[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/) * [Japanese](https://unit42.paloaltonetworks.com/ja/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 12 min read Related Products [![Advanced Threat Prevention icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced Threat Prevention](https://unit42.paloaltonetworks.com/product-category/advanced-threat-prevention/ "Advanced Threat Prevention")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Next-Generation Firewall icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Claud Xiao](https://unit42.paloaltonetworks.com/author/claud-xiao/) * [Cong Zheng](https://unit42.paloaltonetworks.com/author/cong-zheng/) * [Xingyu Jin](https://unit42.paloaltonetworks.com/author/xingyu-jin/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:September 17, 2018 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/) * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [ActiveMQ](https://unit42.paloaltonetworks.com/tag/activemq/) * [Apple](https://unit42.paloaltonetworks.com/tag/apple/) * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/) * [Botnet](https://unit42.paloaltonetworks.com/tag/botnet/) * [CouchDB](https://unit42.paloaltonetworks.com/tag/couchdb/) * [Cryptocurrency](https://unit42.paloaltonetworks.com/tag/cryptocurrency/) * [Elasticsearch](https://unit42.paloaltonetworks.com/tag/elasticsearch/) * [Hadoop](https://unit42.paloaltonetworks.com/tag/hadoop/) * [Iron](https://unit42.paloaltonetworks.com/tag/iron/) * [Linux](https://unit42.paloaltonetworks.com/tag/linux/) * [MacOS](https://unit42.paloaltonetworks.com/tag/macos/) * [Microsoft Windows](https://unit42.paloaltonetworks.com/tag/microsoft-windows/) * [MongoDB](https://unit42.paloaltonetworks.com/tag/mongodb/) * [MySQL](https://unit42.paloaltonetworks.com/tag/mysql/) * [Oracle](https://unit42.paloaltonetworks.com/tag/oracle/) * [PostgreSQL](https://unit42.paloaltonetworks.com/tag/postgresql/) * [RDP](https://unit42.paloaltonetworks.com/tag/rdp/) * [Redis](https://unit42.paloaltonetworks.com/tag/redis/) * [Rocke](https://unit42.paloaltonetworks.com/tag/rocke/) * [Worm](https://unit42.paloaltonetworks.com/tag/worm/) * [Xbash](https://unit42.paloaltonetworks.com/tag/xbash/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/?pdf=download&lg=en&_wpnonce=0070e94fe3 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/?pdf=print&lg=en&_wpnonce=0070e94fe3 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Xbash%20Combines%20Botnet,%20Ransomware,%20Coinmining%20in%20Worm%20that%20Targets%20Linux%20and%20Windows&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows%2F&title=Xbash%20Combines%20Botnet,%20Ransomware,%20Coinmining%20in%20Worm%20that%20Targets%20Linux%20and%20Windows "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows%2F&text=Xbash%20Combines%20Botnet,%20Ransomware,%20Coinmining%20in%20Worm%20that%20Targets%20Linux%20and%20Windows "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Xbash%20Combines%20Botnet,%20Ransomware,%20Coinmining%20in%20Worm%20that%20Targets%20Linux%20and%20Windows%20https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows%2F "Share in Mastodon") Executive Summary: Unit 42 researchers have found a new malware family that is targeting Linux and Microsoft Windows servers that we have named XBash. We can tie this malware to the Iron Group, a threat actor group known for ransomware attacks in the past. Xbash has ransomware and coinmining capabilities. It also has self-propagating capabilities (meaning it has worm-like characteristics similar to WannaCry or Petya/NotPetya). It also has capabilities not currently implemented that, when implemented, could enable it to spread very quickly within an organizations' network (again, much like WannaCry or Petya/NotPetya). Xbash spreads by attacking weak passwords and unpatched vulnerabilities. Xbash is data-destructive; destroying Linux-based databases as part of its ransomware capabilities. We can also find NO functionality within Xbash that would enable restoration after the ransom is paid. This means that, like NotPetya, Xbash is data destructive malware posing at ransomware. Organizations