TrendAI (Organization): news timeline & CVEs

UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML

Russia-aligned UAC-0099 deployed the ASHVEIN RAT against Ukrainian government staff, hiding tasking in HTML.

TrendAI attributes a new .NET infostealer and RAT, ASHVEIN (internally TelemetryBrowser), to Russia-aligned UAC-0099, also tracked as Earth Sirrush, in attacks on Ukrainian government personnel. ASHVEIN steals Chrome and Firefox credentials, captures screenshots, collects files, runs PowerShell, and hides tasking in invisible HTML, with a GitHub dead-drop fallback. Delivery includes DLL sideloading, VHD containers, and a National Police of Ukraine decoy. ESET also reported a VBScript that embeds a prohibited-weapons prompt to trip LLM safety filters and hinder analysis of the MATCHBOIL loader.

The Hacker NewsOct 8, 15:26 UTC · 9h agoThreat actor in the wild 3 sources

Earth Sirrush Uses PNG Steganography and Malicious Notepad++ Plugins to Deploy Espionage Malware

Russia-aligned Earth Sirrush hides espionage malware in PNGs and Notepad++ plugins against Ukrainian government and defense targets.

Earth Sirrush, overlapping CERT-UA's UAC-0099 and previously tracked as SHADOW-EARTH-065, has targeted Ukrainian government, defense, border, and logistics organizations since at least 2022. TrendAI traced more than 10 malware families through July 2026, including PNG steganography campaigns CINDERBLOT/BadPaw, the LUNCHPOKE Notepad++ plugin, loaders BURNYBEAR and MATCHBOIL.V2, and the ASHVEIN stealer and RAT. Earlier activity exploited WinRAR CVE-2023-38831; newer chains use phishing, scheduled tasks, and DLL proxying. ASHVEIN steals Chrome and Firefox credentials, captures screenshots, and runs remote PowerShell.

Cyber Security Newsupdated Oct 8, 15:26 UTC · 9h agofirst Oct 7, 12:39 UTC · 1d agoThreat actor in the wild 3 sources CVE-2023-38831

Earth Sirrush Espionage Activity May Support Sandworm Operations Against Ukraine

Earth Sirrush has spear-phished Ukrainian government and logistics since 2022, possibly feeding Sandworm.

TrendAI says Russia-aligned Earth Sirrush, also tracked as SHADOW-EARTH-065 and CERT-UA's UAC-0099, has spear-phished Ukrainian government, defense, border, and logistics targets since at least 2022 through July 2026. Early intrusions used archives, HTA files, and WinRAR flaw CVE-2023-38831; later chains added C# tools such as MATCHBOIL and the ASHVEIN stealer-RAT, image steganography in CINDERBLOT, and the LUNCHPOKE Notepad++ plugin. Shared signatures, XOR routines, and Regery-plus-Cloudflare infrastructure tie the clusters together. ESET's view that UAC-0099 may have given Sandworm initial access is presented as a hypothesis, not confirmed control.

GBHackersupdated Oct 8, 15:26 UTC · 9h agofirst Oct 7, 08:01 UTC · 1d agoThreat actor in the wild 3 sources CVE-2023-38831

SMTP is the key: BPFDoor and AVERAT hitting the network edge

Rapid7 details BPFDoor and AVERAT Linux implants disguised as telecom-edge software in South Korea and Taiwan.

Rapid7 analyzed Linux samples built for telecom and network-edge devices, including a new BPFDoor variant, a BPF Rekoobe build seen on South Korean targets, a dropper, and six AVERAT builds deployed on Taiwanese appliances. A dropper stages payloads as ntpdate and udevds under /sbin, deletes the files while the processes keep running, and derives an encryption key from the string ShareTech. BPFDoor impersonates SpamSniper and common daemons, uses BPF socket filters, and a newer controller tunnels triggers in padded HTTPS POST requests while also using DNS, TCP, and SMTP. Telecommunications operators and nearby embedded CCTV and DVR systems are the main exposure.

Rapid7 Blogupdated Oct 6, 18:24 UTC · 2d agofirst Oct 2, 13:00 UTC · 6d agoMalware in the wild 3 sources2

$20 per zero-day is already the WordPress plugin reality

TrendAI and CHT Security used an AI pipeline to find over 300 verified WordPress plugin zero-days at roughly $20 per vulnerability.

A pipeline built in three days by TrendAI and CHT Security, presented at Ekoparty Miami, paired AI-driven static analysis with automated Docker provisioning and Chrome DevTools MCP dynamic verification to surface more than 300 critical zero-days in WordPress plugins within 72 hours. The run consumed about 222 million tokens across 95 tasks, averaging roughly $20 per verified vulnerability, with findings including pre-auth RCE, SQL injection, privilege escalation, SSRF, and an AI-assembled downgrade attack chain. Dynamic verification eliminated over 80% of false positives, but manual review at 30-60 minutes per finding remains the bottleneck, straining ZDI and NIST triage backlogs.

Help Net SecurityAug 24, 04:21 UTC · Aug 24, 2026Research1

TrendAI

Timeline5 articles

Related CVEsby mentions

Appears with

UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML

Earth Sirrush Uses PNG Steganography and Malicious Notepad++ Plugins to Deploy Espionage Malware

Earth Sirrush Espionage Activity May Support Sandworm Operations Against Ukraine

SMTP is the key: BPFDoor and AVERAT hitting the network edge

$20 per zero-day is already the WordPress plugin reality