Cisco Talos found a 16.4MB Go implant that asks DeepSeek, Qwen, Mistral and Gemini what to do next and acts on the winning vote, treating the providers themselves as its C2 infrastructure. Talos has no confirmation it was ever deployed.
Perspective Coverage
7 publishers
- Builder
- Builder 28%
- Operator
- Operator 66%
- Investor
- Investor 6%
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap+30
- Incentives45
- Confidence62
Ontinue says the Python implant takes tasking from SharePoint dead drops over Graph API, relays interactive sessions through Teams TURN, and moves all of it through the victim's own headless Edge.
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap+20
- Incentives40
- Confidence60
AvisLoader statically links the reference Tox client, so its operator keeps the same identity after moving to a new server. The ClickFix page and Cloudflare tunnel that deliver it are still ordinary takedown targets.
Publishers:varonis.com
Reality
- Evidence66
- Adoption20
- Hype gap+18
- Incentives62
- Confidence57
Cisco Talos says its CLOSEDQUORUM sample asks four language models for executable decisions, tallies the votes and acts on the winner. An entire phase of the attack runs while the operator is offline.
Reality
- Evidence50
- Adoption8
- Hype gap+40
- Incentives62
- Confidence54
Kaspersky says a previously unknown multi-stage loader has spread since mid-August through a compromised public torrent archive. It reaches its command server through the Solana blockchain. Victims include government and transport organisations.
Reality
- Evidence32
- Adoption30
- Hype gap+35
- Incentives85
- Confidence50
Zscaler ThreatLabz says the Pakistan-aligned group worked government and defense targets in India and Afghanistan with four undocumented tools, one of them a Rust backdoor that takes its orders from files in a private repo.
Reality
- Evidence40
- Adoption25
- Hype gap+18
- Incentives65
- Confidence45
Zscaler says a Rust backdoor tied to ransomware activity moved its command channel onto GitHub. The first version beaconed once a second to a bare HTTP endpoint. The second one does not need a domain at all.
Reality
- Evidence58
- Adoption24
- Hype gap+12
- Incentives68
- Confidence52