[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/xhunt-campaign-new-watering-hole-identified-for-credential-harvesting/) * [Japanese](https://unit42.paloaltonetworks.com/ja/xhunt-campaign-new-watering-hole-identified-for-credential-harvesting/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # xHunt Campaign: New Watering Hole Identified for Credential Harvesting ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 7 min read Related Products [![Advanced Threat Prevention icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced Threat Prevention](https://unit42.paloaltonetworks.com/product-category/advanced-threat-prevention/ "Advanced Threat Prevention")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Brittany Barbehenn](https://unit42.paloaltonetworks.com/author/brittany-barbehenn/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:January 27, 2020 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Credential Harvesting](https://unit42.paloaltonetworks.com/tag/credential-harvesting/) * [DNS Hijacking](https://unit42.paloaltonetworks.com/tag/dns-hijacking/) * [DNS Redirects](https://unit42.paloaltonetworks.com/tag/dns-redirects/) * [Watering Hole](https://unit42.paloaltonetworks.com/tag/watering-hole/) * [XHunt](https://unit42.paloaltonetworks.com/tag/xhunt/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/xhunt-campaign-new-watering-hole-identified-for-credential-harvesting/?pdf=download&lg=en&_wpnonce=c9ebcb9c34 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/xhunt-campaign-new-watering-hole-identified-for-credential-harvesting/?pdf=print&lg=en&_wpnonce=c9ebcb9c34 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=xHunt%20Campaign:%20New%20Watering%20Hole%20Identified%20for%20Credential%20Harvesting&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fxhunt-campaign-new-watering-hole-identified-for-credential-harvesting%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fxhunt-campaign-new-watering-hole-identified-for-credential-harvesting%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fxhunt-campaign-new-watering-hole-identified-for-credential-harvesting%2F&title=xHunt%20Campaign:%20New%20Watering%20Hole%20Identified%20for%20Credential%20Harvesting "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fxhunt-campaign-new-watering-hole-identified-for-credential-harvesting%2F&text=xHunt%20Campaign:%20New%20Watering%20Hole%20Identified%20for%20Credential%20Harvesting "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fxhunt-campaign-new-watering-hole-identified-for-credential-harvesting%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=xHunt%20Campaign:%20New%20Watering%20Hole%20Identified%20for%20Credential%20Harvesting%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fxhunt-campaign-new-watering-hole-identified-for-credential-harvesting%2F "Share in Mastodon") ## Executive Summary During the analysis of the xHunt campaign activities, we identified a Kuwait government organization's webpage used as an apparent watering hole. The webpage contained a hidden image which was observed between June and December 2019, and referenced domains associated with malicious activity conducted by the xHunt campaign operators. We believe that the same threat actors involved in the [Hisoka attack campaign](https://unit42.paloaltonetworks.com/xhunt-campaign-attacks-on-kuwait-shipping-and-transportation-organizations/)compromised and injected this HTML code into this website in an attempt to harvest credentials from the website's visitors; specifically, gathering account names and password hashes. While we cannot confirm this, it is possible that the actors intended to crack these hashes to obtain the visitor's passwords or using the hashes gathered to carry out relay attacks to gain access to additional systems. If successful in harvesting account credentials, the compromised data has a plethora of uses for the attackers and can allow them to breach an organization to steal sensitive information. Furthermore, because they'd be using trusted credentials, it can allow attackers to go undetected for long periods of time, enabling them to infiltrate other parts of an organization and even implement backdoors, like RATs, to get back into a system even after being removed. This can result in significant damage to an organization over a prolonged period of time. During this same timeframe, we observed an indication of DNS redirect activity on infrastructure used by these same operators. The domains observed in redirect activity primarily contained subdomains referencing an association with their organizational email servers further implying an interest in user credential harvesting. Palo Alto Networks Next-Generation Firewall customers are protected from this threat. Our [Threat Prevention Platform](https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/threat-prevention) with [WildFire](https://www.paloaltonetworks.com/products/secure-the-network/wildfire) detects activity