[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/unsigned-dlls/) * [Japanese](https://unit42.paloaltonetworks.com/ja/unsigned-dlls/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # Hunting for Unsigned DLLs to Find APTs ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 7 min read Related Products [![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Daniela Shalev](https://unit42.paloaltonetworks.com/author/daniela-shalev/) * [Itay Gamliel](https://unit42.paloaltonetworks.com/author/itay-gamliel/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:September 26, 2022 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Advanced Persistent Threat](https://unit42.paloaltonetworks.com/tag/advanced-persistent-threat/) * [DLL Sideloading](https://unit42.paloaltonetworks.com/tag/dll-sideloading/) * [Investigation and Response](https://unit42.paloaltonetworks.com/tag/investigation-and-response/) * [Lazarus Group](https://unit42.paloaltonetworks.com/tag/lazarus-group/) * [Malware Prevention](https://unit42.paloaltonetworks.com/tag/malware-prevention/) * [Mustang Panda](https://unit42.paloaltonetworks.com/tag/mustang-panda/) * [PKPLUG](https://unit42.paloaltonetworks.com/tag/pkplug/) * [Selective Pisces](https://unit42.paloaltonetworks.com/tag/selective-pisces/) * [Stately Taurus](https://unit42.paloaltonetworks.com/tag/stately-taurus/) * [Threat intelligence](https://unit42.paloaltonetworks.com/tag/threat-intelligence/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/unsigned-dlls/?pdf=download&lg=en&_wpnonce=279fa6c5e6 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/unsigned-dlls/?pdf=print&lg=en&_wpnonce=279fa6c5e6 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Hunting%20for%20Unsigned%20DLLs%20to%20Find%20APTs&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Funsigned-dlls%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Funsigned-dlls%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funsigned-dlls%2F&title=Hunting%20for%20Unsigned%20DLLs%20to%20Find%20APTs "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funsigned-dlls%2F&text=Hunting%20for%20Unsigned%20DLLs%20to%20Find%20APTs "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funsigned-dlls%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Hunting%20for%20Unsigned%20DLLs%20to%20Find%20APTs%20https%3A%2F%2Funit42.paloaltonetworks.com%2Funsigned-dlls%2F "Share in Mastodon") ## Executive Summary Malware authors regularly evolve their techniques to evade detection and execute more sophisticated attacks. We've commonly observed one method over the past few years: unsigned DLL loading. Assuming that this method might be used by advanced persistent threats (APTs), we hunted for it. The hunt revealed sophisticated payloads and APT groups in the wild, including the Chinese cyberespionage group [Stately Taurus](https://unit42.paloaltonetworks.com/atoms/statelytaurus/) (formerly known as [PKPLUG](https://unit42.paloaltonetworks.com/pkplug_chinese_cyber_espionage_group_attacking_asia/), aka Mustang Panda) and the North Korean Selective Pisces (aka Lazarus Group). Below, we show how hunting for the loading of unsigned DLLs can help you identify attacks and threat actors in your environment. Palo Alto Networks customers receive protections and detections against malicious DLL loading through the [Cortex XDR agent](https://www.paloaltonetworks.com/cortex/cortex-xdr). |--------------------------------|----------------------------------------------------------------------| | **Threat Actor Groups Discussed** || | **Unit 42 tracks group as...** | **Group also known as...** | | Stately Taurus | Mustang Panda, PKPLUG, BRONZE PRESIDENT, HoneyMyte, Red Lich, Baijiu | | Selective Pisces | Lazarus Group, ZINC, APT - C - 26 | ## Malicious DLLs: A Common Method Attackers Use for Executing Malicious Payloads on Infected Systems Based on our observations over years of proactive threat-hunting experience, we hypothesize that one of the main methods for executing malicious payloads on infected systems is loading a malicious DLL. As both individual hackers and APT groups use this method, we decided to conduct research based on this hypothesis. Most of the malicious DLLs we observe in the wild share three common characteristics: * The DLLs are mostly written to unprivileged paths. * The DLLs are unsigned. * To evade detection, the DLLs are loaded by a signed process, whether a utility dedicated to loading DLLs (such as rundll32.exe) or an executable that loads DLLs as part of its activity. With that in mind, we found that the most common techniques that are being used by threat actors in the wild are the following: 1. DLL loading by [rundll32.exe](https://attack.mitre.org/techniques/T1218/011/)/[regsvr32.exe](https://attack.mitre.org/techniques/T1218/010/) -- While those processes are signed and known binaries, threat actors abuse them to achieve code execution in an attempt to evade detection. 