Attacker exploits misconfigured AI tool to run AI-generated payload

MITRE Techniques

• [T1105] Ingress Tool Transfer – Attackers downloaded cryptominers and malicious JAR files from external URLs to the victim system. (“The script then downloads two cryptominers, T-Rex and XMRig” / “downloaded a Java-based loader from 185.208.159[.]155”)
• [T1547.001] Boot or Logon Autostart Execution: Systemd Service – Persistence was established by creating a systemd service ‘ptorchupdater’ to run the malicious Python script. (“uses a systemd service… ‘ptorchupdater’ to try to masquerade as a legitimate service”)
• [T1055] Process Injection – The payload used LDPRELOAD to load shared objects (processhider, argvhider) to hide miner processes and arguments from detection. (“compiled into shared objects and were loaded using LDPRELOAD”)
• [T1071.001] Application Layer Protocol: Web Protocols – Discord webhook was used for command and control communication. (“A Discord webhook was leveraged for command and control (C2)”)
• [T1027] Obfuscated Files or Information – The payload used multi-layer Base64 encoded and compressed Python code obfuscated with PyObfuscator (pyklump). (“The code is obfuscated using PyObfuscator… 64 layers deep”)
• [T1539] Steal Web Session Cookie – The infostealer component stole Discord authentication tokens by hijacking desktop_core.js. (“Malicious code… attempts to hijack Discord and steal the victim’s authentication token”)
• [T1555] Credentials from Password Stores – Attackers targeted Chrome extension credentials for theft. (“This malware contains packages that can be used for credential theft from Chrome extensions”)