can protect themselves against Xbash by: 1. Using strong, non-default passwords 2. Keeping up-to-date on security updates 3. Implementing endpoint security on Microsoft Windows AND Linux systems 4. Preventing access to unknown hosts on the internet (to prevent access to command and control servers) 5. Implementing and maintaining rigorous and effective backup and restoration processes and procedures. Palo Alto Networks customers are protected against this threat as outlined at the end of this blog. Below are some more specifics on Xbash's capabilities: * It combines botnet, coinmining, ransomware and self-propagation. * It targets Linux-based for its ransomware and botnet capabilities. * It targets Microsoft Windows-based systems for its coinmining and self-propagating capabilities. * The ransomware component targets and deletes Linux-based databases. * To date, we have observed 48 incoming transactions to these wallets with total income of about 0.964 bitcoins meaning 48 victims have paid about US$6,000 total (at the time of this writing). * However, as see no evidence that the paid ransoms have resulted in recovery for the victims. * In fact, we can find no evidence of any functionality that makes recovery possible through ransom payment. * Our analysis shows this is likely the work of the Iron group, a group [publicly linked](https://securityaffairs.co/wordpress/73211/malware/iron-cybercrime-group-hackingteam.html) to other ransomware campaigns including those that use the Remote Control System (RCS), whose source code was believed to be stolen [from the HackingTeam in 2015](https://en.wikipedia.org/wiki/Hacking_Team#2015_data_breach). **Research:** Recently Unit 42 used WildFire to identify a new malware family targeting Linux servers. After further investigation we realized it's a combination of botnet and ransomware that developed by an active [cybercrime group Iron](https://www.intezer.com/iron-cybercrime-group-under-the-scope-2/) (aka [Rocke](https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html)) in this year. We have named this new malware "Xbash", based on the name of the malicious code's original main module. Previously the Iron group developed and spread cryptocurrency miners or [cryptocurrency transaction hijacking](https://4hou.win/wordpress/?p=20588) trojans mainly for Microsoft Windows and only a few for Linux. Instead, Xbash aimed on discovering unprotected services, deleting victim's MySQL, PostgreSQL and MongoDB databases, and ransom for Bitcoins. Xbash uses three known vulnerabilities in Hadoop, Redis and ActiveMQ for self-propagation or infecting Windows system. Other new technical characteristics in Xbash that are worth noting: * **Developed in** **[Python:](https://www.python.org/)** Xbash was developed using Python and then converted into self-contained Linux ELF executables by abusing the legitimate tool [PyInstaller](https://www.pyinstaller.org/) for distribution. * **Targets IP addresses and Domain Names:** Modern Linux malware such as [Mirai](https://blog.paloaltonetworks.com/tag/Mirai/) or [Gafgyt](https://blog.paloaltonetworks.com/tag/Gafgyt/) usually generate random IP addresses as scanning destinations. By contrast, Xbash fetches from its C2 servers both IP addresses and domain names for service probing and exploiting. * **Targets Windows and Linux:** When exploiting vulnerable [Redis](https://redis.io/) service, Xbash will also figure out whether the service is running on Windows or not. If so, it will send malicious JavaScript or VBScript payload for downloading and executing a coinminer for Windows. * **Intranet Scanning Functionality:** The Xbash authors have developed the new capability of scanning for vulnerable servers within enterprise intranet. We see this functionality in the samples but, interestingly, it has not been enabled that we can see. We have discovered four different versions of Xbash so far. Code and timestamp differences among these versions show that it's still under active development. The botnet began to operate since as early as May 2018. Thus far, we've observed 48 incoming transactions to the Bitcoin