ArgusMalware
RansomwareFrom MISP Galaxy
Last reported 12 days ago, by Sophos X-Ops5 reports
ATT&CK techniques
6 of 8 · each with the sentence it comes from- T1027Obfuscated Files or Information
“One method of defense subversion we at Huntress often encounter involves incredibly obfuscated malicious scripts—attributed as T1027.”
- T1027.004Compile After Delivery
“… aspnet_compiler.exe line is a known technique of AsyncRAT to compile the malicious executable once it had reached the target machine (T1027.004).”
- T1036Masquerading
“One particular offensive security technique I enjoyed unraveling involved an executable hidden within a LNK file (T1036).”
- T1055Process Injection
“Reflective loading, like process injection, takes advantage of the already existing allocated memory for a process.”
- T1140Deobfuscate/Decode Files or Information
“There are other techniques wrapped up in this LNK -> EXE, such as some light XOR encryption (T1140) that encrypts and then decrypts the bytes of the EXE, to evade detection.”
- T1204User Execution
“This method of defense evasion is completely user-oriented (T1204).”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
building intent-based access control without reading minds“When Larroche re-ran Euler and Argus with all remote logins retained in the Los Alamos National Laboratory test period, both still scored about 98% AUC, which measures how often a random attack outranks a random normal login.”
-
Palo Alto Networks and NVIDIA want tighter control over AI agents“The integration can use NVIDIA DOCA Argus to monitor agent execution paths and tool calls, enforce access rules for networks and external APIs, and send telemetry to Cortex XSIAM for analysis and response.”
-
Risky Bulletin: Two TeamPCP members arrested in Australia“AI finds WP theme zero-day: WordPress security firm Wordfence has used a custom agentic framework named Argus to find a six-step RCE exploit in the Avada WordPress theme.”
-
AI Security: NVIDIA BlueField Now with Vision One™“A key element that makes AI Factory EDR possible is the integration of the DOCA Argus microservice, which provides real-time situational awareness and runtime threat detection by inspecting host memory using advanced memory forensics.”
-
The Mechanics of Defense Evasion“Threat actors are adept at knowing how to leverage our own tooling against us, selectively poking the eyes of the Argus that is supposed to be our panoptic sentinel.”
Indicators in its reports
named in the reports above- hxxps://resources.nvidia[.]com/en-us-accelerated-networking-resource-library/deploy-operate-nvidia-ai-clouds?lx=LbHvpRin 1 report
- new50.noip[.]mein 1 report
- infosec[.]exchangein 1 report
- hxxps://www.techdirt[.]com/2026/08/26/meta-just-paid-nearly-17-billion-to-make-sure-it-gets-to-write-the-kid-safety-rules-for-every-other-social-media-platform/in 1 report
- www.techdirt[.]comin 1 report
- techdirt[.]comin 1 report
- martinmatishak.bsky[.]socialin 1 report
- esetresearch.bsky[.]socialin 1 report
Copy these 8 indicators · defanged
Thanks — we review every report.