[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/)  
[![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/)  
Menu

* [Tools](https://unit42.paloaltonetworks.com/tools/)
* [ATOMs](https://unit42.paloaltonetworks.com/atoms/)
* [Security Consulting](https://www.paloaltonetworks.com/unit42)
* [About Us](https://unit42.paloaltonetworks.com/about-unit-42/)
* [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html)  
  English
* [English](https://unit42.paloaltonetworks.com/watchdog-cryptojacking/)
* [Japanese](https://unit42.paloaltonetworks.com/ja/watchdog-cryptojacking/)
* [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research")
* [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research")
* [Cloud Cybersecurity Research](https://unit42.paloaltonetworks.com/category/cloud-cybersecurity-research/ "Cloud Cybersecurity Research")  
  [Cloud Cybersecurity Research](https://unit42.paloaltonetworks.com/category/cloud-cybersecurity-research/)

# WatchDog: Exposing a Cryptojacking Campaign That's Operated for Two Years

![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 16 min read  
Related Products  
[![Prisma Access icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/prisma_RGB_logo_Icon_Color.png)Prisma Access](https://unit42.paloaltonetworks.com/product-category/prisma-access/ "Prisma Access")[![Prisma Cloud icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/prisma_RGB_logo_Icon_Color.png)Prisma Cloud](https://unit42.paloaltonetworks.com/product-category/prisma-cloud/ "Prisma Cloud")

* ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg)  
  By:
  
  * [Nathaniel Quist](https://unit42.paloaltonetworks.com/author/nathaniel-quist/)

* ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg)  
  Published:February 17, 2021

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg)  
  Categories:
  
  * [Cloud Cybersecurity Research](https://unit42.paloaltonetworks.com/category/cloud-cybersecurity-research/)
  * [Malware](https://unit42.paloaltonetworks.com/category/malware/)
  * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/)

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg)  
  Tags:
  
  * [Cryptojacking](https://unit42.paloaltonetworks.com/tag/cryptojacking/)
  * [GoLang](https://unit42.paloaltonetworks.com/tag/golang/)
  * [Monero](https://unit42.paloaltonetworks.com/tag/monero/)
  * [XMRig](https://unit42.paloaltonetworks.com/tag/xmrig/)

* [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/watchdog-cryptojacking/?pdf=download&lg=en&_wpnonce=279fa6c5e6 "Click here to download")

* [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/watchdog-cryptojacking/?pdf=print&lg=en&_wpnonce=279fa6c5e6 "Click here to print")

Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg)

* ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg)
* [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=WatchDog:%20Exposing%20a%20Cryptojacking%20Campaign%20That’s%20Operated%20for%20Two%20Years&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fwatchdog-cryptojacking%2F "Share in email")
* [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fwatchdog-cryptojacking%2F "Share in Facebook")
* [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fwatchdog-cryptojacking%2F&title=WatchDog:%20Exposing%20a%20Cryptojacking%20Campaign%20That’s%20Operated%20for%20Two%20Years "Share in LinkedIn")
* [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fwatchdog-cryptojacking%2F&text=WatchDog:%20Exposing%20a%20Cryptojacking%20Campaign%20That’s%20Operated%20for%20Two%20Years "Share in Twitter")
* [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fwatchdog-cryptojacking%2F&ts=markdown "Share in Reddit")
* [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=WatchDog:%20Exposing%20a%20Cryptojacking%20Campaign%20That’s%20Operated%20for%20Two%20Years%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fwatchdog-cryptojacking%2F "Share in Mastodon")

## Executive Summary

Unit 42 researchers are exposing one of the largest and longest-lasting Monero cryptojacking operations known to exist. The operation is called WatchDog, taken from the name of a Linux daemon called [watchdogd](https://linux.die.net/man/8/watchdog). The WatchDog mining operation has been running since Jan. 27, 2019, and has collected at least 209 Monero (XMR), valued to be around $32,056 USD. Researchers have determined that at least 476 compromised systems, composed primarily of Windows and NIX cloud instances, have been performing mining operations at any one time for over two years.

Cryptojacking is the process of performing cryptomining operations on systems which are not owned and maintained by the mining operators. Malicious cryptojacking operations are currently estimated to affect [23% of cloud environments](https://unit42.paloaltonetworks.com/highlight-cloud-threat-report-iam/), up from [8% in 2018](https://securelist.com/ransomware-and-malicious-crypto-miners-in-2016-2018/86238/). This increase is primarily caused by the meteoric rise in cryptocurrencies' valuation. The global market for blockchain, the technology behind cryptocurrency, is [anticipated to reach $60.7 billion by 2024](https://www.prnewswire.com/news-releases/worldwide-blockchain-report-market-shares-strategies-and-forecasts-2018-2024-market-is-anticipated-to-reach-607-billion-with-ibm-microsft--accenture-driving-blockchain-300581333.html), and criminal organizations and actor groups are trying to cash in on this.

Within this blog, Unit 42 researchers provide an overview of the WatchDog cryptojacking campaign. The WatchDog miner is composed of a three-part Go Language binary set and a bash or PowerShell script file. The binaries perform specific functionality, one of which emulates the Linux watchdogd daemon functionality by ensuring that the mining process does not hang, overload or terminate unexpectedly. The second Go binary downloads a configurable list of IP addresses net ranges before providing the functionality of targeted exploitation operations of identified NIX or Windows systems discovered during the scanning operation. Finally, the third Go binary script will initiate a mining operation on either Windows or NIX operating systems (OS) using custom configurations from the initiated bash or PowerShell script. WatchDog's usage of Go binaries allows it to perform the stated operations across different operating systems using the same binaries, i.e. Windows and NIX, as long as the Go Language platform is installed on the target system.

Researchers have mapped out the infrastructure behind the mining operations. They have identified 18 root IP endpoints and seven malicious domains, which serve at least 125 malicious URL addresses used to download its toolset.

Unit 42 reported on [Graboid](https://unit42.paloaltonetworks.com/graboid-first-ever-cryptojacking-worm-found-in-images-on-docker-hub/), a wormable Monero mining operation on Docker Hub, in October 2019. Graboid was the largest known mining operation to date in terms of the total number of active systems. At the time of its operation, it consisted of at least 2,000 exposed and compromised Docker Daemon APIs systems. Each Graboid miner was operational 65% of the time, meaning around 1,300 compromised Docker containers were mining at any one time. Additionally, Graboid could have also achieved higher processing speeds due to the configuration script utilizing all available container central processing units (CPUs). However, Graboid was only known to operate for up to three months before its Docker Hub images were removed.

