as installing further payloads, such as Locky ransomware.

### Brexit Disrupts Malware Volume

After 3 months of pretty consistent malware volume, different peak dates and malware campaigns it's very interesting to note that all three countries had their troughs in the same week, if not the same day, at the at the end of June. No, not early summer holidays for these countries or their attackers, but instead, a very significant political event so-called Brexit ("British Exit") whereby British citizens voted to leave the European Union during a referendum held on Thursday 23^rd^ June. The decision, which came as a shock to many around the world, became known the day after. This whole event was significant and I strongly believe it was no coincidence that typical traffic patterns were affected. Perhaps attackers were waiting for the media to report the result with predictions for the future, largely revolving around economic uncertainty and Britain slipping back into recession, before launching their "post-Brexit" phishing attacks using topical news, as [reported the week after](https://www.ibtimes.co.uk/hackers-capitalise-brexit-sending-out-spam-emails-that-infect-victims-computers-malware-1568709).

In the month of June, [PredatorPain](https://autofocus.paloaltonetworks.com/#/tag/Commodity.PredatorPain), an information stealing Trojan capable of capturing passwords, keystrokes, screenshots and other sensitive information, was extremely prevalent in the United Kingdom. Germany had a mixture of malware each constituting significant volume including [Vawtrak](https://autofocus.paloaltonetworks.com/#/tag/Unit42.Vawtrak), another type of information stealing malware forming a botnet primarily focused on gaining unauthorized access to bank accounts through online banking websites, [H1N1](https://autofocus.paloaltonetworks.com/#/tag/Unit42.H1N1), and a single variant of the [Andromeda](https://autofocus.paloaltonetworks.com/#/tag/Unit42.Andromeda) downloader Trojan that alone was the most prevalent sample of the month. France also saw significant volume of the H1N1 Trojan downloader, which is capable of receiving remote commands from a command and control (C2) server in order to download and execute further malicious payloads.

### Turkey, Saudi Arabia and United Arab Emirates

These three countries form part of the Middle East region and the emerging markets of the world. Turkey's economic growth relies primarily on services, much like the European countries in the first regional threat report, however Saudi Arabia and United Arab Emirates (UAE) are extremely reliant on their oil and industrial sectors, although the UAE is diversifying into services and other sectors. The diversity of these countries, not to mention the greater Middle East region, their natural resources and foreign policies makes for a very interesting cyber attack landscape, an example of which, dubbed the [OilRig campaign](https://blog.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/), describes some [targeted attacks](https://blog.paloaltonetworks.com/2016/10/unit42-oilrig-malware-campaign-updates-toolset-and-expands-targets/), against various industries and countries.

It's no surprise to learn that all three countries saw Locky campaigns throughout the month of July but also multiple attacks using the [LuminosityLinkRAT](https://autofocus.paloaltonetworks.com/#/tag/Commodity.LuminosityLinkRAT) (Remote Access Trojan) that has many features including an aggressive key logger that injects its code in almost every running process on the system. Once installed the attacker effectively has full control over the victim's machine with the ability to retrieve user credentials, record web cameras and more.

[![trend\_8](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/12/Trend_8.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/12/Trend_8.png)[![trend\_9](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/12/Trend_9.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/12/Trend_9.png) Saudi Arabia and UAE saw other common malware families not present in Turkey, such as [NetWireRAT](https://autofocus.paloaltonetworks.com/#/tag/Unit42.NetWireRAT), which has shown an uptick [![trend\_10](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/12/Trend_10.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/12/Trend_10.png)the rise [![trend\_11](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/12/Trend_11.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/12/Trend_11.png)globally often using Microsoft Excel documents attached to phishing emails that use macros to launch the malicious payload, whereas in Saudi Arabia and UAE, the emails included the executable files directly implying either different actors behind the attacks or an assumption about targets not filtering such file type attachments. [Atmos](https://autofocus.paloaltonetworks.com/#/tag/Unit42.Atmos) malware -- a polymorphic variant of Citadel (which is based on ZeuS) targeting financial and confidential user data is also trending upwards [![trend\_12](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/12/Trend_12.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/12/Trend_12.png)in these two countries.

