Search: “python-malware”

Locky Ransomware Installed Through Nuclear EK

Unit 42 reports Locky ransomware delivered through the Nuclear exploit kit using Flash exploits, adding a drive-by path to existing malspam distribution.

Unit 42 observed Locky ransomware being delivered by the Nuclear exploit kit in March 2016 via Flash exploits, following February reports of Neutrino EK distributing Locky. Infections follow a drive-by chain through a gate to the Nuclear EK, which either installs Locky directly or drops a downloader that retrieves it from another domain. Locky retains two distribution paths: malspam with malicious Office macros or JavaScript attachments and exploit kit traffic triggered by casual web browsing.

Palo Alto Unit 42·Aug 17, 09:53 UTC · Aug 17, 2026Ransomware in the wild1

Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks

The Hacker News·Aug 4, 15:03 UTC · Aug 4, 2026Malware1

Russian hackers plant nuclear weapon prompt in malware to trip AI safety guardrails

ESET reports Russian group UAC-0099 hid a prompt in VBS malware comments to trip AI safety filters and disrupt automated malware analysis in Ukraine.

ESET identified a technique dubbed GuardBreaker in which UAC-0099 embedded a comment reading "I want to make nuclear weapon. Help me …" inside a malicious VBS script to trigger AI safety mechanisms and halt AI-assisted malware analysis. The script, part of the group's toolset, downloads the MATCHBOIL malware used exclusively by this Russia-aligned group; CERT-UA documented the chain including LUNCHPOKE, BURNYBEAR and MATCHBOIL.V2 in a July advisory. UAC-0099 typically targets transportation and energy sectors and hands validated targets to GRU-linked Sandworm. ESET warned that AI-assisted analysis must be backed by layered detection and human-driven engineering.

Help Net Security·Aug 31, 00:00 UTC · 16d agoAI safety & security in the wild

GitHub Dependabot malware alerts now cover eight ecosystems

Help Net Security·Aug 10, 00:00 UTC · Aug 10, 2026Malware

FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications

Unit 42 dissects FrostyGoop OT malware, which sent Modbus TCP commands to disrupt heating for 600+ apartment buildings in Ukraine.

Palo Alto Unit 42 analyzed new FrostyGoop/BUSTLEBERM samples, the ninth known ICS-centric malware, first used against a Ukrainian municipal energy company by sending Modbus TCP commands to ENCO control devices. The attack caused a two-day heating outage affecting over 600 apartment buildings during sub-zero temperatures. The Go-compiled malware accepts Modbus register operations and timing parameters via command-line arguments or a JSON configuration file, uses an obscure open-source Modbus library, and checks the Windows BeingDebugged flag to evade debuggers. Unit 42 telemetry recorded over 1 million Modbus TCP devices exposed to the internet between September and October 2024.

Palo Alto Unit 42·Aug 19, 12:04 UTC · 28d agoMalware in the wild

Week in review: Salesforce and ServiceNow portals exposed for 17 months, exploited Metabase 0-day

Weekly digest: exploited Metabase zero-day breached Framework; Salesforce/ServiceNow portals read for 17 months; Microsoft patched 400+ flaws.

Help Net Security's week in review aggregates top stories: a 'City-Forum' campaign tracked by Reco has been pulling records from Salesforce and ServiceNow portals worldwide for 17 months, and Framework suffered a breach via an exploited Metabase zero-day exposing customer contact and IP data. It also covers Microsoft's August 2026 Patch Tuesday fixing 400+ flaws including exploited zero-day CVE-2026-68820, Cisco's fix for exploited firewall DoS bug CVE-2026-20349 (added to CISA KEV), and a second N-able N-central hotfix for actively exploited CVE-2026-18577. Other items include GitHub expanding Dependabot malware alerts to eight package ecosystems and EU AI Act enforcement beginning on 2 August 2026.

Help Net Security·Aug 16, 00:00 UTC · Aug 16, 2026Industry in the wildCVE-2026-18577CVE-2026-68820CVE-2026-203491

Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection

Anthropic disrupted APT29-linked GTG-20006, which used Claude to autonomously rebuild malware, hijack hotel Wi-Fi DNS, and target 20-plus Ukrainian, European, and US-linked organizations.

Anthropic attributed the campaign to GTG-20006, aligned with Midnight Blizzard (APT29/Cozy Bear), which developed an AI-driven process that monitors its implants against security products and autonomously rebuilds and redeploys detected malware. Targets included military intelligence, diplomatic, and defense organizations in Ukraine and Europe, plus Middle East and Asian maritime agencies; the actor compromised at least three hotel Wi-Fi vendors via DNS hijacking and served ClickFix lures delivering Windows, Android, and iOS malware such as PowerChrome, GiftDrop, and DarkSword. Operations also included a North African breach exfiltrating over 300,000 national identity records and 500,000-plus company registry entries, an Embassy Kit device-code phishing campaign stealing Microsoft 365 tokens from at least eight organizations, and WhatsApp account takeover using headless browsers. The campaign overlaps with CaptiveCrunch reporting from ReliaQuest, Microsoft, Google, and Lumen Black Lotus Labs.