WatchDog, on the other hand, does not rely on a third-party site to host its malicious payload, allowing it to have remained active for more than two years at the time of this writing.

It is clear that the WatchDog operators are skilled coders and have enjoyed a relative lack of attention regarding their mining operations. While there is currently no indication of additional cloud compromising activity at present (i.e. the capturing of cloud platform identity and access management (IAM) credentials, access ID or keys), there could be potential for further cloud account compromise. It is highly likely these actors could find IAM-related information on the cloud systems they have already compromised, due to the root and administrative access acquired during the implantation of their cryptojacking software.

Palo Alto Networks [Prisma Access](https://www.paloaltonetworks.com/prisma/access) is configured to detect each of WatchDog's 18 IP addresses, seven domains and their associated URL addresses through PAN-OS. [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) also detects the usage of malicious XMRig processes used by the WatchDog miner operating in cloud environments that have Prisma Cloud Compute Defender installed.

## Public Mining Pools

Unit 42 researchers have identified three XMR wallet addresses within WatchDog configuration files. These configuration files are downloaded alongside the WatchDog mining binaries and contain the XMR wallet address and the mining pool(s) to be used during the mining operations. See Figure 1 for an example of the configuration file config.json.
![An example of the configuration files downloaded alongside the WatchDog mining binaries. These contain the XMR wallet address and the mining pool(s) to be used during the mining operations.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/02/word-image-53.png) Figure 1. config.json file detailing the XMR wallet address.

Examining all known config.json files used by WatchDog, Unit 42 researchers have identified three XMR wallet addresses as:

43zqYTWj1JG1H1idZFQWwJZLTos3hbJ5iR3tJpEtwEi43UBbzPeaQxCRysdjYTtdc8aHao7csiWa5BTP9PfNYzyfSbbrwoR

82etS8QzVhqdiL6LMbb85BdEC3KgJeRGT3X1F3DQBnJa2tzgBJ54bn4aNDjuWDtpygBsRqcfGRK4gbbw3xUy3oJv7TwpUG4

87q6aU1M9xmQ5p3wh8Jzst5mcFfDzKEuuDjV6u7Q7UDnAXJR7FLeQH2UYFzhQatde2WHuZ9LbxRsf3PGA8gpnGXL3G7iWMv

These three XMR wallet addresses are used with at least three public mining pools and one private mining pool to process mining operations, performance, functionality and payments.

|----------------------------|----------|-----------------------|
| **Mining Pool**            | **Port** | **Public or Private** |
| xmr.f2pool\[.\]com         | 13531    | Public                |
| xmr-eu2.nanopool\[.\]org   | 14444    | Public                |
| xmr.pool.gntl\[.\]co.uk    | 40009    | Public                |
| 80\[.\]211\[.\]206\[.\]105 | 6666     | Private               |

^*Table 1. Public and private mining pools used by the WatchDog miner.*^

The following eight screenshots illustrate the findings gathered from the f2pool, nanopool and the GNTL public mining pools for each of the three XMR wallets identified.

#### **f2pool mining pool**

Figures 2 and 3 illustrate the XMR address beginning with "43zq" being heavily used within the f2pool public mining pool, pulling in roughly 200 Monero. Meanwhile, the XMR wallet address starting with "82et" operates at a much lower scale and has only pulled in 2.3 XMR (see Figures 4 and 5).
![This shows the XMR total for wallet 43zq in the f2pool public mining pool, pulling in roughly 200 Monero.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/02/word-image-54.png) Figure 2. XMR wallet 43zq and its XMR total. ![XMR wallet 43zq was heavily used by WatchDog within the f2pool public mining pool. The image shows its 30-day hashrate.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/02/word-image-55.png) Figure 3. XMR wallet 43zq and its 30-day hashrate. ![This shows the XMR total for wallet 82et in the f2pool public mining pool, pulling in only 2.3 Monero.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/02/word-image-56.png) Figure 4. XMR wallet 82et and its XMR total. ![XMR wallet 82et was less used by WatchDog within the f2pool public mining pool. The image shows its 30-day hashrate.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/02/word-image-57.png) Figure 5. XMR wallet 82et and its 30-day hashrate.

#### **Nanopool mining pool**

XMR address beginning with "82et" was less active within the f2pool public mining pool, but it is more involved within the nanopool public mining pool (see Figures 6 and 7) than the XMR wallet address beginning with "43zq" (see Figures 8 and 9). However, the nanopool mining operation only equates to a fraction of the total XMR mined by the WatchDog mining operation as a whole, with 6.8 XMR coins mined to date.
![XMR wallet 82et was more involved within the nanopool public mining pool. See its lifetime hashrate and balance shown here.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/02/word-image-58.png) Figure 6. XMR wallet 82et and its lifetime hashrate. ![XMR wallet 82et is shown here with its XMR payouts. Within the nanopool public mining pool, this wallet shows 6.8 XMR coins mined to date.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/02/word-image-59.png) Figure 7. XMR wallet 82et and its XMR payouts. ![The image shows XMR wallet 43zq and its lifetime hashrate within the nanopool public mining pool for comparison.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/02/word-image-60.png) Figure 8. XMR wallet 43zq and its lifetime hashrate. ![The XMR total payout for XMR wallet 43zq within the nanopool public mining pool amounts to a mere fraction of the total WatchDog mining operation.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/02/word-image-61.png) Figure 9. XMR wallet 43zq and its XMR total payout.

#### **GNTL XMR mining pool**

A single configuration file has been identified that links the potential of the wallet that begins with "87qa" to all three public mining pools listed here, but only GNTL displayed any mining operations related to the "87qa" XMR wallet (see Figure 10). However, this XMR wallet address does not seem to be greatly used within the WatchDog operations. As of this writing, only .59 XMR has been mined from GNTL using the "87qa" XMR address (see Figures 10 and 11).
![The GNTL XMR mining pool is the only one of the three public mining pools listed here that displayed mining operations related to the 87qa XMR wallet. The image shows its XMR hashrate.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/02/word-image-62.png) Figure 10. XMR wallet 87qa and XMR hashrate. ![As of this writing, only .59 XMR has been mined from GNTL using the 87qa XMR address.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/02/word-image-63.png) Figure 11. XMR wallet 87qa and all XMR payouts.

