[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/valak-evolution/) * [Japanese](https://unit42.paloaltonetworks.com/ja/valak-evolution/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # Evolution of Valak, from Its Beginnings to Mass Distribution ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 11 min read Related Products [![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Brad Duncan](https://unit42.paloaltonetworks.com/author/brad-duncan/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:July 24, 2020 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/) * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Valak](https://unit42.paloaltonetworks.com/tag/valak/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/valak-evolution/?pdf=download&lg=en&_wpnonce=279fa6c5e6 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/valak-evolution/?pdf=print&lg=en&_wpnonce=279fa6c5e6 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Evolution%20of%20Valak,%20from%20Its%20Beginnings%20to%20Mass%20Distribution&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fvalak-evolution%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fvalak-evolution%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fvalak-evolution%2F&title=Evolution%20of%20Valak,%20from%20Its%20Beginnings%20to%20Mass%20Distribution "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fvalak-evolution%2F&text=Evolution%20of%20Valak,%20from%20Its%20Beginnings%20to%20Mass%20Distribution "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fvalak-evolution%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Evolution%20of%20Valak,%20from%20Its%20Beginnings%20to%20Mass%20Distribution%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fvalak-evolution%2F "Share in Mastodon") ## **Executive Summary** First noted in late 2019, Valak is an information stealer and malware loader that has become increasingly common in our threat landscape. From April through June of 2020, we saw waves of Valak malware two to four times a week on average through an email distribution network nicknamed Shathak or TA551. Characteristics of Valak include: * Valak relies on [scheduled tasks](https://attack.mitre.org/techniques/T1053/005/) and [Windows registry updates](https://attack.mitre.org/techniques/T1547/001/) to remain persistent on an infected Windows host. * Valak uses [Alternate Data Stream (ADS)](https://www.sans.org/blog/alternate-data-streams-overview/) as a technique to run follow-up malware on an infected host. * Recent Valak infections show an increase in obfuscated code for configuration scripts used during the infection, possibly as an attempt to avoid detection. * Since April 2020, we have seen a great deal of Valak malware distributed by an actor sometimes referred to as Shathak/TA551. This blog covers the history of Valak, reviews the chain of events for an infection, examines traffic generated by Valak and explores recent updates in obfuscation techniques used by the malware in order to evade detection. This blog also examines the Shathak/TA551 distribution system that has been consistently pushing Valak since April 2020. Palo Alto Networks customers are protected from Valak by our [Threat Prevention subscription](https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/threat-prevention) for the Next-Generation Firewall. ## Valak History The earliest public record of Valak comes from Proofpoint's ET Pro ruleset, where [two rules detecting Valak were introduced on October 22, 2019](https://www.proofpoint.com/us/daily-ruleset-update-summary-20191022), for the Suricata Open Source threat detection engine. Valak was documented[as follow-up malware during an Ursnif infection](https://www.malware-traffic-analysis.net/2019/12/19/index.html) (also known as Gozi or IFSB) on December 19, 2019. [Analysis by Cybereason](https://www.cybereason.com/blog/valak-more-than-meets-the-eye) revealed Valak used a combination of techniques to remain persistent on an infected Windows host. Valak relies on scheduled tasks combined with Windows registry updates. It also uses [Alternate Data Stream (ADS)](https://www.sans.org/blog/alternate-data-streams-overview/) during the infection process for follow-up malware. Most examples of Valak in recent months have been distributed through malicious spam (malspam). SentinelLabs (SentinelOne) published [a report providing further information about Valak](https://labs.sentinelone.com/valak-malware-and-the-connection-to-gozi-loader-confcrew/), including a connection between Valak malware distribution and campaigns similar to the "Gozi ConfCrew." Distribution characteristics were further explored in a [Threat Spotlight on Valak](https://blog.talosintelligence.com/2020/07/valak-emerges.html) published