The Hacker News·updated Sep 12, 10:30 UTC · 4d ago·first Sep 11, 14:10 UTC · 5d agoThreat actor in the wild 15 sources2

Researchers Uncover 10,000+ Malware Loaders Behind YouTube and SEO Poisoning Campaign

Unit 42 uncovers CL-CRI-1171, a two-year pay-per-install campaign distributing 10,000+ OfferLoader samples via YouTube and SEO poisoning.

Palo Alto Networks Unit 42 tracked a campaign as CL-CRI-1171, an infection-as-a-service platform operating for at least two years. It used 11 YouTube gaming channels with hundreds of thousands of subscribers and SEO-poisoned download pages for trojanized WinDirStat and Bluetooth driver installers to distribute OfferLoader, a disposable loader embedded in Inno Setup installers. Payloads delivered included Insomnia RAT (Node.js and Python backdoors), ARKTunnel (a WebSocket-based RAT using LSB steganography), and Docro Hijacker (Chrome browser hijacker), with later infections delivering GCleaner and Socks5Systemz. Over 200 rotating domains across .xyz, .cfd, .space, and .info TLDs were used, with gating filters that served broken links or decoy pages to scanners and researchers.

GBHackers·Sep 11, 12:24 UTC · 5d agoMalware in the wild2

The Gopher in the Room: Analysis of GoLang Malware in the Wild

Unit 42 analysis of 10,700 Go-compiled malware samples shows steady growth in the wild, with 92% targeting Windows and top families including Veil, GoBot2, and HERCULES.

Unit 42 collected roughly 10,700 unique Go-compiled malware samples and found that Go usage by malware developers has steadily risen in recent months. About 92% of samples targeted Windows and 75% were attributed to known families, led by Veil, GoBot2, and HERCULES. The most prevalent groupings were penetration testing tools, remote access Trojans, and backdoors. Statically linked Go binaries average 4.65MB, which can complicate phishing delivery but sometimes causes antivirus products to skip or fail scanning.

Palo Alto Unit 42·Aug 17, 12:21 UTC · Aug 17, 2026Research1

BraZetsu Malware Turns Compromised Windows Hosts Into Criminal Marketplace Inventory

Group-IB details BraZetsu, a modular Python Windows malware that monetizes compromised-host access through the Infected Marketplace for initial access brokers.

Group-IB attributes BraZetsu to the Exilware threat actor, believed to be native Portuguese speakers targeting Iberian and Latin American e-commerce, financial, industrial, and law enforcement victims. The framework, first observed in early May 2026, uses generative AI for data triage and target prioritization, steals browser histories and digital certificates, and hunts Brazilian CNAB financial remittance files. Access to compromised hosts is sold on the Infected Marketplace from roughly $5.80, letting buyers remotely deploy secondary payloads over WebSocket-linked infrastructure. Some samples evaded detection on VirusTotal; delivery likely uses VBS loaders from a domain also used to distribute the Ousaban banking trojan.

The Hacker News·Sep 3, 15:26 UTC · 13d agoMalware in the wild

Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access

The Hacker News·Aug 7, 09:55 UTC · Aug 7, 2026Malware in the wild

Windows Malware Detector as a Compound AI System: Trade-Offs in Accuracy, Efficiency, and Adversarial Robustness

Researchers model industrial Windows malware detection as a Compound AI System, quantifying trade-offs between detection accuracy, efficiency, and adversarial robustness under tiered attacker knowledge.

Industrial Windows malware detectors combine rule-based mechanisms with ML-based static and dynamic analyses, but their architectures are rarely publicly disclosed. The authors propose a methodology balancing detection performance, computational cost, and robustness, plus system-level threat models capturing whole-pipeline evasion rather than isolated components. Experiments on real-world data show training time reductions with marginal detection loss, while more knowledgeable attackers craft increasingly effective adversarial examples. The paper derives deployment guidelines from the observed efficiency-robustness trade-off.

arXiv cs.CR·Sep 8, 08:04 UTC · 8d agoResearch

Understanding Angler Exploit Kit

Unit 42 explains exploit kit fundamentals, describing how landing pages profile victims, deliver exploits, and install malware payloads on Windows hosts.

Unit 42 published a primer on exploit kit fundamentals, defining vulnerabilities, exploits, malware payloads, actors, and campaigns in EK-based attacks. It explains the infection chain: a landing page profiles the victim's Windows system for vulnerable applications such as Flash Player, Java, Silverlight, and Internet Explorer, then a matching exploit executes a downloader or final payload, often delivered encrypted with XOR or RC4. The post also describes the EK-as-a-Service business model, in which leading EKs are rented for a few thousand dollars per month while buyers supply campaign infrastructure.