Out of the data collected from all three of the public mining pools, Unit 42 researchers calculated an average of 1,037KH/s hash rate from the XMR wallets across the public mining pools. Researchers then developed an estimate of the current number of systems actively participating in the cryptomining operation. Researchers conservatively estimate that an average of 476 systems are actively involved within the WatchDog mining operation at any one time.

This estimation was calculated using the documentation on CPU architecture from several of the largest cloud providers. All cloud providers advertise the use of Intel Xeon E5 and AMD EPYC CPUs for a majority of their cloud VM instances.

We can use the popular XMR mining software [XMRig](https://github.com/xmrig/xmrig)'s benchmark hash calculator to calculate the hash rates for mid-range [Intel Xeon E5](https://xmrig.com/benchmark?cpu=Intel%28R%29+Xeon%28R%29+CPU+E5-2620+v3+%40+2.40GHz) and [AMD EPYC series 7](https://xmrig.com/benchmark?cpu=AMD+EPYC+7601+32-Core+Processor) processors. A single thread on each processor can produce an estimated hash rate of 543 H/s (hashes per second) for the AMD EPYC series 7 and 544 H/s for the Intel Xeon E5. When taking into account the WatchDog miner configuration file, config.json, the miner will use at most four threads on the compromised system (see Figure 12).
![When taking into account the WatchDog miner configuration file, config.json, the miner will use at most four threads on the compromised system.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/02/word-image-64.png) Figure 12. WatchDog miner CPU configuration.

This will result in the compromised system processing a total average of 2,172-2,176 H/s using at most four threads as per the configuration guide. With an average total of 1,037 KH/s (thousand hashes per second) of processing for the total WatchDog miner operation, this leaves a potential total of 476 systems participating in the mining operation at any one time.

The number of systems would depend upon the VM instance type that was compromised and used. It is important to note that not every compromised system would be able to process XMRig operations to the same scale. It is possible that double this estimated number, nearly 900 systems, could be operating at any one time. This size of a mining operation is achievable if smaller, less robust, cloud VM instances were compromised and used to process XMR hashes.

## **WatchDog Infrastructure**

The WatchDog miner has been active since at least Jan. 27, 2019, as witnessed from the public mining pool data. Since that time, a number of malware samples have been identified that point to WatchDog infrastructure, specifically the initialization bash script that begins the system and mining configuration process for newly compromised systems.

Through analysis of these initialization bash scripts, Unit 42 researchers were able to track how WatchDog actors set up mining operations on a compromised system. The authors of the script tipped their hand to show how they set up and configure their mining infrastructure. Within every known operation, the initialization bash script is downloaded onto the compromised system and performs a series of functions. Several of the functions are common to a majority of cryptojacking operations, namely the removal of cloud security tools, the removal of previously installed and known malicious cryptomining software, and then the downloading and setup of the customized malicious cryptomining software. However, the WatchDog bash script miner also hardcodes a primary and secondary URL address that are used to download the WatchDog mining toolkit (see Figure 13).
![The WatchDog bash script miner hardcodes a primary and secondary URL address that are used to download the WatchDog mining toolkit.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/02/word-image-65.png) Figure 13. Establishing command and control (C2).

Using these primary and secondary URL addresses, Unit 42 researchers were able to map a rough estimation of the network infrastructure used by the WatchDog miner operators.

The following Maltego chart illustrates the overall size of the known operation infrastructure used by WatchDog (see Figure 14).
![This Maltego chart illustrates the overall size of the known operation infrastructure used by WatchDog.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/02/word-image-66.png) Figure 14. Maltego chart of the WatchDog miner operation.

To date, there are currently 18 known IP addresses and seven known domains hosting at least 125 URLs that have served or continue to serve the WatchDog miner malware and configuration files. While the majority of the malware appears to be focused on \*NIX OS systems, there are several Windows OS binaries that are also hosted on several of the known host systems.

|---------------------|
| 39.100.33\[.\]209   |
| 45.153.240\[.\]58   |
| 45.9.148\[.\]37     |
| 93.115.23\[.\]117   |
| 95.182.122\[.\]199  |
| 106.15.74\[.\]113   |
| 107.173.159\[.\]206 |
| 146.71.79\[.\]230   |
| 185.181.10\[.\]234  |
| 185.232.65\[.\]124  |
| 185.232.65\[.\]191  |
| 185.232.65\[.\]192  |
| 185.247.117\[.\]64  |
| 198.98.57\[.\]187   |
| 199.19.226\[.\]117  |
| 204.44.105\[.\]168  |
| 205.209.152\[.\]78  |
| 208.109.11\[.\]21   |

^*Table 2. The 18 known IP addresses associated with the WatchDog miner.*^

|--------------------------|
| de.gengine\[.\]com.de    |
| de.gsearch\[.\]com.de    |
| global.bitmex\[.\]com.de |
| ipzse\[.\]com            |
| py2web\[.\]store         |
| sjjjv\[.\]xyz            |
| us.gsearch\[.\]com.de    |

^*Table 3. The seven known domains associated with the WatchDog miner.*^

For a full list of the known URL Addresses associated with the WatchDog mining operation, see the Indicators of Compromise (IOC) section of this blog.

Researchers found that several of these host systems were still operational at the time the research for this blog was being conducted. Due to the live status, researchers were able to pull down several of the malicious files for further analysis. A full IOC breakdown of the files and their SHA-256 hash is listed below within the IOC section.

## WatchDog Malware Breakdown

Unit 42 researchers selected five interrelated malware samples to explain their functionality. The cryptojacking operation appears to begin with a bash script, newdat.sh, which defines the downloadable content for three separate Go binary files and one JSON configuration file config.json. The Go binaries detailed within this blog are a network scanner and exploitation binary called networkmanager, a process monitoring binary called phpguard, and a version of the malicious XMRig cryptomining software called phpupdate.

#### **newdat.sh**

Unit 42 researchers have identified four different filenames for bash scripts that perform the same infrastructure, network scanning and system configuration operations. These file names are init.sh, newinit.sh, newdat.sh and update.sh.

