www.forcepoint.com
Open in
urlscan Pro
2a04:4e42:600::740
Public Scan
Submitted URL: http://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
Effective URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
Submission: On July 18 via api from DE — Scanned from DE
Effective URL: https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
Submission: On July 18 via api from DE — Scanned from DE
Form analysis 4 forms found in the DOM
POST /blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses
<form class="lang_dropdown_form language_content featureWsQuerystringTranslations-processed" id="lang_dropdown_form_language_content" action="/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses" method="post" accept-charset="UTF-8">
<div>
<div class="form-item form-type-select form-item-lang-dropdown-select">
<div class="hidden-on-desktop mobile-language has-subnav events-mobile-list-processed"><span class="subnav-header nolink"><span class="link-text-wrapper">EN - English</span></span>
<div class="subnav dropdown menu"><span class="subnav-back">EN - English</span>
<ul class="language-list" id="lang-dropdown-select-language_content" name="lang_dropdown_select">
<li value="en" class="selected">EN - English</li>
<li value="es">ES - Español (América Latina)</li>
<li value="fr">FR - Français</li>
<li value="de">DE - Deutsch</li>
<li value="it">IT - Italiano</li>
<li value="pt-br">PT-BR - Português</li>
<li value="zh-hans">ZH-HANS - 简体中文</li>
<li value="zh-hant">ZH-HANT - 繁體中文</li>
<li value="ja">JA - 日本語</li>
<li value="ko">KO - 한국어</li>
<li value="tr">TR - Türkçe</li>
<li value="ar">AR - العربية</li>
</ul>
</div><span class="subnav-trigger"></span>
</div><select class="lang-dropdown-select-element form-select chosen-processed build-mobile-list-processed" id="lang-dropdown-select-language_content" style="width: 148px; display: none;" name="lang_dropdown_select">
<option value="en" selected="selected">EN - English</option>
<option value="es">ES - Español (América Latina)</option>
<option value="fr">FR - Français</option>
<option value="de">DE - Deutsch</option>
<option value="it">IT - Italiano</option>
<option value="pt-br">PT-BR - Português</option>
<option value="zh-hans">ZH-HANS - 简体中文</option>
<option value="zh-hant">ZH-HANT - 繁體中文</option>
<option value="ja">JA - 日本語</option>
<option value="ko">KO - 한국어</option>
<option value="tr">TR - Türkçe</option>
<option value="ar">AR - العربية</option>
</select>
<div class="chosen-container chosen-container-single lang-dropdown-select-element form-select chosen-processed chosen-container-single-nosearch" style="width: 200px;" title="" id="lang_dropdown_select_language_content_chosen">
<a class="chosen-single" tabindex="-1"><span>EN - English</span><div><b></b></div></a>
<div class="chosen-drop">
<div class="chosen-search"><input type="text" autocomplete="off" readonly=""></div>
<ul class="chosen-results"></ul>
</div>
</div>
</div>
<input type="hidden" name="en" value="/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses">
<input type="hidden" name="es" value="/es/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses">
<input type="hidden" name="fr" value="/fr/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses">
<input type="hidden" name="de" value="/de/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses">
<input type="hidden" name="it" value="/it/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses">
<input type="hidden" name="pt-br" value="/pt-br/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses">
<input type="hidden" name="zh-hans" value="/zh-hans/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses">
<input type="hidden" name="zh-hant" value="/zh-hant/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses">
<input type="hidden" name="ja" value="/ja/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses">
<input type="hidden" name="ko" value="/ko/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses">
<input type="hidden" name="tr" value="/tr/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses">
<input type="hidden" name="ar" value="/ar/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses">
<noscript>
<div>
<input type="submit" id="edit-submit" name="op" value="Go" class="form-submit">
</div>
</noscript><input type="hidden" name="form_build_id" value="form-npehwt2AdjX23qrrHclHjBVO9B-uhSctkHq1uEjdGgA">
<input type="hidden" name="form_id" value="lang_dropdown_form">
</div>
</form>GET /search
<form action="/search" method="get" id="views-exposed-form-site-search-page" accept-charset="UTF-8">
<div>
<div class="views-exposed-form">
<div class="views-exposed-widgets clearfix">
<div id="edit-keys-wrapper" class="views-exposed-widget views-widget-filter-search_api_views_fulltext">
<label for="edit-keys"> Enter your keywords </label>
<div class="views-widget">
<div class="form-item form-type-textfield form-item-keys">
<input placeholder="Search" type="text" id="edit-keys" name="keys" value="" size="30" maxlength="128" class="form-text">
</div>
</div>
</div>
<div id="edit-type-wrapper" class="views-exposed-widget views-widget-filter-type">
<label for="edit-type"> Is Type </label>
<div class="views-widget">
<div class="form-item form-type-hidden form-item-type">
<input type="hidden" name="type" value="All">
</div>
</div>
</div>
<div class="views-exposed-widget views-submit-button">
<input type="submit" id="edit-submit-site-search" value="Search" class="form-submit">
</div>
</div>
</div>
</div>
</form>POST https://forms.hsforms.com/submissions/v3/public/submit/formsnext/multipart/20987017/16d5bf15-75bb-43be-a7ff-4e4e9779520e
<form id="hsForm_16d5bf15-75bb-43be-a7ff-4e4e9779520e" method="POST" accept-charset="UTF-8" enctype="multipart/form-data" novalidate=""
action="https://forms.hsforms.com/submissions/v3/public/submit/formsnext/multipart/20987017/16d5bf15-75bb-43be-a7ff-4e4e9779520e"
class="hs-form-private hsForm_16d5bf15-75bb-43be-a7ff-4e4e9779520e hs-form-16d5bf15-75bb-43be-a7ff-4e4e9779520e hs-form-16d5bf15-75bb-43be-a7ff-4e4e9779520e_021d5919-692b-454d-9988-2a1070694262 hs-form stacked"
target="target_iframe_16d5bf15-75bb-43be-a7ff-4e4e9779520e" data-instance-id="021d5919-692b-454d-9988-2a1070694262" data-form-id="16d5bf15-75bb-43be-a7ff-4e4e9779520e" data-portal-id="20987017"
data-test-id="hsForm_16d5bf15-75bb-43be-a7ff-4e4e9779520e">
<div class="hs_conversion_prod_interest___most_recent hs-conversion_prod_interest___most_recent hs-fieldtype-text field hs-form-field" style="display: none;"><label
id="label-conversion_prod_interest___most_recent-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your Conversion Prod Interest - Most Recent"
for="conversion_prod_interest___most_recent-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Conversion Prod Interest - Most Recent</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="conversion_prod_interest___most_recent" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_sfcmpid hs-sfcmpid hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-sfcmpid-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your sfcmpid"
for="sfcmpid-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>sfcmpid</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="sfcmpid" class="hs-input" type="hidden" value="7016T000002HlhQQAS"></div>
</div>
<div class="hs_sf_source_campaign_id hs-sf_source_campaign_id hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-sf_source_campaign_id-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class=""
placeholder="Enter your SF Source Campaign ID" for="sf_source_campaign_id-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>SF Source Campaign ID</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="sf_source_campaign_id" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_salesforce_campaign_name hs-salesforce_campaign_name hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-salesforce_campaign_name-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class=""
placeholder="Enter your Salesforce Campaign Name" for="salesforce_campaign_name-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Salesforce Campaign Name</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="salesforce_campaign_name" class="hs-input" type="hidden" value="WW.BRN.WEBS.X-Labs_Newsletter_Sign_Up.Ever"></div>
</div>
