[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/wireshark-tutorial-hancitor-followup-malware/) * [Japanese](https://unit42.paloaltonetworks.com/ja/wireshark-tutorial-hancitor-followup-malware/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Learning Hub](https://unit42.paloaltonetworks.com/category/learning-hub/ "Learning Hub") * [Cybersecurity Tutorials](https://unit42.paloaltonetworks.com/category/cybersecurity-tutorials/ "Cybersecurity Tutorials") [Cybersecurity Tutorials](https://unit42.paloaltonetworks.com/category/cybersecurity-tutorials/) # Wireshark Tutorial: Examining Traffic from Hancitor Infections ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 20 min read * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Brad Duncan](https://unit42.paloaltonetworks.com/author/brad-duncan/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:April 7, 2021 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Cybersecurity Tutorials](https://unit42.paloaltonetworks.com/category/cybersecurity-tutorials/) * [Learning Hub](https://unit42.paloaltonetworks.com/category/learning-hub/) * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Cobalt Strike](https://unit42.paloaltonetworks.com/tag/cobalt-strike/) * [Ficker Stealer](https://unit42.paloaltonetworks.com/tag/ficker-stealer/) * [Hancitor](https://unit42.paloaltonetworks.com/tag/hancitor/) * [NetSupportManager](https://unit42.paloaltonetworks.com/tag/netsupportmanager/) * [Pcap](https://unit42.paloaltonetworks.com/tag/pcap/) * [Send-Safe](https://unit42.paloaltonetworks.com/tag/send-safe/) * [Wireshark](https://unit42.paloaltonetworks.com/tag/wireshark/) * [Wireshark Tutorial](https://unit42.paloaltonetworks.com/tag/wireshark-tutorial/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/wireshark-tutorial-hancitor-followup-malware/?pdf=download&lg=en&_wpnonce=1f7a0335d5 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/wireshark-tutorial-hancitor-followup-malware/?pdf=print&lg=en&_wpnonce=1f7a0335d5 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Wireshark%20Tutorial:%20Examining%20Traffic%20from%20Hancitor%20Infections&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fwireshark-tutorial-hancitor-followup-malware%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fwireshark-tutorial-hancitor-followup-malware%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fwireshark-tutorial-hancitor-followup-malware%2F&title=Wireshark%20Tutorial:%20Examining%20Traffic%20from%20Hancitor%20Infections "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fwireshark-tutorial-hancitor-followup-malware%2F&text=Wireshark%20Tutorial:%20Examining%20Traffic%20from%20Hancitor%20Infections "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fwireshark-tutorial-hancitor-followup-malware%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Wireshark%20Tutorial:%20Examining%20Traffic%20from%20Hancitor%20Infections%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fwireshark-tutorial-hancitor-followup-malware%2F "Share in Mastodon") ## Executive Summary Also known as Chanitor, [Hancitor](https://malpedia.caad.fkie.fraunhofer.de/details/win.hancitor) is malware used by a threat actor designated as MAN1, Moskalvzapoe or TA511. Hancitor establishes initial access on a vulnerable Windows host and sends additional malware. This Wireshark tutorial reviews activity from recent Hancitor infections. It provides tips on identifying Hancitor and its followup malware. In this tutorial, we cover examples of Hancitor with [Cobalt Strike](https://attack.mitre.org/software/S0154/), [Ficker Stealer](https://twitter.com/3xp0rtblog/status/1321209656774135810), [NetSupport Manager RAT](https://www.bleepingcomputer.com/news/security/microsoft-warns-of-massive-phishing-attack-pushing-legit-rat/), a [network ping tool](https://unit42.paloaltonetworks.com/hancitor-infections-cobalt-strike/) and [Send-Safe](https://web.archive.org/web/20190918103313/www.send-safe.com/send-safe.html) spambot malware. This tutorial is designed for security professionals who investigate suspicious network activity and review packet captures (pcaps). Familiarity with [Wireshark](https://www.wireshark.org/) is necessary to understand this tutorial, which focuses on Wireshark version 3.x. Note: These instructions assume you have customized Wireshark as described in [our previous Wireshark tutorial about customizing the column display](https://unit42.paloaltonetworks.com/unit42-customizing-wireshark-changing-column-display/). You will need to access a GitHub repository with ZIP archives containing [the pcaps used for this tutorial](https://github.com/pan-unit42/wireshark-tutorial-Hancitor-traffic). **Warning:** The pcaps for this tutorial contain Windows-based malware. There is a risk of infection if using a Windows computer. If possible, we recommend you review these pcaps in a non-Windows environment such as BSD, Linux or macOS. ## Chain of Events for a Hancitor Infection Hancitor is distributed through email. These emails each contain an HTTPS link for a Google Drive URL through docs.google.com. These Google Drive pages link to a different domain that returns a malicious Word document. Enabling macros on the Word document starts the infection by dropping a DLL. The infected host first generates Hancitor command and control (C2) traffic. Then we see URLs for followup malware such as Ficker Stealer. If the infected host is part of an Active Directory (AD) environment, Hancitor will also send Cobalt Strike. Cobalt Strike provides another access channel for further malicious files such as a network ping tool or NetSupport Manager RAT-based malware. In some cases, we also see Send-Safe spambot malware, which turns the infected Windows host into a spambot pushing more Hancitor emails. ![The chain of events for recent Hancitor infections includes malspam with a Google Docs link, a Google Docs page, a page to download a Word doc, a downloaded Word doc, enabling macros, Hancitor malware, Hancitor C2 traffic, Ficker Stealer and Ficker Stealer data exfiltration. In AD environments, it also includes Cobalt Strike, Cobalt Strike C2 traffic and additional malware. Hancitor infections can also lead to Send-Safe spambot malware, as detailed in the flow chart shown.