There are eight unique operations within the initialization script:

* Environmental setup
  * Configure file and directory read/write permissions and save downloaded files to preconfigured locations.
* Uninstallation of cloud security tools
  * Namely [Alibaba Cloud Security Center](https://www.alibabacloud.com/help/doc-detail/42302.htm?spm=a2c63.l28256.a3.7.28a97cceyxtiqE) and [Tencent Cloud Security Operations Center](https://intl.cloud.tencent.com/product/soc).
  * This is a common operation used by several cryptojacking operations including groups such as [Rocke](https://unit42.paloaltonetworks.com/rockein-the-netflow/) and [TeamTnT](https://sensorstechforum.com/teamtnt-cryptomining-operation-steals-aws-credentials/).
* Download toolkit
  * Download three Go Binaries and a configuration file.
* kill\_miner\_proc
  * Killing known mining processes.
* kill\_sus\_proc
  * Killing previously installed WatchDog mining processes.
* downloads
  * Downloads IP address ranges to be used for scanning.
* unlock\_cron
  * Unlocks the /etc/crontab file.
* lock\_cron
  * Locks the /etc/crontab file.

Perhaps one of the most useful script operations identified by Unit 42 researchers is the section pertaining to the download location of the WatchDog toolkit. As illustrated within the previous infrastructure section, the scripts detailed which endpoints are currently hosting the malicious cryptojacking files.
![The figure shows hardcoded links within the newdat.sh script that point to URL addresses and identify the miner binary, the configuration files, the scanning binary, the WatchDog process and another version of the initial script itself.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/02/word-image-67.png) Figure 15. Establishing command and control (C2).

As can be seen in Figure 15, there are hardcoded links within the newdat.sh script that point to URL addresses and identify the miner binary, the configuration files, the scanning binary and the WatchDog process -- and even another version of the initial script itself. This could allow the actors to update the active miners in near realtime.

Each of these binaries will be investigated in the following sections. First up is the Go language scanning binary, networkmanager.

#### **networkmanager**

The networkmanager binary is a UPX-compressed Go language binary designed to scan networks and, when a vulnerable target is identified, attempt to compromise that identified system using a robust set of built-in application exploits. Researchers have identified two different file names used by the actors to name their binaries that perform the same scanning and exploitation function. Those names are networkmanager and networkservice.

While scanning operations are initiated via the newdat.sh bash script detailed above, the scanner binary will perform the actual scanning and exploitation operations. The WatchDog scanning binary uses a file composed of 60,634 individual Chinese IP net ranges, which is downloaded during the system detection phase of the networkmanager binary. Within the Go binary's main initialization function, sym.go.main.ipc.download\_ipdb, the networkmanager binary requests and then downloads one of two possible IP address netrange files:

http://83.97.20\[.\]90/cccf67356/ip\_cn.txt

http://83.97.20\[.\]90/cccf67356/ips\_cn.txt

The IP address net ranges were stored in binary format and upon conversion to ASCII revealed the targeted IP address net ranges (see Figure 16).
![The IP address net ranges were stored in binary format and upon conversion to ASCII revealed the targeted IP address net ranges.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/02/word-image-68.png) Figure 16. An example of the ip\_cn.txt Chinese net ranges.

Unit 42 researchers downloaded these files, and at the time of their download, both of the files appear to contain the same content, as they both have the same SHA-256 hash, ad3efb9bfd49c379a002532f43cc4867a4f0b1cd52b6f438bb7a8feb8833b8f8. These two identical files will be used by the pnscan or masscan processes to scan the network ranges for potential victims.

At the time of their download for this blog, these two files only appear to contain Chinese-related IP addresses. It is likely the actors behind WatchDog are able to update the binaries to include any number of IP address network ranges they wish to target. This is likely the case as Unit 42 researchers have identified victims of the WatchDog miner operating outside of the China IP address space, specifically within the United States and Europe.

Continuing on, loaded within the networkmanager Go binary are 33 individual exploits functions, 32 individual remote code execution (RCE) functions and several shell grab functions (see Figure 17).
![Loaded within the networkmanager Go binary are 33 individual exploits functions, 32 individual RCE functions and several shell grab functions.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/02/word-image-69.png) Figure 17. Exploits loaded into the networkmanager binary.

The following applications are specifically targeted within the scanning binary:

* CCTV exploit
  * It is currently unknown if the target is a CCTV appliance or if there is another moniker "cctv" could stand for.
* Drupal
  * Versions 7 and 8.
* Elasticsearch
  * CVE-2015-1427 (Elasticsearch sandbox evasion -- version before 1.3.8 and 1.4.x before 1.4.3)
  * CVE-2014-3120 (Elasticsearch before 1.2)
* Apache Hadoop
* PowerShell
  * Encoded command-line operations.
* Redis
* Spring Data Commons
  * CVE-2018-1273, versions prior to 1.13-1.13.10, 2.0-2.0.5
* SQL Server
* ThinkPHP
  * Versions 5.x, 5.10, 5.0.23
* Oracle WebLogic Server
  * CVE-2017-10271 -- versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0)

The reference to "tmp\_0324\_scan" has been witnessed before, within a [May 19, 2019, blog post from the forum.90sec.com](https://forum.90sec.com/t/topic/155), a Chinese-language Information Security group. The 90sec blog highlights a deep dive of a cryptojacking exploitation event targeting Apache Hadoop, Redis and ThinkPHP applications.

Of note, the bash script highlighted within the blog follows the same formatting as the newinit.sh shell script used by the WatchDog miner (see Figure 18). Aside from the different filenames and IP addresses, the two formats are practically identical.
![Similar script formatting between the 90sec blog and NewInit.sh is shown with red arrows connecting similar sections of the scripts.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/02/word-image-70.png) Figure 18. Similar script formatting between the 90sec blog and NewInit.sh.

Additionally, the references to "tmp/0324/scan" within the 90sec post are listed within the same format as witnessed within the networkmanager binary functions (see Figures 17 and 19).
![The image provides a closer view of networkservices exploits pulled from the 90sec forum.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/02/word-image-71.png) Figure 19. Image of networkservices exploits pulled from the 90sec forum.

It is clear that the activity being monitored by 90sec on May 19, 2019, is the same cryptojacking malware family researchers are seeing today in the form of the WatchDog miner. Several similarities can be observed between the past and present forms of the malware, such as that the same exploits appear to be used. However, newer techniques have been developed and implemented within the more current version of WatchDog. Specifically, we see this in relation to the phpguard binary.