associated with these threat groups while simultaneously updating the 'malware' category within the [URL filtering](https://www.paloaltonetworks.com/products/threat-detection-and-prevention/web-security) for malicious and/or compromised domains that have been identified. [AutoFocus](https://www.paloaltonetworks.com/cortex/autofocus) customers can continue to track xHunt Campaign activity by using the [xHunt](https://autofocus.paloaltonetworks.com/#/tag/Unit42.xHunt) tag. ### Use of Responder on Kuwait Government Website During open-source research of the [xHunt Campaign](https://unit42.paloaltonetworks.com/xhunt-campaign-attacks-on-kuwait-shipping-and-transportation-organizations/), we identified a website belonging to a government organization in Kuwait referencing an image hosted on Hisoka associated command and control (C2) infrastructure. Beginning in May 2019, the image referenced the domain microsofte-update\[.\]com but changed to learn-service\[.\]com in December 2019. As of January 2020, this image is no longer referenced on the webpage. We analyzed the HTML code on this website, shown in Figures 1 and 2, in order to try and better understand how this organization's website would attempt to load an image from a domain known to host a C2 server used for malicious activity. Figure 1 shows the webpage's attempt to load an image from the URI file:///\\\\microsofte-update\[.\]com\\c$\\. This URI does not display to the website visitor due to the "visibility:hidden" style attribute. The URI uses the ["file" URI scheme](https://tools.ietf.org/html/rfc8089) with the fully qualified domain microsofte-update\[.\]com as the host and the "c$" as the path to the image. We found this path particularly interesting, as the HTML would attempt to load the "C:" drive file share as an image on the remote server. Logically, the legitimate inclusion of this code does not make sense as the "C:" drive itself would not load as an image. Figure 2 shows the December 2019 change in the URL hosting the image file, however, the rest of the code remained the same. [![Figure 1. Image hosted on Kuwaiti government website Header in mid-2019 xHunt](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/Figure-1.-Image-hosted-on-Kuwaiti-government-website-Header-in-mid-2019.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/Figure-1.-Image-hosted-on-Kuwaiti-government-website-Header-in-mid-2019.png) Figure 1. Image hosted on Kuwait government website Header in mid-2019 [![Figure 2. Image hosted on Kuwaiti government website Footer in late-2019 xHunt](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/Figure-2.-Image-hosted-on-Kuwaiti-government-website-Footer-in-late-2019.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/Figure-2.-Image-hosted-on-Kuwaiti-government-website-Footer-in-late-2019.png) Figure 2. Image hosted on Kuwait government website Footer in late-2019 We believe that the actors likely included this line of code in an attempt to passively harvest account credentials in the form of NTLM hashes from the webpage's visitors. Windows-based machines can use NTLM hashes when authenticating with a server. It is possible that when visiting the webpage containing this code, the user's browser will attempt to load the image by accessing the file share on the remote server. To access this remote file share, Windows will perform an NTLM challenge-response authentication attempt. If the actor-controlled server specified in the URI is configured to emulate the NTLM handshake and the website's visitor is on a local network that allows internal Windows networking protocols to reach the actor controlled server, such as Server Message Block (SMB) and NetBIOS, then the actors could capture NTLM hashes and other system information for that visitor. After capturing the NTLM hashes, the actor could crack the hash to obtain the user's password or use the hash in a relay attack. This could also enable a full breach of an organization and allow the attackers to go undetected for long periods of time. To test this theory, we set up the [Responder](https://github.com/lgandx/Responder) tool on a server in our lab and configured the environment to have the domain microsofte-update\[.\]com resolve to the server. We then visited the website from another system in our lab that had the HTML code injected and observed the Responder tool gathering the domain name, user name, IP address and NTLM hashes from the system on which we visited the website, as shown in Figure 3. [![Figure 3. Spiderlab Responder collection output xHunt](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/Figure-3.-Spiderlab-Responder-collection-output-718x1024.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/Figure-3.