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image.jpeg) Figure 1. Chain of events for recent Hancitor infections. Knowing this chain of events will better help you understand traffic generated during a Hancitor infection. More details can be found in our blog about [recent Hancitor infections](https://unit42.paloaltonetworks.com/hancitor-infections-cobalt-strike/). ## Pcaps of Hancitor Infection Activity Four password-protected ZIP archives containing five pcaps of recent Hancitor activity are available at [this GitHub repository](https://github.com/pan-unit42/wireshark-tutorial-Hancitor-traffic). From the GitHub page, click on each of the ZIP archive entries and download them, as shown in Figures 2 and 3. ![The large black arrow indicates where to click to download one of the four ZIP archives used with this Wireshark tutorial on Hancitor infections.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-1.jpeg) Figure 2. GitHub repository with links to ZIP archives used for this tutorial. ![Once a ZIP archive is selected from the GitHub repository, the large black arrow shows where to click to download it.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-2.jpeg) Figure 3. Downloading the first ZIP archive for this tutorial. Use ***infected*** as the password to extract pcaps from these four ZIP archives. This should give you the following five pcap files: * Example-1-2021-02-17-Hancitor-infection.pcap * Example-2-2021-02-10-Hancitor-infection-part-1-of-2.pcap * Example-2-2021-02-10-Hancitor-infection-part-2-of-2.pcap * Example-3-2021-01-25-Hancitor-infection.pcap * Example-4-2021-02-02-Hancitor-infection.pcap ## Example 1: Hancitor with Ficker Stealer and Cobalt Strike Open ***Example-1-2021-02-17-Hancitor-infection.pcap*** in Wireshark and use a basic web filter as described in our previous[tutorial about Wireshark filters](https://unit42.paloaltonetworks.com/using-wireshark-display-filter-expressions/). The basic filter for Wireshark 3.x is: (http.request or tls.handshake.type eq 1) and !(ssdp) If you've set up Wireshark according to our initial [tutorial about customizing Wireshark displays](https://unit42.paloaltonetworks.com/unit42-customizing-wireshark-changing-column-display/), your display should look similar to Figure 4. ![The screenshot shows how your Wireshark display should look if you've set it up according to our previous tutorial about customizing Wireshark displays.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-3.jpeg) Figure 4. Our first pcap in this tutorial filtered in Wireshark. The pcap comes from an AD environment with the following characteristics: * LAN segment range: 10.2.17.0/24 * Domain: bean-genie.com * Domain controller: 10.2.17.2 - Bean-Genie-DC * LAN segment gateway: 10.2.17.1 * LAN segment broadcast address: 10.2.17.255 * IP address of the infected Windows host: 10.2.17.101 * Host name of the infected Windows host: DESKTOP-GBW8K4N * User account name on the infected Windows host: frankie.muntz Emails pushing Hancitor use HTTPS links to docs.google.com. In our first pcap, the 13th frame listed in the column display uses this domain name. Below, Figure 5 highlights docs.google.com in our Wireshark column display. ![A red box indicates the line that shows HTTPS traffic to docs.google.com in the pcap.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-4.jpeg) Figure 5. HTTPS traffic to docs.google.com from our first pcap. Of note, docs.google.com is a legitimate domain, and it is not inherently malicious. However, Google Drive is frequently abused by the criminals behind Hancitor. Below, Figure 6 shows a web page from one of these URLs created by MAN1/Moskalvzapoe/TA511 for Hancitor. ![The criminals behind Hancitor frequently abuse Google Drive URLs. In the screenshot shown, the Google Docs link leads to an image of a Word doc with the following text: "Previewing is disabled. Click here to download the document."](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-5.jpeg) Figure 6. Example of Google Drive URL hosting a page for Hancitor. Above in Figure 6, the link in "Click here to download the document" leads to a page that provides the malicious Word document. URLs for these pages end with .php. In many cases, these URLs also use HTTPS. Fortunately, in this tutorial, all four examples have unencrypted HTTP as the URL for the Word document. That makes them easy to find in our pcaps. Still using your basic web filter, scroll down until you see two HTTP GET requests to the same domain that end with .php. Below, Figure 7 shows these two HTTP GET requests in the Wireshark column display. They are both for: somdeeppalace\[.\]com - GET /slickness.php ![Red arrows indicate the two lines in the pcap that show URLs ending in .php that deliver a malicious Word document for Hancitor.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-6.jpeg) Figure 7. Two URLs ending in .php that deliver a malicious Word document for Hancitor. You could also use the following Wireshark filter to more quickly find these two URLs: http.request.method eq GET and http.request.uri contains .php Below, Figure 8 shows the results of this filter. ![The image shows the results of identifying the malicious URLs by using a Wireshark filter.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-7.jpeg) Figure 8. Filtering specifically for the two URLs. Right-click on either HTTP GET request for slickness.php in your column display and follow the HTTP stream, as shown below in Figure 9. ![The large black arrow indicates what selections to make to follow the HTTP stream for traffic to somdeeppalace\[.\]com, where malicious Word documents for Hancitor are being hosted.