Also of note, the [denisenkom/go-mssqldb](https://github.com/denisenkom/go-mssqldb) library is added to Go binary which allows for SQL DB functions to be accessible through the Go Language, including remote connections, error handling, bulk operations, logging and data manipulation (see Figure 20).
![The image shows libraries added to Go binary, allowing SQL DB functions to be accessible through the Go Language, including remote connections, error handling, bulk operations, logging and data manipulation.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/02/word-image-72.png) Figure 20. Loaded Libraries -- Denisenkom mssql-db, Go-Civil and Redis.

The Go binary is also loaded with the [Google Cloud library Go Civil](https://godoc.org/cloud.google.com/go/civil) to allow for the usage of a Gregorian calendar with exactly 24-hour days, 60-minute hours, and 60-second minutes, as well as the [Github Redis Go Library](https://github.com/go-redis/redis), allowing for Redis service control by the binary.

#### **phpguard**

Phpguard is a UPX-compressed Go language binary designed to protect the mining software during operation. It performs the functions of monitoring system processes and scheduled tasks or CronJobs to ensure the mining software is running. Unit 42 researchers have identified two different filenames for binaries that perform the same protective function, phpguard and sysguard.

Through the use of the custom Go library "tmp\_0324\_dog\_platform" (see Figure 21), the Go binary is able to control the XMRig mining software in either Windows or NIX systems.
![Through the use of a custom Go library, the Go binary is able to control the XMRig mining software in either Windows or NIX systems.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/02/word-image-73.png) Figure 21. phpguard custom Go functions for miner control in Windows and NIX.

Additionally, the binary embeds the mining software within the relevant OS through scheduled tasks, as is the case in Windows systems (see Figure 22). This can also happen via CronJobs, as is the case with NIX systems (see Figure 23).
![The binary embeds the mining software within the relevant OS through scheduled tasks, as is the case in Windows systems. The relevant section in phpguard is shown here.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/02/word-image-74.png) Figure 22. phpguard WIN Scheduled Task creation. ![The binary can embed the mining software via CronJobs, as is the case with NIX systems. The relevant section in phpguard is shown here.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/02/word-image-75.png) Figure 23. phpguard NIX CronJob creation.

The binary will also continually crawl through each of the OS running processes to ensure that the mining process is running (see Figure 24).
![The binary will continually crawl through each of the OS running processes to ensure that the mining process is running.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/02/word-image-76.png) Figure 24. phpguard process crawling cycle.

The binary is designed to ensure the mining process is protected. If this is a first run for the binary, it will set the new process for protection. If the mining software has not been started, it will start the mining software. And if the software has yet to be downloaded, the binary will begin the download process (see Figure 25).
![The binary is designed to ensure the mining process is protected. Several of the relevant protections are shown here.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/02/word-image-77.png) Figure 25. Setting protections for the mining process.

#### **phpupdate**

The phpupdate process is the XMRig mining software used by the WatchDog miner. Unit 42 researchers have identified three different filenames for binaries that perform the same mining operations, phpupdate, zzh and trace.

There is little to disclose about the WatchDog miner's version of XMRig or its mining operations that is outside of known industry mining software operations. It offers a fully configurable operational menu, allowing the user to specify the following mining attributes (see Figure 26):

* URL of the mining pool.
* Mining algorithm (or the desired coin).
* Username.
* Password.
* Proxy information.
* Sending of a keep alive packet
* Size of packet, and more.

![WatchDog miner's version of XMRig offers a fully configurable operational menu, as shown here.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/02/word-image-78.png) Figure 26. The WatchDog miner's configuration options.

While the miner can be controlled by the phpguard Go binary, as was described within the section just prior, the mining software can also be operated through direct user interaction.

## Conclusion

The WatchDog mining operation has been in progress since at least Jan. 27, 2019, and has collected at least 209 Monero CryptoCoins (XMR), valued at least $32,056 USD. The WatchDog actors are using cloud-efficient cryptojacking malware, through the use of UPX-compressed Go language binaries, ensuring they are able to compromise both Windows and Linux operating systems -- assuming those systems have the Go platform installed. At this time, the WatchDog mining infrastructure is known to include 18 IP addresses and seven domains. These malicious endpoints continue to host or have hosted at least 125 URL addresses used to download the WatchDog mining toolkit. Additionally, the scanning and exploitation binary, networkmanager, is loaded with 33 unique exploits, including 32 RCE functions. The WatchDog mining operation is quite large, as at least 476 compromised systems are estimated to be mining at any given time.

It is clear that the WatchDog operators are skilled coders and have enjoyed a relative lack of attention regarding their mining operations. While there is currently no indication of additional cloud compromising activity at present (i.e. the capturing of cloud platform IAM credentials, access ID, or keys), there could be potential for further cloud account compromise. It is highly likely these actors could find IAM-related information on the cloud systems they have already compromised, due to the root and administrative access acquired during the implantation of their cryptojacking software.

Palo Alto Networks [Prisma Access](https://www.paloaltonetworks.com/prisma/access) is configured to detect each of WatchDog's 18 IP addresses, seven domains and their associated URL addresses through PAN-OS. [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) also detects the usage of malicious XMRig processes used by the WatchDog miner operating in cloud environments that have Prisma Cloud Compute Defender installed.

## **Indicators of Compromise**

###### **IP Addresses**

|---------------------|
| 39.100.33\[.\]209   |
| 45.153.240\[.\]58   |
| 45.9.148\[.\]37     |
| 93.115.23\[.\]117   |
| 95.182.122\[.\]199  |
| 106.15.74\[.\]113   |
| 107.173.159\[.\]206 |
| 146.71.79\[.\]230   |
| 185.181.10\[.\]234  |
| 185.232.65\[.\]124  |
| 185.232.65\[.\]191  |
| 185.232.65\[.\]192  |
| 185.247.117\[.\]64  |
| 198.98.57\[.\]187   |
| 199.19.226\[.\]117  |
| 204.44.105\[.\]168  |
| 205.209.152\[.\]78  |
| 208.109.11\[.\]21   |

###### **Domains**

|--------------------------|
| de.gengine\[.\]com.de    |
| de.gsearch\[.\]com.de    |
| global.bitmex\[.\]com.de |
| ipzse\[.\]com            |
| py2web\[.\]store         |
| sjjjv\[.\]xyz            |
| us.gsearch\[.\]com.de    |

