Threat Actors

Profiling adversary groups targeting AI systems and leveraging AI in their operations.

Jun 26, 2026 4 min read

Gaslight: North Korean Backdoor Poisons AI Malware Analysis Tools

SentinelLabs discovered a Rust-based macOS backdoor attributed to North Korea that embeds 38 fake system messages designed to trick AI-assisted malware triage into aborting or refusing analysis.

Jun 25, 2026 5 min read

Threat Actors

Threat Actors Are Systematically Scanning Enterprise LLM Deployments

GreyNoise honeypots captured 91,403 attack sessions targeting enterprise LLM endpoints across two distinct campaigns between October 2025 and January 2026. One campaign fingerprinted 73+ model endpoints across all major AI providers. The other exploited SSRF vulnerabilities in Ollama and Twilio integrations.

img of PROMPTSTEAL: How APT28 Used an LLM to Generate Attack Commands

Jun 25, 2026 6 min read

Threat Actors

PROMPTSTEAL: How APT28 Used an LLM to Generate Attack Commands

APT28's PROMPTSTEAL malware queries an LLM via the Hugging Face API to dynamically generate Windows recon commands, marking the first confirmed use of LLM-driven malware in live operations against real targets.

img of North Korea Poisons 144 AI Framework npm Packages in 88 Minutes

Jun 23, 2026 4 min read

Threat Actors

North Korea Poisons 144 AI Framework npm Packages in 88 Minutes

Microsoft attributes the Mastra AI npm supply chain attack to Sapphire Sleet, a North Korean state actor: 144 packages backdoored via a hijacked contributor account, targeting LLM API keys, cloud credentials, and cryptocurrency wallets.

img of LLMjacking Evolved: Stolen Compute Powers Autonomous Offensive Tools

Jun 22, 2026 4 min read

Threat Actors

LLMjacking Evolved: Stolen Compute Powers Autonomous Offensive Tools

Sysdig caught a threat actor using a misconfigured Ollama instance as the reasoning engine for an automated offensive pentesting framework — a significant escalation from credential theft to weaponised AI infrastructure.