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-8.jpeg) Figure 9. Following HTTP stream for traffic to somdeeppalace\[.\]com. In the HTTP stream window, scroll down past the second set of HTTP request and response headers, then examine the HTML script after the initial \ tag. You should find a large amount of base64 text shortly after a script function for saveAs. The beginning of this text is shown below in Figure 10. ![Red arrows indicate where you can find a script function for saveAs, as well as base64 text for the malicious Word document.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-9.jpeg) Figure 10. HTTP stream showing saveAs function followed by base64 text. Scroll down to the end of the HTTP stream. You should find a script that offers to save a file named 0217\_2857682888090.doc created from the base64 text. This is the malicious Word document. After the closing \ tag, additional script refreshes the web page to a different URL. See Figure 11 below for details. ![Red arrows indicate a spot where, from the base64 text, the web page offers the malicious Word document for download. Also highlighted in red is the line of script that redirects to a different URL after offering the file for download.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-10.jpeg) Figure 11. Script showing file name for the malicious Word document and refreshing the browser to a different URL. We can obtain a copy of this malicious Word document by exporting the web page from the pcap and opening it in a web browser. Since this is malware, we recommend you do this in a non-Windows environment or a controlled lab setting. First, export the web page by using the following menu path, as shown below in Figure 12: File --\> Export Objects --\> HTTP ![The large black arrow shows where to click to export HTTP objects from the pcap.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-11.jpeg) Figure 12. Using Wireshark to export HTTP objects from the pcap. Find the second entry for slickness.php from somdeeppalace\[.\]com that is 534 kB, as shown below in Figure 13. Then save it as a web page using a file name ending with .htm or .html. ![Large black arrows indicate where to find the second entry for slickness.php, and then how to save it as a web page.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-12.jpeg) Figure 13. Saving the second entry for sickness.php from the HTTP object list. Open your saved HTML page in a web browser. You should see a pop-up menu including the option to save the malicious Word document. You should also see that your web browser has been refreshed to a URL ending with the string cashplus. See Figure 14 below for details. ![Red arrows indicate the telltale element of the URL that the web browser has been redirected to, as well as the offer to save the malicious Word document. This malicious Word document caused Hancitor C2 traffic when we tested it.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-13.jpeg) Figure 14. Viewing your saved HTML page in a web browser. This malicious Word document caused Hancitor C2 traffic that starts less than two minutes later in the pcap. #### **What does Hancitor C2 traffic look like?** Hancitor first causes an IP address check to api.ipify.org by the infected Windows host. Then it causes the C2 traffic. Hancitor C2 traffic consists of HTTP POST URLs that end with /8/forum.php. Of note, traffic to api.ipify.org is an indicator, but it's not inherently malicious by itself. Using your basic web filter, scroll down to find an IP address check to api.ipify.org followed by the first HTTP POST request for Hancitor C2 traffic to thavelede\[.\]ru. Below, Figure 15 shows where you can find these two items. ![Red arrows indicate where in the Wireshark column display the IP address check and the Hancitor C2 traffic are shown.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-14.jpeg) Figure 15. IP address check followed by Hancitor C2 noted in the Wireshark column display. Since November 2020, URLs for Hancitor C2 traffic have always ended with /8/forum.php. The easiest way to check for Hancitor-specific traffic in Wireshark is using the following filter: http.request.uri contains "/8/forum.php" or http.host contains api.ipify.org The above Wireshark filter should show you Hancitor's IP address check followed by HTTP POST requests for Hancitor C2 traffic, as shown below in Figure 16. ![The screenshot shows how the Wireshark column display should appear after using a filter that searches for Hancitor-specific traffic using known indicators of Hancitor.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-15.jpeg) Figure 16. Filtering for Hancitor-specific traffic in Wireshark. * api.ipify.org - GET / * thavelde\[.\]ru - POST /8/forum.php * zinsubtal\[.\]ru - POST /8/forum.php The results also include the following HTTP GET request generated by Ficker Stealer malware: * api.ipify.org - GET /?format=xml We will cover Ficker Stealer traffic later. First, let us examine how Hancitor sends its followup malware. Hancitor uses a specific domain to send Ficker Stealer and Cobalt Strike as followup malware. This domain changes each day Hancitor is active, but you should see three HTTP GET requests to the same domain for followup malware. One of the URLs ends with .exe, which is for Ficker Stealer. Two of the URLs end with .bin, which are for Cobalt Strike. Use the following Wireshark filter to find URLs for Ficker Stealer and Cobalt Strike: http.request.uri contains .exe or http.request.uri contains .bin The results are shown below in Figure 17. ![The screenshot shows how the Wireshark column display should appear after using a filter to find URLs for Ficker Stealer and Cobalt Strike.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-16.jpeg) Figure 17. Filtering for Hancitor sending Cobalt Strike and Ficker Stealer. As shown above in Figure 17, filtering for followup malware from Hancitor should reveal the following traffic in our first pcap: * belcineloweek\[.