@VirLabs_AI

AI-powered reverse-engineering https://xitter.cf/t.co/4ekdN1jbuU

Joined February 2026
  • Tweets52
  • Following3
  • Followers332
1Media
New VirLabs research: Tessera, an undocumented backdoor targeting MikroTik RouterOS on TILE-Gx. The samples had 0 detections on VirusTotal. Underneath a small launcher and wrapper sits a fairly sophisticated remote-control implant. virlabs.ai/blog/tessera/

Tessera: reverse-engineering a backdoor on forgotten silicon | VirLabs

The discovery of an unknown malware family affecting MikroTik CCR1000 routers. Unpacking it reveals file transfer, process execution, layered encryption, and cleanup, but leaves its deployment and...

virlabs.ai
1
11
1
40
4,442
more replies
Once authenticated, the operator gets file upload/download, process execution with output capture, metadata queries, checksumming, session control, and more. There is also an auto-update/replacement mechanism involving via the local path: .hug.um.
1
1
89
The infrastructure is interesting too. The sample is configured for 131.255.4[.]144:443 (live). Its self-signed certificate has been observed across a small set of servers on several hosting providers since 2024. I could not tie the infrastructure or malware to a known actor.
1
94
[Insert witty knock-knock joke] I found an interesting/undetected Linux sample on VirusTotal: a port-knocking launcher that waits for a packet sequence before executing a separate payload, which unfortunately I couldn't find. virlabs.ai/blog/knock-outd/

knock-outd: an undetected port-knocking backdoor in the wild | VirLabs

An undetected Linux launcher uses libpcap to bind to the nerwork interface, and waits for three packets before executing a missing companion.

virlabs.ai
1
4
2
17
7,024
The launcher disguises itself as bash and monitors a network interface in promiscuous mode. Once triggered by a sequence of 3 packets, it runs /sbin/xfs_timesupdate with the sender’s IP address and a selected port. (I assume it's a reverse shell of some sort.)
1
1
466
The malware uses libpcap with the following filter to detect the sequence: dst host [IP] and src port 35646 or 46589 or src portrange 41232-41238 As far as I know, it has never been reported on and I couldn't attribute it to any known activity. Let me know if you get hits!
1
1
286
In the first sample, uploaded to VT a minute after being compiled, four "models" actually return hardcoded answers ("exfiltrate" always wins). Its handler logs messages and enumerates local interfaces without stealing or sending data. The shellcode generator produces four NOPs.
1
1
226
more replies
Hot take: LLM-controlled malware might in fact be very difficult to achieve in practice: attackers simply have no way of meaningfully protecting secrets. If I were to find API keys in a sample, you better believe I'd be "imposing cost" and burning tokens like there's no tomorrow.
1
1
80
Original research: blog.talosintelligence.com/t… (h/t @iknowuhack)

The Closed Quorum: Inside the first reported autonomous AI C2 implant

CLOSEDQUORUM, a malware binary discovered through Cisco Talos’ CAIRN project, exhibits fully autonomous command and control (C2). It represents a shift in effort displacement for attackers, in which...

blog.talosintelligence.com
1
84
CLOSEDQUORUM, spotted by @TalosSecurity asks four LLMs to decide what a Windows implant should do next. AI-as-a-C2? I analyzed two samples from their report. There is real experimentation here, but the implant was never really finished. virlabs.ai/blog/closedquorum….

CLOSEDQUORUM's paint is still wet | VirLabs

CLOSEDQUORUM offers a glimpse of LLM-directed malware in the making, complete with hardcoded decisions, broken injection and a decision loop that only decides once. Autonomy remains a work in...

virlabs.ai
1
4
1
11
5,662
Two names in a Linux rootkit configuration led back to HestiaCP compromises reported months before Acronis's Red Heron report. I used VirLabs to follow the trail through SIXZUT, JITTERLY and their infrastructure. virlabs.ai/blog/red-heron/

Tracing SIXZUT and JITTERLY in the wild | VirLabs

VirLabs links additional JITTERLY samples to a populated SIXZUT configuration and artifacts reported in HestiaCP compromises. The findings complement Acronis and GreyNoise research into related...

virlabs.ai
1
5
1
9
5,749
more replies
Working hypothesis: acquiring servers for staging and proxying may be a substantial part of this actor's job. The data theft documented by Acronis and GreyNoise could be opportunistic, in the context of mass 1-day exploitation (speculation).
1
69
Several related hostnames still resolve to public IPs. The post includes current and historical infrastructure, recovered configurations, and eight sample hashes with very low detections. Full analysis, with links to the VirLabs reports: virlabs.ai/blog/red-heron/

Tracing SIXZUT and JITTERLY in the wild | VirLabs

VirLabs links additional JITTERLY samples to a populated SIXZUT configuration and artifacts reported in HestiaCP compromises. The findings complement Acronis and GreyNoise research into related...

virlabs.ai
52
Load more