<div class="hs_core_non_core hs-core_non_core hs-fieldtype-select field hs-form-field" style="display: none;"><label id="label-core_non_core-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your Core/Non-core"
for="core_non_core-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Core/Non-core</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="core_non_core" class="hs-input" type="hidden" value="Non-core"></div>
</div>
<div class="hs_gclid hs-gclid hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-gclid-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your GCLID - DO NOT USE"
for="gclid-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>GCLID - DO NOT USE</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="gclid" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_email_opt_in_security_research__c hs-email_opt_in_security_research__c hs-fieldtype-booleancheckbox field hs-form-field" style="display: none;">
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="email_opt_in_security_research__c" class="hs-input" type="hidden" value="true"></div>
</div>
<div class="hs_email hs-email hs-fieldtype-text field hs-form-field"><label id="label-email-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your Work Email" for="email-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Work
Email</span><span class="hs-form-required">*</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input id="email-16d5bf15-75bb-43be-a7ff-4e4e9779520e" name="email" required="" placeholder="Email Address" type="email" class="hs-input" inputmode="email" autocomplete="email" value=""></div>
</div>
<div class="hs-dependent-field">
<div class="hs_country__c hs-country__c hs-fieldtype-select field hs-form-field smart-field"><label id="label-country__c-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your Country Picklist"
for="country__c-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Country Picklist</span><span class="hs-form-required">*</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><select id="country__c-16d5bf15-75bb-43be-a7ff-4e4e9779520e" required="" class="hs-input" name="country__c">
<option disabled="" value="">Select Country</option>
<option value="Afghanistan">Afghanistan</option>
<option value="Aland Islands">Aland Islands</option>
<option value="Albania">Albania</option>
<option value="Algeria">Algeria</option>
<option value="Andorra">Andorra</option>
<option value="Angola">Angola</option>
<option value="Anguilla">Anguilla</option>
<option value="Antarctica">Antarctica</option>
<option value="Antigua and Barbuda">Antigua and Barbuda</option>
<option value="Argentina">Argentina</option>
<option value="Armenia">Armenia</option>
<option value="Aruba">Aruba</option>
<option value="Australia">Australia</option>
<option value="Austria">Austria</option>
<option value="Azerbaijan">Azerbaijan</option>
<option value="Bahamas">Bahamas</option>
<option value="Bahrain">Bahrain</option>
<option value="Bangladesh">Bangladesh</option>
<option value="Barbados">Barbados</option>
<option value="Belarus">Belarus</option>
<option value="Belgium">Belgium</option>
<option value="Belize">Belize</option>
<option value="Benin">Benin</option>
<option value="Bermuda">Bermuda</option>
<option value="Bhutan">Bhutan</option>
<option value="Bolivia, Plurinational State of">Bolivia, Plurinational State of</option>
<option value="Bonaire, Sint Eustatius and Saba">Bonaire, Sint Eustatius and Saba</option>
<option value="Bosnia and Herzegovina">Bosnia and Herzegovina</option>
<option value="Botswana">Botswana</option>
<option value="Bouvet Island">Bouvet Island</option>
<option value="Brazil">Brazil</option>
<option value="British Indian Ocean Territory">British Indian Ocean Territory</option>
<option value="Brunei Darussalam">Brunei Darussalam</option>
<option value="Bulgaria">Bulgaria</option>
<option value="Burkina Faso">Burkina Faso</option>
<option value="Burundi">Burundi</option>
<option value="Cambodia">Cambodia</option>
<option value="Cameroon">Cameroon</option>
<option value="Canada">Canada</option>
<option value="Cape Verde">Cape Verde</option>
<option value="Cayman Islands">Cayman Islands</option>
<option value="Central African Republic">Central African Republic</option>
<option value="Chad">Chad</option>
<option value="Chile">Chile</option>
<option value="China">China</option>
<option value="Chinese Taipei">Chinese Taipei</option>
<option value="Christmas Island">Christmas Island</option>
<option value="Cocos (Keeling) Islands">Cocos (Keeling) Islands</option>
<option value="Colombia">Colombia</option>
<option value="Comoros">Comoros</option>
<option value="Congo">Congo</option>
<option value="Congo, the Democratic Republic of the">Congo, the Democratic Republic of the</option>
<option value="Cook Islands">Cook Islands</option>
<option value="Costa Rica">Costa Rica</option>
<option value="Cote d'Ivoire">Cote d'Ivoire</option>
<option value="Croatia">Croatia</option>
<option value="Cuba">Cuba</option>
<option value="Curaçao">Curaçao</option>
<option value="Cyprus">Cyprus</option>
<option value="Czech Republic">Czech Republic</option>
<option value="Denmark">Denmark</option>
<option value="Djibouti">Djibouti</option>
<option value="Dominica">Dominica</option>
<option value="Dominican Republic">Dominican Republic</option>
<option value="Ecuador">Ecuador</option>
<option value="Egypt">Egypt</option>
<option value="El Salvador">El Salvador</option>
<option value="Equatorial Guinea">Equatorial Guinea</option>
<option value="Eritrea">Eritrea</option>
<option value="Estonia">Estonia</option>
<option value="Ethiopia">Ethiopia</option>
<option value="Falkland Islands (Malvinas)">Falkland Islands (Malvinas)</option>
<option value="Faroe Islands">Faroe Islands</option>
<option value="Fiji">Fiji</option>
<option value="Finland">Finland</option>
<option value="France">France</option>
<option value="French Guiana">French Guiana</option>
<option value="French Polynesia">French Polynesia</option>
<option value="French Southern Territories">French Southern Territories</option>
<option value="Gabon">Gabon</option>
<option value="Gambia">Gambia</option>
<option value="Georgia">Georgia</option>
<option value="Germany">Germany</option>
<option value="Ghana">Ghana</option>
<option value="Gibraltar">Gibraltar</option>
<option value="Greece">Greece</option>
<option value="Greenland">Greenland</option>
<option value="Grenada">Grenada</option>
<option value="Guadeloupe">Guadeloupe</option>
<option value="Guam">Guam</option>
<option value="Guatemala">Guatemala</option>
<option value="Guernsey">Guernsey</option>
<option value="Guinea">Guinea</option>
<option value="Guinea-Bissau">Guinea-Bissau</option>
<option value="Guyana">Guyana</option>
<option value="Haiti">Haiti</option>
<option value="Heard Island and McDonald Islands">Heard Island and McDonald Islands</option>
<option value="Holy See (Vatican City State)">Holy See (Vatican City State)</option>
<option value="Honduras">Honduras</option>
<option value="Hong Kong">Hong Kong</option>
<option value="Hungary">Hungary</option>
<option value="Iceland">Iceland</option>
<option value="India">India</option>
<option value="Indonesia">Indonesia</option>
<option value="Iran, Islamic Republic of">Iran, Islamic Republic of</option>
<option value="Iraq">Iraq</option>
<option value="Ireland">Ireland</option>
<option value="Isle of Man">Isle of Man</option>
<option value="Israel">Israel</option>
<option value="Italy">Italy</option>
<option value="Ivory Coast">Ivory Coast</option>
<option value="Jamaica">Jamaica</option>
<option value="Japan">Japan</option>
<option value="Jersey">Jersey</option>
<option value="Jordan">Jordan</option>
<option value="Kazakhstan">Kazakhstan</option>
<option value="Kenya">Kenya</option>
<option value="Kiribati">Kiribati</option>
<option value="Korea, Democratic People's Republic of">Korea, Democratic People's Republic of</option>
<option value="Korea, Republic of">Korea, Republic of</option>
<option value="Kosovo">Kosovo</option>
<option value="Kuwait">Kuwait</option>
<option value="Kyrgyzstan">Kyrgyzstan</option>
<option value="Lao People's Democratic Republic">Lao People's Democratic Republic</option>
<option value="Latvia">Latvia</option>
<option value="Lebanon">Lebanon</option>
<option value="Lesotho">Lesotho</option>
<option value="Liberia">Liberia</option>
<option value="Libyan Arab Jamahiriya">Libyan Arab Jamahiriya</option>