wallet addresses used by the malware, which may indicate 48 victims of its ransom behavior. In the rest of this blog, we will introduce more technical details of these behaviors, and introduce how Palo Alto Networks products prevent the threat. Technical Details **From Python Code to Native Executable** In [a previous blog from 2016](https://blog.paloaltonetworks.com/2016/04/unit42-python-based-pwobot-targets-european-organizations/), Unit 42 revealed a Windows malware being developed by Python and being converted to PE executable by PyInstaller. All four versions of Xbash that we discovered also used this technique. Based on this, we believe the malware authors gain many benefits: 1. **Faster Development:** Developing in Python can be easier and faster than in C, C++ or Go: therefore it can enable faster, iterative development which enables the malware's faster evolution (and can enable faster counter-counter-measures as well). 2. **Easy, Assured Installation:** PyInstaller creates self-contained native executables which include all necessary dependencies including Python runtime, libraries,user and third-party libraries. Given the diversity of Linux installations and environments, the attackers cannot be sure that Python-based malware would install and run successfully. By packaging in a self-contained native executable like this, ensures that the malware will successfully install on the target systems. 3. **Anti-Detection Capabilities:** PyInstaller's code compilation, code compression/conversion, and optional code encryption together work to obfuscate the indicators of malicious behavior. This obfuscation helps the malware to defeat detection by antivirus/antimalware engines or static analysis. At the time of this writing, we observed a 1/57 detection rate for Xbash in VirusTotal as shown in Figure 1. 4. \*\*Cross-Platform Malware:\*\*PyInstaller supports creating binaries for Windows, Apple macOS and Linux from the same Python code: this enables the malware to be truly cross-platform (though at the time of this writing we have not found any Windows or macOS versions of Xbash). ![xbash\_1](https://blog.paloaltonetworks.com/wp-content/uploads/2018/09/xbash_1.png) *Figure 1 Detection Rate of Xbash as shown on VirusTotal* Through manual reverse engineering, we were able to extract the main malicious Python modules from the Xbash executables and decompile them successfully. Therefore, in the later sections of this analysis, we show the Python source code. C2 Communication Xbash hard-coded a bunch of domain names as its C2 servers. It also fetches a webpage hosted on Pastebin (listed in the IOCs) to update the C2 domain list. Some of these C2 domains are reused from previous Windows coinminers [attributed](https://4hou.win/wordpress/?p=20588) to Iron cybercrime group. All C2 communications were based on HTTP protocol. We found three kinds of C2 traffic: 1. One for fetching a list of IP addresses or domains for scanning 2. One for fetching a list of weak passwords, in addition of using hard-coded passwords 3. One for reporting scan results Three types of URIs were used to fetch scanning targets: 1. /domain/phpmyadmin or /domain/all: to get a list of domains for scanning of vulnerable or unprotected web services such as phpMyAdmin. 2. /port/tcp8080, /port/udp1900, etc.: to get a list of IP addresses for scanning of their specific TCP or UDP port 3. /cidir, to get a list of CIDR of IP addresses for popular ports/services scanning. Through a still alive C2 domain, we were able to get 1,000 domains, 1,000 IP addresses, or a /22 CIDR per request, respectively as shown in Figure 2. We found that different requests will return different results, showing that the C2 servers were dynamic dispatching tasks to different bots. We randomly chose some domains and didn't find any specific region or industry targeted. And, the targeted domains are not in the Alexa top one million domains list. ![xbash\_2](https://blog.paloaltonetworks.com/wp-content/uploads/2018/09/xbash_2.png) *Figure 2 Xbash fetched domains from C2 server for further scanning* Popular Linux botnets such as Mirai and Gafgyt usually