Malware Analysis

Researchers have detailed a financially motivated campaign tracked as Canto Incognito, which targets exposed AI and LLM infrastructure with the goal of deploying cryptocurrency miners and growing the reach of an existing botnet. The malware family at the center of the activity, PoeLLM, has reportedly infected more than 3,400 servers. Once access is gained, the operators install mining payloads on the compromised systems, using the added compute to mine cryptocurrency while quietly expanding the botnet's footprint. The campaign stands out because it goes after internet-facing AI and LLM services rather than the usual web application targets. Exposed model endpoints, inference servers, and similar infrastructure give attackers both valuable hardware and a foothold inside environments that are often less hardened than traditional production systems. Key points: Campaign name: Canto Incognito Malware: PoeLLM Impact: 3,400+ servers infected Objective: cryptocurrency mining and botnet expansion Target: exposed AI and LLM infrastructure Operators of AI and LLM services should treat any internet-exposed endpoint as a potential entry point. Restricting access to management interfaces, keeping software patched, and monitoring for unexpected CPU or GPU load are sensible first steps while more details on the campaign emerge. Source: The Hacker News Does your organization run any internet-facing AI or LLM services, and how are you securing them?

The U.S. Department of Justice has announced charges against a 50-year-old dual U.S. and Israeli national accused of defrauding ransomware victims. Zohar Pinhasi, who also goes by the aliases Zack Silver and Zack Green, allegedly operated under the pretense of recovering encrypted data using proprietary tools, while secretly paying the ransomware actors for decryptors and billing victims far more than those payments cost. Authorities say the scheme generated over $19 million in fraudulent billing. Pinhasi faces two counts of wire fraud and one count of wire fraud conspiracy in connection with the operation. According to the announcement, the alleged conduct centered on MonsterCloud, the recovery service Pinhasi owned. Rather than deploying in-house technology to break or bypass encryption as claimed, he is accused of negotiating with the same attackers holding the victims' data and paying them for decryption keys or tools, then passing the cost on to clients at a significant markup. No specific CVE IDs or software vulnerability identifiers were referenced in the charging announcement, as the case concerns alleged fraudulent business practices rather than a technical exploit. Key points: Defendant: Zohar Pinhasi, also known as Zack Silver and Zack Green Charges: two counts of wire fraud, one count of wire fraud conspiracy Alleged scheme: billing victims over $19 million while secretly paying ransomware operators for decryptors Entity involved: MonsterCloud Agency announcing charges: U.S. Department of Justice Affected parties are primarily the ransomware victims who engaged MonsterCloud's recovery services. There are no software versions, indicators of compromise, or patch details to list, since this is a fraud prosecution rather than a product vulnerability. Source: The Hacker News Do you think cases like this will push more organizations to verify how recovery vendors actually obtain decryptors before signing a contract?

Daiichi Kosho, a major Japanese entertainment system maker, has disclosed a data exposure stemming from a malware infection at its contractor, Nippon Columbia. The incident affected more than 8.7 million customer and employee records, according to the company's disclosure. The exposed data originates from karaoke-related services, and the compromised records include details belonging to both customers and employees. The disclosure attributes the root cause to a malware infection at Nippon Columbia rather than at Daiichi Kosho itself, highlighting the supply chain risk that third-party contractors can introduce. At this stage, the reporting does not provide a specific CVE ID or advisory identifier for the malware involved, so no such identifier can be referenced. Readers should treat the 8.7 million figure as the headline impact number and monitor official statements from both companies for further details on affected services and notification procedures. Root cause: malware infection at contractor Nippon Columbia Disclosing entity: Daiichi Kosho Records exposed: more than 8.7 million customer and employee records No CVE ID or advisory identifier was provided in the source reporting Organizations that rely on third-party vendors for customer data processing should take this as a reminder to review contractor security requirements, data access scopes, and incident notification clauses in their agreements. Source: BleepingComputer Does your organization assess the security posture of third-party contractors that handle customer data, and how do you enforce it?

A Russia-aligned threat actor tracked as UAC-0099 has been linked to a previously undocumented .NET infostealer and remote access trojan (RAT) codenamed ASHVEIN, according to research from TrendAI. The malware has been used in attacks targeting Ukrainian government personnel. TrendAI is tracking this activity cluster under the name Earth Sirrush, which was formerly tracked as SHADOW-EARTH-065. The reporting attributes the campaign to a Russia-aligned actor, consistent with UAC-0099's established focus on Ukrainian government targets. ASHVEIN combines infostealer and RAT capabilities within a .NET-based implant, and the malware has been observed hiding commands in HTML. Details beyond these core facts—including specific indicators of compromise, affected software versions, and mitigation guidance—were not available in the source material. Source: [email protected] (The Hacker News) Has your organization encountered any UAC-0099 activity or similar .NET-based RATs targeting government personnel?