<option value="Liechtenstein">Liechtenstein</option>
<option value="Lithuania">Lithuania</option>
<option value="Luxembourg">Luxembourg</option>
<option value="Macao">Macao</option>
<option value="Macedonia, the former Yugoslav Republic of">Macedonia, the former Yugoslav Republic of</option>
<option value="Madagascar">Madagascar</option>
<option value="Malawi">Malawi</option>
<option value="Malaysia">Malaysia</option>
<option value="Maldives">Maldives</option>
<option value="Mali">Mali</option>
<option value="Malta">Malta</option>
<option value="Martinique">Martinique</option>
<option value="Mauritania">Mauritania</option>
<option value="Mauritius">Mauritius</option>
<option value="Mexico">Mexico</option>
<option value="Micronesia, Federated States of">Micronesia, Federated States of</option>
<option value="Moldova, Republic of">Moldova, Republic of</option>
<option value="Monaco">Monaco</option>
<option value="Mongolia">Mongolia</option>
<option value="Montenegro">Montenegro</option>
<option value="Montserrat">Montserrat</option>
<option value="Morocco">Morocco</option>
<option value="Mozambique">Mozambique</option>
<option value="Myanmar">Myanmar</option>
<option value="Namibia">Namibia</option>
<option value="Nauru">Nauru</option>
<option value="Nepal">Nepal</option>
<option value="Netherlands">Netherlands</option>
<option value="New Caledonia">New Caledonia</option>
<option value="New Zealand">New Zealand</option>
<option value="Nicaragua">Nicaragua</option>
<option value="Niger">Niger</option>
<option value="Nigeria">Nigeria</option>
<option value="Niue">Niue</option>
<option value="Norfolk Island">Norfolk Island</option>
<option value="Norway">Norway</option>
<option value="Oman">Oman</option>
<option value="Pakistan">Pakistan</option>
<option value="Palestinian Territory, occupied">Palestinian Territory, Occupied</option>
<option value="Panama">Panama</option>
<option value="Papua New Guinea">Papua New Guinea</option>
<option value="Paraguay">Paraguay</option>
<option value="Peru">Peru</option>
<option value="Philippines">Philippines</option>
<option value="Pitcairn">Pitcairn</option>
<option value="Poland">Poland</option>
<option value="Portugal">Portugal</option>
<option value="Puerto Rico">Puerto Rico</option>
<option value="Qatar">Qatar</option>
<option value="Reunion">Reunion</option>
<option value="Romania">Romania</option>
<option value="Russian Federation">Russian Federation</option>
<option value="Rwanda">Rwanda</option>
<option value="Saint Barthélemy">Saint Barthélemy</option>
<option value="Saint Helena, Ascension and Tristan da Cunha">Saint Helena, Ascension and Tristan da Cunha</option>
<option value="Saint Kitts and Nevis">Saint Kitts and Nevis</option>
<option value="Saint Lucia">Saint Lucia</option>
<option value="Saint Martin (French part)">Saint Martin (French part)</option>
<option value="Saint Pierre and Miquelon">Saint Pierre and Miquelon</option>
<option value="Saint Vincent and the Grenadines">Saint Vincent and the Grenadines</option>
<option value="Samoa">Samoa</option>
<option value="San Marino">San Marino</option>
<option value="Sao Tome and Principe">Sao Tome and Principe</option>
<option value="Saudi Arabia">Saudi Arabia</option>
<option value="Senegal">Senegal</option>
<option value="Serbia">Serbia</option>
<option value="Seychelles">Seychelles</option>
<option value="Sierra Leone">Sierra Leone</option>
<option value="Singapore">Singapore</option>
<option value="Sint Maarten (Dutch part)">Sint Maarten (Dutch part)</option>
<option value="Slovenia">Slovenia</option>
<option value="Solomon Islands">Solomon Islands</option>
<option value="Somalia">Somalia</option>
<option value="South Africa">South Africa</option>
<option value="South Georgia and the South Sandwich Islands">South Georgia and the South Sandwich Islands</option>
<option value="South Sudan">South Sudan</option>
<option value="Spain">Spain</option>
<option value="Sri Lanka">Sri Lanka</option>
<option value="Sudan">Sudan</option>
<option value="Suriname">Suriname</option>
<option value="Svalbard and Jan Mayen">Svalbard and Jan Mayen</option>
<option value="Swaziland">Swaziland</option>
<option value="Sweden">Sweden</option>
<option value="Switzerland">Switzerland</option>
<option value="Syrian Arab Republic">Syrian Arab Republic</option>
<option value="Taiwan">Taiwan</option>
<option value="Tajikistan">Tajikistan</option>
<option value="Tanzania, United Republic of">Tanzania, United Republic of</option>
<option value="Thailand">Thailand</option>
<option value="Timor-Leste">Timor-Leste</option>
<option value="Togo">Togo</option>
<option value="Tokelau">Tokelau</option>
<option value="Tonga">Tonga</option>
<option value="Trinidad and Tobago">Trinidad and Tobago</option>
<option value="Tunisia">Tunisia</option>
<option value="Turkey">Turkey</option>
<option value="Turkmenistan">Turkmenistan</option>
<option value="Turks and Caicos Islands">Turks and Caicos Islands</option>
<option value="Tuvalu">Tuvalu</option>
<option value="Uganda">Uganda</option>
<option value="Ukraine">Ukraine</option>
<option value="United Arab Emirates">United Arab Emirates</option>
<option value="United Kingdom">United Kingdom</option>
<option value="United States">United States</option>
<option value="Uruguay">Uruguay</option>
<option value="Uzbekistan">Uzbekistan</option>
<option value="Vanuatu">Vanuatu</option>
<option value="Viet Nam">Viet Nam</option>
<option value="Virgin Islands, British">Virgin Islands, British</option>
<option value="Virgin Islands, U.S.">Virgin Islands, U.S.</option>
<option value="Wallis and Futuna">Wallis and Futuna</option>
<option value="Western Sahara">Western Sahara</option>
<option value="Yemen">Yemen</option>
<option value="Zambia">Zambia</option>
<option value="Zimbabwe">Zimbabwe</option>
<option value="Slovakia">Slovakia</option>
<option value="Venezuela, Bolivarian Republic of">Venezuela, Bolivarian Republic of</option>
</select></div>
</div>
</div>
<div>
<div class="hs-richtext hs-main-font-element">
<p style="font-size: 12px;">By submitting this form, you agree to our <a href="https://www.forcepoint.com/legal/website-terms-and-conditions">terms</a> and to receiving communications from Forcepoint, you acknowledge our
<a href="https://www.forcepoint.com/company/privacy-policy">privacy policy</a> and you consent to the processing of your data. You can <a href="https://www.forcepoint.com/email-communication-preference-center">unsubscribe</a> at any time.</p>
</div>
</div>
<div class="hs_conversion_type hs-conversion_type hs-fieldtype-select field hs-form-field" style="display: none;"><label id="label-conversion_type-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your Conversion Type"
for="conversion_type-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Conversion Type</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="conversion_type" class="hs-input" type="hidden" value="Newsletter Sign-Up"></div>
</div>
<div class="hs_submit hs-submit">
<div class="hs-field-desc" style="display: none;"></div>
<div class="actions"><input type="submit" class="hs-button primary large" value="Sign Up"></div>
</div><input name="hs_context" type="hidden"