only scan IP addresses. Xbash represents a next-stage evolution of Linux botnets by extending the targets to public websites by targeting domains as well as IP address. This also makes deploying a honeypot to observe Xbash challenging since honeypots are usually deployed with IP addresses only. While it may not be an intentional step, the inclusion of domain targeting has an anti-analysis benefit for the attackers. Besides of fetching a list of scanning targets, Xbash will also request C2 server via URI "/p" to fetch a list of weak passwords for brute forcing. After Xbash has scanned a target and successfully found specific opening ports, weak credentials or exploitable, unpatched vulnerability, it will report the result to a random C2 server via HTTP POST to URI "/c". **Service Probing and Brute Forcing** If the scanning target is an IP address, Xbash will try to scan many TCP or UDP ports. Here are part of services they're probing and the ports used: * HTTP: 80, 8080, 8888, 8000, 8001, 8088 * VNC: 5900, 5901, 5902, 5903 * MySQL: 3306 * Memcached: 11211 * MySQL/MariaDB: 3309, 3308,3360 3306, 3307, 9806, 1433 * FTP: 21 * Telnet: 23, 2323 * PostgreSQL: 5432 * Redis: 6379, 2379 * ElasticSearch: 9200 * MongoDB: 27017 * RDP: 3389 * UPnP/SSDP: 1900 * NTP: 123 * DNS: 53 * SNMP: 161 * LDAP: 389 * Rexec: 512 * Rlogin: 513 * Rsh: 514 * Rsync: 873 * Oracle database: 1521 * CouchDB: 5984 For some services, such as VNC, Rsync, MySQL, MariaDB, Memcached, PostgreSQL, MongoDB, and phpMyAdmin, if a related port is open, it will use a built-in weak username/password dictionary and try to login into the service as shown in Figure 3. The dictionary also contains common or default passwords for services like Telnet, FTP, and Redis. ![xbash\_3](https://blog.paloaltonetworks.com/wp-content/uploads/2018/09/xbash_3.png) *Figure 3 Xbash tries to brute force services such as Rsync* ## **Delete Databases and Ransom** If Xbash successfully login into a service including MySQL, MongoDB, and PostgreSQL, it will delete almost all existing databases in the server (except for some databases that stored user login information), create a new database named "PLEASE\_READ\_ME\_XYZ", and leave a ransom message into table "WARNING" of the new database, as shown in Figure 4 and Figure 5. Send 0.02 BTC to this address and contact this email with your website or your ip or db\_name of your server to recover your database! Your DB is Backed up to our servers!If we not received your payment,we will leak your database 1jqpmcLygJdH8fN7BCk2cwwNBRWqMZqL1 backupsql@pm.me ![xbash\_4](https://blog.paloaltonetworks.com/wp-content/uploads/2018/09/xbash_4.png) *Figure 4 Xbash create ransom message into MySQL database via phpMyAdmin* ![xbash\_5](https://unit42.paloaltonetworks.com/wp-content/uploads/2018/09/xbash_5.png) *Figure 5 New database, table and ransome message created by Xbash* If Xbash logged into a phpMyAdmin service, it will do exactly the same operations as above to those databases too, via sending HTTP requests to phpMyAdmin. This is because the phpMyAdmin service is usually managing some MySQL databases. It's important to note that, the database name, table name, table schema, and the ransom message used by Xbash are almost identical with [some incidents](https://www.guardicore.com/2017/02/0-2-btc-strikes-back-now-attacking-mysql-databases/) within [multiple waves of ransom attacks](https://www.bleepingcomputer.com/news/security/massive-wave-of-mongodb-ransom-attacks-makes-26-000-new-victims/) to MySQL, MongoDB, ElasticSearch, Hadoop, CouchDB, Cassandra, Redis, AWS S3, etc. at 2016 and 2017, which have compromised over 56,685 servers in the globe [by report](https://www.bleepingcomputer.com/news/security/massive-wave-of-mongodb-ransom-attacks-makes-26-000-new-victims/). The only changes in Xbash are: * Database name changed from PLEASE\_READ\_ME to PLEASE\_README\_XYZ * Bitcoins they're asking for reduced from 0.2 BTC or 0.15 BTC to0.02 BTC * Bitcoin wallet address and email address changed * This time a blackmail phrase was added into the message: "If we not received your payment,we will leak your database" Thus far, we