[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fMP6ff5F28GqD7bX3sPonMxlEmPIagHHmdpcCSnavE9A":3,"$fpjQ1hjP2iU6gtSvJ2oLuSChRzvg2Q5_I7RGV3gtNWa0":49},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":45,"created_at":46,"updated_at":47,"published_at":48},"palo-alto-unit-42-405-ai-enabled-malware-samples-show-12-in-production","Palo Alto Unit 42: 405 AI-enabled malware samples show 12 in production","FunkSec ransomware leads with 7 LLM-assisted variants compiled in six days, while 393 samples remain PoC or researcher code.","Palo Alto Networks Unit 42 analyzed 405 AI-enabled malware samples and found the space is dominated by PoC and researcher code, with only 12 samples hitting production endpoints across five distinct malware families.",[10,11,12,13,14],"AI malware","FunkSec","Palo Alto Unit 42","ransomware","LLM","# Palo Alto Unit 42: 405 AI-enabled malware samples show 12 in production\n\n*FunkSec ransomware leads with 7 LLM-assisted variants compiled in six days, while 393 samples remain PoC or researcher code.*\n\n**Tags:** `AI malware` `FunkSec` `Palo Alto Unit 42` `ransomware` `LLM`\n\n> Palo Alto Networks Unit 42 analyzed 405 AI-enabled malware samples and found the space is dominated by PoC and researcher code, with only 12 samples hitting production endpoints across five distinct malware families.\n\n---\n\n## 405 AI-enabled malware samples analyzed\n\nPalo Alto Networks Unit 42 has analyzed 405 AI-enabled malware samples across Cortex XDR-protected endpoints in three countries, identifying five distinct malware families. Only 12 of the samples reached production endpoints, with the remaining 393 observed in earlier stages of the campaign. The five families are FunkSec ransomware, the Oyster backdoor, the Rhadamanthys stealer, a trojanized AI application, and a COM hijacking DLL. FunkSec is the most represented family, with seven distinct variants compiled between Jan. 1 and Jan. 6, 2025, and PDB paths revealing project names including Dev.pdb, Funksec.pdb, Darkzone.pdb, and Darkfunk.pdb.\n\n## FunkSec ransomware: 7 variants in 6 days\n\nFunkSec is the most represented family in the endpoint data, with seven distinct variants compiled between Jan. 1 and Jan. 6, 2025. The PDB paths embedded in the binaries reveal project names — Dev.pdb, Funksec.pdb, Darkzone.pdb, and Darkfunk.pdb — consistent with a developer iterating on the same codebase under multiple working names. Seven builds in six days is a pace that suggests LLM-assisted development. The binaries exhibit the standard behavioral indicators: volume shadow copy deletion and a desktop wallpaper swap to display the ransom note.\n\n## The other four families\n\nThe remaining four families round out the campaign. Oyster is a backdoor delivered via CleanBoost, a trojanized loader that drops the payload after initial execution. Rhadamanthys is an infostealer, the type of malware that scrapes browser credentials, crypto wallets, and form data from the victim’s session. The COM hijacking DLL, 360Util.dll, replaces a legitimate COM object to intercept and log traffic at the component level. Finally, RecipeLister is a trojanized AI application — the social engineering layer that lures users into running the payload under a recognizable AI brand name.\n\nAll five families were observed on Cortex XDR-protected endpoints across three countries. The 405 samples span the full campaign, with 12 reaching production endpoints and the remaining 393 caught in earlier stages. The SHA256 hashes confirm the family assignments: RecipeLister, seven FunkSec variants, the 360Util.dll COM hijacker, and the Oyster\u002FCleanBoost backdoor each have distinct hashes in the endpoint data.\n\n## Who was hit\n\nThe 405 samples were observed on Cortex XDR-protected endpoints across three countries, all in IT and software organizations. The five families are confirmed by SHA256 hash: RecipeLister (1619bcad…), seven FunkSec variants (5226ea8e… through dd15ce86…), the 360Util.dll COM hijacker (c398b3e0…), and the Oyster\u002FCleanBoost backdoor (bb932056…).