SkynetMalware
Last reported today, by The Register (security)5 reports
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1552.004Private Keys
“Browser makers untrusted its root after it used weak private keys to generate eight intermediary certificates.”
- T1195Supply Chain Compromise
“Microsoft Threat Intelligence assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multitenant application.”
- T1542.003Bootkit
“APT41 revives BlackLotus bootkit: Chinese cyber espionage group APT42 has been using new versions of the BlackLotus bootkit , named BlackX, which they have used to target entities all over Central Asia.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
Autonomous attack agent in 'Skynet mode' hijacks other models to carry out its evil deeds“Autonomous attack agent in 'Skynet mode' hijacks other models to carry out its evil deeds”
-
Hackers hijack exposed AI models to launch cyberattacks at victims’ expense“A directive the operators called “Skynet” mode told the model to run tools without asking permission and to keep scanning for targets, infecting them and deploying cryptocurrency miners on its own.”
-
Risky Bulletin: Supply chain attack lets ransomware group inside 40+ shipping companies“Skynet agent hijacks exposed AI: An AI agent is scanning the internet for exposed LLM endpoints and hijacks them to run its own attacks.”
-
Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation“The activity is powered by an offensive AI agent, which operates in a "Skynet mode" to scan and infect targets with miners and allow the threat actors to run their own attacks.”
-
Four Cyber Threats Harboring Big Plans for the Future“Not unlike the fictional Skynet sending increasingly sophisticated ‘Terminators’ as older versions of the monster failed to achieve their earthly missions, cyberattacks are growing more persistent and automated, further testing an organization’s security maturity.”
Indicators in its reports
named in the reports above- railway[.]comin 1 report
- pylos[.]coin 1 report
- infosec[.]exchangein 1 report
- masto.deoan[.]orgin 1 report
- sheogorath.bsky[.]socialin 1 report
- chaos[.]socialin 1 report
Copy these 6 indicators · defanged
Thanks — we review every report.