\]ru - GET /6sufiuerfdvc.exe * belcineloweek\[.\]ru - GET /1602s.bin * belcineloweek\[.\]ru - GET /1602s.bin The first HTTP GET request returned an EXE file for Ficker Stealer. The next two HTTP GET requests returned encoded data used to infect the victim with Cobalt Strike. #### What does Ficker Stealer infection traffic look like? Ficker Stealer is the same EXE file for several weeks at a time. Since 2021-01-20 until as recently as 2021-03-04, the SHA256 hash for Ficker Stealer has been: 94e60de577c84625da69f785ffe7e24c889bfa6923dc7b017c21e8a313e4e8e1 The above EXE for Ficker Stealer causes an IP address check to api.ipifiy.org/?format=xml, which is not inherently malicious on its own. Ficker Stealer then generates a DNS query for sweyblidian\[.\]com and sends non-HTTP traffic over TCP port 80 to that domain. This traffic consists of data stolen from the infected Windows host. To find the IP address used for sweyblidian\[.\]com, search for the associated DNS query using the following Wireshark filter: dns.qry.name contains sweyblidian The answer to this query is the IPv4 address 185.100.65\[.\]29, as shown below in Figure 18. ![The red arrow indicates the IP address used for sweyblidian\[.\]com](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-17.jpeg) Figure 18. Finding the IP address used for sweyblidian\[.\]com. Find any TCP streams to that IP address using the following Wireshark filter: ip.addr eq 185.100.65.29 and tcp.flags eq 0x0002 The results should reveal three TCP SYN segments for two TCP streams (one of the TCP SYN segments is a retransmission), as shown below in Figure 19. ![The screenshot shows how the Wireshark column display should appear after filtering for TCP streams to the IP address used for sweyblidian\[.\]com.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-18.jpeg) Figure 19. TCP SYN segments for two TCP streams to the IP address for sweyblidian\[.\]com. Follow the TCP stream with port 49807 as the TCP source port. This should show approximately 1.16 MB of data. The majority of it appears encoded or otherwise obfuscated, as shown below in Figure 20. ![The screenshot shows how the majority of data from the TCP stream appears encoded or otherwise obfuscated.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-19.jpeg) Figure 20. TCP stream showing the start of data exfiltrated by Ficker Stealer. After exfiltrating its data, Ficker Stealer goes quiet and we don't see anything more from it. At this point, if the infected computer is a standalone Windows host, we will only see Hancitor C2 traffic. But if the infected computer is part of an AD environment, we should also see Cobalt Strike. Let's look at the initial requests for Cobalt Strike by Hancitor using the following Wireshark filter: http.request.uri contains .bin This should return the following lines: * belcineloweek\[.\]ru - GET /1602s.bin * belcineloweek\[.\]ru - GET /1602s.bin Follow the TCP stream for either of those HTTP GET requests. This TCP stream contains all three HTTP GET requests and responses to and from belcineloweek\[.\]ru, so you must scroll past a large amount of data representing the Ficker Stealer EXE. Near the end of the TCP stream, you should find two identical HTTP GET requests for 1602s.bin. Both requests return the same 682 bytes of data as shown below in Figure 21. This data is used to infect the victim with Cobalt Strike. ![The screenshot shows the 682 bytes of data used to infect a victim of a Hancitor infection in an AD environment with Cobalt Strike.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-20.jpeg) Figure 21. TCP stream showing 682 bytes of data returned from belcineloweek\[.\]ru for Cobalt Strike. #### What does Cobalt Strike traffic look like? It can be HTTP or HTTPS. In this pcap, HTTP GET requests by Hancitor for Cobalt Strike use the letter s in the URLs. The request for 1602s.bin indicates Cobalt Strike for this infection uses HTTPS traffic. That is indeed what happened. Use your basic web traffic filter, then scroll down, and you should see several frames in the column display to 192.99.250\[.\]2 over TCP port 443 as shown below in Figure 22. This is Cobalt Strike traffic. Cobalt Strike traffic to this IP address does not have an associated domain, so the host name is blank in the column display. ![Red arrows indicate the lines in the Wireshark column display that relate to traffic from the infected Windows host caused by Cobalt Strike.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-21.jpeg) Figure 22. Traffic from the infected Windows host caused by Cobalt Strike. Certificate issuer data for HTTPS traffic caused by Cobalt Strike HTTPS is unusual. Why? Because all of the identification fields for items like country, locality and organization are blank. We can filter for certificate data in Cobalt Strike's HTTPS traffic and expand the frame details to see this. First, find certificate data from the IP address for Cobalt Strike traffic by using the following Wireshark filter: tls.handshake.type eq 11 and ip.addr eq 192.99.250.2 This should reveal two frames in your column display. Expand frame details for either of these frames until you find fields for certificate issuer data. These fields should be blank. Below, Figure 23 shows an example. ![A red arrow and box highlight the blank certificate issuer data for Cobalt Strike HTTPS traffic.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-22.jpeg) Figure 23. Certificate issuer data for Cobalt Strike traffic. For the rest of this pcap, we see HTTP GET requests for Hancitor C2 and HTTPS traffic for Cobalt Strike. Hancitor C2 traffic happens approximately every 2 minutes. HTTPS traffic for Cobalt Strike happens nearly every second. ## Example 2, Part 1: Hancitor with Ficker Stealer and Cobalt Strike Open ***Example-2-2021-02-10-Hancitor-infection-part-1-of-2.pcap*** in Wireshark and use a basic web filter, as shown in Figure 24. ![The screenshot shows the Wireshark column display after opening the Example 2, part 1 pcap and applying a basic web filter. A Google Docs link is highlighted in blue.