CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

CL-UNK-1280

actor · actor:cl-unk-1280

Unit 42's designation, relayed by Dream Research (2026-10-29), for a Chinese-speaking operator in the UTC+8 time zone who chained a custom PHP2Shell build with the Fragnesia kernel flaw to root 25 PAN-OS firewall and management servers and then attacked the Active Directory of a US government-affiliated organization; Dream Research itself names no actor.

Coverage
1
first 2026-10-22 → last 2026-11-01
Latest activity
2026-11-01
PAN-OS management interfaces were rooted in the wild via PHP2Shell and a kernel flaw: hotfix, then check for…
Peak priority
high
1 high
Targets
·
no sector or region stated
Sources cited
7
6 hosts

Action items (2)

Do-now tasks recorded on the entries about CL-UNK-1280, newest first. Check the date before acting on an older one.

  • Take the management interface of every PA-Series and VM-Series firewall and Panorama off the internet now by restricting it to a jump box or trusted internal addresses, because Palo Alto reports active exploitation against internet-exposed management interfaces, and install the hotfix for your maintenance release, which Palo Alto's table lists for every line from 10.2.7 to 12.2.4 (11.2.10-h17 adds the Brotli fix).
    2026-10-22CVE-2026-109618 +1
  • Rotate the directory bind account, HA replication keys, certificate private keys and device authentication keys of every PAN-OS firewall and Panorama that was reachable from the internet while unpatched and shows a PHP web shell or a tunnel, because the chain Dream Research recovered harvested exactly those from rooted firewalls, and the hotfix does not remove a web shell or tunnel already in place.
    2026-10-22CVE-2026-109618 +1

Defender insights

What each entry about CL-UNK-1280 tells a defender to do, newest first.

2026-10-22HIGHexploitedPAN-OS management interfaces were rooted in the wild via PHP2Shell and a kernel flaw: hotfix, then check for compromise

Exposure · detection

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

attributed activity

Story timeline

  1. 2026-10-22CVE-2026-109618 / CVE-2026-109619, Palo Alto Networks PAN-OS and Panorama: the PHP2Shell flaws affect every release below its train's hotfix through the management web interface, and Palo Alto reports active exploitation against internet-exposed management interfaces; all twenty hotfixes are out
    trending-vulnerabilitiesPAN-OS management interfaces were rooted in the wild via PHP2Shell and a kernel flaw: hotfix, then check for compromise

Hunting pivots

CVEs (exploited first)
CVE-2026-109618CVE-2026-109619
Affected products
Palo Alto Networks PAN-OSPalo Alto Networks Panorama
Tags
actively-exploitedcisa-kevpatch-availablepre-authrcevulnerabilities
ATT&CK techniques (10 across 6 tactics)

10 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • PersistenceBoot or Logon Initialization Scripts: RC Scripts · Server Software Component: Web Shell · Create or Modify System Process: Systemd Service
  • Privilege EscalationBoot or Logon Initialization Scripts: RC Scripts · Exploitation for Privilege Escalation · Create or Modify System Process: Systemd Service
  • Credential AccessBrute Force: Password Spraying · Unsecured Credentials: Private Keys
  • DiscoveryAccount Discovery: Domain Account
  • Command and ControlProxy · Protocol Tunneling

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-22/pan-os-panorama-php2shell-mgmt-interface-no-fixed-release · ATT&CK page ↗

Persistence TA0003

T1037.004Boot or Logon Initialization Scripts: RC Scripts×1

Adversaries may establish persistence by modifying RC scripts, which are executed during a Unix-like system’s startup. These files allow system administrators to map and start custom services at startup for different run levels. RC scripts require root privileges to modify.

Evidence: 2026-10-22/pan-os-panorama-php2shell-mgmt-interface-no-fixed-release · ATT&CK page ↗

T1505.003Server Software Component: Web Shell×1

Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.

Evidence: 2026-10-22/pan-os-panorama-php2shell-mgmt-interface-no-fixed-release · ATT&CK page ↗

T1543.002Create or Modify System Process: Systemd Service×1

Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources. Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible.

Evidence: 2026-10-22/pan-os-panorama-php2shell-mgmt-interface-no-fixed-release · ATT&CK page ↗

Privilege Escalation TA0004

T1037.004Boot or Logon Initialization Scripts: RC Scripts×1

Adversaries may establish persistence by modifying RC scripts, which are executed during a Unix-like system’s startup. These files allow system administrators to map and start custom services at startup for different run levels. RC scripts require root privileges to modify.

