Researchers from Palo Alto Networks' Unit 42 have demonstrated a novel technique to bypass the safety guardrails of popular Large Language Models (LLMs).
This research highlights a class of vulnerabilities in the logic of AI systems rather than a specific software flaw, so no CVE-ID has been assigned; the exploitation status is a Proof of Concept.
Vulnerability Details
Affected Product: Large Language Models (LLMs), particularly those used as 'AI Judges' to enforce safety policies. This includes open-weight enterprise models and high-parameter models.
Identifier: Not Applicable
CVSS Score: Not Applicable
Exploitation Status: Proof of Concept
Risk & Impact
Triage: High priority for organizations developing or deploying LLM-based applications, as the technique can systematically defeat AI guardrails.
Attack Vector: The attack uses a method called "fuzzing" to identify and use stealthy, innocent-looking inputs, like formatting symbols, to manipulate an LLM's decision-making logic and authorize policy violations. This is a form of prompt injection.
Ease of Exploit: The researchers developed an automated fuzzer, AdvJudge-Zero, that achieved an attack success rate of approximately 99% in testing.
Action Plan
Immediate Action: Adopt adversarial training by using internal fuzzing tools to identify weaknesses and then retraining the model on these examples to harden the system.
Workaround: Implement multi-layered defenses. Do not rely solely on built-in guardrails or AI judges; employ robust input validation and output filtering mechanisms.
Detection: Monitor for unusual prompt patterns and anomalous outputs that deviate from established policies. Organizations can use services like Unit 42's AI Security Assessment to help identify weaknesses.
Relevant professional terms
LLM Guardrails
A suite of programmable, rule-based safety measures designed to oversee and regulate user interactions with LLM applications, ensuring the model adheres to an organization's established policies.
Prompt Injection
A type of attack where a malicious user crafts inputs designed to manipulate the LLM, bypassing safety restrictions to make it generate harmful, offensive, or unauthorized outputs.
For over a year, a Russian-speaking threat actor has been targeting Human Resources (HR) departments with a multi-stage malware campaign.
The campaign delivers a new tool, BlackSanta, designed to disable Endpoint Detection and Response (EDR) and antivirus solutions to facilitate data theft.
Key TTPs
Initial Access: Phishing emails with links to resume-themed ISO files hosted on cloud services like Dropbox.
Execution: A malicious LNK file inside the ISO executes obfuscated PowerShell commands, which use steganography to extract payloads from an image file.
Defense Evasion: BlackSanta uses a Bring-Your-Own Vulnerable Driver (BYOVD) technique to gain kernel-level access and terminate EDR and antivirus processes.
Campaign Analysis
This long-running campaign demonstrates a sophisticated adversary using a multi-layered approach to bypass security.
The use of a dedicated EDR killer at the kernel level shows a significant effort to remain undetected while exfiltrating sensitive data from compromised networks.
Targeting & Infrastructure
Target Profile: Human Resources (HR) and recruitment personnel who frequently handle external documents.
Infrastructure: C2 communication is conducted over HTTPS, with payloads hosted on attacker-controlled domains.
Actionable Intelligence
Domains:resumebuilders.us
Relevant Terms
EDR (Endpoint Detection and Response): A cybersecurity solution that continuously monitors endpoint devices (like laptops and servers) to detect and respond to cyber threats like malware and ransomware.
BYOVD (Bring Your Own Vulnerable Driver): An attack technique where malware loads a legitimate, but vulnerable, third-party driver to gain high-level system privileges and bypass security controls.
A new Android banking trojan, BeatBanker, is being distributed through websites mimicking the Google Play Store.
The malware poses as a legitimate Starlink application to hijack user devices, steal financial credentials, and mine cryptocurrency.
Key TTPs
Initial Access: Distributed via fake Google Play Store websites offering a malicious APK disguised as a Starlink app.
Execution: Tricks users into granting extensive permissions, including Accessibility Services, to gain control and install additional payloads.
Defense Evasion: Loads encrypted DEX code into memory, delays execution post-installation, and plays a silent audio file to maintain persistence and avoid process termination.
Campaign Analysis
This campaign demonstrates a hybrid threat model, combining a banking trojan with a cryptocurrency miner to maximize revenue from victims. The latest versions have evolved to deploy a full-featured Remote Access Trojan (RAT), indicating a shift towards complete device takeover.
Targeting & Infrastructure
Target Profile: Android users in Brazil.
Infrastructure: Malicious websites impersonating the Google Play Store.
Relevant Terms
Banking Trojan: A type of malware specifically designed to steal banking credentials from infected devices, often by using fake login screens or capturing keystrokes.
Remote Access Trojan (RAT): Malware that provides an attacker with complete remote administrative control over a victim's computer or device.
A new malware botnet dubbed KadNap is actively compromising ASUS routers and other edge networking devices.
Its primary goal is to create a large-scale proxy network to conceal and facilitate malicious traffic for cybercrime operations.
Key TTPs
Initial Access: Infection begins with the download of a malicious shell script (aic.sh) from a hardcoded IP address.