value="{"embedAtTimestamp":"1721290931798","formDefinitionUpdatedAt":"1713365382354","lang":"en","embedType":"REGULAR","clonedFromForm":"c5d286e0-e74d-4914-95cd-1df5fc073545","renderRawHtml":"true","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","pageTitle":"ShadowRoot Ransomware Targeting Turkish Businesses","pageUrl":"https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses","isHubSpotCmsGeneratedPage":false,"formTarget":"#form-nid-38032-6698cdea8237e","boolCheckBoxFields":"email_opt_in_security_research__c","rumScriptExecuteTime":675.8000030517578,"rumTotalRequestTime":976.6000022888184,"rumTotalRenderTime":1003.1000022888184,"rumServiceResponseTime":300.79999923706055,"rumFormRenderTime":26.5,"connectionType":"4g","firstContentfulPaint":0,"largestContentfulPaint":0,"locale":"en","timestamp":1721290933872,"originalEmbedContext":{"portalId":"20987017","formId":"16d5bf15-75bb-43be-a7ff-4e4e9779520e","region":"na1","target":"#form-nid-38032-6698cdea8237e","isBuilder":false,"isTestPage":false,"isPreview":false,"redirectUrl":"https://www.forcepoint.com/thank-you-signing-our-newsletter","locale":"en","isMobileResponsive":true},"correlationId":"021d5919-692b-454d-9988-2a1070694262","renderedFieldsIds":["conversion_prod_interest___most_recent","sfcmpid","sf_source_campaign_id","salesforce_campaign_name","core_non_core","gclid","email_opt_in_security_research__c","email","country__c","conversion_type"],"captchaStatus":"NOT_APPLICABLE","emailResubscribeStatus":"NOT_APPLICABLE","isInsideCrossOriginFrame":false,"source":"forms-embed-1.5387","sourceName":"forms-embed","sourceVersion":"1.5387","sourceVersionMajor":"1","sourceVersionMinor":"5387","allPageIds":{},"_debug_embedLogLines":[{"clientTimestamp":1721290931892,"level":"INFO","message":"Retrieved customer callbacks used on embed context: [\"onFormReady\",\"onFormSubmit\"]"},{"clientTimestamp":1721290931893,"level":"INFO","message":"Retrieved pageContext values which may be overriden by the embed context: {\"pageTitle\":\"ShadowRoot Ransomware Targeting Turkish Businesses\",\"pageUrl\":\"https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses\",\"userAgent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\",\"isHubSpotCmsGeneratedPage\":false}"},{"clientTimestamp":1721290931894,"level":"INFO","message":"Retrieved countryCode property from normalized embed definition response: \"DE\""}]}"><iframe
name="target_iframe_16d5bf15-75bb-43be-a7ff-4e4e9779520e" style="display: none;"></iframe>
</form>POST https://forms.hsforms.com/submissions/v3/public/submit/formsnext/multipart/20987017/16d5bf15-75bb-43be-a7ff-4e4e9779520e
<form id="hsForm_16d5bf15-75bb-43be-a7ff-4e4e9779520e" method="POST" accept-charset="UTF-8" enctype="multipart/form-data" novalidate=""
action="https://forms.hsforms.com/submissions/v3/public/submit/formsnext/multipart/20987017/16d5bf15-75bb-43be-a7ff-4e4e9779520e"
class="hs-form-private hsForm_16d5bf15-75bb-43be-a7ff-4e4e9779520e hs-form-16d5bf15-75bb-43be-a7ff-4e4e9779520e hs-form-16d5bf15-75bb-43be-a7ff-4e4e9779520e_dd64b192-f5ef-4555-91e1-c50b814174af hs-form stacked"
target="target_iframe_16d5bf15-75bb-43be-a7ff-4e4e9779520e" data-instance-id="dd64b192-f5ef-4555-91e1-c50b814174af" data-form-id="16d5bf15-75bb-43be-a7ff-4e4e9779520e" data-portal-id="20987017"
data-test-id="hsForm_16d5bf15-75bb-43be-a7ff-4e4e9779520e">
<div class="hs_conversion_prod_interest___most_recent hs-conversion_prod_interest___most_recent hs-fieldtype-text field hs-form-field" style="display: none;"><label
id="label-conversion_prod_interest___most_recent-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your Conversion Prod Interest - Most Recent"
for="conversion_prod_interest___most_recent-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Conversion Prod Interest - Most Recent</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="conversion_prod_interest___most_recent" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_sfcmpid hs-sfcmpid hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-sfcmpid-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your sfcmpid"
for="sfcmpid-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>sfcmpid</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="sfcmpid" class="hs-input" type="hidden" value="7016T000002HlhQQAS"></div>
</div>
<div class="hs_sf_source_campaign_id hs-sf_source_campaign_id hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-sf_source_campaign_id-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class=""
placeholder="Enter your SF Source Campaign ID" for="sf_source_campaign_id-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>SF Source Campaign ID</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="sf_source_campaign_id" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_salesforce_campaign_name hs-salesforce_campaign_name hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-salesforce_campaign_name-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class=""
placeholder="Enter your Salesforce Campaign Name" for="salesforce_campaign_name-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Salesforce Campaign Name</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="salesforce_campaign_name" class="hs-input" type="hidden" value="WW.BRN.WEBS.X-Labs_Newsletter_Sign_Up.Ever"></div>
</div>
<div class="hs_core_non_core hs-core_non_core hs-fieldtype-select field hs-form-field" style="display: none;"><label id="label-core_non_core-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your Core/Non-core"
for="core_non_core-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Core/Non-core</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="core_non_core" class="hs-input" type="hidden" value="Non-core"></div>
</div>
<div class="hs_gclid hs-gclid hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-gclid-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your GCLID - DO NOT USE"
for="gclid-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>GCLID - DO NOT USE</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="gclid" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_email_opt_in_security_research__c hs-email_opt_in_security_research__c hs-fieldtype-booleancheckbox field hs-form-field" style="display: none;">
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="email_opt_in_security_research__c" class="hs-input" type="hidden" value="true"></div>
</div>
<div class="hs_email hs-email hs-fieldtype-text field hs-form-field"><label id="label-email-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your Work Email" for="email-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Work
Email</span><span class="hs-form-required">*</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input id="email-16d5bf15-75bb-43be-a7ff-4e4e9779520e" name="email" required="" placeholder="Email Address" type="email" class="hs-input" inputmode="email" autocomplete="email" value=""></div>
</div>
<div class="hs-dependent-field">
<div class="hs_country__c hs-country__c hs-fieldtype-select field hs-form-field smart-field"><label id="label-country__c-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your Country Picklist"
for="country__c-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Country Picklist</span><span class="hs-form-required">*</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><select id="country__c-16d5bf15-75bb-43be-a7ff-4e4e9779520e" required="" class="hs-input" name="country__c">
<option disabled="" value="">Select Country</option>
<option value="Afghanistan">Afghanistan</option>
<option value="Aland Islands">Aland Islands</option>
<option value="Albania">Albania</option>
<option value="Algeria">Algeria</option>
<option value="Andorra">Andorra</option>
<option value="Angola">Angola</option>
<option value="Anguilla">Anguilla</option>
<option value="Antarctica">Antarctica</option>
<option value="Antigua and Barbuda">Antigua and Barbuda</option>
<option value="Argentina">Argentina</option>
<option value="Armenia">Armenia</option>
<option value="Aruba">Aruba</option>
<option value="Australia">Australia</option>
<option value="Austria">Austria</option>
<option value="Azerbaijan">Azerbaijan</option>
<option value="Bahamas">Bahamas</option>
<option value="Bahrain">Bahrain</option>
<option value="Bangladesh">Bangladesh</option>
<option value="Barbados">Barbados</option>
<option value="Belarus">Belarus</option>
<option value="Belgium">Belgium</option>
<option value="Belize">Belize</option>
<option value="Benin">Benin</option>
<option value="Bermuda">Bermuda</option>
<option value="Bhutan">Bhutan</option>
<option value="Bolivia, Plurinational State of">Bolivia, Plurinational State of</option>
<option value="Bonaire, Sint Eustatius and Saba">Bonaire, Sint Eustatius and Saba</option>
<option value="Bosnia and Herzegovina">Bosnia and Herzegovina</option>
<option value="Botswana">Botswana</option>
<option value="Bouvet Island">Bouvet Island</option>
<option value="Brazil">Brazil</option>
<option value="British Indian Ocean Territory">British Indian Ocean Territory</option>
<option value="Brunei Darussalam">Brunei Darussalam</option>
<option value="Bulgaria">Bulgaria</option>
<option value="Burkina Faso">Burkina Faso</option>
<option value="Burundi">Burundi</option>
<option value="Cambodia">Cambodia</option>
<option value="Cameroon">Cameroon</option>
<option value="Canada">Canada</option>
<option value="Cape Verde">Cape Verde</option>
<option value="Cayman Islands">Cayman Islands</option>