have observed three different bitcoin wallet addresses hard-coded in the Xbash samples. Since May 2018, there are 48 incoming transactions to these wallets with total income of about 0.964 bitcoins (about US$6,000 at the time of this writing). Figure 5 shows one of the wallets. Also, note that the funds are being withdrawn, showing us that the attackers are actively collecting their ransom. ![xbash\_6](https://unit42.paloaltonetworks.com/wp-content/uploads/2018/09/xbash_6.png) *Figure 6 Incoming transactions to one of bitcoin wallets* However, as is so often the case, we see no evidence that the attackers are actually making good on their "promise" and helping the victims restore their deleted databases. In fact, contrary to the ransom note, we found NO evidence of code in Xbash that backs up the deleted databases at all. Exploit for Propagation When Xbash finds a destination has Hadoop, Redis or ActiveMQ running, it will also attempt to exploit the service for self-propagation. Three known vulnerabilities are targeted: 1. [Hadoop YARN ResourceManager unauthenticated command execution](https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/hadoop_unauth_exec.rb), which was first disclosed in October 2016 and has no CVE number assigned. 2. [Redis arbitrary file write and remote command execution](https://packetstormsecurity.com/files/134200/Redis-Remote-Command-Execution.html), which was first disclosed in October 2015 and has no CVE number assigned. This is shown below in Figure 6. 3. [ActiveMQ arbitrary file write vulnerability](https://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt), CVE-2016-3088. ![xbash\_7](https://unit42.paloaltonetworks.com/wp-content/uploads/2018/09/xbash_7.png) *Figure 7 Xbash exploiting Redis vulnerability* When the exploit succeeds, Xbash will either directly execute a shell command to download and to run malicious Shell or Python scripts, or create new cron job to do the same, again as shown in Figure 6. The malicious scripts were downloaded from the same C2 servers as Xbash used. In either instance, their main functions are to kill other popular Coinminers, download Coinminers developed by the Iron cybercrime group, and download Xbash itself onto the target system for further propagation. The net of this is that Xbash targets and uses vulnerable Hadoop, Redis or ActiveMQ systems both to run the attackers' coinminer AND propagate Xbash within the environment. Infecting Windows Servers Another notable feature of Xbash is the way it uses Redis and an HTTP service to determine if the vulnerable Redis service is installed on Linux or Microsoft Windows. If the destination being scanned has both vulnerable Redis service and a HTTP service running, Xbash will try to use information leaked by the Redis vulnerability to guess HTTP web server's installation location. Xbash then uses the location to guess which operating system (Linux or Windows) the destination is running as shown in Figure 7. ![xbash\_8](https://unit42.paloaltonetworks.com/wp-content/uploads/2018/09/xbash_8.png) *Figure 8 Web server paths Xbash used to determine operating system* If it believes it's found a Windows server, Xbash will exploit the Redis vulnerability to create a Windows startup item (as shown in Figure 6), instead of a Linux cronjob. Depends on Xbash's version, this new startup item will download a malicious HTML or a Scriptlet file from Xbash's C2 server, and to execute the JavaScript or VBScript code in the file via "mshta" or via "regsvr32". These scripts will then invoke PowerShell to download a malicious PE executable or PE DLL file from the same C2 server for execution as shown in Figure 8. ![xbash\_9](https://unit42.paloaltonetworks.com/wp-content/uploads/2018/09/xbash_9.png) *Figure 8 Malicious JavaScript code to be executed in vulnerable Windows server (with comments)* Through our investigation we found that these malicious PE files were coinminer or ransomware developed by the Iron cybercrime group as shown in Figure 9. ![xbash\_10](https://unit42.paloaltonetworks.com/wp-content/uploads/2018/09/xbash_10.png) *Figure 9 AutoFocus associated the malicious PE