Recorded Future reports the Russian influence network CopyCop is targeting Western-backed AI and infrastructure projects in Armenia.
According to Recorded Future, the Russian influence network CopyCop is running a campaign against Western-backed AI and infrastructure initiatives in Armenia. Targets include the Firebird AI data center. The apparent goal is to undermine Armenia's westward geopolitical realignment by discrediting these projects.
Kaspersky reports Iran-linked Mirage Kitten delivers new NodeRabbit and PollCat malware to fintech and aviation targets via fake LinkedIn coding assessments.
Kaspersky researchers documented two previously undocumented Node.js malware families, NodeRabbit and PollCat, attributed with high confidence to Iran-linked APT group Mirage Kitten. The malware is delivered via fake recruiter personas on LinkedIn offering coding assessments hosted on Amazon S3, with instructions banning AI assistants so AI code-review tools would not flag the trojanized npm packages. NodeRabbit is cross-platform (Windows, Linux, macOS), uses AES-256-GCM-encrypted C2 on Azure, includes sandbox checks, and one variant installs a fake 'GitHub Copilot Helper' VS Code extension plus Git hook persistence. Victims identified so far are in fintech and aviation organizations across Egypt, Ethiopia, and Afghanistan.