[Neutrino](https://autofocus.paloaltonetworks.com/#/tag/Unit42.Neutrino) point-of-sale (PoS) malware was seen in Turkey and UAE during July. Neutrino attempts to scrape credit card information from memory on the infected system. UAE saw one variant of this malware over twenty one SMTP sessions using blank email subject lines and attachment "Payment TT copy with Invoice.exe" primarily affecting the Energy sector.

[![trend\_13](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/12/Trend_13.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2016/12/Trend_13.png)

Like the United Kingdom, the PredatorPain information stealing Trojan was present in Turkey in July, however on this occasion the malware was delivered through an exploit in a Rich Text Document (RTF) file taking advantage of a 2012 vulnerability causing a buffer overflow in the ListView / TreeView ActiveX controls present in the MSCOMCTL.OCX library. The fact this exploit was so old proves that attackers will often use such techniques as they are still successful, unfortunately.

Patching systems as a security practice is as critical now as it ever has been, if not more so, given the advancements in Exploit Kits largely automating the exploitation and delivery malware but you can prioritize by focusing on vulnerabilities being used by attackers in the wild, followed by vulnerabilities with known exploits and Proofs of Concept.

After Locky, related downloader malware and PredatorPain, the Pony Trojan was the next most prevalent malware in all three countries. Pony is a popular piece of commodity malware capable of downloading further payloads but also comes equipped with a number of plugins to stealing stored credentials for various file transfer clients, web browsers and email applications. Whilst global trends for this malware were trending down slightly during this time the volume seen in the three countries was consistent and at quite high volume, relatively speaking, with Higher Education and Finance sectors being most affected.

### Conclusion

EMEA is a socially and economically diverse region with many interesting assets whether they be citizen data, financial information or natural resources and, as such, is a target for cyber criminals the world over.

It's interesting to consider that information-stealing malware, such as PredatorPain, is prevalent in countries that have a more service-based economy that manage and process plenty of user data and personally identifiable information (PII).

Some of the other countries analyzed that are more reliant on industrial sectors and natural resources seem to have more cyber attacks using RATs providing full control to remote attackers and use of key-logging technologies to harvest data.

Currently on its fourth iteration the regional threat reports have proved useful and, based on feedback, discussions are now ongoing about releasing publicly and expanding beyond the EMEA region as well, so watch this space so you too can get a better understanding of what's going on in different countries, sub-regions and industry verticals around the world.

### Cyber Hygiene

The threat landscape is vast and can be complex but you can minimize your risk of infection and enhance the overall health of your network by following some basic cyber hygiene habits:

Patch systems and applications wherever (and as soon as) possible. Alternatively, focus on other security solutions, such as exploit prevention technology to protect those systems and applications from attack or to help manage patching cycles to suit your requirements. Prioritize patching based on known exploits or in-the-wild-attacks. Segment those unpatched/unpatchable devices in the network with additional access controls based on users or application communication to minimize the risk of exploitation. Perform regular vulnerability scans of systems and review changes to spot new devices or changes in active vulnerabilities.

Change the file association for JavaScript to be opened using notepad (or something else benign) rather than the Windows Scripting Host or other shell capable of executing malcode. This can be done per PC or enterprise-wide using Group Policy.

Educate users and employees of the security risks faced by your organization and perform regular training and reminders about these and how they can help the effort. Provide a platform for users to learn about the risks and to report incidents to security-related staff. Create a culture whereby such reporting is important and valued. Monitor effectiveness of training for the purposes of gap analysis and creating dialogue between security teams and users.
Back to top

### Tags

* [EMEA](https://unit42.paloaltonetworks.com/tag/emea/ "EMEA")
* [Threat research](https://unit42.paloaltonetworks.com/tag/threat-research/ "threat research")  
  [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Palo Alto Networks Unit 42 Vulnerability Research December 2016 Disclosures](https://unit42.paloaltonetworks.com/unit42-palo-alto-networks-unit-42-vulnerability-research-december-2016-disclosures/ "Palo Alto Networks Unit 42 Vulnerability Research December 2016 Disclosures")

