405 AI-enabled malware samples analyzed
Palo Alto Networks Unit 42 has analyzed 405 AI-enabled malware samples across Cortex XDR-protected endpoints in three countries, identifying five distinct malware families. Only 12 of the samples reached production endpoints, with the remaining 393 observed in earlier stages of the campaign. The five families are FunkSec ransomware, the Oyster backdoor, the Rhadamanthys stealer, a trojanized AI application, and a COM hijacking DLL. FunkSec is the most represented family, with seven distinct variants compiled between Jan. 1 and Jan. 6, 2025, and PDB paths revealing project names including Dev.pdb, Funksec.pdb, Darkzone.pdb, and Darkfunk.pdb.
FunkSec ransomware: 7 variants in 6 days
FunkSec is the most represented family in the endpoint data, with seven distinct variants compiled between Jan. 1 and Jan. 6, 2025. The PDB paths embedded in the binaries reveal project names — Dev.pdb, Funksec.pdb, Darkzone.pdb, and Darkfunk.pdb — consistent with a developer iterating on the same codebase under multiple working names. Seven builds in six days is a pace that suggests LLM-assisted development. The binaries exhibit the standard behavioral indicators: volume shadow copy deletion and a desktop wallpaper swap to display the ransom note.
The other four families
The remaining four families round out the campaign. Oyster is a backdoor delivered via CleanBoost, a trojanized loader that drops the payload after initial execution. Rhadamanthys is an infostealer, the type of malware that scrapes browser credentials, crypto wallets, and form data from the victim’s session. The COM hijacking DLL, 360Util.dll, replaces a legitimate COM object to intercept and log traffic at the component level. Finally, RecipeLister is a trojanized AI application — the social engineering layer that lures users into running the payload under a recognizable AI brand name.
All five families were observed on Cortex XDR-protected endpoints across three countries. The 405 samples span the full campaign, with 12 reaching production endpoints and the remaining 393 caught in earlier stages. The SHA256 hashes confirm the family assignments: RecipeLister, seven FunkSec variants, the 360Util.dll COM hijacker, and the Oyster/CleanBoost backdoor each have distinct hashes in the endpoint data.
Who was hit
The 405 samples were observed on Cortex XDR-protected endpoints across three countries, all in IT and software organizations. The five families are confirmed by SHA256 hash: RecipeLister (1619bcad…), seven FunkSec variants (5226ea8e… through dd15ce86…), the 360Util.dll COM hijacker (c398b3e0…), and the Oyster/CleanBoost backdoor (bb932056…).
Key points
- 405 AI-enabled malware samples analyzed across five distinct families
- 12 samples hit production endpoints; 393 are PoC/researcher code
- FunkSec ransomware has 7 variants compiled Jan 1–6, 2025 with LLM-assisted development
- PDB paths reveal project names: Dev.pdb, Funksec.pdb, Darkzone.pdb, Darkfunk.pdb
- Trojanized RecipeLister, Oyster backdoor, Rhadamanthys stealer, and COM hijacking DLL round out the five families