-Spiderlab-Responder-collection-output.png) Figure 3. Spiderlab Responder collection output ### DNS Redirects During the analysis of the Responder collection activity on the Kuwait organization's webpage, we observed an indication of DNS redirect activity in related infrastructure analysis within [AutoFocus](https://www.paloaltonetworks.com/cortex/autofocus). As shown in Figure 4 below, in May 2019, the domain belonging to an organization within Kuwait began resolving to infrastructure within a netblock utilized by the xHunt operators during that same timeframe. [![Figure 4. Example DNS redirect activity observed in April and May 2019 xHunt](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/Figure-4.-Example-DNS-redirect-activity-observed-in-April-and-May-2019.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/Figure-4.-Example-DNS-redirect-activity-observed-in-April-and-May-2019.png) Figure 4. Example DNS redirect activity observed in April and May 2019 Pivoting on this activity within RiskIQ PassiveTotal, we were able to identify an additional Government organization in Kuwait with the same resolution change in April 2019. [![Figure 5. RiskIQ PassiveTotal indication of DNS redirect activity xHunt](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/Figure-5.-RiskIQ-PassiveTotal-indication-of-DNS-redirect-activity.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/Figure-5.-RiskIQ-PassiveTotal-indication-of-DNS-redirect-activity.png) Figure 5. RiskIQ PassiveTotal indication of DNS redirect activity These changes led us to additional DNS Redirect infrastructure associated with the xHunt activities. We were able to identify DNS redirect activity surrounding both the 2018 Sakabota activity as well as the 2019 Hisoka activity. All redirects observed were associated with the Kuwait government and private sector organizations. Figure 6 shows a sample timeline of the activity where the top row shows the target organizations, the middle row shows the infrastructure change and the bottom row shows the related xHunt domains. [![Figure 6. Sakabota and Hisoka DNS redirect activity Timeline xHunt](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/Figure-6.-Sakabota-and-Hisoka-DNS-redirect-activity-Timeline.jpeg)](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/01/Figure-6.-Sakabota-and-Hisoka-DNS-redirect-activity-Timeline.jpeg) Figure 6. Sakabota and Hisoka DNS redirect activity Timeline Similar to the activities reported by [FireEye](https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html), [Crowdstrike](https://www.crowdstrike.com/blog/widespread-dns-hijacking-activity-targets-multiple-sectors/), and [Cisco Talos](https://blog.talosintelligence.com/2019/04/seaturtle.html), we too observed the creation of one or more Let's Encrypt certificates created during the same time as the changes in domain hosting, all of which contained the name of the redirected domain. It is unknown whether or not the DNS redirects were successful in capturing visitor information. This activity further led us to take a look at the infrastructure previously reported in DNS redirect activities. We identified several interesting resolutions within the same IP range although not a direct overlap with other xHunt infrastructure activities. One particular resolution of interest is with the Sakabota related domain sakabota\[.\]com. This domain resolved to the IP address 185.15.247\[.\]140 in September 2018. Between December 2017 and January 2018, this IP was used in [DNS hijacking](https://www.crowdstrike.com/blog/widespread-dns-hijacking-activity-targets-multiple-sectors/) activities. We also noted both OilRig and Chafer resolutions within these same IP ranges over varying timeframes. Many of the redirected domains contained the subdomain mx, mail, or owa, indicating that these operators were likely targeting mail credentials. These infrastructure similarities are shown in the Appendix below. ## Conclusion The injected HTML code identified on the Kuwait organization's website indicates a likely attempt to harvest credentials from the website's visitors; specifically, gathering account names and password hashes. We believe that the same threat actors involved in the Hisoka attack campaign conducted these activities. Similarities in infrastructure utilized by cyber threat operators targeting the Middle East are not new. Infrastructure has often been reused and even shared in the past. The overlaps in DNS redirect activities with the xHunt Campaign and known threat operators show a continued interest in this attack method within that region. Our [Threat Prevention Platform](https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/threat-prevention) with [WildFire](https://www.paloaltonetworks.com/products/secure-the-network/wildfire) detects activity associated with these threat groups while simultaneously updating the 'malware' category within the [URL filtering](https://www.paloaltonetworks.com/products/threat-detection-and-prevention/web-security) for malicious and/or compromised domains that have been identified. [AutoFocus](https://www.paloaltonetworks.com/cortex/autofocus) customers can continue to track xHunt Campaign activity by using the [xHunt](https://autofocus.paloaltonetworks.com/#/tag/Unit42.xHunt) tag. ## Appendix |-------------------------|-------------------------|--------------------------------------------------------------------------------------------------| | **IP Address** | **Date** | **Campaign/Association** | | 185.15.247\[.