Evidence: 2026-10-22/pan-os-panorama-php2shell-mgmt-interface-no-fixed-release · ATT&CK page ↗

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-10-22/pan-os-panorama-php2shell-mgmt-interface-no-fixed-release · ATT&CK page ↗

T1543.002Create or Modify System Process: Systemd Service×1

Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources. Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible.

Evidence: 2026-10-22/pan-os-panorama-php2shell-mgmt-interface-no-fixed-release · ATT&CK page ↗

Credential Access TA0006

T1110.003Brute Force: Password Spraying×1

Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain. Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords.

Evidence: 2026-10-22/pan-os-panorama-php2shell-mgmt-interface-no-fixed-release · ATT&CK page ↗

T1552.004Unsecured Credentials: Private Keys×1

Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures. Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc.

Evidence: 2026-10-22/pan-os-panorama-php2shell-mgmt-interface-no-fixed-release · ATT&CK page ↗

Discovery TA0007

T1087.002Account Discovery: Domain Account×1

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.

Evidence: 2026-10-22/pan-os-panorama-php2shell-mgmt-interface-no-fixed-release · ATT&CK page ↗

Command and Control TA0011

T1090Proxy×1

Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.

Evidence: 2026-10-22/pan-os-panorama-php2shell-mgmt-interface-no-fixed-release · ATT&CK page ↗

T1572Protocol Tunneling×1

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.

Evidence: 2026-10-22/pan-os-panorama-php2shell-mgmt-interface-no-fixed-release · ATT&CK page ↗

Entries about CL-UNK-1280 (1)

2026-10-22 · view entry permalink →

HIGHCVE-2026-109618 +1exploitedupdatedNATOA2

CVE-2026-109618 / CVE-2026-109619, Palo Alto Networks PAN-OS and Panorama: the PHP2Shell flaws affect every release below its train's hotfix through the management web interface, and Palo Alto reports active exploitation against internet-exposed management interfaces; all twenty hotfixes are out

Palo Alto Networks' advisory of 2026-10-21 lists PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2 and Panorama as affected by CVE-2026-109618 and CVE-2026-109619, the unauthenticated PHP remote-code-execution flaws (Palo Alto Networks, 2026-10-21) (PHP, 2026-10-21). Only the management web interface is affected; the GlobalProtect portal and gateway and the captive portal are not (Palo Alto Networks, 2026-10-21).

The advisory says active exploitation has been observed against the management interface exposed to the internet (Palo Alto Networks, 2026-10-28). Dream Research reports that a custom PHP2Shell build for the PAN-OS management web server, chained with the Linux kernel flaw CVE-2026-46300 to turn the web server's unprivileged context into root in one unauthenticated HTTPS request, rooted 25 PAN-OS firewall and management servers in the United States, Japan, Taiwan and South Korea (Dream Research, 2026-10-29). On the second of two firewalls of a US government-affiliated organization (the first crashed) it added a reboot-persistent reverse SSH tunnel and, through it, ran the same chain against the organization's internal firewall management server, decrypted the directory service account's password from the device configuration, enumerated the Active Directory and attempted a password spray and backdoor accounts, which Dream cannot say succeeded (Dream Research, 2026-10-29). Unit 42 says it independently verified the attacker's tooling and results and that customers who applied the available patches are not affected (Unit 42, 2026-10-29); Dream relays that Unit 42 tracks it as CL-UNK-1280, a Chinese-speaking attacker in UTC+8, while Dream names none (Dream Research, 2026-10-29).

All twenty hotfixes are released (Palo Alto Networks, 2026-10-30); its Threat Prevention coverage (Threat IDs 543004, 97622 to 97625 and twenty further IDs between 97643 and 97678) applies only where inbound management traffic is decrypted on a dataplane interface with the certificate replaced and threat prevention enabled (Palo Alto Networks, 2026-10-27).

Current analysis shows no impact of CVE-2026-115560 on PAN-OS (NGFW and Panorama).

This issue will be fixed in the upcoming releases of PAN-OS.