A ransomware affiliate has reportedly betrayed their own operation by keeping the profits for themselves, highlighting that trust issues exist on both sides of the criminal ecosystem. Separately, an attacker left a server exposed with tools and traces of an intrusion, exposing their own toolkit in the process. The week also saw malicious code surface in developer packages and extensions, continuing a worrying trend of supply chain compromise. Details remain limited in the source report, so specific identifiers such as CVE IDs are not available at this time. Affected package and extension names, along with mitigation guidance, were not disclosed. Review any developer packages and extensions currently in use Monitor for signs of unauthorized access or exposed infrastructure Treat supply chain components as potential attack vectors until verified Source: The Hacker News Are you reviewing your developer dependencies and extensions in light of this week's supply chain activity?

German authorities have arrested a Russian national suspected of being a leading member of the Qilin ransomware group. The arrest followed an extradition from Japan earlier this month, marking a notable development in cross-border efforts to hold ransomware operators accountable. Details released so far remain limited, and no specific charges, advisory identifiers, or technical indicators tied to this individual have been disclosed in the reporting. Qilin, also tracked under other names, has been linked to a string of high-profile ransomware attacks against organizations across multiple sectors, typically employing double-extortion tactics. As always, defenders should treat this as a reminder that ransomware crews like Qilin remain active and adaptable regardless of arrests. Organizations are encouraged to maintain offline backups, enforce phishing-resistant multi-factor authentication, and monitor for lateral movement and data exfiltration activity. Verify that backups are isolated and tested for restore integrity Enforce MFA across remote access and privileged accounts Segment networks to limit lateral movement Monitor for unusual data staging or large outbound transfers Keep incident response contacts and playbooks current Source: Unknown Do you think arrests like this meaningfully disrupt ransomware operations, or do groups simply regroup under new leadership?

A malware campaign tracked as Midnight Mimosa has been found preinstalled on low-cost Android smartphones, embedded directly in the devices' firmware. Because the malicious components ship with the phone rather than arriving through a user-installed app, they can operate quietly from the moment the device is first powered on. Once active, the malware gives attackers the ability to silently install additional apps, carry out ad fraud, and turn infected devices into residential proxies. That last capability is particularly noteworthy, since compromised handsets can be used to route other parties' traffic through the victim's home or mobile IP address, helping threat actors obscure their origin. Key points: Campaign name: Midnight Mimosa Target: low-cost Android smartphones Infection vector: malicious software baked into device firmware Capabilities: silent app installation, ad fraud, and residential proxy functionality Because the malicious code is part of the firmware image, standard app-level removal may not be enough, and affected users may need to rely on vendor-supplied firmware updates or replace the device entirely. Source: Publication Name Has anyone encountered low-cost Android devices in their environment showing signs of preinstalled proxy or ad-fraud components?

IDC Frontier, a major Japanese cloud and digital infrastructure provider, has disclosed that its IDCF Cloud service was hit by a ransomware attack. The incident caused an outage at a data center cluster serving the eastern part of Japan. According to the disclosure, the service disruption affected government clients among others, though the article does not specify a CVE ID, advisory number, or the number of affected customers. No specific indicators of compromise or affected version lists were provided in the source. Details on the ransomware family, ransom demand, and recovery timeline have not been included in the available reporting. Affected customers are advised to monitor IDC Frontier's official communications for updates on restoration progress and any further guidance. Source: BleepingComputer Does your organization rely on IDCF Cloud or similar regional providers, and what contingency measures do you have in place for cloud service outages?

The FakeGit campaign has resurfaced, with researchers identifying 17,610 malicious repositories on GitHub distributing the SmartLoader malware. The operation reactivated earlier this month after a period of inactivity, now primarily pushing the StealC infostealer as its final payload. The attack chain typically begins when a user downloads and executes a malicious file from one of the fake repositories. SmartLoader then acts as a loader, retrieving and deploying StealC, which is designed to harvest credentials, cryptocurrency wallets, and other sensitive data from compromised systems. Key points: Over 17,000 fake repositories identified on GitHub SmartLoader serves as the initial payload and loader StealC infostealer is the primary final-stage malware The campaign reactivated earlier this month after a dormant period Users and organizations should exercise caution when downloading code or executables from unfamiliar GitHub repositories, even if they appear legitimate. Verifying repository ownership, checking commit history, and scanning downloaded files before execution are recommended precautions. Source: Publication Name Has anyone in the community encountered suspicious repositories matching this pattern, and what steps is your organization taking to vet third-party code from platforms like GitHub?