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-23.jpeg) Figure 24. Traffic from part one of our second example filtered in Wireshark using a basic web filter. The pcap comes from an AD environment with the following characteristics: * LAN segment range: 10.2.10.0/24 * Domain: pizzawithapples.food * Domain controller: 10.2.10.10 - Apples-DC * LAN segment gateway: 10.2.10.1 * LAN segment broadcast address: 10.2.10.255 * IP address of the infected Windows host: 10.2.10.101 * Host name of the infected Windows host: DESKTOP-TRH50EJ * User account name on the infected Windows host: dave.thomas Above in Figure 24, we see a link to docs.google.com followed by HTTP GET requests to b2b.ebike-your-life\[.\]com/commemorative.php. As we did in our first example, we can export the HTML page from b2b.ebike-your-life\[.\]com from our second example and open it in a web browser to get the malicious Word document. The SHA256 hash for your Word document should be 793d134cdb4bcba47e1f678d052c4d7747b93ea4199714efb8b614321b58dca7, and its name should be 0210\_1723194332604.doc. Also as we did for our first example, find Hancitor C2 activity using the following Wireshark filter: http.request.uri contains "/8/forum.php" or http.host contains api.ipify.org This returns IP address checks by Hancitor and Ficker Stealer, along with Hancitor C2 traffic, as listed below and shown in Figure 25. * api.ipify.org - GET / * anumessensan\[.\]ru - POST /8/forum.php * api.ipify.org - GET /?format=xml ![The screenshot shows the results of filtering for IP address checks by Hancitor and Ficker Stealer, along with Hancitor C2 traffic.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-24.jpeg) Figure 25. IP address checks and Hancitor C2 traffic. Filter for followup malware sent by Hancitor using the following Wireshark filter: http.request.uri contains .exe or http.request.uri contains .bin This should reveal Hancitor sending followup malware for Cobalt Strike and Ficker Stealer, as listed below and shown in Figure 26: * backupez\[.\]com - GET /0902.bin * backupez\[.\]com - GET /0902s.bin * backupez\[.\]com - GET /6yudfgh.exe ![The screenshot shows the results of filtering the Wireshark column display for followup malware sent by Hancitor.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-25.jpeg) Figure 26. Hancitor sends follow-up malware for Cobalt Strike and Ficker Stealer. In this case, one of the GET requests for Cobalt Strike has an s in the URL, but the other does not, so we should see both HTTP and HTTPS traffic caused by the Cobalt Strike. Return to your basic web filter, then scroll down to see what type of HTTP requests happen after the traffic to backupez\[.\]com. The results should show HTTP traffic over TCP port 1080 and HTTPS traffic over TCP port 4443. Your Wireshark setup might not display any HTTP traffic over TCP port 1080, so you might have to set up Wireshark to show it. First, use the menu path ***Analyze --\> Decode As*** shown below in Figure 27 to bring up the ***Decode As*** window. ![The large black arrow shows where to click in Wireshark to bring up the Decode As window.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-26.jpeg) Figure 27. Menu path for the Decode As window. Once you have the Decode As window, create a new entry to decode TCP port 1080 as HTTP, as shown below in Figure 28. ![The large black arrows show where to click to create a new entry to decode TCP port 1080 as HTTP.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-27.jpeg) Figure 28. Creating a new entry in the Decode As window to decode TCP port 1080 as HTTP. When you've created the new entry, either click the OK button or click the Save button. The Save button literally saves the entry, so it will work after you close and open Wireshark again. The OK button applies the decoding only as long as your current Wireshark session stays open. In this case, we should click the Save button. After saving the entry, go back to your Wireshark column display and use the basic web filter. Scroll down, and you should see both HTTP and HTTPS traffic for Cobalt Strike, as highlighted below in Figure 29. ![Red arrows and boxes indicate traffic caused by Cobalt Strike in our second example.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-28.jpeg) Figure 29. Traffic caused by Cobalt Strike in our second example. Shown above in Figure 29, traffic caused by Cobalt Strike is: * 104\.160.190\[.\]114:8080 - GET /WWFh * 104\.160.190\[.\]114:8080 - GET /fwlink * 104\.160.190\[.\]114 port 4443 - HTTPS traffic The first HTTP GET request, ending with WWFh, returned 208,473 bytes of an encoded binary that most likely decodes to a Windows binary used for Cobalt Strike. Follow the TCP stream for this HTTP request, and you should see information shown below in Figure 30. ![The information shown is obtained by following the TCP stream for the first HTTP GET request found in our second example, the one ending with WWFh.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-29.jpeg) Figure 30. TCP stream of the initial HTTP GET request to 104.160.190\[.\]114:8080. Further HTTP traffic to 104.160.190\[.\]114:8080 for fwlink is Cobalt Strike C2 traffic. This traffic also returns encoded data, if it returns any data at all. In most cases, zero bytes of content are returned. The first HTTP request to 104.160.190\[.\]114:8080 for fwlink returned 48 bytes of encoded data, as shown below in Figure 31. ![The first HTTP request to 104.160.190\[.\]114:8080 for fwlink returned 48 bytes of encoded data, shown here.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-30.jpeg) Figure 31. First HTTP request for Cobalt Strike C2 traffic returned 48 bytes of data. These HTTP requests for Cobalt Strike C2 happen approximately once every second. HTTPS traffic for Cobalt Strike C2 is similarly busy, with traffic to 104.160.190\[.