file with Iron cybercrime group* Targeting Enterprise Intranet In all versions of Xbash we found, there is a Python class named "LanScan". Its functions are to get local intranet information, generate a list of all IP addresses within the same subnet, and to perform port scanning to all these IPs as shown in figure 10. It appears that during its evolution, the author was adding more ports to this piece of code. However, the code was inert and unutilized: it is still standalone and yet to be connected with the main part of the code. We believe the author may enable this functionality in coming versions. ![xbash\_11](https://unit42.paloaltonetworks.com/wp-content/uploads/2018/09/xbash_11.png) *Figure 10 Generate list of IP addresses in victim's subnet and perform port scanning* In an enterprise network (including office network and datacenter or private cloud), there are usually more servers providing services internally than to public. And these services are also more likely unprotected or configured with weak password. The chance of find vulnerable services within Intranet is much higher than over Internet. We believe that is the main motivation of Xbash's Intranet scanning code. If events like WannaCry and NotPetya are any guide, this intranet functionality could make Xbash even more devastating once it's enabled. Conclusions Xbash is a novel and complex Linux malware and the newest work of an active cybercrime group. From its characteristics and behaviors, we could realize many trends in current IoT/Linux security battleground: * Attackers are expanding their profit-making ways from mining cryptocurrency to hijacking or ransom for cryptocurrency * Attackers are expanding territory by scanning domain names and by attacking enterprise Intranet * Attackers are looking for more potential victims by gathering more and more vulnerabilities from everywhere, no matter whether the vulnerability is new or old, and no matter whether it's famous or not (a CVE number was assigned or not) * Attackers are to toward cross-platform attacks and quick evolution * Different types of script files are important actors between exploiting and malware execution Palo Alto Networks customers are protected from this threat: * WildFire detected Xbash for Linux as well as the dropped CoinMiner for Windows * ELF and PE format malware's signatures have been released via Antivirus * All involved malicious domains have been covered by PAN-DB URL Filtering * All three vulnerabilities exploit by Xbash have been covered by Threat Prevention (39786, 39787, 54654, 54655) * Xbash C2 traffic have been covered by Threat Prevention too (18474, 18475, 18476) * [An AutoFocus tag](https://autofocus.paloaltonetworks.com/#/tag/Unit42.Xbash) has been created for tracking this attack. Indicators of Compromise **Samples for Linux** 7a18c7bdf0c504832c8552766dcfe0ba33dd5493daa3d9dbe9c985c1ce36e5aa zlibx 0b9c54692d25f68ede1de47d4206ec3cd2e5836e368794eccb3daa632334c641 Xbash dbc380cbfb1536dfb24ef460ce18bccdae549b4585ba713b5228c23924385e54 xapache 5b790f02bdb26b6b6b270a5669311b4f231d17872aafb237b7e87b6bbb57426d libhttpd e59be6eec9629d376a8a4a70fe9f8f3eec7b0919019f819d44b9bdd1c429277c XbashX f808a42b10cf55603389945a549ce45edc6a04562196d14f7489af04688f12bc XbashY dcd37e5b266cc0cd3fab73caa63b218f5b92e9bd5b25cf1cacf1afdb0d8e76ff rootv2.sh de63ce4a42f06a5903b9daa62b67fcfbdeca05beb574f966370a6ae7fd21190d lowerv2.sh 09968c4573580398b3269577ced28090eae4a7c326c1a0ec546761c623625885 rootv2.sh a27acc07844bb751ac33f5df569fd949d8b61dba26eb5447482d90243fc739af r88.sh **Samples for Windows** f888dda9ca1876eba12ffb55a7a993bd1f5a622a30045a675da4955ede3e4cb8 tt.txt 31155bf8c85c6c6193842b8d09bda88990d710db9f70efe85c421f1484f0ee78 tg.jpg 725efd0f5310763bc5375e7b72dbb2e883ad90ec32d6177c578a1c04c1b62054 reg9.sct d7fbd2a4db44d86b4cf5fa4202203dacfefd6ffca6a0615dca5bc2a200ad56b6 m.png ece3cfdb75aaabc570bf38af6f4653f73101c1641ce78a4bb146e62d9ac0cd50 tmp.jpg **Downloading URLs** hxxp://3g2upl4pq6kufc4m\[.\]tk/zlibx hxxp://e3sas6tzvehwgpak\[.\]tk/XbashY hxxp://3g2upl4pq6kufc4m\[.\]tk/XbashY hxxp://3g2upl4pq6kufc4m\[.\]tk/xapache hxxp://3g2upl4pq6kufc4m\[.