###### **URL Addresses**

|-------------------------------------------------------------------|
| hxxp://107.173.159\[.\]206:8880/tatavx1hym9z928m/bsh.sh           |
| hxxp://107.173.159\[.\]206:8880/tatavx1hym9z928m/config.json      |
| hxxp://107.173.159\[.\]206:8880/tatavx1hym9z928m/sysupdate        |
| hxxp://107.173.159\[.\]206:8880/tatavx1hym9z928m/update.sh        |
| hxxp://146.71.79\[.\]230/363A3EDC10A2930DVNICE/config.json        |
| hxxp://146.71.79\[.\]230/363A3EDC10A2930DVNICE/networkservice     |
| hxxp://146.71.79\[.\]230/363A3EDC10A2930DVNICE/sysguard           |
| hxxp://146.71.79\[.\]230/363A3EDC10A2930DVNICE/sysupdate          |
| hxxp://146.71.79\[.\]230/363A3EDC10A2930DVNICE/update.sh          |
| hxxp://176.123.10\[.\]57/cf67356/config.json                      |
| hxxp://176.123.10\[.\]57/cf67356/networkmanager                   |
| hxxp://176.123.10\[.\]57/cf67356/newinit.sh                       |
| hxxp://176.123.10\[.\]57/cf67356/phpguard                         |
| hxxp://176.123.10\[.\]57/cf67356/zzh                              |
| hxxp://185.181.10\[.\]234/E5DB0E07C3D7BE80V520/config.json        |
| hxxp://185.181.10\[.\]234/E5DB0E07C3D7BE80V520/networkservice     |
| hxxp://185.181.10\[.\]234/E5DB0E07C3D7BE80V520/sysguard           |
| hxxp://185.181.10\[.\]234/E5DB0E07C3D7BE80V520/sysupdate          |
| hxxp://185.181.10\[.\]234/E5DB0E07C3D7BE80V520/update.sh          |
| hxxp://185.232.65\[.\]124/update.sh                               |
| hxxp://185.232.65\[.\]191/cf67356/config.json                     |
| hxxp://185.232.65\[.\]191/cf67356/newinit.sh                      |
| hxxp://185.232.65\[.\]191/cf67356/zzh                             |
| hxxp://185.232.65\[.\]191/config.json                             |
| hxxp://185.232.65\[.\]191/trace                                   |
| hxxp://185.232.65\[.\]191/update.sh                               |
| hxxp://185.232.65\[.\]192/cf67356/networkmanager                  |
| hxxp://185.232.65\[.\]192/cf67356/phpguard                        |
| hxxp://185.232.65\[.\]192/config.json                             |
| hxxp://185.232.65\[.\]192/trace                                   |
| hxxp://185.247.117\[.\]64/cf67356/config.json                     |
| hxxp://185.247.117\[.\]64/cf67356/networkmanager                  |
| hxxp://185.247.117\[.\]64/cf67356/newdat.sh                       |
| hxxp://185.247.117\[.\]64/cf67356/phpguard                        |
| hxxp://185.247.117\[.\]64/cf67356/phpupdate                       |
| hxxp://198.98.57\[.\]187/config.json                              |
| hxxp://198.98.57\[.\]187/trace                                    |
| hxxp://198.98.57\[.\]187/update.sh                                |
| hxxp://204.44.105\[.\]168:66/config.json                          |
| hxxp://204.44.105\[.\]168:66/networkmanager                       |
| hxxp://204.44.105\[.\]168:66/newdat.sh                            |
| hxxp://204.44.105\[.\]168:66/phpguard                             |
| hxxp://204.44.105\[.\]168:66/phpupdate                            |
| hxxp://205.209.152\[.\]78:8000/sysupdate                          |
| hxxp://205.209.152\[.\]78:8000/update.sh                          |
| hxxp://209.182.218\[.\]161:80/363A3EDC10A2930D/config.json        |
| hxxp://209.182.218\[.\]161:80/363A3EDC10A2930D/networkservice     |
| hxxp://209.182.218\[.\]161:80/363A3EDC10A2930D/sysguard           |
| hxxp://209.182.218\[.\]161:80/363A3EDC10A2930D/sysupdate          |
| hxxp://209.182.218\[.\]161:80/363A3EDC10A2930D/update.sh          |
| hxxp://39.100.33\[.\]209/b2f628/config.json                       |
| hxxp://39.100.33\[.\]209/b2f628/newinit.sh                        |
| hxxp://39.100.33\[.\]209/b2f628/zzh                               |
| hxxp://39.100.33\[.\]209/b2f628fff19fda999999999/is.sh            |
| hxxp://45.153.240\[.\]58/N3DN0E09C5D9BU70V1720/config.json        |
| hxxp://45.153.240\[.\]58/N3DN0E09C5D9BU70V1720/networkservice     |
| hxxp://45.153.240\[.\]58/N3DN0E09C5D9BU70V1720/sysguard           |
| hxxp://45.153.240\[.\]58/N3DN0E09C5D9BU70V1720/sysupdate          |
| hxxp://45.153.240\[.\]58/N3DN0E09C5D9BU70V1720/update.sh          |
| hxxp://45.9.148\[.\]37/cf67356a3333e6999999999/1.0.4.tar.gz       |
| hxxp://45.9.148\[.\]37/cf67356a3333e6999999999/config.json        |
| hxxp://45.9.148\[.\]37/cf67356a3333e6999999999/is.sh              |