by Talos (Cisco). The distribution network using malspam to push Valak has been called[Shathak](https://twitter.com/luc4m/status/1265194192768315392) on Twitter. Shathak has been[attributed to an actor named TA551](https://malware.dontneedcoffee.com/refs/actors/ta551/) on the Malware Don't Need Coffee blog. ## Chain of Events ![This image illustrates the chain of events observed for recent Valak malware activity. Beginning with Shathak/TA551 distribution, the process includes malspan, password-protected ZIP attachment, extracting a Word document with macros from that attachment, enabling macros and then leading to an HTTP URL ending in .cab. This leads to downloading the initial Valak binary, configuring the script for the initial infection activity, HTTP Valak C2 traffic, and making Valak persistent through JS file, registry entries and scheduled tasks. More Valak C2 traffic can lead to followup malware added as ADS to text file, initially run through scheduled task.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/07/word-image.jpeg) Figure 1. Chain of events for recent Valak malware activity. Figure 1 shows the chain of events seen for Valak infections in June and early July 2020. For a Windows computer to become infected, a victim must: * Open malspam with password-protected ZIP attachment. On June 30 and July 1, 2020, we saw indications there may also have been a link to download a ZIP archive instead of an attachment. * Extract Microsoft Word document from the password-protected ZIP archive using a unique password from the message text. * Open the Word document as shown below in Figure 2 and enable macros. ![The text in the screenshot reads: "This document created in previous version of Microsoft Office Word. To view or edit this document, please click 'Enable editing' button on the top bar, and then click 'Enable content.'" This message is designed to trick the recipient into enabling macros for Valak.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/07/word-image-1.jpeg) Figure 2. Example of a Microsoft Word document from June 24, 2020, with macros for Valak. For Valak infections during June 2020, the initial activity consisted of: * An HTTP or HTTPS URL ending with .cab that returned a DLL to install Valak. * Valak DLL was saved to the C:\\ProgramData\\ directory using a random file name, usually with a .dat or .jpg file extension, as shown in Figure 3. * Valak DLL was run using regsvr32.exe -s *\[filename\]* * Popup message stating the DLL was successfully run, as shown in Figure 4. * A JavaScript configuration file appeared as a random file name (always the same name for each wave of infections) under the C:\\Users\\Public\\ directory, as shown in Figures 5 and 6. * Initial HTTP command and control (C2) traffic returned encoded ASCII text used to create additional malware/artifacts for the infection. ![Valak DLL is saved to the C:\\ProgramData\\ directory using a random file name, as shown in this screenshot.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/07/word-image-2.jpeg) Figure 3. Initial Valak DLL retrieved after enabling macros on the Word document from Figure 2. ![Message shown in screenshot: RegSvr32, DllRegisterServer in c:\\programdata\\51508.jpg succeeded. A link is present for the user to click OK.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/07/word-image-3.jpeg) Figure 4. Pop-up message on a Windows 10 host when an initial Valak DLL was successfully run using RegSvr32.exe after macros were enabled on June 24, 2020. ![A JavaScript configuration file appears as a random file name under the C:\\Users\\Public\\ directory](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/07/word-image-4.jpeg) Figure 5. Initial script file in C:\\Users\\Public\\ directory used during Valak infection from June 24, 2020. ![The screenshot shows how Valak obfuscates variable names in the JavaScript configuration file. This is an example of obfuscation that we have noted since June 2020.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/07/word-image-5.jpeg) Figure 6. Contents of the JavaScript configuration file from June 24, 2020. Figure 6 reveals variable names are obfuscated in the JavaScript configuration file. This is an example of obfuscation that we have noted since June 2020, and it is covered in more detail later in this blog when discussing Valak developments. As the infection progressed, three things happened near-simultaneously to make Valak persistent on an infected Windows host: * A Windows executable (EXE) appeared in the infected user's AppData\\Local\\Temp directory as a random file name ending in .bin (PE32 executable, Mono/.Net assembly), as shown in Figure 7. * Windows registry entries were created under the key for