30
55
30
60
42
47
42
55
30
TuxBot v3: Inside an IoT Botnet Framework With LLM
Unit 42 uncovers TuxBot v3, an LLM-assisted IoT botnet framework with 17-architecture builds, Telnet brute-forcing, and DDoS capabilities.
Palo Alto Unit 42 identified TuxBot v3 Evolution, a modular IoT botnet framework derived from AISURU, Wuhan-lineage botnets, and MHDDoS. The C-based bot brute-forces Telnet with 1,496 credential pairs, targets over 30 IoT device families, and communicates with a Go-based C2 over encrypted TCP with multiple fallback mechanisms including DGA, P2P, and DNS TXT. LLM-assisted development left hallucinated crypto implementations and broken exploit modules in the analyzed samples, though roughly 70% of core functionality works. Researchers warn polished production builds likely exist, raising the threat potential.
45
55
60
42
42
30
42
42
42
The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions
Elastic details KREMLIN, a Brazilian banking malware whose malicious Chrome/Edge extension forges Chromium integrity checks to steal sessions.
Elastic Security Labs tracked operation REF9334 and its KREMLIN toolkit, a Brazilian banking malware campaign impersonating twelve banks across seven campaigns since May 2025. The infection chain uses multi-stage obfuscated JavaScript loaders with sandbox checks (file and process counting), scheduled-task persistence, and an Ethereum smart contract acting as a dead-drop resolver for C2 and payload URLs, abusing Archive.org for hosting. The malicious browser extension bypasses Chromium integrity mechanisms by manipulating Secure Preferences and regenerating required HMACs and App-Bound encrypted hashes. Threat Command disrupted over 1,500 infections by registering the kill-switch canary domain.
58
55
60
42
42
30
55
55
55
60
30
30
42
42
60
55
47
AsyncRAT Malware Abuses AutoIt and PowerShell to Hide Inside Legitimate Windows Process
Point Wild details a five-stage AsyncRAT campaign using AutoIt abuse and process injection to hide a .NET RAT inside Microsoft's signed charmap.exe.
Researchers at Point Wild Threat Intelligence analyzed a campaign starting from a lure batch file ('Right-click to open Invoice Details.bat') that launches hidden PowerShell to reconstruct a Base64/XOR-obfuscated payload. The stage drops a renamed signed AutoIt interpreter and loader script into %LOCALAPPDATA%\Temp and achieves persistence via a batch file in the user's Startup folder (T1547.001). The loader decrypts the payload in memory with single-byte XOR key 0x36 and injects it into SysWOW64\charmap.exe using OpenProcess/VirtualAllocEx/WriteProcessMemory/CreateRemoteThread, with PE-sieve confirming an in-memory implanted PE and patched AMSI modules. The final AsyncRAT payload performs screen capture and data theft, with observed C2 at 158[.]51[.]122[.]136:4944 over raw TCP.
48
F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans
Sophos found F5 BIG-IP APM malware that injects a PHP web shell into Apache's memory, evading disk scans, linked to exploited CVE-2025-53521.
Sophos's September 7 analysis describes malware tied to F5's c05d5254 activity that hooks apr_dso_load, modifies the libphp PHP module in memory, and injects a PHP web shell when Apache loads apm_css.php3, full_wt.php3 or webtop_popup_css.php3, leaving on-disk files clean. A separate installer infects /usr/sbin/httpd and umount, runs before Apache starts, disables SELinux (per ESET's related PoisonedRefresh analysis), and opens a local socket at /run/bigtlog.pipe for shell access. The activity is linked to CVE-2025-53521 in BIG-IP APM, rated 9.8 CVSS 3.1, patched in October 2025, added to CISA KEV on March 27, 2026.
72
60
47
55