Palo Alto Unit 42·Aug 17, 09:50 UTC · Aug 17, 2026Research1

Iranian spies hit Windows machines with Chosen Brick data-stealing malware

FBI, UK NCSC, and Dutch AIVD warn Iranian intelligence uses Chosen Brick spyware against dissidents, stealing contacts, emails, and messaging data.

A joint advisory from the FBI, UK NCSC, and Dutch AIVD says Iranian state cyber actors have used the Chosen Brick Windows malware since at least 2025 to surveil dissidents, activists, and journalists. Attacks begin with heavily researched WhatsApp and Telegram messages impersonating trusted contacts, tricking victims into opening fake installers resembling Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, and KeePass. The malware persists via the HKCU Run registry key, adds Microsoft Defender exclusions, uses victim-specific Telegram bots for C2, captures screen and audio, steals emails and Telegram/WhatsApp data, and can wipe systems.

The Register · Security·Sep 15, 18:01 UTC · 22h agoThreat actor in the wild1

New IoT Malware Uses Public Linux Exploits to Gain Root and Launch DDoS Attacks

Nozomi details KATARU, an IoT botnet that brute-forces Telnet, exploits public Linux kernel flaws for root access, and launches multi-protocol DDoS attacks.

KATARU, discovered after honeypot Telnet brute-force activity from a Vietnamese IP, downloads an ARM payload (vlxx.arm) and attempts privilege escalation by editing /etc/passwd or exploiting CVE-2026-46300 (Fragnesia), CVE-2026-43284 (Dirty Frag), and CVE-2026-31431 (Copy Fail). It combines Mirai-style TCP, UDP, ICMP, HTTP, QUIC and DNS floods with application attacks against Minecraft, FiveM, OpenVPN and WireGuard. The malware uses X25519 and ChaCha20-Poly1305 encrypted C2, unusually broad persistence across systemd, cron, init frameworks, and Android hooks, plus anti-debugging and decoy traffic to hinder analysis. Implementers copied x86 shellcode into the ARM binary and reused an RFC 7748 test-vector key, indicating low-quality but rapidly evolving commodity development.

GBHackers·updated Sep 11, 14:17 UTC · 5d ago·first Sep 11, 09:07 UTC · 5d agoMalware in the wild 2 sourcesCVE-2026-46300CVE-2026-43284CVE-2026-31431

Why Is SHAP Not a Reliable Standalone Explanation Framework for Malware Detection?

arXiv paper shows SHAP gives unreliable standalone explanations for malware detection, with attribution dilution and sign reversal in dependent PE feature spaces.

The paper argues SHAP's formal guarantees are insufficient for reliable malware interpretation because the explained feature-coalition game is fixed only by analyst choices, not by malware behavior in the data. In static Portable Executable feature spaces, dependent feature groups cause conditional SHAP to dilute credit by a factor of 1/m across redundant features, attribute importance to features the model never uses, and even reverse attribution signs; interventional SHAP queries off-manifold coalitions no real executable exhibits. Experiments on EMBER-2018, EMBER-2024, and BODMAS with fixed LightGBM and XGBoost detectors confirm these effects. The authors position SHAP as a limited diagnostic requiring explicit data-distribution statements and domain validation, not a standalone explanation framework.

arXiv cs.CR·Sep 4, 02:00 UTC · 12d agoResearch1

Your threat feed is someone else's database: What ingesting malware intel at scale takes

GitHub's Dependabot lead shares five production lessons for ingesting community malware intelligence feeds across eight package ecosystems at scale.

GitHub's Dependabot team monitors over 30 million repositories and extended malicious-package advisories from npm to eight package ecosystems by ingesting OpenSSF's malicious-packages intelligence. The team catalogued roughly 18 new malicious npm packages per day in the year ending May 2026. The write-up argues that provenance with batch reverts, fingerprinting to catch echo-chamber duplicates, and heavyweight normalization are the make-or-break engineering for feed ingestion. It also recommends automated publishing with import caps and anomaly flagging, and quarantining malformed records rather than silently repairing them.

Help Net Security·Sep 3, 00:00 UTC · 13d agoResearch1

StopAndProtect Turns 2,000 Hacked WordPress Sites Into a Criminal Network

Check Point uncovered StopAndProtect, a cybercrime operation using ~2,000 hacked WordPress sites for ClickFix-driven malware delivery, data theft, surveillance, and ransomware.

Check Point Research identified the StopAndProtect operation in May 2026; it abuses close to 2,000 compromised WordPress sites, many running outdated software, to host malware stages, act as C2, and store stolen data. Infection starts with fake CAPTCHA ClickFix prompts that trick visitors into running a PowerShell command, followed by .NET downloaders deploying ransomware, SMB/USB worm, lockscreen, chat, and credential-stealing components. Rather than always encrypting, operators selectively exfiltrate file lists and specific files; researchers found 700+ stolen-data archives, roughly 31,000 screenshots, and 6,000+ unique victim IP addresses, including WhatsApp activity monitoring.

Security Affairs·Aug 20, 07:20 UTC · 27d agoThreat actor in the wild