HKCU\\SOFTWARE\\ApplicationContainer\\Appsw64 * A randomly-named text file and JavaScript (JS) file both appeared under the C:\\Users\\Public\\ directory, as shown in Figures 8, 9 and 10. * A scheduled task was created to run the JS file located under C:\\Users\\Public\\ and repeat running it every four minutes, as shown in Figure 11. ![A Windows executable appeared in the infected user's AppData\\Local\\Temp directory as a random file name ending in .bin](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/07/word-image-6.jpeg) Figure 7. EXE file with a .bin file extension from the June 24, 2020, Valak infection. ![A randomly-named text file and JavaScript (JS) file both appeared under the C:\\Users\\Public\\ directory.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/07/word-image-7.jpeg) Figure 8. Additional artifacts in the C:\\Users\\Public\\ directory created during the infection. ![Displayed in WordPad, we see the contents of the text file, which is a random string.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/07/word-image-8.jpeg) Figure 9. Contents of the text file, a random string of text. ![Within the contents of the JS file used to keep the Valak infection persistent, we identified a 32-character ASCII string representing a hexadecimal value that identifies the infected Windows host](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/07/word-image-9.jpeg) Figure 10. Contents of the JS file used to keep the Valak infection persistent. ![The screenshot shows the context of a scheduled task that keeps the Valak infection persistent. Some of the text reads: "Smart Update Service - After triggered, repeat every 00:04:00 indefinitely."](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/07/word-image-10.jpeg) Figure 11. Scheduled task for JS file used to keep the Valak infection persistent. If the C2 domains remained active during the infection, as early as four minutes later, we saw follow-up malware: * Valak C2 traffic returned encoded ASCII text used to create a follow-up malware EXE. * The follow-up malware EXE was appended to the randomly-named text file in C:\\Users\\Public using ADS, as shown in Figure 12. * A scheduled task was created to run the follow-up malware EXE once, shortly after it was created, as shown in Figure 13. ![The top section of the screenshot shows the AlternateStreamView, appended with ADS for follow-up malware. The lower section of the screenshot shows the text file modified after it first appeared.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/07/word-image-11.jpeg) Figure 12. Text file in C:\\Users\\Public\\ directory updated with ADS. ![In addition to Smart Update Service, the screenshot shows an additional scheduled task to run follow-up malware (WSUPackage...)](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/07/word-image-12.jpeg) Figure 13. Scheduled task to run the follow-up malware. In our tests, running Valak from a U.S. location on a vulnerable Windows 10 host returned a banking Trojan called [IcedID](https://malpedia.caad.fkie.fraunhofer.de/details/win.icedid) as the follow-up malware. In one case, we saw both IcedID and [NetSupport Manager RAT-based malware](https://threatpost.com/netsupport-manager-rat-nortonlifelock-docs/153387/) delivered as follow-up malware on a Windows 7 host [from June 2020](https://twitter.com/malware_traffic/status/1276640971367776259). ## **Valak Infection Traffic** The infection starts when a victim enables macros on one of the malicious documents. This usually generates a URL ending with .cab that returns a Windows DLL file. Figure 14 shows [a Valak infection from June 24, 2020](https://www.malware-traffic-analysis.net/2020/06/24/index.html), filtered in Wireshark to list the HTTP requests and other web-based traffic. The first line shows a URL that ends with .cab. A TCP stream of this activity is shown in Figure 15, and it reveals signs of an EXE or DLL file returned from the server. ![This shows a log of traffic from a Valak infection with IcedID as the follow-up malware.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/07/word-image-13.jpeg) Figure 14. Traffic from a Valak infection with IcedID as the follow-up malware from June 2020 filtered in Wireshark. ![Indicators of an EXE or DLL file returned from the server.