\n\n## Key points\n\n- 405 AI-enabled malware samples analyzed across five distinct families\n- 12 samples hit production endpoints; 393 are PoC\u002Fresearcher code\n- FunkSec ransomware has 7 variants compiled Jan 1–6, 2025 with LLM-assisted development\n- PDB paths reveal project names: Dev.pdb, Funksec.pdb, Darkzone.pdb, Darkfunk.pdb\n- Trojanized RecipeLister, Oyster backdoor, Rhadamanthys stealer, and COM hijacking DLL round out the five families\n\n## Further reading & sources\n\n- [The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https:\u002F\u002Funit42.paloaltonetworks.com\u002Fai-enabled-malware-analysis) — PaloAlto Networks Unit 42\n- [Cybercriminals Eye DeepSeek, Alibaba LLMs for Malware Development - Infosecurity Magazine](https:\u002F\u002Fwww.infosecurity-magazine.com\u002Fnews\u002Fdeepseek-alibaba-llms-malware\u002F)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fpalo-alto-unit-42-405-ai-enabled-malware-samples-show-12-in-production.png?v=efb3f6f578",{"actors":18,"malware":24,"technologies":36},[19],{"url":20,"name":11,"slug":21,"type":13,"origin":22,"motivation":23},"\u002Fthreat-groups\u002Ffunksec","funksec","Algeria (encryptor author assessed by Check Point to be an inexperienced Algeria-based developer)","financial and ideological (hacktivism\u002Fcybercrime hybrid)",[25,27,28,30,32,34],{"name":26},"Oyster",{"name":11},{"name":29},"Rhadamanthys",{"name":31},"360Util.dll",{"name":33},"Funksec ransomware",{"name":35},"infostealer",[37,40,42],{"vendor":38,"product":39},"Palo Alto Networks","Cortex XDR",{"vendor":38,"product":41},"Advanced WildFire",{"vendor":43,"product":44},"DeepSeek","R1","threat_actor_activity","2026-09-26T12:10:59.266452+00:00","2026-10-16T12:28:04.845626+00:00",null,{"articles":50},[51,62,74,85],{"slug":52,"title":53,"summary":54,"tags":55,"hero_image_url":60,"story_type":45,"created_at":61},"gen-digital-researchers-unveil-wordlistloader-and-synkloader-malware-loaders-for","Gen Digital Researchers Unveil WordlistLoader and SynkLoader Malware Loaders for ClickFix Infostealer Delivery","Gen Digital researchers identified two new malware loaders, WordlistLoader and SynkLoader, that deliver infostealers and phishing credentials through the ClickFix technique and are sold to ransomware affiliates.",[56,57,58,59,35,13],"Gen Digital","ClickFix","WordlistLoader","SynkLoader","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgen-digital-researchers-unveil-wordlistloader-and-synkloader-malware-loaders-for.png?v=ea5de72eef","2026-09-25T12:05:45.613962+00:00",{"slug":63,"title":64,"summary":65,"tags":66,"hero_image_url":72,"story_type":45,"created_at":73},"palo-alto-unit-42-details-thehatman-s-august-2026-credential-attack-campaign","Palo Alto Unit 42 details TheHatman's August 2026 credential attack campaign","Palo Alto Networks Unit 42 published a threat brief on August 18, 2026, detailing TheHatman's large-scale credential attack campaign that ran from August 1–17, 2026, where the actor exfiltrated ~3.6M employee records from Microsoft Entra tenants and sold them across multiple forums.",[67,12,68,69,70,71],"TheHatman","Microsoft Entra","password spraying","MFA fatigue","Azure","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fpalo-alto-unit-42-details-thehatman-s-august-2026-credential-attack-campaign.png?v=a517fffda4","2026-09-17T17:06:03.041262+00:00",{"slug":75,"title":76,"summary":77,"tags":78,"hero_image_url":83,"story_type":45,"created_at":84},"acronis-tru-details-inc-ransomware-evolution-with-800-victims-and-yara-rules","Acronis TRU details INC ransomware evolution with 800+ victims and YARA rules","Acronis Threat Research Unit publishes a detailed analysis of INC ransomware, tracing its evolution from an emerging RaaS operation to a top-tier group with 800+ victims since 2023, including full attack chain, YARA rules, and IOCs.",[13,79,80,81,82],"INC","Lynx","Acronis","RaaS","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Facronis-tru-details-inc-ransomware-evolution-with-800-victims-and-yara-rules.png?v=f32eebbecf","2026-09-04T07:03:39.197374+00:00",{"slug":86,"title":87,"summary":88,"tags":89,"hero_image_url":95,"story_type":96,"created_at":97},"lockfile-ransomware-hijacks-windows-domains-via-petitpotam-ntlm-relay","LockFile Ransomware Hijacks Windows Domains via PetitPotam NTLM Relay","LockFile ransomware gang is leveraging the PetitPotam NTLM relay attack (CVE-2021-36942) to take over Windows domain controllers, with initial access gained through ProxyShell on Exchange servers.",[13,90,91,92,93,94],"PetitPotam","NTLM relay","ProxyShell","LockFile","CVE-2021-36942","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Flockfile-ransomware-hijacks-windows-domains-via-petitpotam-ntlm-relay.png?v=3ebd8c1c3f","ransomware_incident","2026-09-26T07:06:42.867972+00:00"]