\]140 | 12/30/2017 - 1/15/2018 | Widespread DNS Hijacking Activity | | 185.15.247\[.\]140 | 1/14/2017 | [Oilrig](https://twitter.com/clearskysec/status/1123276260195602432) (cloudipnameserver\[.\]com) | | 185.15.247\[.\]140 | 9/9/2018 | Sakabota (sakabota\[.\]com) | | 185.161.211\[.\]72 - 79 | 9/28/2018 - 10/26/2018 | DNSpionage Campaign | | 185.161.211\[.\]86 | 10/4/2018 | Oilrig (lowconnectivity\[.\]com) | | 185.161.209\[.\]147 | 11/28/2018 | Widespread DNS Hijacking Activity | | 185.174.101\[.\]68 | 9/28/2018 - 10/11/2018 | DNSpionage Campaign | | 185.174.101\[.\]66 | 8/6/2018 | Oilrig (ffconnectivitycheck\[.\]com) | | 185.174.101\[.\]68 | 2/14/2019 | DNSpionage Campaign | | 199.247.3\[.\]191 | 11/5/2018 | Widespread DNS Hijacking Activity | | 199.247.3\[.\]186 - 198 | 5/6/2018 - 8/30/2018 | Chafer (zombsroyale\[.\]io) | | 213.202.217\[.\]31 | 7/6/2018 | Newly identified DNS redirect activity | | 213.202.217\[.\]0,22 | 6/1/2018, 12/24/2018 | Sakabota (alforatsystem\[.\]com) | | 213.202.217\[.\]4 | 9/8/2018 | Sakabota (firewallsupports\[.\]com) | | 213.202.217\[.\]9 | 11/18/2018 - 11/29/2018 | Oilrig (googie\[.\]email) | | 91.132.139\[.\]200 | 4/16/2019, 5/12/2019 | Newly identified DNS redirect activity | | 91.132.139\[.\]183 | 4/7/2019 | Hisoka (microsofte-update\[.\]com) | | 192.99.138\[.\]4 | 4/17/2019 - 6/17/2019 | Newly identified DNS redirect activity | | 192.99.138\[.\]4 | 4/24/2019 | Sakabota (antivirus-update\[.\]top) | | 192.99.138\[.\]6 | 4/14/2019 - 5/4/2019 | Sakabota (6google\[.\]com) | | 104.168.136\[.\]161 | 6/24/2019 | Newly identified DNS redirect activity | | 104.168.244\[.\]213 | 7/14/2019 | Hisoka (microsofte-update\[.\]com) | | 104.168.244\[.\]213 | 7/15/2019 - 7/18/2019 | Hisoka (google-update\[.\]com) | ## Additional Resources * [xHunt Campaign: xHunt Actor's Cheat Sheet](https://unit42.paloaltonetworks.com/xhunt-actors-cheat-sheet/) * [xHunt Campaign: New PowerShell Backdoor Blocked Through DNS Tunnel Detection](https://unit42.paloaltonetworks.com/more-xhunt-new-powershell-backdoor-blocked-through-dns-tunnel-detection/) * [xHunt Campaign: Attacks on Kuwait Shipping and Transportation Organizations](https://unit42.paloaltonetworks.com/xhunt-campaign-attacks-on-kuwait-shipping-and-transportation-organizations/) Back to top ### Tags * [Credential Harvesting](https://unit42.paloaltonetworks.com/tag/credential-harvesting/ "Credential Harvesting") * [DNS Hijacking](https://unit42.paloaltonetworks.com/tag/dns-hijacking/ "DNS Hijacking") * [DNS Redirects](https://unit42.paloaltonetworks.com/tag/dns-redirects/ "DNS Redirects") * [Watering Hole](https://unit42.paloaltonetworks.com/tag/watering-hole/ "Watering Hole") * [XHunt](https://unit42.paloaltonetworks.com/tag/xhunt/ "xHunt") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: The Fractured Statue Campaign: U.S. Government Agency Targeted in Spear-Phishing Attacks](https://unit42.paloaltonetworks.com/the-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks/ "The Fractured Statue Campaign: U.S. Government Agency Targeted in Spear-Phishing Attacks") ### Table of Contents * ### Related Articles * [The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15)](https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/ "article - table of contents") * ["Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26)](https://unit42.paloaltonetworks.com/npm-supply-chain-attack/ "article - table of contents") * [The Dual-Use Dilemma of AI: Malicious LLMs](https://unit42.paloaltonetworks.com/dilemma-of-ai-malicious-llms/ "article - table of contents") ## Related Malware Resources ![Pictorial representation of TLS Certificate compromise. A person typing on a laptop with digital graphics of binary code and light beams emanating from the screen, representing data transfer or cyber activity.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/07_Security-Technology_Category_1920x900-1-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) October 22, 2026 [#### EMudhra Intermediate CA Certificates Compromised](https://unit42.paloaltonetworks.com/emudhra-certificate-compromise/) * [Certificates](https://unit42.paloaltonetworks.com/tag/certificates/ "certificates") * [Compromise](https://unit42.paloaltonetworks.com/tag/compromise/ "Compromise") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/emudhra-certificate-compromise/ "EMudhra Intermediate CA Certificates Compromised") ![](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/AdobeStock_1246251272-2-1-786x369.