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/07/word-image-14.jpeg) Figure 15. TCP stream for the HTTP GET request ending in .cab that returned a Windows DLL file. [Checking the binary in VirusTotal](https://www.virustotal.com/gui/file/0f0d870fcad3e935d191e4076bfdc3812c278c3bdb6ec2233d71d9cf14a04a17/) shows this file is a DLL. This DLL is an installer for Valak. Shortly after the initial HTTP traffic for the Valak DLL, we see other HTTP GET requests starting with: * license.jsp?client= * archive.jsp?page= * db.aspx?dfc= The HTTP requests are Valak C2 traffic, which is sent to decoy domains (non-malicious domains from legitimate organizations) and malicious domains. These domains are listed in the initial Valak script previously shown in Figure 5. For example, for Valak infections from the June 24, 2020, wave, the decoy domains were: * e87.dspb.akamaidege.net * insiderppe.cloudapp.net * pagead46.l.doubleclick.net Also noted in Figure 5 are the malicious domains from the June 24, 2020, wave of Valak: * thepicklepilot.com * joonaskallinen.com * xfitnessproducts.com Figure 5 also shows three additional domains from the June 24, 2020, wave of Valak. These domains appear to be fake or possibly placeholders because they were not registered and did not resolve to any IP address. * 59xidd-fuel.com * 19geds-space.com * 55sfors-cask.com Valak C2 traffic returns data as encoded ASCII text that is decoded on the victim host and saved as malware items like script files, EXE used during the infection and data for registry updates for the Valak infection. Figure 16 shows an example of this traffic. ![Valak C2 over HTTP traffic returning ASCII data used to create malware items on the victim host.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/07/word-image-15.jpeg) Figure 16. Valak C2 over HTTP traffic returning ASCII data used to create malware items on the victim host. In addition to HTTP GET requests, Valak uses HTTP POST requests to exfiltrate certain types of data. In Figures 17 and 18, we see an HTTP POST request starting with class4.aspx?internalService= that sends login credentials used for Microsoft Outlook from an infected Windows host. ![HTTP POST request seen on a Valak-infected Windows host with Outlook](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/07/word-image-16.jpeg) Figure 17. Valak infection traffic filtered in Wireshark showing an HTTP POST request from the C2 traffic. ![The screenshot shows login credentials of email account used for Microsoft Outlook on the infected Windows host. It also shows a base64 string that translates to Outlook login credentials of the Valak-infected host.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/07/word-image-17.jpeg) Figure 18. TCP stream of the HTTP POST request showing a base64 string containing Outlook login credentials of the infected host. We primarily see IcedID as follow-up malware from the Valak infections generated from U.S. locations. Figure 19 shows indicators of IcedID during the Valak infection traffic. ![IcedID traffic during the Valak infection (malicious domains noted by the arrows in the screenshot)](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/07/word-image-18.jpeg) Figure 19. Indicators of IcedID as the follow-up malware during this Valak infection. ## **Recent Developments** As Valak has developed, we have noticed increased obfuscation in the Valak configuration script. This obfuscation finds its way into other script and Windows registry updates used to keep the infection persistent. Figure 20 shows configuration script from June 23, 2020, using Valak software version 40. Figure 21 shows configuration script from June 24, 2020, using Valak software version 41. Note how variable names and some of the values were obfuscated when Valak changed from version 40 to version 41. ![Valak configuration script from June 23, 2020, shows software (Valak) signature, software (Valak) version, and variable names and values in plain text.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/07/word-image-19.jpeg) Figure 20. Valak version 40 configuration script with variable names and values in plain text. ![A Valak configuration script from June 24, 2020, shows software (Valak) signature, software (Valak) version, and variable names and values now using encoded strings.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/07/word-image-20.jpeg) Figure 21. Valak version 41 configuration script with variable names and some values using obfuscated text. Like most obfuscation, this is likely an attempt to evade detection. As the weeks and months progress, we predict further obfuscation in Valak's configuration script and related files. ## **Shathak/TA551 Distribution** Shathak or TA551 is the name some security researchers have given to a specific distribution method that uses password-protected ZIP archives as attachments to malspam. The distribution network [may be associated with Russian cybercriminals](https://www.cybereason.com/blog/valak-more-than-meets-the-eye#Relationship-Other-Malware). It has used Word document templates targeting English-, Italian-, German- and Japanese-speaking recipients. Shathak/TA551 has been active at least as early as February 2019. Shathak/TA551 