Cybersecurity researchers have disclosed a long-running npm supply chain malware campaign that distributes information stealers and remote access trojans (RATs) to compromised hosts. The campaign has been codenamed MALFEX by CloudSEK and Checkmarx. The activity is assessed to be the work of a lone threat actor who appears to have published 12 packages since August 2023, eight of which have been downloaded 40,767 times. These packages deliver the Overlord RAT and a stealer. Given the available information, no specific CVE identifiers or advisory numbers have been published for this campaign. Key details to note: Campaign codename: MALFEX Attributed by: CloudSEK and Checkmarx Actor profile: assessed to be a lone threat actor Packages published: 12 since August 2023 Malicious packages: 8, downloaded 40,767 times Payloads: Overlord RAT and an information stealer Distribution vector: npm supply chain If your organization uses npm dependencies, review your package inventory for anything published since August 2023 that matches this activity and audit install scripts and post-install behavior in your build pipeline. Source: The Hacker News Has your team audited its npm dependencies for these packages, and what controls are you using to catch malicious install scripts before they run?

The owner of ransomware remediation firm MonsterCloud faces federal charges for allegedly defrauding ransomware victims. According to the allegations, the company told clients it could recover their encrypted data using proprietary technology, while actually paying the attackers behind the scenes for decryptors and concealing those payments. Clients were allegedly led to believe MonsterCloud's own tools and expertise were responsible for restoring access to their files. The actual recovery method was reportedly ransom payments made quietly to the threat actors. The charges center on the gap between what victims were told and what was actually done on their behalf. Source: Publication Name If your organization has ever used a third-party recovery firm after an attack, would you have any way of knowing whether a ransom was paid on your behalf?

Ransomware operators are shifting tactics, increasingly focusing on backup infrastructure as a primary target rather than an afterthought. The goal is straightforward: if recovery options are destroyed, victims face far more pressure to pay. This trend means that backups can no longer be treated as a passive safety net tucked away somewhere on the network. According to Kaseya, effective defense against this approach requires backups that are isolated, immutable, and regularly tested. In practice, that means ensuring copies exist that attackers cannot easily reach or alter, and verifying through testing that those copies can actually be restored when needed. A backup that has never been tested offers little assurance once an incident occurs. Key considerations for organizations reviewing their backup posture: Isolate backup copies so they are not accessible from the primary network. Make backups immutable, so they cannot be modified or deleted by an attacker. Test restoration procedures on a regular basis to confirm they work. Assume attackers will specifically look for backup systems during an intrusion. The broader lesson is that recovery capability is now part of the attack surface. If backup systems are reachable and writable, they are a target. Source: Unknown Does your organization currently test backup restoration, or are backups still assumed to work until something goes wrong?

Advantest Corporation has confirmed that a ransomware attack earlier this year resulted in the theft of personal information belonging to affected individuals. The company is now in the process of notifying those impacted by the incident. The semiconductor test equipment maker disclosed that the breach led to the exposure of personally identifiable data. While full details of the compromised information have not been publicly detailed, the company is reaching out to affected parties as part of its notification obligations. Those who may be impacted should remain alert for suspicious communications and monitor their accounts for unauthorized activity. Affected individuals are advised to follow any guidance provided in the company's notification. Watch for phishing attempts referencing Advantest or the incident Monitor financial and personal accounts for unusual activity Follow instructions in any official notification received from the company Source: Unknown Were you or your organization notified about this breach, and what steps are you taking in response?

CERT-UA has uncovered a widespread campaign involving over 100 compromised websites that have been injected with malicious JavaScript. The goal is to deliver an information-stealing malware known as LunexStealer, which also goes by the alias Psychedelic Stealer. The activity was observed by the agency in September 2026 and has been attributed to a threat cluster tracked as UAC-0277. The agency did not disclose who is behind the operation. The compromised sites are used to display fake Cloudflare verification checks. These lure visitors into executing the malicious payload, which ultimately installs LunexStealer on their systems. Source: The Hacker News Has your organization encountered fake Cloudflare verification prompts in recent browsing activity, and how are you handling the risk?

Linux backdoors targeting telecom and network appliances in South Korea and Taiwan have been disguising their traffic as email services and seemingly legitimate processes in order to blend in and evade detection. Threat actors commonly name their malicious software after a legitimate operating system component or process as a defense evasion measure. By borrowing the name of a real binary, the malware may avoid raising suspicion during routine system inspection, allowing it to persist quietly on compromised appliances. The campaign focuses on telecom and network infrastructure, sectors that are frequently targeted for their strategic value and their role in carrying large volumes of sensitive traffic. Key points: Targets include telecom and network appliances in South Korea and Taiwan. Traffic is disguised as email services to avoid network-based detection. Malicious processes impersonate legitimate system binaries on Linux hosts. The technique is a classic defense evasion tactic aimed at blending into normal system activity. If your organization runs Linux-based telecom or network appliances in these regions, review running processes and outbound email-related traffic for anything that does not match a known, legitimate binary or service. Source: The Hacker News Does your organization operate Linux-based telecom or network appliances in these regions, and how are you hunting for impersonated processes on those systems?

