30
47
30
AI models' written reasoning steps correspond to distinct internal patterns, a new study finds
KAIST and Naver AI Lab researchers show LLM reasoning steps like extraction and computation map to distinct activation patterns, strongest in middle layers.
Researchers at KAIST and Naver AI Lab defined eight recurring reasoning operations, including extraction, decomposition, formula recall, deduction, and computation, and showed they correspond to separable activation patterns in Qwen2.5-7B, Qwen3-8B, and Gemma4-31B on math tasks, with GPT-5 labeling solution segments. The separation peaks in middle layers, holds even when a computation step produces a wrong answer, and goes beyond surface-level token choice. Findings replicated on Llama-3-8B, and classifiers trained on Qwen3-8B transferred to GPQA-Diamond and MATH-500. The authors note that using internal states for error detection or mid-generation steering remains future work.
42
30
47
42
45
45
30
30
57
57
57
North Korean Hackers Deploy New Linux Espionage Toolkit
Rapid7 says North Korea-aligned actors use a new Linux espionage toolkit (ted HAProxy backdoor, CurlRAT) against South Korean automotive and media targets.
Rapid7 reports a stealthy Linux framework comprising a custom HAProxy backdoor ('ted'), trojanized system binaries (agetty, atd, crond, polkitd, sshd), an SSH keylogger, and CurlRAT that polls C&C every 12 hours. Initial access came via a Groupware login portal flaw, with credential harvesting enabling lateral movement to internal systems. The toolkit supports long-term surveillance, HTTP traffic interception/injection, and drive-by downloads, likely in use since late 2024. Infrastructure and artifacts overlap Operation SyncHole, suggesting Lazarus or APT37 involvement.
72
Iranian Hackers Pose as Recruiters to Deliver Cross
Kaspersky attributes new cross-platform RATs NodeRabbit and PollCat to Iranian group Nimbus Manticore, spread via recruiter-themed LinkedIn lures.
Kaspersky links two previously undocumented malware families, NodeRabbit (Node.js) and PollCat (obfuscated JavaScript), to the Iranian threat actor Nimbus Manticore, also known as Iranian Dream Job. Victims in Afghanistan, Egypt, and Ethiopia received trojanized coding challenge archives containing fake npm packages (colorized_terminal, pretty-log) that silently launched the RATs as background processes. NodeRabbit contacts Azure-hosted C2 servers via checkin, task, and result API endpoints and supports 11 commands including shell execution, file operations, and network enumeration. Persistence is platform-specific: Windows Run keys or scheduled tasks, Linux cron entries, and macOS launch agents, impersonating Microsoft Edge updates or Intel's Driver & Support Assistant.
55
55
30
42
45
30
45
42
42
42
60
45
60
30
60
30
30
42
45
55
57
57
60
57
30