2. [DLL order hijacking](https://attack.mitre.org/techniques/T1574/001/) -- This refers to loading a malicious DLL by abusing the search order of a legitimate process. This way, a benign application will load a malicious payload with the name of a known DLL. Reviewing the results of the above techniques in the wild revealed that the most common unprivileged paths to load malicious unsigned DLLs are the folders and sub-folders of ProgramData, AppData and the users' home directories. The next section will introduce several findings based on the above hypothesis. ## Attack Trends in the Wild Related to Unsigned DLLs To start hunting based on the hypothesis we described, we created two XQL queries. The first one looks for unsigned DLLs that were loaded by rundll32.exe/regsvr32.exe, while the other looks for signed software that loads an unsigned DLL. The hunting activity revealed various malware families that used unsigned DLL loading. Figure 1 presents the malware we detected using these methods over the past six months (February-August 2022). ![Malware observed using DLL loading between February-August 2022: Raspberry Robin (31.0%), Emotet (17.4%), QakBot (15.5%), IcedID (9.7%), Cobalt Strike (7.8%), Vawtrak (6.8%), Ursnif (5.8%), Amavaldo (3.1%), Stately Taurus (1.9%), Selective Pisces (1.0%)](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/09/unnamed-file.png) Figure 1. Malware observed using DLL loading. Analyzing the execution techniques used by the above threats showed that banking trojans and individual threat actors typically used rundll32.exe or regsvr32.exe to load a malicious DLL, while APT groups used the DLL side-loading technique most of the time. ## Diving Into Selected Payloads ### Stately Taurus We decided to highlight an investigation around [Stately Taurus](https://unit42.paloaltonetworks.com/pkplug_chinese_cyber_espionage_group_attacking_asia/) activity that we detected in the environment of one organization. Stately Taurus is a Chinese APT group that usually targets non-governmental organizations and is known for abusing legitimate software to load payloads. In this case, we observed the usage of the DLL search order hijacking technique that enabled the attacker's malicious DLL to load into the memory space of a legitimate process. The threat actor used multiple pieces of third party software for the DLL side-loading, such as antivirus software and a PDF reader. ![The screenshot shows the benign exe file (AvastSvc.exe) that uses side-loading to load the malicious DLL wsc.dll](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/09/word-image-66.png) Figure 2. AvastSvc.exe uses side-loading to load a malicious DLL. To achieve DLL side-loading, the group dropped the payload into the ProgramData folder, which contained three files -- a benign EXE file for DLL hijacking (AvastSvc.exe), a DLL file (wsc.dll) and an encrypted payload (AvastAuth.dat). The loaded DLL appeared to be the [PlugX RAT](https://unit42.paloaltonetworks.com/thor-plugx-variant/), which loads the encrypted payload from the .dat file. ![The table shows the following: File Create - AvastAuth.dat - C:\\ProgramData\\AvastSvcZEg\\AvastAuth.dat; File Write - wsc.dll - C:\\ProgramData\\AvastSvcZEg\\wsc.dll; File Write - wsc.dll - C:\\ProgramData\\AvastSvcZEg\\wsc.dll; File Create - wsc.dll - C:\\ProgramData\\AvastSvcZEg\\wsc.dll; File Write - AvastSvc.exe - C:\\ProgramData\\AvastSvcZEg\\AvastSvc.exe](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/09/word-image-67.png) Figure 3. PlugX files: benign executable, DLL loader and encrypted .dat file. ### Selective Pisces Among the results of our hunting queries, we also identified several high-entropy malicious modules within the ProgramData directories shown in Figure 4. ![The screenshot shows high-entropy malicious modules associated with Selective Pisces, including uso.dat (0.999545), mi.dll (0.999396), mi.dll (0.999393), SXSHARED.DLL (0.999354), and USOShared.tmp (0.999317)](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/09/word-image-68.png) Figure 4. DLL side-loading by Selective Pisces. Investigating the execution chain of the unsigned modules shown in Figure 4 revealed that they were dropped to the disk by the signed DreamSecurity MagicLine4NX process (MagicLine4NX.exe). MagicLine4NX.exe executed a second-stage payload that we observed