Palo Alto Networks PSIRT (advisory, revised 2026-10-25) 2026-10-25

removed the ETA for 10.2.18-h13, 11.1.16-h4 and 11.2.10-h16 as these versions are released

Palo Alto Networks PSIRT (advisory record with revision history) 2026-10-25

Removed the ETAs for 10.2.13-h27 and 10.2.16-h12 as these versions are released.

Palo Alto Networks PSIRT (advisory record with revision history, 2026-10-27) 2026-10-27

The only exception is 11.2.10-h16 which only includes the fix for PHP vulnerabilities; 11.2.10-h17 includes fixes for both vulnerabilities.

Palo Alto Networks PSIRT (advisory, revised 2026-10-27) 2026-10-27

This issue strictly affects the management web interface, which includes the HTTPS web UI and XML API service.

This issue will be fixed in the upcoming releases of PAN-OS.

Palo Alto Networks PSIRT (advisory, Impact of Critical Vulnerabilities in PHP on Palo Alto Networks Products) 2026-10-21

Active exploitation has been observed targeting the Palo Alto Networks management interface

Palo Alto Networks PSIRT (advisory, as read on 2026-10-28) 2026-10-28

Very limited exploitation has been observed targeting the Palo Alto Networks management interface.

Palo Alto Networks PSIRT (advisory, Internet Archive copy of 2026-10-27 17:10 UTC) 2026-10-27

Severity Updated to Critical and Urgency updated as Highest

The risk is highest on PAN-OS when you allow access to the management interface from external IP addresses on the internet.

Palo Alto Networks PSIRT (advisory, revised 2026-10-27) 2026-10-27

No special configuration is required to be affected by this issue.

Palo Alto Networks PSIRT (advisory, Impact of Critical Vulnerabilities in PHP on Palo Alto Networks Products) 2026-10-21

Although WildFire Cloud was previously impacted, a remediation patch was deployed on October 22, 2026.

Palo Alto Networks PSIRT (advisory, revised 2026-10-23) 2026-10-23

This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).

Palo Alto Networks PSIRT (advisory, revised 2026-10-24) 2026-10-24

Removed ETAs for 11.1.7-h12 as the version is released.

Palo Alto Networks PSIRT (advisory record with revision history, as read on 2026-10-30) 2026-10-30

The affected devices run specific versions of Palo Alto Networks PAN-OS.

For 22 of the 24 rooted firewalls, the attacker did nothing beyond planting the webshell.

Palo Alto Networks’ Unit 42 tracks this activity as CL-UNK-1280 and attributes it to a Chinese-speaking attacker in the UTC+8 time zone.

Dream Research

Unit 42 has independently verified the same attacker’s tooling and confirmed the reported results.

Customers who have applied the available patches are not affected.

Palo Alto Networks Unit 42
Updaterun 2026-10-23T0256Z-inteltitleheadlinesummaryentitiesaffected_productscvessourcesevidencebody

Palo Alto Networks revised its advisory on 2026-10-23: the WildFire appliances WF-500 and WF-500-B are now listed as affected in all versions, and the footnotes say Cortex XCORE (SaaS) was remediated on 2026-10-21 and WildFire Cloud on 2026-10-22 (Palo Alto Networks, 2026-10-23). The advisory now also gives estimated availability dates for hotfix builds of every supported PAN-OS train, from 2026-10-26 (for example 10.2.18-h13, 11.1.16-h4 and 11.2.10-h16) to 2026-10-30, while Panorama and the WildFire appliances remain with no date (Palo Alto Networks, 2026-10-23). Palo Alto still states that it is not aware of malicious exploitation against its products, and the Threat Prevention coverage and the jump-box restriction are unchanged (Palo Alto Networks, 2026-10-23). The advisory names the management web interface only for PAN-OS and does not say which interface of the WildFire appliances is reachable.

Updaterun 2026-10-24T0255Z-intelaffected_productsbodycvesentitiesevidenceheadlinesourcessummarytitle

Palo Alto Networks' advisory now lists the WildFire appliances WF-500 and WF-500-B, which an earlier revision of 2026-10-23 had listed as affected, as unaffected, a correction its timeline dates 2026-10-23, and the table no longer distinguishes Panorama while a note says the issue applies to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series) and the mitigation text covers PAN-OS and Panorama together (Palo Alto Networks, 2026-10-24). The estimated hotfix dates for PAN-OS, 2026-10-26 to 2026-10-30, the CVSS-B scores of 8.7 and 7.1, and the statement that Palo Alto Networks is not aware of malicious exploitation against its products are unchanged; on 2026-10-24 the advisory added updated threat-signature and content-version details, and the Threat Prevention coverage now lists twenty further Threat IDs, from 97643 to 97678 (Palo Alto Networks, 2026-10-24).