distribution has the following characteristics: * Malspam spoofs legitimate email chains based on mailbox data retrieved from previously-infected Windows hosts. It sends copies of these email chains to senders and recipients from the original email chain. * The spoofed email chain includes a short message as the most recent item in the chain. This item is a generic message that instructs recipients to open an attached ZIP archive using a supplied password. * The password-protected ZIP attachments contain a Microsoft Word document with macros to install malware. See [Appendix A](https://raw.githubusercontent.com/pan-unit42/iocs/master/Valak/2020-June-SHA256-hashes-of-Word-docs-from-Shathak-TA551-distribution.txt) for examples of these Word documents from June 2020. * The macros usually generate a URL ending in .cab to retrieve a binary that installs malware. This binary is currently a DLL file. [Appendix B](https://www.virustotal.com/gui/file/0f0d870fcad3e935d191e4076bfdc3812c278c3bdb6ec2233d71d9cf14a04a17/) lists examples of URLs from this campaign. * Prior to April 2020, the most common malware caused by Word documents associated with Shathak/TA551 was Ursnif. * Since April 2020, the most common malware distributed by these Word documents has been Valak. [Appendix C](https://raw.githubusercontent.com/pan-unit42/iocs/master/Valak/2020-June-SHA256-hashes-of-Valak-DLL-files-from-Shathak-TA551-distribution.txt) lists a series of Valak DLL examples from June 2020. * Since May 2020, passwords used for the ZIP attachments appear to be unique to each recipient. To get an idea of traffic patterns associated with Shathak/TA551, recent examples of URLs generated by the associated Word macros follow (Read: Date - URL). * 2020-05-26 - hxxp://c1j4xptyujjpyt8\[.\]com/gg88wyaftcxr7gu/wo0zz.php?l=sfzs9.cab * 2020-05-27 - hxxp://ft23fpcu5yabw2\[.\]com/alfh/xzrn.php?l=lfahe9.cab * 2020-06-03 - hxxp://awh93dhkylps5ulnq-be\[.\]com/czwih/fxla.php?l=gap1.cab * 2020-06-09 - hxxp://a4zy33hbmhxx70w9q\[.\]com/hdil/kzex.php?l=soub12.cab * 2020-06-10 - hxxp://kzex9vp0jfw6a8up1\[.\]com/hdil/kzex.php?l=phin1.cab * 2020-06-22 - hxxp://5u2mr\[.\]com/unbbmevd/d76.php?l=oev1.cab * 2020-06-23 - hxxp://fepz41\[.\]com/unbbmevd/d76.php?l=ynetz11.cab * 2020-06-24 - hxxp://mbzrrt\[.\]com/unbbmevd/d76.php?l=ftywl4.cab * 2020-06-26 - hxxp://ofxvp\[.\]com/unbbmevd/d76.php?l=wozmbl9.cab * 2020-07-06 - hxxp://eto9ve1\[.\]com/iz5/yaca.php?l=tze7.cab As noted previously, [Appendix B](https://www.virustotal.com/gui/file/0f0d870fcad3e935d191e4076bfdc3812c278c3bdb6ec2233d71d9cf14a04a17/) provides more examples of these URLs generated by Word macros associated with Shathak/TA551. Figures 22-30 provide screenshots with selected examples of malspam and the extracted Word documents associated with Shathak/TA551. These images illustrate how the Shathak/TA551 distribution has evolved since February 2019. ![Screenshot reads: "Good Morning, Please see the attached proposal!" It continues by offering a zip password and closeout. The extracted document, request 11, opens with a message attempting to trick the user into enabling macros.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/07/word-image-21.jpeg) Figure 22. Shathak/TA551 malspam to an English-speaking recipient from February 4, 2019. ![Screenshot reads: "Buongiorno, Vedi allegato e di confermare." It continues by offering a zip password and closeout. The extracted document, doc\_02.04, opens with a message attempting to trick the user into enabling macros.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/07/word-image-22.jpeg) Figure 23. Shathak/TA551 malspam to an Italian-speaking recipient from April 2, 2019. ![Screenshot reads: "Good morning, Please see attached and confirm." It continues by offering a zip password and closeout. The extracted document, info\_07.22, opens with a message attempting to trick the user into enabling macros.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/07/word-image-23.jpeg) Figure 24. Shathak/TA551 malspam to an English-speaking recipient from July 22, 2019. ![Screenshot reads: "Guten Morgen, siehe Anhang." It continues by offering a zip password and closeout. The extracted document, info\_10.30, opens with a message attempting to trick the user into enabling macros.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/07/word-image-24.jpeg) Figure 25. Shathak/TA551 malspam to a German-speaking recipient from October 30, 2019. ![Screenshot includes a Japanese-language greeting. It continues by offering a zip password and closeout. The extracted document, info\_12\_18, opens with a message attempting to trick the user into enabling macros.