<option value="Central African Republic">Central African Republic</option>
<option value="Chad">Chad</option>
<option value="Chile">Chile</option>
<option value="China">China</option>
<option value="Chinese Taipei">Chinese Taipei</option>
<option value="Christmas Island">Christmas Island</option>
<option value="Cocos (Keeling) Islands">Cocos (Keeling) Islands</option>
<option value="Colombia">Colombia</option>
<option value="Comoros">Comoros</option>
<option value="Congo">Congo</option>
<option value="Congo, the Democratic Republic of the">Congo, the Democratic Republic of the</option>
<option value="Cook Islands">Cook Islands</option>
<option value="Costa Rica">Costa Rica</option>
<option value="Cote d'Ivoire">Cote d'Ivoire</option>
<option value="Croatia">Croatia</option>
<option value="Cuba">Cuba</option>
<option value="Curaçao">Curaçao</option>
<option value="Cyprus">Cyprus</option>
<option value="Czech Republic">Czech Republic</option>
<option value="Denmark">Denmark</option>
<option value="Djibouti">Djibouti</option>
<option value="Dominica">Dominica</option>
<option value="Dominican Republic">Dominican Republic</option>
<option value="Ecuador">Ecuador</option>
<option value="Egypt">Egypt</option>
<option value="El Salvador">El Salvador</option>
<option value="Equatorial Guinea">Equatorial Guinea</option>
<option value="Eritrea">Eritrea</option>
<option value="Estonia">Estonia</option>
<option value="Ethiopia">Ethiopia</option>
<option value="Falkland Islands (Malvinas)">Falkland Islands (Malvinas)</option>
<option value="Faroe Islands">Faroe Islands</option>
<option value="Fiji">Fiji</option>
<option value="Finland">Finland</option>
<option value="France">France</option>
<option value="French Guiana">French Guiana</option>
<option value="French Polynesia">French Polynesia</option>
<option value="French Southern Territories">French Southern Territories</option>
<option value="Gabon">Gabon</option>
<option value="Gambia">Gambia</option>
<option value="Georgia">Georgia</option>
<option value="Germany">Germany</option>
<option value="Ghana">Ghana</option>
<option value="Gibraltar">Gibraltar</option>
<option value="Greece">Greece</option>
<option value="Greenland">Greenland</option>
<option value="Grenada">Grenada</option>
<option value="Guadeloupe">Guadeloupe</option>
<option value="Guam">Guam</option>
<option value="Guatemala">Guatemala</option>
<option value="Guernsey">Guernsey</option>
<option value="Guinea">Guinea</option>
<option value="Guinea-Bissau">Guinea-Bissau</option>
<option value="Guyana">Guyana</option>
<option value="Haiti">Haiti</option>
<option value="Heard Island and McDonald Islands">Heard Island and McDonald Islands</option>
<option value="Holy See (Vatican City State)">Holy See (Vatican City State)</option>
<option value="Honduras">Honduras</option>
<option value="Hong Kong">Hong Kong</option>
<option value="Hungary">Hungary</option>
<option value="Iceland">Iceland</option>
<option value="India">India</option>
<option value="Indonesia">Indonesia</option>
<option value="Iran, Islamic Republic of">Iran, Islamic Republic of</option>
<option value="Iraq">Iraq</option>
<option value="Ireland">Ireland</option>
<option value="Isle of Man">Isle of Man</option>
<option value="Israel">Israel</option>
<option value="Italy">Italy</option>
<option value="Ivory Coast">Ivory Coast</option>
<option value="Jamaica">Jamaica</option>
<option value="Japan">Japan</option>
<option value="Jersey">Jersey</option>
<option value="Jordan">Jordan</option>
<option value="Kazakhstan">Kazakhstan</option>
<option value="Kenya">Kenya</option>
<option value="Kiribati">Kiribati</option>
<option value="Korea, Democratic People's Republic of">Korea, Democratic People's Republic of</option>
<option value="Korea, Republic of">Korea, Republic of</option>
<option value="Kosovo">Kosovo</option>
<option value="Kuwait">Kuwait</option>
<option value="Kyrgyzstan">Kyrgyzstan</option>
<option value="Lao People's Democratic Republic">Lao People's Democratic Republic</option>
<option value="Latvia">Latvia</option>
<option value="Lebanon">Lebanon</option>
<option value="Lesotho">Lesotho</option>
<option value="Liberia">Liberia</option>
<option value="Libyan Arab Jamahiriya">Libyan Arab Jamahiriya</option>
<option value="Liechtenstein">Liechtenstein</option>
<option value="Lithuania">Lithuania</option>
<option value="Luxembourg">Luxembourg</option>
<option value="Macao">Macao</option>
<option value="Macedonia, the former Yugoslav Republic of">Macedonia, the former Yugoslav Republic of</option>
<option value="Madagascar">Madagascar</option>
<option value="Malawi">Malawi</option>
<option value="Malaysia">Malaysia</option>
<option value="Maldives">Maldives</option>
<option value="Mali">Mali</option>
<option value="Malta">Malta</option>
<option value="Martinique">Martinique</option>
<option value="Mauritania">Mauritania</option>
<option value="Mauritius">Mauritius</option>
<option value="Mexico">Mexico</option>
<option value="Micronesia, Federated States of">Micronesia, Federated States of</option>
<option value="Moldova, Republic of">Moldova, Republic of</option>
<option value="Monaco">Monaco</option>
<option value="Mongolia">Mongolia</option>
<option value="Montenegro">Montenegro</option>
<option value="Montserrat">Montserrat</option>
<option value="Morocco">Morocco</option>
<option value="Mozambique">Mozambique</option>
<option value="Myanmar">Myanmar</option>
<option value="Namibia">Namibia</option>
<option value="Nauru">Nauru</option>
<option value="Nepal">Nepal</option>
<option value="Netherlands">Netherlands</option>
<option value="New Caledonia">New Caledonia</option>
<option value="New Zealand">New Zealand</option>
<option value="Nicaragua">Nicaragua</option>
<option value="Niger">Niger</option>
<option value="Nigeria">Nigeria</option>
<option value="Niue">Niue</option>
<option value="Norfolk Island">Norfolk Island</option>
<option value="Norway">Norway</option>
<option value="Oman">Oman</option>
<option value="Pakistan">Pakistan</option>
<option value="Palestinian Territory, occupied">Palestinian Territory, Occupied</option>
<option value="Panama">Panama</option>
<option value="Papua New Guinea">Papua New Guinea</option>
<option value="Paraguay">Paraguay</option>
<option value="Peru">Peru</option>
<option value="Philippines">Philippines</option>
<option value="Pitcairn">Pitcairn</option>
<option value="Poland">Poland</option>
<option value="Portugal">Portugal</option>
<option value="Puerto Rico">Puerto Rico</option>
<option value="Qatar">Qatar</option>
<option value="Reunion">Reunion</option>
<option value="Romania">Romania</option>
<option value="Russian Federation">Russian Federation</option>
<option value="Rwanda">Rwanda</option>
<option value="Saint Barthélemy">Saint Barthélemy</option>
<option value="Saint Helena, Ascension and Tristan da Cunha">Saint Helena, Ascension and Tristan da Cunha</option>
<option value="Saint Kitts and Nevis">Saint Kitts and Nevis</option>
<option value="Saint Lucia">Saint Lucia</option>
<option value="Saint Martin (French part)">Saint Martin (French part)</option>
<option value="Saint Pierre and Miquelon">Saint Pierre and Miquelon</option>
<option value="Saint Vincent and the Grenadines">Saint Vincent and the Grenadines</option>
<option value="Samoa">Samoa</option>
<option value="San Marino">San Marino</option>
<option value="Sao Tome and Principe">Sao Tome and Principe</option>
<option value="Saudi Arabia">Saudi Arabia</option>
<option value="Senegal">Senegal</option>
<option value="Serbia">Serbia</option>
<option value="Seychelles">Seychelles</option>
<option value="Sierra Leone">Sierra Leone</option>
<option value="Singapore">Singapore</option>
<option value="Sint Maarten (Dutch part)">Sint Maarten (Dutch part)</option>
<option value="Slovenia">Slovenia</option>
<option value="Solomon Islands">Solomon Islands</option>
<option value="Somalia">Somalia</option>
<option value="South Africa">South Africa</option>
<option value="South Georgia and the South Sandwich Islands">South Georgia and the South Sandwich Islands</option>
<option value="South Sudan">South Sudan</option>
<option value="Spain">Spain</option>
<option value="Sri Lanka">Sri Lanka</option>
<option value="Sudan">Sudan</option>
<option value="Suriname">Suriname</option>
<option value="Svalbard and Jan Mayen">Svalbard and Jan Mayen</option>