| hxxp://45.9.148\[.\]37/cf67356a3333e6999999999/networkmanager     |
| hxxp://45.9.148\[.\]37/cf67356a3333e6999999999/newdat.sh          |
| hxxp://45.9.148\[.\]37/cf67356a3333e6999999999/phpguard           |
| hxxp://45.9.148\[.\]37/cf67356a3333e6999999999/phpupdate          |
| hxxp://47.253.42\[.\]213/b2f628/config.json                       |
| hxxp://47.253.42\[.\]213/b2f628/newinit.sh                        |
| hxxp://47.253.42\[.\]213/b2f628/zzh                               |
| hxxp://82.202.66\[.\]50/cf67356/config.json                       |
| hxxp://82.202.66\[.\]50/cf67356/networkmanager                    |
| hxxp://82.202.66\[.\]50/cf67356/newinit.sh                        |
| hxxp://82.202.66\[.\]50/cf67356/phpguard                          |
| hxxp://82.202.66\[.\]50/cf67356/zzh                               |
| hxxp://83.97.20\[.\]90/cf67356/config.json                        |
| hxxp://83.97.20\[.\]90/cf67356/networkmanager                     |
| hxxp://83.97.20\[.\]90/cf67356/newinit.sh                         |
| hxxp://83.97.20\[.\]90/cf67356/phpguard                           |
| hxxp://83.97.20\[.\]90/cf67356/zzh                                |
| hxxp://93.115.23\[.\]117/N3DN0E09C5D9BU70V1720/config.json        |
| hxxp://93.115.23\[.\]117/N3DN0E09C5D9BU70V1720/networkservice     |
| hxxp://93.115.23\[.\]117/N3DN0E09C5D9BU70V1720/sysguard           |
| hxxp://93.115.23\[.\]117/N3DN0E09C5D9BU70V1720/sysupdate          |
| hxxp://93.115.23\[.\]117/N3DN0E09C5D9BU70V1720/update.sh          |
| hxxp://95.182.122\[.\]199/E5DB0E07C3D7BE80V52/config.json         |
| hxxp://95.182.122\[.\]199/E5DB0E07C3D7BE80V52/networkservice      |
| hxxp://95.182.122\[.\]199/E5DB0E07C3D7BE80V52/Saltmin.sh          |
| hxxp://95.182.122\[.\]199/E5DB0E07C3D7BE80V52/sysupdate           |
| hxxp://95.182.122\[.\]199/init.sh                                 |
| hxxp://global.bitmex\[.\]com\[.\]de/cf67355a3333e6/config.json    |
| hxxp://global.bitmex\[.\]com\[.\]de/cf67355a3333e6/is.sh          |
| hxxp://global.bitmex\[.\]com\[.\]de/cf67355a3333e6/networkmanager |
| hxxp://global.bitmex\[.\]com\[.\]de/cf67355a3333e6/newdat.sh      |
| hxxp://global.bitmex\[.\]com\[.\]de/cf67355a3333e6/phpguard       |
| hxxp://global.bitmex\[.\]com\[.\]de/cf67355a3333e6/phpupdate      |
| hxxp://py2web\[.\]store/7356a3333e6999999999/networkmanager       |
| hxxp://py2web\[.\]store/7356a3333e6999999999/phpguard             |
| hxxp://py2web\[.\]store/cf67356/config.json                       |
| hxxp://py2web\[.\]store/cf67356/newinit.sh                        |
| hxxp://py2web\[.\]store/cf67356/zzh                               |
| hxxp://xmr.ipzse\[.\]com:66/bd.sh                                 |
| hxxp://xmr.ipzse\[.\]com:66/config.json                           |
| hxxp://xmr.ipzse\[.\]com:66/is.sh                                 |
| hxxp://xmr.ipzse\[.\]com:66/networkmanager                        |
| hxxp://xmr.ipzse\[.\]com:66/newdat.sh                             |
| hxxp://xmr.ipzse\[.\]com:66/phpguard                              |
| hxxp://xmr.ipzse\[.\]com:66/phpupdate                             |
| hxxp://xmr.ipzse\[.\]com:66/rs.sh                                 |
| hxxps://de.gengine\[.\]com\[.\]de/api/config.json                 |
| hxxps://de.gengine\[.\]com\[.\]de/api/networkservice              |
| hxxps://de.gengine\[.\]com\[.\]de/api/sysguard                    |
| hxxps://de.gengine\[.\]com\[.\]de/api/sysupdate                   |
| hxxps://de.gengine\[.\]com\[.\]de/api/update.sh                   |
| hxxps://de.gsearch\[.\]com\[.\]de/api/config.json                 |
| hxxps://de.gsearch\[.\]com\[.\]de/api/networkservice              |
| hxxps://de.gsearch\[.\]com\[.\]de/api/sysguard                    |
| hxxps://de.gsearch\[.\]com\[.\]de/api/sysupdate                   |
| hxxps://de.gsearch\[.\]com\[.\]de/api/update.sh                   |
| hxxps://sjjjv\[.\]xyz/sysupdate                                   |
| hxxps://sjjjv\[.\]xyz/update.sh                                   |
| hxxps://us.gsearch\[.\]com\[.\]de/api/config.json                 |
| hxxps://us.gsearch\[.\]com\[.\]de/api/networkservice              |
| hxxps://us.gsearch\[.\]com\[.\]de/api/sysguard                    |
| hxxps://us.gsearch\[.\]com\[.\]de/api/sysupdate                   |
| hxxps://us.gsearch\[.\]com\[.\]de/api/update.sh                   |