Updaterun 2026-10-25T1308Z-audittitleheadlinesummarycvessourcesevidencebodytagssourcing_note

Palo Alto Networks' revision of 2026-10-25 removed the estimated dates of 10.2.18-h13, 11.1.16-h4 and 11.2.10-h16 "as these versions are released" (Palo Alto Networks, 2026-10-25); the advisory's solution text, unrevised, still says the issue will be fixed in upcoming releases of PAN-OS, and every other hotfix carries an estimated date from 2026-10-27 to 2026-10-30 (Palo Alto Networks, 2026-10-25). The FAQ adds that Palo Alto's current analysis shows no impact on PAN-OS firewalls or Panorama of CVE-2026-115560, the new vulnerability PHP announced, and Palo Alto still knows of no malicious exploitation against its products (Palo Alto Networks, 2026-10-25).

Correctionrun 2026-10-26T0256Z-intelbodyevidencesourcessourcing_note

Unit 42's brief, revised on 2026-10-25, no longer says that it has seen a proof of concept of the PHP flaws (Unit 42, 2026-10-25).

Updaterun 2026-10-27T0256Z-intelactionsbodycvesevidenceheadlinesourcessourcing_notesummarytagstitle

Palo Alto Networks' advisory now records eleven PAN-OS hotfixes as released: 10.2.18-h13, 11.1.16-h4 and 11.2.10-h16 (revision of 2026-10-25), 11.1.4-h38, 11.1.6-h40, 11.1.10-h36 and 11.1.13-h16 (2026-10-26), and 10.2.13-h27, 10.2.16-h12, 12.1.7-h11 and 12.2.4-h1 (2026-10-27) (Palo Alto Networks, 2026-10-27). Nine hotfixes still carry estimated dates from 2026-10-27 to 2026-10-30, among them 12.1.4-h13, 12.1.10-h3 and four 11.2 lines, and the FAQ says 11.2.10-h16 carries only the PHP fix while 11.2.10-h17 carries the PHP and the Brotli fixes (Palo Alto Networks, 2026-10-27). Palo Alto still says it is not aware of malicious exploitation of this issue against its products (Palo Alto Networks, 2026-10-27). CISA added both PHP flaws to its Known Exploited Vulnerabilities catalog on 2026-10-26, as the PHP flaws themselves rather than as a PAN-OS finding (CISA KEV, 2026-10-26).

Updaterun 2026-10-28T0256Z-inteltitleheadlinesummaryprioritycvesevidencesourcing_noteactionsbodytagssources

Palo Alto Networks' advisory now states that active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet (Palo Alto Networks, 2026-10-28). A copy of the page taken on 2026-10-27 at 17:10 UTC said instead that very limited exploitation had been observed (Palo Alto Networks, 2026-10-27); the vendor timeline records no change of wording, and its entries of 2026-10-27 are two removals of hotfix estimated dates and the 16:40 UTC change that raised the severity to Critical and the urgency to Highest (Palo Alto Networks, 2026-10-28). The vendor score is now CVSS-B 9.2 with high impact on confidentiality, integrity and availability when management is reachable from the internet, and 7.7 when it is reachable only from an adjacent network; the earlier text scored availability impact only (8.7) and knew of no exploitation. The advisory names no actor, victim or post-exploitation behaviour. CISA's catalog flags both PHP flaws with forensic triage requirements (CISA KEV, 2026-10-27). The hotfix table has moved on since the previous record: as read on 2026-10-28, fourteen builds are released and six are due by 2026-10-30 (Palo Alto Networks, 2026-10-28).

Updaterun 2026-10-29T0255Z-inteltitleheadlinesummaryupdated_atcvesactionssourcesbody

Palo Alto Networks' advisory timeline of 2026-10-29 removes the estimated dates of 10.2.7-h39, 10.2.10-h42, 11.2.4-h23, 12.1.4-h13 and 12.1.10-h3 because those builds are released (Palo Alto Networks, 2026-10-29). Nineteen of the twenty hotfixes are now available, and the advisory table gives only 11.1.7-h12 an estimated date, 2026-10-30 (Palo Alto Networks, 2026-10-29). Its exploitation statement is unchanged.