<option value="Swaziland">Swaziland</option>
<option value="Sweden">Sweden</option>
<option value="Switzerland">Switzerland</option>
<option value="Syrian Arab Republic">Syrian Arab Republic</option>
<option value="Taiwan">Taiwan</option>
<option value="Tajikistan">Tajikistan</option>
<option value="Tanzania, United Republic of">Tanzania, United Republic of</option>
<option value="Thailand">Thailand</option>
<option value="Timor-Leste">Timor-Leste</option>
<option value="Togo">Togo</option>
<option value="Tokelau">Tokelau</option>
<option value="Tonga">Tonga</option>
<option value="Trinidad and Tobago">Trinidad and Tobago</option>
<option value="Tunisia">Tunisia</option>
<option value="Turkey">Turkey</option>
<option value="Turkmenistan">Turkmenistan</option>
<option value="Turks and Caicos Islands">Turks and Caicos Islands</option>
<option value="Tuvalu">Tuvalu</option>
<option value="Uganda">Uganda</option>
<option value="Ukraine">Ukraine</option>
<option value="United Arab Emirates">United Arab Emirates</option>
<option value="United Kingdom">United Kingdom</option>
<option value="United States">United States</option>
<option value="Uruguay">Uruguay</option>
<option value="Uzbekistan">Uzbekistan</option>
<option value="Vanuatu">Vanuatu</option>
<option value="Viet Nam">Viet Nam</option>
<option value="Virgin Islands, British">Virgin Islands, British</option>
<option value="Virgin Islands, U.S.">Virgin Islands, U.S.</option>
<option value="Wallis and Futuna">Wallis and Futuna</option>
<option value="Western Sahara">Western Sahara</option>
<option value="Yemen">Yemen</option>
<option value="Zambia">Zambia</option>
<option value="Zimbabwe">Zimbabwe</option>
<option value="Slovakia">Slovakia</option>
<option value="Venezuela, Bolivarian Republic of">Venezuela, Bolivarian Republic of</option>
</select></div>
</div>
</div>
<div>
<div class="hs-richtext hs-main-font-element">
<p style="font-size: 12px;">By submitting this form, you agree to our <a href="https://www.forcepoint.com/legal/website-terms-and-conditions">terms</a> and to receiving communications from Forcepoint, you acknowledge our
<a href="https://www.forcepoint.com/company/privacy-policy">privacy policy</a> and you consent to the processing of your data. You can <a href="https://www.forcepoint.com/email-communication-preference-center">unsubscribe</a> at any time.</p>
</div>
</div>
<div class="hs_conversion_type hs-conversion_type hs-fieldtype-select field hs-form-field" style="display: none;"><label id="label-conversion_type-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your Conversion Type"
for="conversion_type-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Conversion Type</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="conversion_type" class="hs-input" type="hidden" value="Newsletter Sign-Up"></div>
</div>
<div class="hs_submit hs-submit">
<div class="hs-field-desc" style="display: none;"></div>
<div class="actions"><input type="submit" class="hs-button primary large" value="Sign Up"></div>
</div><input name="hs_context" type="hidden"
value="{"embedAtTimestamp":"1721290931981","formDefinitionUpdatedAt":"1713365382354","lang":"en","embedType":"REGULAR","clonedFromForm":"c5d286e0-e74d-4914-95cd-1df5fc073545","renderRawHtml":"true","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","pageTitle":"ShadowRoot Ransomware Targeting Turkish Businesses","pageUrl":"https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses","isHubSpotCmsGeneratedPage":false,"formTarget":"#form-nid-27476-6698cdeb3fbad","boolCheckBoxFields":"email_opt_in_security_research__c","rumScriptExecuteTime":675.8000030517578,"rumTotalRequestTime":1207.6000022888184,"rumTotalRenderTime":1229.3000030517578,"rumServiceResponseTime":531.7999992370605,"rumFormRenderTime":21.700000762939453,"connectionType":"4g","firstContentfulPaint":0,"largestContentfulPaint":0,"locale":"en","timestamp":1721290934697,"originalEmbedContext":{"portalId":"20987017","formId":"16d5bf15-75bb-43be-a7ff-4e4e9779520e","region":"na1","target":"#form-nid-27476-6698cdeb3fbad","isBuilder":false,"isTestPage":false,"isPreview":false,"redirectUrl":"https://www.forcepoint.com/thank-you-signing-our-newsletter","locale":"en","isMobileResponsive":true},"correlationId":"dd64b192-f5ef-4555-91e1-c50b814174af","renderedFieldsIds":["conversion_prod_interest___most_recent","sfcmpid","sf_source_campaign_id","salesforce_campaign_name","core_non_core","gclid","email_opt_in_security_research__c","email","country__c","conversion_type"],"captchaStatus":"NOT_APPLICABLE","emailResubscribeStatus":"NOT_APPLICABLE","isInsideCrossOriginFrame":false,"source":"forms-embed-1.5387","sourceName":"forms-embed","sourceVersion":"1.5387","sourceVersionMajor":"1","sourceVersionMinor":"5387","allPageIds":{},"_debug_embedLogLines":[{"clientTimestamp":1721290932124,"level":"INFO","message":"Retrieved customer callbacks used on embed context: [\"onFormReady\",\"onFormSubmit\"]"},{"clientTimestamp":1721290932124,"level":"INFO","message":"Retrieved pageContext values which may be overriden by the embed context: {\"pageTitle\":\"ShadowRoot Ransomware Targeting Turkish Businesses\",\"pageUrl\":\"https://www.forcepoint.com/blog/x-labs/shadowroot-ransomware-targeting-turkish-businesses\",\"userAgent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\",\"isHubSpotCmsGeneratedPage\":false}"},{"clientTimestamp":1721290932125,"level":"INFO","message":"Retrieved countryCode property from normalized embed definition response: \"DE\""}]}"><iframe
name="target_iframe_16d5bf15-75bb-43be-a7ff-4e4e9779520e" style="display: none;"></iframe>
</form>Text Content
Skip to main content
Forcepoint
* Partners
Partners
* Partner Login
* Find a Partner
* Become a Partner
* Global Partner Program
* Technology Partners
* Find a Distributor
* Services & Support
Services & Support
* Support Login
* Training
* Company
Company
* Customers
* Newsroom
* Work With Us
* Contact Us
* Forcepoint Trust Hub
EN - English
EN - English
* EN - English
* ES - Español (América Latina)
* FR - Français
* DE - Deutsch
* IT - Italiano
* PT-BR - Português
* ZH-HANS - 简体中文
* ZH-HANT - 繁體中文
* JA - 日本語
* KO - 한국어
* TR - Türkçe
* AR - العربية
EN - EnglishES - Español (América Latina)FR - FrançaisDE - DeutschIT -
ItalianoPT-BR - PortuguêsZH-HANS - 简体中文ZH-HANT - 繁體中文JA - 日本語KO - 한국어TR -
TürkçeAR - العربية
EN - English
Enter your keywords
Is Type
Jump to
* Why Forcepoint
Why Forcepoint
* group
* About Us Our vision and mission
* Our Approach Our data-first approach to cybersecurity
* Our Customers We help people work freely, securely and with confidence
* Data Security Everywhere
Data Security Everywhere
* group (1st row)
* group (Data Security Everywhere)
* Data Security Everywhere Work Anywhere with Data Everywhere. Safely.
Discover How
* group (Products)
* group (Products 1st Row)
* Featured Products
* Forcepoint ONE Data Security (Cloud DLP) Prevent breaches and
streamline compliance from the cloud.
* Enterprise DLP Industry-leading DLP with enterprise-class
accuracy and automation.
* DSPM (Data Security Posture Management) Discover, classify and
orchestrate with AI-powered automation.
* Data Classification Increase the accuracy and efficiency of
classification.
* Risk Adaptive Protection Respond to risk in real-time with policy
automation.
* DLP for Email Prevent data exfiltration within outbound emails.
* group (Products 2nd row)
* Top-Rated Solutions
* Unify Cloud, Endpoint and BYOD Data Protection
* Automate Data Security Based on Risky Behavior
* Discover and Secure Unstructured Data with AI
* Classify and Protect Sensitive Data with AI
* Prevent Data Theft in Outbound Emails
* Protect Users and Data on the Web
* group (2nd row)
* Schedule a Live Demo
* On-Demand Demo
* Data-first SASE
Data-first SASE
* group (row1)
* group (FP ONE)
* Forcepoint ONE Simplify and Secure Access to Data Everywhere
Discover How
* group (products)
* group (products 1st row)
* Featured Products
* Cloud Access Security Broker Secure data on any public cloud
application.
* Zero Trust Network Access Remotely access every private web app
on any device.
* Web Security Safely browse the web and download files.
* Remote Browser Isolation Render risky websites in a container to
browse safely.
* Cloud Firewall Inspect traffic and protect against threats.
* Secure SD-WAN Connect and protect branches, offices and more.