###### **Files**

|------------------------------------------------------------------|----------------|
| **SHA-256**                                                      | **Filename**   |
| 0a48bd0d41052c1e3138d558fc06ebde8d6f15b8d866200b8f00b214a73eb5b9 | config.json    |
| 0c4aa6afd2a81fd15f3bd65adcbd4f649fbc58ef12dd2d528125435169555901 | update.sh      |
| 1f65569b77f21f47256db339700b4ff33b7570e44e1981b5c213b7b2e65b0f6c | networkmanager |
| 2b52288383588f65803a5dc9583171103be79f0b196d01241b5cd3a8cf69b190 | networkservice |
| 2eeac2b9577047a9eef2d164c13ace5e826ac85990a3a915871d6b0c2fc8fe67 | update.sh      |
| 2f642efdf56b30c1909c44a65ec559e1643858aaea9d5f18926ee208ec6625ed | update.sh      |
| 37492d1897f77371f2eb431b9be7c861b81e97f04a091d8c6d63719171eda2ac | rs.sh          |
| 3ab7cf786eeb23ebd11e86e0fc48b0a9b37a427d5d730d774c9ed8d98a925c6f | sysupdate      |
| 43d7b29668786731f1bbbb3ae860487e84604195b186c1b7b253f99156d7f57a | sysguard       |
| 49366ae4766492d94136ca1f715a37554aa6243686c66bf3c6fbb9da9cb2793d | newinit.sh     |
| 51de345f677f46595fc3bd747bfb61bc9ff130adcbec48f3401f8057c8702af9 | tar.gz         |
| 55c92d64ffa9d170e340e0528dc8ea1fa9be98f91db891869947c5b168a728c8 | networkmanager |
| 55dd539d8fe94648294e91df89b005f1dba330b432ceda25775963485bae7def | config.json    |
| 67d0f77adf98ac34a6db78110c78652a9b7f63e22ae5ab7df4f57d3413e48822 | phpguard       |
| 68cedf2a018c0830655dc9bb94aadf6492ab31196cbc83ceb44defae0a02d3dc | config.json    |
| 6a7109481e113fd92ff98534e780f47a32b64bfa5692f7bd7da33c84033a9028 | sysguard       |
| 758dbfda2b7d2e97caba294089c4c836ab447d7c9ceef510c667526fd873e161 | phpguard       |
| 80b1a70d7ec5d1944787afff3c2feac3aa40ec8c64177886481d96623bc786bf | config.json    |
| 818c16d1921572ffee6853c16c5c9158d2f217b6adbb5154cbb7daf945db493c | update.sh      |
| 82815c61402cfc0edd6ce3be37848259711ef07e3391e74c85fbdaa676d95c0c | is.sh          |
| 849f86a8fd06057eeb1ae388789881516239282dd4cb079b8281f995035874e1 | newinit.sh     |
| 895e994dafaa00009a46f3b56ca0d563e066a14e77f5030b1331fc9b3f9f6478 | networkservice |
| 96fe63c25e7551a90051431aeddb962f05d82b7dd2940c0e8e1282273ba81e22 | newinit.sh     |
| a322dc6af6fed1326b04ec966e66b68dd8ef22374edd286569710afc65ccc741 | newinit.sh     |
| ac719447894b2f5029f493c7395d128f710a3ba7b31c199558f3ee00fb90ea12 | networkmanager |
| ad05d09e6ed4bd09fe1469e49885c5169458635a1a33f2579cb7caa221b43fce | newdat.sh      |
| b6a5790a9bfaf159af68c4dbb09de9c2c0c2371c886fdb28223d40e6984b1dd7 | config.json    |
| bd3506b86452d46d395b38aa807805097da1291c706318b5fe970fe4b20f5406 | config.json    |
| c67881c1f05477939b8964ad26f1a467762a19c2c7d1a1656b338d8113ca1ac1 | phpguard       |
| c8ca3ab0ae00a1bf197086370ab5994264ac5bc1fcf52b2ddf8c9fcacc4402ff | 1.0.4.tar      |
| d54157bb703b360bb911363d9bb483a2ee00ee619d566d033a8c316f06cf26cc | zzh            |
| d6cf2d54e3bb564cb15638b58d2dd124ae7acd40e05af42d1bdc0588a8d5211d | networkmanager |
| e3cbb08913493e54d74081349972423444cbc0f4853707b84409131d19cad15b | phpguard       |
| e7446d595854b6bac01420378176d1193070ef776788af12300eb77e0a397bf7 | sysupdate      |
| ed1e49cb05c375cc1149c349880ed077b6ee75cb7e5c6cae9cbd4bd086950c93 | zzh            |

Back to top

### Tags

* [Cryptojacking](https://unit42.paloaltonetworks.com/tag/cryptojacking/ "cryptojacking")
* [GoLang](https://unit42.paloaltonetworks.com/tag/golang/ "GoLang")
* [Monero](https://unit42.paloaltonetworks.com/tag/monero/ "Monero")
* [XMRig](https://unit42.paloaltonetworks.com/tag/xmrig/ "XMRig")  
  [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Threat Brief: Windows IPv4 and IPv6 Stack Vulnerabilities (CVE-2021-24074, CVE-2021-24086 and CVE-2021-24094)](https://unit42.paloaltonetworks.com/cve-2021-24074-patch-tuesday/ "Threat Brief: Windows IPv4 and IPv6 Stack Vulnerabilities (CVE-2021-24074, CVE-2021-24086 and CVE-2021-24094)")

### Table of Contents

* 

### Related Articles

* [The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "article - table of contents")
* [The Covert Operator's Playbook: Infiltration of Global Telecom Networks](https://unit42.paloaltonetworks.com/infiltration-of-global-telecom-networks/ "article - table of contents")
* [GoldMelody's Hidden Chords: Initial Access Broker In-Memory IIS Modules Revealed](https://unit42.paloaltonetworks.com/initial-access-broker-exploits-leaked-machine-keys/ "article - table of contents")

## Related Resources

![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg)  
[![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/)

* [API](https://unit42.paloaltonetworks.com/tag/api/ "API")

* [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic")

* [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE")  
  ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/)

* [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel")

* [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2")

* [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure")  
  ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/)

* [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI")

* [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT")

* [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America")  
  ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/)

* [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa")

* [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID")

* [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams")  
  ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/)

* [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor")

* [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin")

* [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution")  
  ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/)

* [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication")

* [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft")

* [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels")  
  ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/)

* [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK")

* [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum")

* [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet")  
  ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/)

* [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum")

* [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain")

* [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications")  
  ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/)

* [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain")

* [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop")

* [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm")  
  ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/)

* [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API")

* [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway")

* [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources")

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)  
  ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]()  
  ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png)  
  ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42

## Peace of mind comes from staying ahead of threats. Subscribe today.

Your Email

Subscribe for email updates to all Unit 42 threat research.  
By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement")

This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.

Invalid captcha!
Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg)  
{#footer} Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security)

* [Secure AI by Design](https://www.paloaltonetworks.com/ai-security)

* [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase)

* [Prisma SASE](https://www.paloaltonetworks.com/sase)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam)

* [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira)

* [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management)

* [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management)

* [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager)

* [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance)

* [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management)

* [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic)

* [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management)

* [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance)

* [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery)

* [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42)

* [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense)

* [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses)

* [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy)

* [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence)

* [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond)  
  Company

* [About Us](https://www.paloaltonetworks.com/about-us)

* [Careers](https://jobs.paloaltonetworks.com/en/)

* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales)

* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility)

* [Customers](https://www.paloaltonetworks.com/customers)

* [Investor Relations](https://investors.paloaltonetworks.com/)

* [Location](https://www.paloaltonetworks.com/about-us/locations)

* [Newsroom](https://www.paloaltonetworks.com/company/newsroom)  
  Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/)

* [Communities](https://www.paloaltonetworks.com/communities)

* [Content Library](https://www.paloaltonetworks.com/resources)

* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia)

* [Event Center](https://events.paloaltonetworks.com/)

* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)

* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z)

* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications)

* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure)

* [Sitemap](https://www.paloaltonetworks.com/sitemap)

* [Tech Docs](https://docs.paloaltonetworks.com/)

* [Unit 42](https://unit42.paloaltonetworks.com/)

* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)

* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy)

* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center)

* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use)

* [Documents](https://www.paloaltonetworks.com/legal)

Copyright © 2026 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* EN  
  Select your language  
  ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg)

### Default Heading

Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg)  
Seekbar

![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg)  
![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg)  
Volume
![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)