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/07/word-image-25.jpeg) Figure 26. Shathak/TA551 malspam to a Japanese-speaking recipient from December 17, 2019. ![Screenshot reads: "Guten Morgen, Siehen Sie bitte die beigefugle Datei." It continues by offering a zip password and closeout. The extracted document, information\_03.26, opens with a message attempting to trick the user into enabling macros.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/07/word-image-26.jpeg) Figure 27. Shathak/TA551 malspam to a German-speaking recipient from March 26, 2020. ![Screenshot reads: "Please see the attached document." It continues by offering a zip password and closeout. The Zip archive includes many documents, which when extracted, open with a message attempting to trick the user into enabling macros.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/07/word-image-27.jpeg) Figure 28. Shathak/TA551 malspam to an English-speaking recipient from April 28, 2020. ![Screenshot reads: "Good Morning, Please see the attached document." It continues by offering a zip password and closeout. The Zip archive includes many documents, which when extracted, open with a message attempting to trick the user into enabling macros.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/07/word-image-28.jpeg) Figure 29. Shathak/TA551 malspam to an English-speaking recipient from May 22, 2020. ![Figure 30. Shathak/TA551 malspam to a German-speaking recipient from May 26, 2020.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/07/word-image-29.jpeg) Figure 30. Shathak/TA551 malspam to a German-speaking recipient from May 26, 2020. This distribution network has generally pushed Ursnif in previous years, but since late April 2020, we've most often seen Valak from Shathak/TA551. In some cases, we still see Ursnif from this distribution, which recently happened on June 10, 2020, and July 7, 2020. ## **Conclusion** As we enter the second half of 2020, Valak shows no signs of slowing down. We expect to see further waves of malspam from Shathak/TA551 distribution pushing Word documents with macros for Valak. Due to its complex infection process that relies in part on registry updates with malware code, Valak can easily infect an unprotected Windows host. With ADS used to hide follow-up malware from a Valak infection, the risk is greatly increased. However, security best practices like running fully patched and up-to-date versions of Microsoft Windows will hinder or prevent Valak infections. Palo Alto Networks customers are further protected from Valak by our Threat Prevention subscription for the Next-Generation Firewall. [AutoFocus](https://www.paloaltonetworks.com/cortex/autofocus) users can search for Valak activity by using the [Valak](https://autofocus.paloaltonetworks.com/#/tag/Unit42.Valak) tag. Appendix A Examples of SHA256 file hashes along with the associated file names for Word documents from Shathak/TA551 distribution during June 2020. Information available at: [https://raw.githubusercontent.com/pan-unit42/iocs/master/Valak/2020-June-SHA256-hashes-of-Word-docs-from-Shathak-TA551-distribution.txt](https://github.com/pan-unit42/iocs/blob/master/Valak/2020-June-SHA256-hashes-of-Word-docs-from-Shathak-TA551-distribution.txt) Appendix B Examples of URLs generated by Word documents associated with Shathak/TA551. Information available at: [https://raw.githubusercontent.com/pan-unit42/iocs/master/Valak/2020-03-23-to-2020-07-07-TA551-traffic-pattern-history-since-Valak.txt](https://raw.githubusercontent.com/pan-unit42/iocs/master/Valak/2020-03-23-to-2020-07-07-TA551-traffic-pattern-history-since-Valak.txt) Appendix C Examples of SHA256 file hashes for Valak DLL files seen from Shathak/TA551 distribution during June 2020. Information available at: [https://raw.githubusercontent.com/pan-unit42/iocs/master/Valak/2020-June-SHA256-hashes-of-Valak-DLL-files-from-Shathak-TA551-distribution.txt](https://raw.githubusercontent.com/pan-unit42/iocs/master/Valak/2020-June-SHA256-hashes-of-Valak-DLL-files-from-Shathak-TA551-distribution.txt) Back to top ### Tags * [Valak](https://unit42.paloaltonetworks.com/tag/valak/ "Valak") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: OilRig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory](https://unit42.paloaltonetworks.com/oilrig-novel-c2-channel-steganography/ "OilRig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory") ### Table of Contents * ### Related Articles * [TA551: Email Attack Campaign Switches from Valak to IcedID](https://unit42.paloaltonetworks.com/ta551-shathak-icedid/ "article - table of contents") ## Related Resources ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/) * [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API") * [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway") * [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)