Malware

TELEPUZ is a lightweight and modular malware, likely developed by a small team and potentially offered as a malware-as-a-service.

The OkoBot framework, particularly its SeedHunter module, targets popular hardware wallets like Ledger and Trezor.

The malware is written in C++ and uses a signed and notarized dropper to evade Gatekeeper.

LabubaRAT operates by impersonating NVIDIA's container runtime toolkit, using an executable named "nvidia-sysruntime.exe."

QiAnXin, a Chinese cybersecurity company, reported that while the group's operations may appear unsophisticated due to the use of SEO poisoning and counterfeit software installers, their organizational structure is more complex, involving multiple distributors.

The AI-generated tool, titled "100% Working AD Information Gathering Script - FULLY FIXED," exhibited several hallmarks of LLM assistance, including a placeholder server name, over-engineering with multiple fallback methods, and a "pretty" console output using excessive colors, Huntress said.

GigaWiper, written in Go, operates on Windows and presents operators with numbered commands, three of which are designed for system destruction.