\]tk/libhttpd hxxp://xmr.enjoytopic\[.\]tk/l/rootv2.sh hxxp://xmr.enjoytopic\[.\]tk/l2/rootv2.sh hxxp://xmr.enjoytopic\[.\]tk/l/r88.sh hxxp://xmr.enjoytopic\[.\]tk/12/r88.sh hxxp://e3sas6tzvehwgpak\[.\]tk/lowerv2.sh hxxp://3g2upl4pq6kufc4m\[.\]tk/r88.sh hxxp://e3sas6tzvehwgpak\[.\]tk/XbashY hxxp://e3sas6tzvehwgpak\[.\]tk/XbashX hxxp://png.realtimenews\[.\]tk/m.png hxxp://daknobcq4zal6vbm\[.\]tk/tt.txt hxxp://d3goboxon32grk2l\[.\]tk/reg9.sct **Domains for C2 Communication** ejectrift.censys\[.\]xyz scan.censys\[.\]xyz api.leakingprivacy\[.\]tk news.realnewstime\[.\]xyz scan.realnewstime\[.\]xyz news.realtimenews\[.\]tk scanaan\[.\]tk scan.3g2upl4pq6kufc4m\[.\]tk scan.vfk2k5s5tfjr27tz\[.\]tk scan.blockbitcoin\[.\]tk blockbitcoin\[.\]com **IPs for C2 Communication** 142\.44.215\[.\]177 144\.217.61\[.\]147 **URLs for C2 Domain Updating** hxxps://pastebin\[.\]com/raw/Xu74Mzif hxxps://pastebin\[.\]com/raw/rBHjTZY6 **Bitcoin Wallet Addresses in Ransom Messages** 1Kss6v4eSUgP4WrYtfYGZGDoRsf74M7CMr 1jqpmcLygJdH8fN7BCk2cwwNBRWqMZqL1 1ExbdpvKJ6M1t5KyiZbnzsdQ63SEsY6Bff **Email Addresses in Ransom Messages** backupsql@protonmail\[.\]com backupsql@pm\[.\]me backupdatabase@pm\[.\]me Back to top ### Tags * [ActiveMQ](https://unit42.paloaltonetworks.com/tag/activemq/ "ActiveMQ") * [Apple](https://unit42.paloaltonetworks.com/tag/apple/ "Apple") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [Botnet](https://unit42.paloaltonetworks.com/tag/botnet/ "botnet") * [CouchDB](https://unit42.paloaltonetworks.com/tag/couchdb/ "CouchDB") * [Cryptocurrency](https://unit42.paloaltonetworks.com/tag/cryptocurrency/ "Cryptocurrency") * [Elasticsearch](https://unit42.paloaltonetworks.com/tag/elasticsearch/ "Elasticsearch") * [Hadoop](https://unit42.paloaltonetworks.com/tag/hadoop/ "Hadoop") * [Iron](https://unit42.paloaltonetworks.com/tag/iron/ "Iron") * [Linux](https://unit42.paloaltonetworks.com/tag/linux/ "Linux") * [MacOS](https://unit42.paloaltonetworks.com/tag/macos/ "macOS") * [Microsoft Windows](https://unit42.paloaltonetworks.com/tag/microsoft-windows/ "Microsoft Windows") * [MongoDB](https://unit42.paloaltonetworks.com/tag/mongodb/ "MongoDB") * [MySQL](https://unit42.paloaltonetworks.com/tag/mysql/ "MySQL") * [Oracle](https://unit42.paloaltonetworks.com/tag/oracle/ "Oracle") * [PostgreSQL](https://unit42.paloaltonetworks.com/tag/postgresql/ "PostgreSQL") * [RDP](https://unit42.paloaltonetworks.com/tag/rdp/ "RDP") * [Redis](https://unit42.paloaltonetworks.com/tag/redis/ "Redis") * [Rocke](https://unit42.paloaltonetworks.com/tag/rocke/ "Rocke") * [Worm](https://unit42.paloaltonetworks.com/tag/worm/ "Worm") * [Xbash](https://unit42.paloaltonetworks.com/tag/xbash/ "Xbash") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government](https://unit42.paloaltonetworks.com/unit42-oilrig-uses-updated-bondupdater-target-middle-eastern-government/ "OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government") ### Table of Contents * ### Related Articles * [Atomic macOS (AMOS) Stealer Activity](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/ "article - table of contents") * [The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "article - table of contents") * [The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "article - table of contents") ## Related Resources ![Pictorial representation of a magnifying glass illuminating a glowing orange circular digital circuit interface on a dark, high-tech background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Myth-Busting_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) September 16, 2026 [#### Atomic macOS (AMOS) Stealer Activity](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/) * [MacOS](https://unit42.paloaltonetworks.com/tag/macos/ "macOS") * [Threat intelligence](https://unit42.paloaltonetworks.com/tag/threat-intelligence/ "threat intelligence") * [Unit 42](https://unit42.paloaltonetworks.com/tag/unit-42/ "Unit 42") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/ "Atomic macOS (AMOS) Stealer Activity") ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/content/pan/en_US/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)