solarmarkerMalware
- Jupyter
- polazert
- yellow cockatoo
Unit 42 notes that they identified a new version of SolarMarker, a malware family known for its infostealing and backdoor capabilities, mainly delivered through search engine optimization (SEO) manipulation to convince users to download malicious documents.From MISP Galaxy
Last reported today, by The Register (security)11 reports
ATT&CK techniques
6 of 17 · each with the sentence it comes from- T1027Obfuscated Files or Information
“Obfuscated Files or Information - Indicator Removal from Tools”
- T1027.005Indicator Removal from Tools
“Obfuscated Files or Information - Indicator Removal from Tools”
- T1036Masquerading
“Want to shed light on masquerading malicious binaries?”
- T1055Process Injection
“On August 31, 2021, Elastic observed process injection telemetry that shared techniques with the Jupyter Infostealer as reported by Morphisec, Binary Defense, and security researcher Squibydoo [1] [2] [3] [4] [5].”
- T1056.001Keylogging
“…of remote administration functions, including features such as system information collection, file management, remote desktop viewing, keylogging, and command execution.”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter - PowerShell”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
11 reports, newest first · the exact sentence from each-
Autonomous attack agent in 'Skynet mode' hijacks other models to carry out its evil deeds“…e internet-wide asset discovery, botnet command-and-control, database dumping through Prisma, exploit modules aimed at VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask/Werkzeug deployments that allow remote code execution, GraphQL and generic command injection, serv…”
-
Hackers hijack exposed AI models to launch cyberattacks at victims’ expense“They covered internet-wide scanning for targets, exploits for Django, Jupyter, Laravel and other web frameworks, dumping of exposed databases and control of a botnet.”
-
Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation“The exploits target Microsoft Visual Studio Code, Django, Jupyter, Laravel, Supabase, Next.js, and Flask/Werkzeug deployments.”
-
Deno Goes the Way of the Dinosaur“His announced fork, Ende, would drop Node compatibility and cut features he considers distractions, including Deploy, KV, and Jupyter integration.”
-
N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled "go-titan," and how to hunt for it“Probed Ray Dashboard through :8265/api/version; static code also contains LightLLM, Ray, Marimo, Jupyter, and FastGPT deployment paths”
-
Advent of Configuration Extraction, Part 2: QuasarRAT Config“The article begins by detailing the environment: Jupyter Notebook, pythonnet, dnSpy and friends—so every step is reproducible.”
-
141 Key Cybersecurity Statistics for 2026 and Beyond“Remote access trojans (RATs) like AsyncRAT and Jupyter were used in over 75% of observed remote access attacks.”
-
2025 Cybersecurity Threat Report“Remote access trojans (RATs) are more popular: Over 75% of remote access incidents utilized RATs such as AsyncRAT and Jupyter.”
-
Google Cloud for Cyber Data Analytics“Various tools and programming languages can be utilized for data extraction, including Python, R, Go, Jupyter Notebooks, and Looker Studio.”
-
Accelerating Elastic detection tradecraft with LLMs“We also explored using the GCP Vertex AI Workbench to facilitate collaborative work on Jupyter notebooks, but the complexity of using the available open source (OSS) models made them challenging to use during the short ONWeek.”
-
Going Coast to Coast - Climbing the Pyramid with the Deimos Implant“A remote access tool is actively being developed in campaigns beyond the initially reported Jupyter Infostealer, SolarMarker, and Yellow Cockatoo campaigns”
Indicators in its reports
named in the reports above- instr.opcode[.]namein 1 report
- instr.operand[.]namein 1 report
- vb[.]netin 1 report
- main.test[.]namein 1 report
- field[.]namein 1 report
- 4ef44bf6815e7860…912c38ac9639in 1 report
- mtype[.]namein 1 report
- instr.operand.declaringtype[.]namein 1 report
- typedef[.]namein 1 report
- method[.]namein 1 report
- www.esentire[.]comin 1 report
- google.cloud[.]storagein 1 report
- google[.]cloudin 1 report
- datetime.datetime[.]nowin 1 report
- plt[.]showin 1 report
- 650326ac2b1100c4508b8a700b658ad7in 1 report
- d2e227be5d58955a8d12db18fca5d787in 1 report
- a5fb52fc397f782c691961d23cf5e785in 1 report
- 4284a9859ab2184b017070368b4a73cdin 1 report
- 89555a8780abdb39d3f1761918c40505in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.