◈ Encrygma — AI Cyber Security Intelligence. Defensive research only. No exploit code or attack instructions. All analysis based on public reporting & OSINT. ◈
27 articles tagged with #Malware
Encrygma analysts have identified a surge in sophisticated phishing operations utilizing the 'RedFlick' delivery technique. This method automates the deployment of the CosmicPulse backdoor, marking a significant evolution in Russian state-sponsored cyber espionage tactics.
Security researchers have identified a sophisticated Windows malware strain, CLOSEDQUORUM, that utilizes a voting mechanism between four distinct AI models to determine its next malicious action.
Bitdefender has released its October 2026 threat debrief, highlighting 'Operation KillSwitch' and a surge in ransomware activity. The report details evolving RaaS operations and new modular malware.
Researchers have identified a sophisticated new Windows malware, CLOSEDQUORUM, that leverages four distinct AI chatbots to autonomously execute credential theft and cryptocurrency exfiltration.
Russian state-sponsored actor Star Blizzard has adopted the 'RedFlick' technique to automate the deployment of its CosmicPulse backdoor, significantly reducing the need for direct victim interaction.
A sophisticated China-nexus threat actor, tracked as UAT-11587, is deploying the newly discovered 'Antino' backdoor to infiltrate government and policy organizations across Asia. The campaign leverages legitimate cloud services for command-and-control, complicating detection efforts.
Cisco Talos researchers have identified CLOSEDQUORUM, a sophisticated Windows malware that utilizes a consensus-based AI voting mechanism to execute malicious commands autonomously without human intervention.
Russian state-sponsored actor Star Blizzard is deploying the new 'RedFlick' malware delivery technique. The campaign leverages sophisticated steganography and AI-assisted evasion to deploy the CosmicPulse backdoor.
A China-linked threat actor, UAT-11587, is actively targeting government and policy organizations across Asia using a novel backdoor called Antino. The campaign leverages legitimate cloud services like Outlook and OneDrive for command-and-control communications.
Threat actors are leveraging a novel 'RedFlick' technique to distribute malware, marking a significant shift in evasion tactics. This development highlights the ongoing evolution of state-sponsored cyber espionage.
Security researchers have identified CLOSEDQUORUM, a novel Windows malware that utilizes a consensus of four distinct AI models to autonomously execute malicious actions, marking a shift in threat architecture.
Cisco Talos has identified a novel malware strain, CLOSEDQUORUM, that autonomously decides its next attack phase by polling four commercial AI models, eliminating the need for human operators.
Security researchers have identified CLOSEDQUORUM, a novel malware strain that utilizes a consensus-based voting mechanism across four commercial AI models to autonomously determine its next malicious move.
Security researchers have identified CLOSEDQUORUM, a novel malware strain that utilizes a consensus-based voting mechanism across four commercial AI models to autonomously determine its next malicious move.
Security researchers have identified a surge in activity from the Iranian state-sponsored group Nimbus Manticore. The group is deploying sophisticated new backdoors and SSH tunneling tools to maintain long-term persistence in targeted government and critical infrastructure networks.
The Iranian-linked threat actor Nimbus Manticore has launched a new wave of cross-platform cyber espionage campaigns. By masquerading as recruiters, they are deploying custom RATs to exfiltrate data.
Security researchers have identified a new iteration of the PromptFlux malware that utilizes live API calls to LLMs to rewrite its own source code, effectively bypassing traditional signature-based detection.
Security researchers have identified the Kothamine malware family utilizing Tailscale's 'tailcat' utility to bypass traditional network security controls. This technique allows attackers to maintain persistent, encrypted access while evading detection by standard perimeter defenses.
Microsoft Threat Intelligence has uncovered NeedyMantis, a sophisticated, modular post-compromise malware family. The threat is currently being deployed in highly targeted operations against critical sectors.
Recent intelligence confirms a surge in autonomous AI-agent attacks, including the first recorded incident in Spain and the discovery of malware like PhantomRaven, signaling a shift toward AI-driven operations.
Spanish authorities have confirmed the first incident of an autonomous AI agent conducting a multi-stage cyber attack. This marks a shift from AI-assisted tools to fully self-directed offensive operations.
A new Go-based malware, ClosedQuorum, has emerged, utilizing a sophisticated voting mechanism across four major LLMs to autonomously execute post-compromise attack stages without human intervention.
A new Go-based malware strain, ClosedQuorum, has emerged, utilizing a sophisticated voting mechanism across four major AI models to autonomously execute post-compromise attack decisions.
A sophisticated new Android malware, RatHat, has emerged, utilizing AI-powered subsystems to automate device navigation and bypass security controls for banking theft.
Cisco Talos has identified 'ClosedQuorum,' a novel Windows malware that utilizes a voting system between four different LLMs to autonomously execute post-compromise attack stages without human intervention.
A novel Windows malware strain, ClosedQuorum, has emerged, utilizing a multi-model AI voting system to autonomously determine post-compromise attack vectors without human intervention.
A sophisticated new Android malware family, RatHat, has emerged, utilizing an AI-powered subsystem to automate remote device navigation. Researchers have linked the campaign to Chinese-speaking threat actors.