### Related Articles

* [Effective Phishing Campaign Targeting European Companies and Organizations](https://unit42.paloaltonetworks.com/european-phishing-campaign/ "article - table of contents")
* [New Shameless Commodity Cryptocurrency Stealer (WeSteal) and Commodity RAT (WeControl)](https://unit42.paloaltonetworks.com/westeal/ "article - table of contents")
* [OilRig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory](https://unit42.paloaltonetworks.com/oilrig-novel-c2-channel-steganography/ "article - table of contents")

## Related Malware Resources

![Pictorial representation of a magnifying glass illuminating a glowing orange circular digital circuit interface on a dark, high-tech background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Myth-Busting_Overview_1920x900-786x368.jpg)  
[![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) September 16, 2026 [#### Atomic macOS (AMOS) Stealer Activity](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/)

* [MacOS](https://unit42.paloaltonetworks.com/tag/macos/ "macOS")

* [Threat intelligence](https://unit42.paloaltonetworks.com/tag/threat-intelligence/ "threat intelligence")

* [Unit 42](https://unit42.paloaltonetworks.com/tag/unit-42/ "Unit 42")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/ "Atomic macOS (AMOS) Stealer Activity")  
  ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/)

* [API](https://unit42.paloaltonetworks.com/tag/api/ "API")

* [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic")

* [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE")  
  ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/)

* [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel")

* [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2")

* [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure")  
  ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/)

* [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI")

* [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT")

* [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America")  
  ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/)

* [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa")

* [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID")

* [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams")  
  ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/)

* [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor")

* [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin")

* [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution")  
  ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/)

* [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication")

* [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft")

* [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels")  
  ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/)

* [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK")

* [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum")

* [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet")  
  ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/)

* [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum")

* [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain")

* [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications")  
  ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/)

* [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain")

* [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop")

* [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm")

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)  
  ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]()  
  ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png)  
  ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42

## Peace of mind comes from staying ahead of threats. Subscribe today.

Your Email

Subscribe for email updates to all Unit 42 threat research.  
By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement")

This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.

Invalid captcha!
Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg)  
{#footer} Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security)

* [Secure AI by Design](https://www.paloaltonetworks.com/ai-security)

* [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase)

* [Prisma SASE](https://www.paloaltonetworks.com/sase)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/content/pan/en_US/cortex/managed-detection-and-response)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam)

* [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira)

* [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management)

* [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management)

* [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager)

* [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance)

* [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management)

* [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic)

* [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management)

* [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance)

* [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery)

* [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42)

* [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense)

* [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses)

* [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy)

* [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence)

* [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond)  
  Company

* [About Us](https://www.paloaltonetworks.com/about-us)

* [Careers](https://jobs.paloaltonetworks.com/en/)

* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales)

* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility)

* [Customers](https://www.paloaltonetworks.com/customers)

* [Investor Relations](https://investors.paloaltonetworks.com/)

* [Location](https://www.paloaltonetworks.com/about-us/locations)

* [Newsroom](https://www.paloaltonetworks.com/company/newsroom)  
  Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/)

* [Communities](https://www.paloaltonetworks.com/communities)

* [Content Library](https://www.paloaltonetworks.com/resources)

* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia)

* [Event Center](https://events.paloaltonetworks.com/)

* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)

* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z)

* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications)

* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure)

* [Sitemap](https://www.paloaltonetworks.com/sitemap)

* [Tech Docs](https://docs.paloaltonetworks.com/)

* [Unit 42](https://unit42.paloaltonetworks.com/)

* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)

* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy)

* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center)

* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use)

* [Documents](https://www.paloaltonetworks.com/legal)

Copyright © 2026 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* EN  
  Select your language  
  ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg)

### Default Heading

Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg)  
Seekbar

![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg)  
![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg)  
Volume
![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)