utilizing DLL side-loading in order to evade detection. The second-stage payload wrote a new DLL named mi.dll, and copied wsmprovhost.exe (host process for WinRM) to a random directory in ProgramData. Wsmprovhost.exe is a native Windows binary that attempts to load mi.dll from the same directory. The attackers abused this mechanism in order to achieve DLL side-loading ([T1574.002](https://attack.mitre.org/techniques/T1574/002/)) with this process. The mi.dll payload was observed dropping a new payload named ualapi.dll to the System32 directory (C:\\Windows\\System32\\ualapi.dll). As ualapi.dll is in this case a missing DLL on the System32 directory, the attackers used this fact to achieve persistence by giving their malicious payload the name ualapi.dll. That way, spoolsv.exe will load it upon startup. After analyzing the payloads above, we attributed them to the North Korean APT group that Unit 42 tracks as Selective Pisces. This group's utilization of legitimate third party-software such as MagicLine4NX was described earlier this year in a [blog post](https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lazarus-dream-job-chemical) by Symantec. ### Raspberry Robin The last attack we would like to elaborate on is the most common one we observed in the wild. Some of the results that our query yields share several common characteristics: * DLLs with scrambled names reside in random sub-folders of the ProgramData or AppData folders. * Those DLLs have a similar range of entropy (~0.66). * All of them were loaded by rundll32.exe or regsvr32.exe For example: RUNDLL32.EXE C:\\ProgramData\\\\\fhcplow\_Tudjdm.dll,iarws\_sbv ![DLLs loaded by Raspberry Robin include npwmse\_Nemcttdid.dll, iyclBaiic\_fig.dll, Portsoft\_Gdfv.dll, adlsoft\_w\_ni.dll, dfjssoft\_002.dll, fhcplow\_Tudjdm.dll, CNBERngs\_De4\_3.dll](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/09/word-image-69.png) Figure 5. DLLs loaded by Raspberry Robin. The DLL loading activities that take place in those attacks were attributed to a campaign called Raspberry Robin, which was recently described by [Red Canary](https://redcanary.com/blog/raspberry-robin/). Those attacks begin from a shortcut file on an infected USB device. This spawns msiexec.exe to retrieve the malicious DLL from a remote C2 server. Over installation, a scheduled task is created in order to achieve persistence, loading the DLL using rundll32.exe/regsvr32.exe on system start up. ## Using Unsigned DLLs to Hunt for Attacks in Your Environment You can hunt for the loading of unsigned DLLs using XQL Search in Cortex XDR. To narrow down the results, we suggest focusing on the following: * For DLL side-loading, we recommend paying attention to known third-party software placed in non-standard directories. * Focus on the file's entropy -- binaries that have a high value of entropy may contain a packed section that will be extracted during execution. * Focus on the frequency of execution -- high-frequency results may indicate a legitimate activity that occurs periodically, while low-frequency results may be a lead for an investigation. * Focus on the file's path -- results that contain folders or files with scrambled names are more suspicious than others. ![Query results sorted by the module's entropy, showing how examples of Emotet execution rise when sorted in that way. Module entropy scores range from 0.860774 to 0.637715 in the examples shown here.](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/09/word-image-70.png) Figure 6. Query results sorted by the module's entropy. Figure 6 contains partial results of the queries that are mentioned in the next section, sorted by the module's entropy. While the first two rows are an example of Emotet execution, the others are benign DLLs. ### Hunting Queries // Rundll32.exe / Regsvr32.exe loads an unsigned module from uncommon folders over the past 30 days. config case\_sensitive = false timeframe = 30d | dataset = xdr\_data | filter event\_type = ENUM.LOAD\_IMAGE and (action\_module\_path contains "C:\\ProgramData" or action\_module\_path contains "\\public" or action\_module\_path contains "\\documents" or action\_module\_path contains "\\pictures" or action\_module\_path contains "\\videos" or action\_module\_path contains "appdata") and action\_module\_signature\_status = 3 and (actor\_process\_image\_name contains "rundll32.exe" or actor\_process\_image\_name contains "regsvr32.exe") and (actor\_process\_command\_line contains "programdata" or actor\_process\_command\_line contains "\\public" or actor\_process\_command\_line contains "\\documents" or actor\_process\_command\_line contains "\\pictures" or