A former core infrastructure engineer at an industrial company headquartered in New Jersey has been sentenced to 32 months in prison after launching a ransomware-style attack against his own employer's network. Rather than a typical external intrusion, this was an insider incident: the engineer used his privileged access to lock thousands of devices across the organization. The attack affected more than 3,000 devices, disrupting operations on the employer's network by rendering the machines inaccessible. The case highlights the risk posed by malicious insiders who already hold legitimate administrative rights, allowing them to cause widespread damage without needing to bypass perimeter defenses. Details on the specific malware used, the exact date of the attack, and any financial motive were not disclosed in the available reporting. Notably, no CVE identifiers or vendor advisories are associated with this incident, as it stemmed from abuse of authorized access rather than a software vulnerability. Key points for defenders: Insider threats can bypass many traditional security controls because the actor already has valid credentials and elevated privileges. Rapid detection of abnormal mass-encryption or lockout activity is critical, especially from privileged accounts. Least-privilege enforcement and monitoring of high-access accounts remain essential controls. Source: BleepingComputer Does your organization have monitoring in place to detect a privileged insider locking or encrypting devices at scale?

The U.S. Department of Justice has announced the arrest of the alleged developer behind Ploutus, a malware family used in ATM jackpotting attacks that stole millions of dollars across the United States. The suspect has appeared in a U.S. court following the arrest. Ploutus is a long-standing ATM malware strain associated with jackpotting, a technique in which attackers force cash machines to dispense large amounts of cash on demand. According to the DOJ, losses linked to the malware run into the millions of dollars. Details on the specific charges, the suspect's identity, and the jurisdictions involved are limited in the initial announcement. No CVE identifiers were referenced in the source material. Discussion question: Has your organization reviewed its ATM fleet for jackpotting exposure, and what physical or logical controls are you relying on to mitigate this class of attack? Source: BleepingComputer

Cybersecurity researchers have disclosed details of a new botnet malware dubbed Carbonato, which targets exposed Docker daemons to deploy an open-source AI agent framework known as Hermes Agent. According to ThreatDown, the implant installs the framework without modification, then overwrites its SOUL.md persona file. The 39-line prompt directs the agent to execute tasks received through a Telegram-controlled channel, effectively turning the compromised host into a remotely commanded automation node. Key points from the disclosure: Carbonato exploits internet-exposed Docker daemons as its initial access vector. It deploys the open-source Hermes Agent framework as-is. The malware replaces the SOUL.md persona file with a 39-line prompt. Command and control is handled via Telegram, instructing the agent to run received tasks. This incident highlights the continued risk of leaving Docker daemons reachable from the internet, as well as the emerging trend of abusing legitimate AI agent tooling for malicious automation. Operators should ensure Docker APIs are not publicly exposed and monitor for unexpected modifications to agent configuration files such as SOUL.md. Source: The Hacker News Has anyone observed unexpected changes to AI agent configuration files or suspicious Telegram-related traffic on their Docker hosts?

RatHat operators are running their Android banking trojan through a web-based console, according to research from Cleafy. The console lets those behind the malware build and publish the trojan, as well as control infected phones remotely. Cleafy has traced nearly 100 deployments of the console since April 2026. The security firm says this points to a malware-as-a-service setup, where each customer operates a separate copy of the console. The console also stores the data the malware collects from each infected device. Source: The Hacker News Has anyone in the community observed RatHat console infrastructure or similar Android banking trojan deployments in their environment?

Threat actors are abusing ChatGPT Custom GPTs to pose as legitimate product offerings and redirect victims to malicious sites that use ClickFix lures to deliver malware. According to Huntress, which observed the activity in late September 2026, this is the latest example of attackers weaponizing features within trusted artificial intelligence platforms. Earlier campaigns similarly abused shared components of these platforms to lend credibility to their operations. The abuse chain relies on the trusted ChatGPT brand to lower victim suspicion before pushing them toward fake sites. Once there, ClickFix lures trick users into executing malicious commands, ultimately leading to a RAT payload. Huntress noted that prior campaigns have weaponized shared features in AI platforms, indicating a continuing trend rather than an isolated incident. Attackers disguise Custom GPTs as legitimate product offerings Victims are directed to malicious sites that host ClickFix lures ClickFix prompts lead to malware delivery, including a RAT Observed activity dates to late September 2026 Source: The Hacker News Has your organization seen any suspicious Custom GPT links shared internally, and what controls do you have in place to block ClickFix-style lures?