\]114 over TCP port 4443 appearing approximately once every second. Our next pcap for our second example is from later during the same infection, when we see indicators of Send-Safe spambot malware. ## Example 2, Part 2: Hancitor C2, Cobalt Strike C2 and Send-Safe Spambot Malware Open ***Example-2-2021-02-10-Hancitor-infection-part-2-of-2.pcap*** in Wireshark and use a basic web filter, as shown in Figure 32. ![The screenshot shows how your Wireshark column display should look after applying a basic web filter to traffic from part two of our second example.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-31.jpeg) Figure 32. Traffic from part two of our second example filtered in Wireshark using a basic web filter. This pcap happens later during the same infection as our previous pcap. At times, we see up to three or four HTTP GET requests for Cobalt Strike C2 traffic during the same second. However, this pcap reveals that Hancitor sent another Windows executable file, and that executable is Send-Safe-based spambot malware. To find this Windows executable file, use the following Wireshark filter: http.request.uri contains .exe The result is another HTTP GET request to backupez\[.\]com, which is the domain used by Hancitor to push followup malware in part one of this example. The URL ends with 47.exe. See the result below in Figure 33. ![Using a Wireshark filter designed to identify .exe files, we retrieve the Windows executable for Send-Safe spambot malware, shown here.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-32.jpeg) Figure 33. Hancitor retrieves Windows executable for Send-Safe spambot malware. You can export this file from the pcap using the menu path ***File --\> Export Objects --\> HTTP.*** Select the entry for 47.exe from backupez\[.\]com, as shown below in Figure 34. ![The red arrow indicates the steps required to export the Windows executable for Send-Safe spambot malware from the pcap.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-33.jpeg) Figure 34. Exporting the Send-Safe spambot EXE from the pcap. The SHA256 hash of 47.exe is: 51ca66a8ac7f4e072b39ef886d7d414d6c6868d0d67a46150835297e65493dc6 Send-Safe was a commercially available program sold through a now-defunct website named send-safe\[.\]com. It was advertised as "[...a bulk-emailing program that allows you to send email from your own computer, or a remote computer with or without the use of proxies.](https://web.archive.org/web/20190918103313/www.send-safe.com/send-safe.html)" This program has been used by various threat actors as malware to turn infected Windows computers into spambot hosts. What does Send-Safe spambot traffic look like? Our infected Windows host generated the following traffic: * HTTPS traffic to 31.44.184\[.\]47 over TCP port 50025 * Traffic to 31.44.184\[.\]47 over UDP port 50026 * SMTP traffic sending out malicious spam pushing Hancitor. To find Send-Safe UDP traffic, use udp.port eq 50026 for your Wireshark filter. The results should look like Figure 35 below. ![The screenshot shows how your Wireshark column display should look after you filter to find Send-Safe UDP traffic.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-34.jpeg) Figure 35. UDP traffic caused by Send-Safe-based spambot malware. To view Send-Safe SMTP traffic and HTTPS traffic, use the following Wireshark filter: (tcp.port eq 50025 and tls.handshake.type eq 1) or smtp.data.fragment Your results should look similar to Figure 36. ![This shows an example of the results of filtering for Send-Safe SMTP traffic and HTTPS traffic after a Hancitor infection.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-35.jpeg) Figure 36. HTTPS and spambot traffic caused by Send-Safe-based malware. HTTPS traffic over TCP port 50025 caused by Send-Safe has certificate issuer data that uses Send-Safe as the organizationName and commonName, as shown below in Figure 37. ![HTTPS traffic over TCP port 50025 caused by Send-Safe has certificate issuer data that uses Send-Safe as the organizationName and commonName, as shown here.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-36.jpeg) Figure 37. Send-Safe-specific certificate issuer data in HTTPS traffic caused by Send-Safe malware. Since the SMTP traffic in this pcap is unencrypted, you can extract the emails using Wireshark. The menu path is ***File --\> Export Objects --\> IMF*** as shown below in Figure 38. ![The red arrow indicates the selections to make to extract malicious emails caused by Send-Safe spambot malware in this example.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-37.jpeg) Figure 38. Exporting emails caused by the Send-Safe spambot malware. This pcap contains 167 emails you can export. On average, several messages were pushed out each second from this Send-Safe-infected Windows host. Below, Figure 39 shows what one of the exported items of Hancitor spam looks like in a Thunderbird email client. The template for this specific wave of Hancitor spam spoofed a well-known bank. ![A Hancitor email exported from the pcap is designed to spoof a well-known bank.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-38.jpeg) Figure 39. An example of a Hancitor email exported from the pcap. ## Example 3: Hancitor with Ficker Stealer, Cobalt Strike and a Network Ping Tool Open ***Example-3-2021-01-25-Hancitor-infection.pcap*** in Wireshark and use a basic web filter, as shown in Figure 40. ![The screenshot shows how your Wireshark display should look after opening traffic from example three and applying a basic web filter.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-39.jpeg) Figure 40. Traffic from the fourth pcap filtered in Wireshark using our basic web filter. The pcap comes from an AD environment with the following characteristics: * LAN segment range: 10.1.25.0/24 * Domain: permafrostie.com * Domain controller: 10.1.25.2 - Permafrostie-DC * LAN segment gateway: 10.1.25.1 * LAN segment broadcast address: 10.1.25.255 * IP address of the infected Windows host: 10.1.25.101 * Host name of the infected Windows host: DESKTOP-GAL3OV5 * User account name on the infected Windows host: barry.paulsen The page that delivered the initial Word document was www.nuicala.inspia\[.