actor\_process\_command\_line contains "\\videos" or actor\_process\_command\_line contains "appdata") | alter module\_entropy = json\_extract\_scalar(action\_module\_file\_info, "$.entropy") | fields agent\_hostname , action\_module\_sha256 , action\_module\_path , actor\_process\_image\_name, actor\_process\_command\_line, module\_entropy | comp count (action\_module\_path) as counter by action\_module\_path , action\_module\_sha256 , module\_entropy |-------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 | // Rundll32.exe / Regsvr32.exe loads an unsigned module from uncommon folders over the past 30 days. config case\_sensitive = false timeframe = 30d | dataset = xdr\_data | filter event\_type = ENUM.LOAD\_IMAGE and (action\_module\_path contains "C:\\ProgramData" or action\_module\_path contains "\\public" or action\_module\_path contains "\\documents" or action\_module\_path contains "\\pictures" or action\_module\_path contains "\\videos" or action\_module\_path contains "appdata") and action\_module\_signature\_status = 3 and (actor\_process\_image\_name contains "rundll32.exe" or actor\_process\_image\_name contains "regsvr32.exe") and (actor\_process\_command\_line contains "programdata" or actor\_process\_command\_line contains "\\public" or actor\_process\_command\_line contains "\\documents" or actor\_process\_command\_line contains "\\pictures" or actor\_process\_command\_line contains "\\videos" or actor\_process\_command\_line contains "appdata") | alter module\_entropy = json\_extract\_scalar(action\_module\_file\_info, "$.entropy") | fields agent\_hostname , action\_module\_sha256 , action\_module\_path , actor\_process\_image\_name, actor\_process\_command\_line, module\_entropy | comp count (action\_module\_path) as counter by action\_module\_path , action\_module\_sha256 , module\_entropy | // Possible DLL side-loading - a signed process loaded an unsigned DLL from AppData\\ProgramData\\Public folder over the past 30 days config case\_sensitive = false timeframe = 30d | dataset = xdr\_data | filter event\_type = ENUM.LOAD\_IMAGE and (action\_module\_path contains "C:\\ProgramData" or action\_module\_path contains "\\public" or action\_module\_path contains "appdata") and action\_module\_signature\_status = 3 and (actor\_process\_image\_name not contains "rundll32.exe" or actor\_process\_image\_name not contains "regsvr32.exe") and actor\_process\_signature\_status = 1 and (actor\_process\_image\_path contains "appdata" or actor\_process\_image\_path contains "programdata" or actor\_process\_image\_path contains "public" ) | alter module\_entropy = json\_extract\_scalar(action\_module\_file\_info, "$.entropy") | fields agent\_hostname , action\_module\_sha256 , action\_module\_path , actor\_process\_image\_name, actor\_process\_command\_line, module\_entropy, actor\_process\_image\_path | comp count (action\_module\_path) as counter by action\_module\_path , action\_module\_sha256 , module\_entropy, actor\_process\_image\_path |-----------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 | // Possible DLL side-loading - a signed process loaded an unsigned DLL from AppData\\ProgramData\\Public folder over the past 30 days config case\_sensitive = false timeframe = 30d | dataset = xdr\_data | filter event\_type = ENUM.LOAD\_IMAGE and (action\_module\_path contains "C:\\ProgramData" or action\_module\_path contains "\\public" or action\_module\_path contains "appdata") and action\_module\_signature\_status = 3 and (actor\_process\_image\_name not contains "rundll32.exe" or actor\_process\_image\_name not contains "regsvr32.exe") and actor\_process\_signature\_status = 1 and (actor\_process\_image\_path contains "appdata" or actor\_process\_image\_path contains "programdata" or actor\_process\_image\_path contains "public" ) | alter module\_entropy = json\_extract\_scalar(action\_module\_file\_info, "$.entropy") | fields agent\_hostname , action\_module\_sha256 , action\_module\_path , actor\_process\_image\_name, actor\_process\_command\_line, module\_entropy, actor\_process\_image\_path | comp count (action\_module\_path) as counter by action\_module\_path , action\_module\_sha256 , module\_entropy, actor\_process\_image\_path | ## Conclusion Most detection techniques for blocking malicious DLLs rely on the module's behavior after it has been loaded into memory. This can limit the ability to block all malicious modules. That said, you can proactively hunt for malicious unsigned DLLs using hunting approaches such as the ones presented in this blog. Knowing the baseline of your network in terms of legitimate software or behavior can reduce the number