* group (products 2nd row)
* Top-Rated Solutions
* Simplify Security at the Edge with SSE
* Work Safely from Anywhere with Data-first SASE
* Safeguard the Use of GenAI
* Enable Remote Workers
* Protect Sensitive Data in ChatGPT
* Secure Data in Microsoft 365
* group (row2)
* Schedule a Live Demo
* On-Demand Demo
* Resources
Resources
* group (links column)
* group (resource links)
* Blog
* Webcasts
* Podcasts
* Analyst Reports
* Customer Stories
* Resource Library
* Training
* --------------------------------------------------------------------------------
* group (cyber edut)
* Cyber Edu Learn More
* group (cta column)
* group (cards)
* Guide Ultimate Guide to Data Security Dive into the Guide
* Video Forcepoint Data Security Posture Management Demo Watch the
Video
* Analyst Report Forcepoint has been named a leader in The Forrester
Wave: Security Service Edge Solutions, Q1 2024 Read the Report
* Podcast The Radical Transparency Opportunity in Cybersecurity Listen
to the Podcast
* View All Resources
* Talk to an Expert
Main Menu
YOU ARE HERE
Home:Blogs:ShadowRoot Ransomware Targeting Turkish Businesses
X-Labs
July 12, 2024 | 5 min read
SHADOWROOT RANSOMWARE TARGETING TURKISH BUSINESSES
Mayur Sewani
Ransomware
Our X-Labs team’s research seems to have discovered and identified basic
ransomware targeting Turkish businesses. The attack vector initiates through a
PDF attachment disseminated via suspicious emails originating from the
"internet[.]ru" domain. The embedded links within the PDF facilitate the
download of a subsequent stage exe payload upon user interaction. It encrypts
files with “.shadowroot” extension. Currently, ransomware is actively targeting
numerous businesses worldwide, including those in the healthcare and online
shopping sectors.
Initial Access:
PDF attachment
This pdf contains a URL link, which downloads further exe payload from a
compromised GitHub account.
hxxps://raw[.]githubusercontent[.]com/kurumsaltahsilat/detayfatura/main/PDF.FaturaDetay_202407.exe
malicious URL from pdf
Execution of stage payloads:
The download file is a 32 bit Borland Delphi 4.0 compiled binary. While
analyzing exe, it is observed that it drops further payload in
“C:\TheDream\RootDesign.exe”, “C:\TheDream\Uninstall.exe” and
“C:\TheDream\Uninstall.ini”.
Dropped second stage rootdesign.exe is protected with dotnet confuser core ver
1.6.
Packer info
We can see classes with random names having special characters and all function
names are obfuscated. It is mostly preferred by malware authors to bypass
traditional detection techniques of security applications and it is an
open-source protector for .NET applications.
Obfuscated function and class name
PDF.FaturaDetay_202407.exe after dropping payload it initiates PowerShell to run
another hidden PowerShell command to execute RootDesign.exe in hidden mode.
Command:
“”C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden powershell
-c C:\TheDream\RootDesign.exe”
Created mutants/mutex:
Local\ZonesCacheCounterMutex
Local\ZonesLockedCacheCounterMutex
_SHuassist.mtx
This dropped file then creates its recursive threads of itself in memory with
new PIDs and starts performing encryption.
It logs its every thread activity on root “C:\TheDream\log.txt” by adding a new
line comment “ApproveExit.dot”. Its recursive threads also increase memory
consumption.
After this it will start performing, encrypting various system-critical non-pe
and office files and renaming those files with “.ShadowRoot” extension, dropping
readme.txt.
Encrypted files with. ShadowRoot extension
Readme.txt shows ransom notes in Turkish and encrypted files are dropped on
desktop.
There is no direct crypto wallet ID info mentioned, but it is asking victims via
readme to contact via the provided email address for further payment processing
via crypto wallet and decryption tools.
We have observed recursive self-process creation by RootDesign.exe, which causes
the files to get encrypted multiple times, resulting in higher memory
consumption. It also drops many copies of encrypted files on the root. As
highlighted in the screenshot the file extensions are also appended multiple
times.
Standard AESCryptoServiceProvider .Net class is observed in the code.
.Net AES class
It is the most commonly used class in .net compiled binary and in powershell
scripts.
Readme.txt
It performs SMTP C2 connection on smtp[.]mail[.]ru on port 587. Then it sends
details via email service to suspicious accounts username: kurumsal[.]tasilat
@internet[.]ru, which is also used as a sender domain.
C2 connection
CONCLUSION:
This ransomware seems to be targeting Turkish businesses by sending suspicious
fake PDF invoices and urging users to click on malicious links. It downloads
suspicious Delphi payload and then drops dotnet confuser protected binary for
further activity. It encrypts files with “.ShadowRoot” extension and connects to
a Russian SMTP mail server. This ransomware appears to a relatively rudimentary,
likely the work of an inexperienced developer, exhibiting some basic
functionality.
PROTECTION STATEMENT:
Forcepoint customers are protected against this threat at the following stages
of attack:
* Stage 2 (Lure) – Malicious PDF attachments associated with these attacks are
identified and blocked.
* Stage 5 (Dr.opper File) - The dropper files are added to Forcepoint malicious
database and are blocked.
* Stage 6 (Call Home) - Blocked C2 credentials
IOCS
Payload HASH:
* CD8FBF0DCDD429C06C80B124CAF574334504E99A
* 1C9629AEB0E6DBE48F9965D87C64A7B8750BBF93
Download URL:
* hxxps://raw[.]githubusercontent[.]com/kurumsaltahsilat/detayfatura/main/PDF.FaturaDetay_202407.exe
Email addresses to block:
* Kurumsal[.]tasilat[@]internet[.]ru
* ran_master_som[@]proton[.]me
* lasmuruk[@]mailfence[.]com
MAYUR SEWANI
Mayur serves as a Senior Security Researcher as part of the Forcepoint X-Labs
Research Team. He focuses on APT malwares, information stealers, phishing
attacks, and also works to stay on top of the latest threats. He is passionate
about advancing the field of defensive adversary...
Read more articles by Mayur Sewani
ABOUT FORCEPOINT
Forcepoint is the leading user and data protection cybersecurity company,
entrusted to safeguard organizations while driving digital transformation and
growth. Our solutions adapt in real-time to how people interact with data,
providing secure access while enabling employees to create value.