\]net/mars.php. As we did in our two previous examples, we can export the web page, open it in a browser and get the malicious Word document used to kick off this Hancitor infection. The SHA256 hash and name for the extracted malicious Word document is: 8922dbb1e7f157c62fe64d03278757d78d136eb94d00ac2df101789d602f1224 0125\_206410993.doc Based on techniques from our first two examples, you can find the following information from this Hancitor infection: Hancitor traffic: * port 80 - api.ipify.org - GET / * 83\.220.169\[.\]45 port 80 - wasintodese\[.\]ru - POST /8/forum.php Followup malware for Cobalt Strike: * 8\.209.78\[.\]68 port 80 - drivewaysnowservice\[.\]com - GET /2101.bin * 8\.209.78\[.\]68 port 80 - drivewaysnowservice\[.\]com - GET /2101s.bin Followup malware for Ficker Stealer * 8\.209.78\[.\]68 port 80 - drivewaysnowservice\[.\]com - GET /6gfbd5ws.exe Cobalt Strike traffic: * 23\.106.80\[.\]14 port 1080 - 23.106.80\[.\]14:1080 - GET /JdHf * 23\.106.80\[.\]14 port 1080 - 23.106.80\[.\]14:1080 - GET /match * 23\.106.80\[.\]14 port 1080 - 23.106.80\[.\]14:1080 - POST /submit.php?id=2612103345 * 23\.106.80\[.\]14 port 4443 - HTTPS traffic Ficker Stealer traffic: * port 80 - api.ipify.org - GET /?format=xml * 185\.100.65\[.\]29 port 80 - sweyblidian\[.\]com - TCP traffic Of note, Ficker Stealer is the same binary for all examples in this tutorial, so we should see the same post-infection traffic by this malware. For Cobalt Strike, any HTTP POST request containing /submit.php?id= has an identification number that's unique for each infected Windows host. If you see these HTTP POST requests with /submit.php?id= from Cobalt Strike, be alert for indicators of additional malware. Malware sent through Cobalt Strike appears as an encoded binary that is decoded on the victim host. Because of this, we will not find the actual malware binary in the pcap. Instead, followup malware sent through Cobalt Strike is identified by its post-infection traffic. In this case, we see ICMP scanning that indicates a [network ping tool](https://unit42.paloaltonetworks.com/hancitor-infections-cobalt-strike/) was sent through Cobalt Strike. Use the Wireshark filter icmp in the pcap, and your column display should look similar to Figure 41 below. ![The screenshot displays an example of how ICMP traffic from a network ping tool sent through Cobalt Strike should look after you apply the Wireshark filter icmp to the example pcap.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-40.jpeg) Figure 41. ICMP traffic from a network ping tool sent through Cobalt Strike. As described in our recent blog about [Hancitor](https://unit42.paloaltonetworks.com/hancitor-infections-cobalt-strike/), samples of the network ping tool recovered from infected Windows hosts generate approximately 1.5 GB of ICMP traffic, as they ping more than 17 million IP addresses targeting internal, non-routable IPv4 address space. Based on our tests, these network ping tools hit the following address space: * 192\.168.0.0 through 192.168.254.254 * 172\.16.0.0 through 172.31.254.254 * 10\.0.0.0 through 10.254.254.254 This much ping traffic is prohibitively slow to display in Wireshark. The pcap for our third example of Hancitor has ping traffic to 192.168.0.0/16 and some of the ping traffic hitting the 172.16.0.0/12 address space before the recording was stopped. ## Example 4: Hancitor with Ficker Stealer, Cobalt Strike and NetSupport Manager RAT Open ***Example-4-2021-02-02-Hancitor-infection.pcap*** in Wireshark and use a basic web filter, as shown in Figure 42. ![The screenshot shows how your Wireshark display should look after opening traffic from example four and applying a basic web filter.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-41.jpeg) Figure 42. Traffic from the fifth pcap filtered in Wireshark using our basic web filter. The pcap comes from an AD environment with the following characteristics: * LAN segment range: 10.2.2.0/24 * Domain: sillybobcat.com * Domain controller: 10.2.2.2 - Cats-DC * LAN segment gateway: 10.2.2.1 * LAN segment broadcast address: 10.2.2.255 * IP address of the infected Windows host: 10.2.2.101 * Host name of the infected Windows host: DESKTOP-NDGEE4D * User account name on the infected Windows host: baxter.murdoch The page that delivered the initial Word document was premierpt.co\[.\]uk/footage.php. As we did for our previous examples, we can export the web page, open it in a browser and get the malicious Word document used to kick off this Hancitor infection. The SHA256 hash and name for the extracted malicious Word document is: b60431e0fe5bf2b5c7cd5e01add62d24cd6ad2c99eb6a23fb5a2967d812cbf08 0202\_10846666250132.doc Based on techniques from our previous examples, you can find the following information from this Hancitor infection: Hancitor traffic: * port 80 - api.ipify.org - GET / * 45\.9.191\[.\]107 port 80 - knorshand\[.\]ru - POST /8/forum.php Followup malware for Cobalt Strike: * 8\.209.78\[.\]68 port 80 - bobcatofredding\[.\]com - GET /0102.bin * 8\.209.78\[.\]68 port 80 - bobcatofredding\[.\]com - GET /0102s.bin Followup malware for Ficker Stealer * 8\.209.78\[.\]68 port 80 - bobcatofredding\[.\]com - GET /6lavfdk.exe Cobalt Strike traffic: * 192\.254.79\[.\]71 port 8080 - 23.106.80\[.\]14:1080 - GET /EbHm * 192\.254.79\[.\]71 port 8080 - 23.106.80\[.\]14:1080 - GET /ptj * 192\.254.79\[.\]71 port 8080 - 23.106.80\[.\]14:1080 - POST /submit.php?id=242569267 * 192\.254.79\[.\]71 port 443 - HTTPS traffic Ficker Stealer traffic: * port 80 - api.ipify.org - GET /?format=xml * 185\.100.65\[.\]29 port 80 - sweyblidian\[.