Updaterun 2026-10-30T0255Z-intelactionsbodycvesevidenceheadlinesourcessummarytitle

Palo Alto Networks' advisory timeline of 2026-10-29 at 23:54 UTC removes the estimated date of 11.1.7-h12 "as the version is released" (Palo Alto Networks, 2026-10-30). With it, all twenty PAN-OS hotfixes are available and the advisory table gives no estimated date for any build (Palo Alto Networks, 2026-10-30). The exploitation statement is unchanged.

Updaterun 2026-11-01T0256Z-intelheadlinesummaryentitiestechniquessourcesevidenceverificationsourcing_notereferencesactionsbodycvestitle

Dream Research updated its report on 2026-10-29 to say that the affected devices run Palo Alto Networks PAN-OS; the operation it had described with an unnamed vendor rooted 25 PAN-OS firewall and management servers, and Unit 42 says it independently verified the attacker's tooling and confirmed the reported results (Dream Research, 2026-10-29; Unit 42, 2026-10-29). Dream's recovered artifacts show web shells left on 24 firewalls, 22 of them parked with nothing further done, and a boot-persistent tunnel into the internal network of a US government-affiliated organization that it assesses is likely still active (Dream Research, 2026-10-29). Unit 42 says customers who applied the available patches are not affected and that the management interface is not exposed to the internet by default (Unit 42, 2026-10-29). Dream also says the management web server fronts the GlobalProtect portal, which Palo Alto's advisory lists as not affected (Dream Research, 2026-10-29; Palo Alto Networks, 2026-10-30). A device that was exposed and unpatched therefore needs the compromise checks in the Detection line, not only the hotfix.

Builds on: PHP2Shell: CISA lists both flaws as exploited after honeypot code execution; update the… · CVE-2026-46300 (Fragnesia): CISA lists the Linux kernel root flaw as exploited, chained with… · Palo Alto confirms limited exploitation of a PAN-OS management-interface root flaw; no… · Qilin and Inc ransomware exploit the GlobalProtect bypass; one intrusion pivoted to vCenter and…

vulnerability22 Oct 03:41Zmulti-sourceOpen finding →
Sources: Palo Alto Networks PSIRT (advisory, Impact of Critical Vulnerabilities in PHP on Palo Alto Networks Products) · Palo Alto Networks PSIRT (advisory, revised 2026-10-23) · Palo Alto Networks PSIRT (advisory, revised 2026-10-24) · Palo Alto Networks PSIRT (advisory, revised 2026-10-25) · Palo Alto Networks PSIRT (advisory record with revision history) · Palo Alto Networks PSIRT (advisory, revised 2026-10-27) · Palo Alto Networks PSIRT (advisory record with revision history, 2026-10-27) · CISA Known Exploited Vulnerabilities catalog (version 2026.10.26) · Palo Alto Networks Unit 42 (threat brief, revised 2026-10-25) · PHP (security advisory) · Palo Alto Networks PSIRT (advisory, as read on 2026-10-28) · Palo Alto Networks PSIRT (advisory, Internet Archive copy of 2026-10-27 17:10 UTC) · CISA Known Exploited Vulnerabilities catalog (version 2026.10.27) · Palo Alto Networks PSIRT (advisory record with revision history, as read on 2026-10-28) · Palo Alto Networks PSIRT (advisory, as read on 2026-10-29) · Palo Alto Networks PSIRT (advisory record with revision history, as read on 2026-10-29) · Palo Alto Networks PSIRT (advisory, as read on 2026-10-30) · Palo Alto Networks PSIRT (advisory record with revision history, as read on 2026-10-30) · Dream Research (report on the chained PHP2Shell and Fragnesia exploit against PAN-OS, updated 2026-10-29) · Palo Alto Networks Unit 42 (threat brief, updated 2026-10-29)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • security.paloaltonetworks.com2 (29%)
  • cisa.gov1 (14%)
  • dreamgroup.com1 (14%)
  • php.net1 (14%)
  • unit42.paloaltonetworks.com1 (14%)
  • web.archive.org1 (14%)
All cited sources (7)