of results generated by the above queries, allowing you to focus on results that might be suspicious. Cortex XDR alerts on and blocks malicious DLLs loaded by known hijacking techniques, and can also prevent post-exploitation activities, through the Behavioral Threat Protection and Analytics modules. Indicators of compromise and TTPs associated with Stately Taurus can be found in the Stately Taurus [ATOM](https://unit42.paloaltonetworks.com/atoms/statelytaurus/mware/). If you think you may have been compromised or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call North America Toll-Free: 866.486.4842 (866.4.UNIT42), EMEA: +31.20.299.3130, APAC: +65.6983.8730, or Japan: +81.50.1790.0200. ## Indicators of Compromise |------------------|------------------------------------------------------------------| | **Threat Actor** | **SHA256** | | Selective Pisces | 779a6772d4d35e1b0018a03b75cc6f992d79511321def35956f485debedf1493 | | Selective Pisces | d9b1ad70c0a043d034f8eecd55a8290160227ea66780ccc65d0ffb2ebc2fb787 | | Selective Pisces | 3131985fa7394fa9dbd9c9b26e15ac478a438a57617f1567dc32c35b388c2f60 | | Selective Pisces | 5be717dc9eda4df099e090f2a59c25372d6775e7d6551b21f385cf372247c2fd | | Selective Pisces | 18cc18d02742da3fa88fc8c45fe915d58abb52d3183b270c0f84ae5ff68cf8a2 | | Selective Pisces | 7aa62af5a55022fd89b3f0c025ea508128a03aab5bc7f92787b30a3e9bc5c6e4 | | Selective Pisces | 79b7964bde948b70a7c3869d34fe5d5205e6259d77d9ac7451727d68a751aa7d | | Selective Pisces | cf9ccba037f807c5be523528ed25cee7fbe4733ec19189e393d17f92e76ffccc | | Selective Pisces | 32449fd81cc4f85213ed791478ec941075ff95bb544ba64fa08550dd8af77b69 | | Selective Pisces | 5a8b1f003ae566a8e443623a18c1f1027ec46463c5c5b413c48d91ca1181dbf7 | | Selective Pisces | 5bb4950a05a46f7d377a3a8483484222a8ff59eafdf34460c4b1186984354cf9 | | Stately Taurus | 352fb4985fdd150d251ff9e20ca14023eab4f2888e481cbd8370c4ed40cfbb9a | | Stately Taurus | 6491c646397025bf02709f1bd3025f1622abdc89b550ac38ce6fac938353b954 | | Stately Taurus | e8f55d0f327fd1d5f26428b890ef7fe878e135d494acda24ef01c695a2e9136d | | Raspberry Robin | 06f11ea2d7d566e33ed414993da00ac205793af6851a2d6f809ff845a2b39f57 | | Raspberry Robin | 202dab603585f600dbd884cb5bd5bf010d66cab9133b323c50b050cc1d6a1795 | | Raspberry Robin | f9e4627733e034cfc1c589afd2f6558a158a349290c9ea772d338c38d5a02f0e | | Raspberry Robin | 9fad2f59737721c26fc2a125e18dd67b92493a1220a8bbda91e073c0441437a9 | | Raspberry Robin | 9973045c0489a0382db84aef6356414ef29814334ecbf6639f55c3bec4f8738f | *Table 1. Hashes of samples.* Back to top ### Tags * [Advanced Persistent Threat](https://unit42.paloaltonetworks.com/tag/advanced-persistent-threat/ "Advanced Persistent Threat") * [DLL Sideloading](https://unit42.paloaltonetworks.com/tag/dll-sideloading/ "DLL Sideloading") * [Investigation and Response](https://unit42.paloaltonetworks.com/tag/investigation-and-response/ "Investigation and Response") * [Lazarus Group](https://unit42.paloaltonetworks.com/tag/lazarus-group/ "Lazarus Group") * [Malware Prevention](https://unit42.paloaltonetworks.com/tag/malware-prevention/ "Malware Prevention") * [Mustang Panda](https://unit42.paloaltonetworks.com/tag/mustang-panda/ "Mustang Panda") * [PKPLUG](https://unit42.paloaltonetworks.com/tag/pkplug/ "PKPLUG") * [Selective Pisces](https://unit42.paloaltonetworks.com/tag/selective-pisces/ "Selective Pisces") * [Stately Taurus](https://unit42.paloaltonetworks.com/tag/stately-taurus/ "Stately Taurus") * [Threat intelligence](https://unit42.paloaltonetworks.com/tag/threat-intelligence/ "threat intelligence") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Domain Shadowing: A Stealthy Use of DNS Compromise for Cybercrime](https://unit42.paloaltonetworks.com/domain-shadowing/ "Domain Shadowing: A Stealthy Use of DNS Compromise for Cybercrime") ### Table of Contents * ### Related Articles * [Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation](https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/ "article - table of contents") * [Tracking Iranian APT Screening Serpens' 2026 Espionage Campaigns](https://unit42.paloaltonetworks.com/tracking-iran-apt-screening-serpens/ "article - table of contents") * [Converging Interests: Analysis of Threat Clusters Targeting a Southeast Asian Government](https://unit42.paloaltonetworks.com/espionage-campaigns-target-se-asian-government-org/ "article - table of contents") ## Related Malware Resources ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/) * [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API") * [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway") * [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)