Learn more about Forcepoint
Cyber Security
IN THE ARTICLE
SHARE
LinkedIn
Twitter
Facebook
FORCEPOINT | X-LABS
SIGN UP FOR THE LATEST FROM OUR RESEARCH AND DEVELOPMENT TEAM
Conversion Prod Interest - Most Recent
sfcmpid
SF Source Campaign ID
Salesforce Campaign Name
Core/Non-core
GCLID - DO NOT USE
Work Email*
Country Picklist*
Select CountryAfghanistanAland
IslandsAlbaniaAlgeriaAndorraAngolaAnguillaAntarcticaAntigua and
BarbudaArgentinaArmeniaArubaAustraliaAustriaAzerbaijanBahamasBahrainBangladeshBarbadosBelarusBelgiumBelizeBeninBermudaBhutanBolivia,
Plurinational State ofBonaire, Sint Eustatius and SabaBosnia and
HerzegovinaBotswanaBouvet IslandBrazilBritish Indian Ocean TerritoryBrunei
DarussalamBulgariaBurkina FasoBurundiCambodiaCameroonCanadaCape VerdeCayman
IslandsCentral African RepublicChadChileChinaChinese TaipeiChristmas IslandCocos
(Keeling) IslandsColombiaComorosCongoCongo, the Democratic Republic of theCook
IslandsCosta RicaCote d'IvoireCroatiaCubaCuraçaoCyprusCzech
RepublicDenmarkDjiboutiDominicaDominican RepublicEcuadorEgyptEl
SalvadorEquatorial GuineaEritreaEstoniaEthiopiaFalkland Islands (Malvinas)Faroe
IslandsFijiFinlandFranceFrench GuianaFrench PolynesiaFrench Southern
TerritoriesGabonGambiaGeorgiaGermanyGhanaGibraltarGreeceGreenlandGrenadaGuadeloupeGuamGuatemalaGuernseyGuineaGuinea-BissauGuyanaHaitiHeard
Island and McDonald IslandsHoly See (Vatican City State)HondurasHong
KongHungaryIcelandIndiaIndonesiaIran, Islamic Republic ofIraqIrelandIsle of
ManIsraelItalyIvory CoastJamaicaJapanJerseyJordanKazakhstanKenyaKiribatiKorea,
Democratic People's Republic ofKorea, Republic ofKosovoKuwaitKyrgyzstanLao
People's Democratic RepublicLatviaLebanonLesothoLiberiaLibyan Arab
JamahiriyaLiechtensteinLithuaniaLuxembourgMacaoMacedonia, the former Yugoslav
Republic
ofMadagascarMalawiMalaysiaMaldivesMaliMaltaMartiniqueMauritaniaMauritiusMexicoMicronesia,
Federated States ofMoldova, Republic
ofMonacoMongoliaMontenegroMontserratMoroccoMozambiqueMyanmarNamibiaNauruNepalNetherlandsNew
CaledoniaNew ZealandNicaraguaNigerNigeriaNiueNorfolk
IslandNorwayOmanPakistanPalestinian Territory, OccupiedPanamaPapua New
GuineaParaguayPeruPhilippinesPitcairnPolandPortugalPuerto
RicoQatarReunionRomaniaRussian FederationRwandaSaint BarthélemySaint Helena,
Ascension and Tristan da CunhaSaint Kitts and NevisSaint LuciaSaint Martin
(French part)Saint Pierre and MiquelonSaint Vincent and the GrenadinesSamoaSan
MarinoSao Tome and PrincipeSaudi ArabiaSenegalSerbiaSeychellesSierra
LeoneSingaporeSint Maarten (Dutch part)SloveniaSolomon IslandsSomaliaSouth
AfricaSouth Georgia and the South Sandwich IslandsSouth SudanSpainSri
LankaSudanSurinameSvalbard and Jan MayenSwazilandSwedenSwitzerlandSyrian Arab
RepublicTaiwanTajikistanTanzania, United Republic
ofThailandTimor-LesteTogoTokelauTongaTrinidad and
TobagoTunisiaTurkeyTurkmenistanTurks and Caicos IslandsTuvaluUgandaUkraineUnited
Arab EmiratesUnited KingdomUnited StatesUruguayUzbekistanVanuatuViet NamVirgin
Islands, BritishVirgin Islands, U.S.Wallis and FutunaWestern
SaharaYemenZambiaZimbabweSlovakiaVenezuela, Bolivarian Republic of
By submitting this form, you agree to our terms and to receiving communications
from Forcepoint, you acknowledge our privacy policy and you consent to the
processing of your data. You can unsubscribe at any time.
Conversion Type
TO THE POINT CYBERSECURITY
A podcast covering latest trends and topics in the world of cybersecurity
Listen now
MORE ARTICLES IN X-LABS
X-Labs
Previous
POLICE SHUT DOWN 600 COBALT STRIKE SERVERS, CLOUDFLARE TOOL TO STOP AI BOTS,
INFOSTEALER MALWARE LOGS USED TO IDENTIFY CSAM WEBSITE MEMBERS AND MORE
Lionel Menchaca
|
Jul 05 2024
X-Labs
Previous
URL SHORTENER IN A MICROSOFT WORD FILE THAT LEADS TO REMCOS RAT
Hassan Faizan
|
Jun 24 2024
X-Labs
ShadowRoot Ransomware Targeting Turkish Businesses
X-LABS
GET INSIGHT, ANALYSIS & NEWS STRAIGHT TO YOUR INBOX
Conversion Prod Interest - Most Recent
sfcmpid
SF Source Campaign ID
Salesforce Campaign Name
Core/Non-core
GCLID - DO NOT USE
Work Email*
Country Picklist*
Select CountryAfghanistanAland
IslandsAlbaniaAlgeriaAndorraAngolaAnguillaAntarcticaAntigua and
BarbudaArgentinaArmeniaArubaAustraliaAustriaAzerbaijanBahamasBahrainBangladeshBarbadosBelarusBelgiumBelizeBeninBermudaBhutanBolivia,
Plurinational State ofBonaire, Sint Eustatius and SabaBosnia and
HerzegovinaBotswanaBouvet IslandBrazilBritish Indian Ocean TerritoryBrunei
DarussalamBulgariaBurkina FasoBurundiCambodiaCameroonCanadaCape VerdeCayman
IslandsCentral African RepublicChadChileChinaChinese TaipeiChristmas IslandCocos
(Keeling) IslandsColombiaComorosCongoCongo, the Democratic Republic of theCook
IslandsCosta RicaCote d'IvoireCroatiaCubaCuraçaoCyprusCzech
RepublicDenmarkDjiboutiDominicaDominican RepublicEcuadorEgyptEl
SalvadorEquatorial GuineaEritreaEstoniaEthiopiaFalkland Islands (Malvinas)Faroe
IslandsFijiFinlandFranceFrench GuianaFrench PolynesiaFrench Southern
TerritoriesGabonGambiaGeorgiaGermanyGhanaGibraltarGreeceGreenlandGrenadaGuadeloupeGuamGuatemalaGuernseyGuineaGuinea-BissauGuyanaHaitiHeard
Island and McDonald IslandsHoly See (Vatican City State)HondurasHong
KongHungaryIcelandIndiaIndonesiaIran, Islamic Republic ofIraqIrelandIsle of
ManIsraelItalyIvory CoastJamaicaJapanJerseyJordanKazakhstanKenyaKiribatiKorea,
Democratic People's Republic ofKorea, Republic ofKosovoKuwaitKyrgyzstanLao
People's Democratic RepublicLatviaLebanonLesothoLiberiaLibyan Arab
JamahiriyaLiechtensteinLithuaniaLuxembourgMacaoMacedonia, the former Yugoslav
Republic
ofMadagascarMalawiMalaysiaMaldivesMaliMaltaMartiniqueMauritaniaMauritiusMexicoMicronesia,
Federated States ofMoldova, Republic
ofMonacoMongoliaMontenegroMontserratMoroccoMozambiqueMyanmarNamibiaNauruNepalNetherlandsNew
CaledoniaNew ZealandNicaraguaNigerNigeriaNiueNorfolk
IslandNorwayOmanPakistanPalestinian Territory, OccupiedPanamaPapua New
GuineaParaguayPeruPhilippinesPitcairnPolandPortugalPuerto
RicoQatarReunionRomaniaRussian FederationRwandaSaint BarthélemySaint Helena,
Ascension and Tristan da CunhaSaint Kitts and NevisSaint LuciaSaint Martin
(French part)Saint Pierre and MiquelonSaint Vincent and the GrenadinesSamoaSan
MarinoSao Tome and PrincipeSaudi ArabiaSenegalSerbiaSeychellesSierra
LeoneSingaporeSint Maarten (Dutch part)SloveniaSolomon IslandsSomaliaSouth
AfricaSouth Georgia and the South Sandwich IslandsSouth SudanSpainSri
LankaSudanSurinameSvalbard and Jan MayenSwazilandSwedenSwitzerlandSyrian Arab
RepublicTaiwanTajikistanTanzania, United Republic
ofThailandTimor-LesteTogoTokelauTongaTrinidad and
TobagoTunisiaTurkeyTurkmenistanTurks and Caicos IslandsTuvaluUgandaUkraineUnited
Arab EmiratesUnited KingdomUnited StatesUruguayUzbekistanVanuatuViet NamVirgin
Islands, BritishVirgin Islands, U.S.Wallis and FutunaWestern
SaharaYemenZambiaZimbabweSlovakiaVenezuela, Bolivarian Republic of
By submitting this form, you agree to our terms and to receiving communications
from Forcepoint, you acknowledge our privacy policy and you consent to the
processing of your data. You can unsubscribe at any time.
Conversion Type
* Company
* Newsroom
* Work With Us
* Executive Team
* Blog
* Free E-Learning Courses
* Feedback
* All Products
* All Solutions
* Customer Stories
* Report a Vulnerability
* Contact Us
Terms & Conditions
Legal and Privacy
Manage Cookies
© 2024 Forcepoint
* LinkedIn
* Twitter
* Facebook
* YouTube
* RSS
Schedule a Demo
We use essential cookies to ensure that our website functions as intended for
you. Additionally, Forcepoint requests your consent to use other cookies to
collect website usage data, deliver personalized advertising, and to enhance and
optimize your browsing experience.
To learn more about the cookies we use and how to manage them, visit our Cookie
Policy page; to find out how we use and protect personal data, please review our
Privacy Policy.
Accept All
Required Only
Manage Cookies