\]com - TCP traffic As we discussed in our previous example, if you see HTTP POST requests with /submit.php?id= from Cobalt Strike, be alert for indicators of additional malware. Also like our previous example, we cannot find the malware binary in the pcap, so we must identify followup malware by its post-infection traffic. In this case, we find indicators for NetSupport Manager RAT malware. This RAT first does an IP address check to the domain geo.netsupportsoftware\[.\]com . Then it generates traffic with NetSupport Manager as part of the User-Agent string in its HTTP request headers. Search for this traffic by using the following Wireshark display filter: http.user\_agent contains "NetSupport Manager" or http.host contains netsupport The results should look similar to Figure 43 below: ![This is an example of how traffic generated by NetSupport Manager RAT should appear in Wireshark after being surfaced by the suggested "NetSupport Manager" filter.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-42.jpeg) Figure 43. Traffic generated by NetSupport Manager RAT. Traffic seen above in Figure 43 is: * 62\.172.138\[.\]35 port 80 - geo.netsupportsoftware\[.\]com - GET /location/loca.asp * 46\.17.106\[.\]230 port 3543 - 46.17.106\[.\]230 - POST hxxp://46.17.106\[.\]230/fakeurl.htm Follow the TCP stream for any of the HTTP POST requests to see what NetSupport Manager C2 traffic looks like. The results should look similar to Figure 44 below. ![The screenshot shows an example of data from a TCP stream of NetSupport Manager RAT C2 traffic.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/04/word-image-43.jpeg) Figure 44. TCP stream of NetSupport Manager RAT C2 traffic. Of note, this tutorial only contains two examples of followup traffic from Cobalt Strike after a Hancitor infection. Cobalt Strike can be used to send other types of malware, not just a network ping tool or NetSupport Manager RAT. So if you examine activity from a Hancitor infection with Cobalt Strike, we recommend you search for indicators from any other type of malware. ## Conclusion This tutorial reviewed how to identify Hancitor activity and its followup malware from pcaps of infection traffic. We reviewed five pcaps from four recent examples and found consistent patterns from the network traffic. These patterns are fairly unique and can be used to identify Hancitor activity and its associated malware within your network. This knowledge can help security professionals better detect and catch Hancitor when reviewing suspicious network activity. For more help with Wireshark, see our previous tutorials: * [Changing Your Column Display](https://unit42.paloaltonetworks.com/unit42-customizing-wireshark-changing-column-display/) * [Display Filter Expressions](https://unit42.paloaltonetworks.com/using-wireshark-display-filter-expressions/) * [Identifying Hosts and Users](https://unit42.paloaltonetworks.com/using-wireshark-identifying-hosts-and-users/) * [Exporting Objects from a Pcap](https://unit42.paloaltonetworks.com/using-wireshark-exporting-objects-from-a-pcap/) * [Examining Trickbot Infections](https://unit42.paloaltonetworks.com/wireshark-tutorial-examining-trickbot-infections/) * [Examining Ursnif Infections](https://unit42.paloaltonetworks.com/wireshark-tutorial-examining-ursnif-infections/) * [Examining Qakbot Infections](https://unit42.paloaltonetworks.com/tutorial-qakbot-infection/) * [Decrypting HTTPS Traffic](https://unit42.paloaltonetworks.com/wireshark-tutorial-decrypting-https-traffic/) * [Examining Dridex Infection Traffic](https://unit42.paloaltonetworks.com/wireshark-tutorial-dridex-infection-traffic/) * [Examining Emotet Infection Traffic](https://unit42.paloaltonetworks.com/wireshark-tutorial-emotet-infection/) Back to top ### Tags * [Cobalt Strike](https://unit42.paloaltonetworks.com/tag/cobalt-strike/ "Cobalt Strike") * [Ficker Stealer](https://unit42.paloaltonetworks.com/tag/ficker-stealer/ "Ficker Stealer") * [Hancitor](https://unit42.paloaltonetworks.com/tag/hancitor/ "hancitor") * [NetSupportManager](https://unit42.paloaltonetworks.com/tag/netsupportmanager/ "NetSupportManager") * [Pcap](https://unit42.paloaltonetworks.com/tag/pcap/ "pcap") * [Send-Safe](https://unit42.paloaltonetworks.com/tag/send-safe/ "Send-Safe") * [Wireshark](https://unit42.paloaltonetworks.com/tag/wireshark/ "Wireshark") * [Wireshark Tutorial](https://unit42.paloaltonetworks.com/tag/wireshark-tutorial/ "Wireshark Tutorial") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Highlights from the Unit 42 Cloud Threat Report, 1H 2021](https://unit42.paloaltonetworks.com/highlights-cloud-threat-report-1h-2021/ "Highlights from the Unit 42 Cloud Threat Report, 1H 2021") ### Table of Contents * ### Related Articles * [Nation-State Actors Exploit Notepad++ Supply Chain](https://unit42.paloaltonetworks.com/notepad-infrastructure-compromise/ "article - table of contents") * [Exploitation of Critical Vulnerability in React Server Components (Updated December 12)](https://unit42.paloaltonetworks.com/cve-2025-55182-react-and-cve-2025-66478-next/ "article - table of contents") * [CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia](https://unit42.paloaltonetworks.com/espionage-campaign-targets-south-asian-entities/ "article - table of contents") ## Related Resources ![Pictorial representation of a magnifying glass illuminating a glowing orange circular digital circuit interface on a dark, high-tech background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Myth-Busting_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) September 16, 2026 [#### Atomic macOS (AMOS) Stealer Activity](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/) * [MacOS](https://unit42.paloaltonetworks.com/tag/macos/ "macOS") * [Threat intelligence](https://unit42.paloaltonetworks.com/tag/threat-intelligence/ "threat intelligence") * [Unit 42](https://unit42.paloaltonetworks.com/tag/unit-42/ "Unit 42") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/ "Atomic macOS (AMOS) Stealer Activity") ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/content/pan/en_US/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)