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) October 21, 2026 [#### "Next Exploit Opportunities": How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities](https://unit42.paloaltonetworks.com/ai-assisted-cybercrime-analysis/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Data exfiltration](https://unit42.paloaltonetworks.com/tag/data-exfiltration/ "data exfiltration") * [DeepSeek](https://unit42.paloaltonetworks.com/tag/deepseek/ "DeepSeek") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-assisted-cybercrime-analysis/ "“Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities") ![Pictorial representation of AI-powered campaign targeting government infrastructure. A glowing, blue, brain-shaped structure floats above a central microchip on a circuit board. The scene is futuristic, with neon lights illuminating the interconnected pathways and components.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/AdobeStock_637057734-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) October 15, 2026 [#### AI-Powered Espionage Campaign Targets Government Linux Infrastructure](https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/) * [Exfiltration](https://unit42.paloaltonetworks.com/tag/exfiltration/ "exfiltration") * [LLM](https://unit42.paloaltonetworks.com/tag/llm/ "LLM") * [Network security](https://unit42.paloaltonetworks.com/tag/network-security/ "network security") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/ "AI-Powered Espionage Campaign Targets Government Linux Infrastructure") ![Pictorial representation of PEERSTITCH, a FortiGate implant. A digital illustration depicting a circuit board with a prominent red warning triangle and exclamation mark in the center. The background is filled with various computer circuitry patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/09_Vulnerabilities_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) October 14, 2026 [#### Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/) * [Apache](https://unit42.paloaltonetworks.com/tag/apache/ "Apache") * [CL-STA-0954](https://unit42.paloaltonetworks.com/tag/cl-sta-0954/ "CL-STA-0954") * [Logging](https://unit42.paloaltonetworks.com/tag/logging/ "logging") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/ "Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant") ![Pictorial representation of operation blinder tunnel. Screen displaying code with a prominent alert symbol and the words 'VIRUS DETECTED' highlighted in red.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/05_Malware_Category_1920x900-1-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) October 6, 2026 [#### Blinder Tunnel Campaign Targets Iraqi Infrastructure](https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/) * [Advanced Persistent Threat](https://unit42.paloaltonetworks.com/tag/advanced-persistent-threat/ "Advanced Persistent Threat") * [Agent Serpens](https://unit42.paloaltonetworks.com/tag/agent-serpens/ "Agent Serpens") * [AppDomainManager](https://unit42.paloaltonetworks.com/tag/appdomainmanager/ "AppDomainManager") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/ "Blinder Tunnel Campaign Targets Iraqi Infrastructure") ![Pictorial representation of how K8 operators betray your security posture. A close-up of a futuristic microchip with glowing circuits in vibrant colors, including blue, purple, and orange, reflecting light.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_652069707-1-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 29, 2026 [#### OperTraitors: How Kubernetes Operators Betray Your Security Posture](https://unit42.paloaltonetworks.com/agentic-ai-kubernetes-operator-risks/) * [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI") * [AI agents](https://unit42.paloaltonetworks.com/tag/ai-agents/ "AI agents") * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/agentic-ai-kubernetes-operator-risks/ "OperTraitors: How Kubernetes Operators Betray Your Security Posture") ![Pictorial representation of a magnifying glass illuminating a glowing orange circular digital circuit interface on a dark, high-tech background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Myth-Busting_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) September 16, 2026 [#### Atomic macOS (AMOS) Stealer Activity](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/) * [MacOS](https://unit42.paloaltonetworks.com/tag/macos/ "macOS") * [Threat intelligence](https://unit42.paloaltonetworks.com/tag/threat-intelligence/ "threat intelligence") * [Unit 42](https://unit42.paloaltonetworks.com/tag/unit-42/ "Unit 42") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/ "Atomic macOS (AMOS) Stealer Activity") ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE") ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/) * [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") * [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure") ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * Observability * [Cortex XCOR](https://www.paloaltonetworks.com/cortex/xcor) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center-subscribe.html) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)