Execution: The script downloads and executes the main payload, an ELF binary named "kad," which installs the KadNap client.
Defense Evasion: The botnet uses a custom version of the Kademlia (DHT) peer-to-peer protocol to hide its command-and-control (C2) infrastructure, making it difficult to track and disrupt.
Campaign Analysis
This campaign highlights the ongoing trend of threat actors targeting insecure IoT and edge devices to build resilient, anonymized infrastructure.
The compromised devices are sold as a proxy service called Doppelganger, which is used to launch attacks like DDoS and credential stuffing.
Targeting & Infrastructure
Target Profile: Primarily ASUS routers, though other edge networking devices are also vulnerable.
Infrastructure: The botnet has grown to over 14,000 compromised devices, with the majority located in the United States.
Actionable Intelligence
IPs:212.104.141[.]140
Relevant Terms
Botnet: A network of malware-infected devices controlled remotely by an attacker to perform automated tasks, such as launching DDoS attacks.
Proxy Network: An intermediary network of servers (in this case, compromised routers) that forwards traffic, masking the true origin of the malicious activity.
The Russia-affiliated threat actor Sednit (APT28) has deployed a sophisticated dual-implant toolkit for long-term cyber-espionage campaigns. The group is primarily targeting Ukrainian military personnel to facilitate surveillance and data exfiltration.
Key TTPs
Initial Access: Social engineering via Signal or WhatsApp, persuading targets to open Trojanized documents.
Execution: The primary implant, a modified version of the open-source Covenant framework, executes post-exploitation tasks. A secondary implant, BeardShell, executes PowerShell commands.
Defense Evasion: Utilizes legitimate cloud services like Icedrive and Filen for command-and-control (C2) communications to blend in with normal network traffic.
Campaign Analysis
After years of using simpler tools, Sednit has returned to using custom, sophisticated malware, indicating a significant operational shift. The dual-implant strategy, using different cloud providers for C2, enhances resilience against takedowns and complicates detection.
Targeting & Infrastructure
Target Profile: Ukrainian military personnel and government entities.
Infrastructure: Abuses legitimate cloud storage services (Icedrive, Filen, formerly pCloud and Koofr) for C2 infrastructure.
Relevant Terms
Implant: Malicious software installed on a compromised system to establish persistent access and control for an attacker.
C2 (Command and Control): The server infrastructure that attackers use to send commands to compromised systems and receive stolen data.
Threat actors published five malicious packages to the Rust `crates.io` repository, masquerading as time-related utilities to steal sensitive `.env` file data from developer environments and CI/CD pipelines.
Key TTPs
Initial Access: Publishing typosquatted packages to the public `crates.io` repository (Software Supply Chain Compromise).
Execution: The malicious code executes when a developer includes and calls the compromised crate in their project, triggering the exfiltration of secrets.
Defense Evasion: Packages masqueraded as legitimate, time-related utilities to deceive developers. One package, `chrono_anchor`, used additional obfuscation to hide its malicious logic.
Campaign Analysis
This campaign highlights the growing trend of supply chain attacks targeting developers through trusted package registries. By impersonating common utilities, attackers exploit developer trust to inject malicious code that steals credentials and secrets directly from automated build and integration pipelines.
Targeting & Infrastructure
Target Profile: Software developers and organizations utilizing the Rust programming language, particularly within automated CI/CD environments.
Infrastructure: The attack leveraged the official `crates.io` repository for distribution and a lookalike domain (`timeapis[.]io`) for data exfiltration.
Relevant Terms
CI/CD Pipeline: An automated software development process that allows developers to build, test, and deploy code changes frequently and reliably.
Typosquatting: A type of supply chain attack where an attacker publishes a malicious package to a public repository with a name very similar to a popular, legitimate package.
Threat actors are exploiting vulnerabilities and weak credentials in FortiGate firewalls to gain initial network access.
The primary goal is to extract configuration files, steal service account credentials, and facilitate deeper network infiltration.
Key TTPs
Initial Access: Exploitation of known vulnerabilities (e.g., CVE-2025-59718, CVE-2026-24858) or weak credentials.
Execution: Attackers have used PowerShell to download malware from cloud storage and deployed remote access tools like Pulseway and MeshAgent.
Defense Evasion: Malware is launched via DLL side-loading to evade detection.
Campaign Analysis
This campaign highlights a focus on edge devices as a primary intrusion vector. By compromising firewalls, attackers gain significant access to protected environments, including service accounts connected to authentication infrastructure like Active Directory.
Targeting & Infrastructure
Target Profile: Observed victims include organizations in healthcare, government, and managed service providers (MSPs).
Infrastructure: FortiGate Next-Generation Firewall (NGFW) appliances are the primary infrastructure being abused.
Actionable Intelligence
IPs:172.67.196[.]232
Relevant Terms
NGFW (Next-Generation Firewall): An advanced network security device that combines traditional firewall capabilities with additional features like deep-packet inspection and application-level filtering.
DLL Side-Loading: A technique where an attacker places a malicious DLL in a location where a legitimate application will load it, allowing the malicious code to be executed.
