Discover All the Reasons Why This Year is a Can't-Miss Conference

Table of Contents

Cyberthreat Analysis

• Linux Malware Delivered Via Malicious RAR Filenames Evades Antivirus Detection
• Warlock: From SharePoint Vulnerability Exploit to Enterprise Ransomware
  
• ESET Discovers PromptLock, the First AI-Powered Ransomware

Industry News

#NMFTACyber On Demand

Linux Malware Delivered Via Malicious RAR Filenames Evades
Antivirus Detection

Cybersecurity researchers have shed light on a novel attack chain that employs phishing emails to deliver an open-source backdoor called VShell.

The "Linux-specific malware infection chain that starts with a spam email with a malicious RAR archive file," Trellix researcher Sagar Bade said in a technical write-up.

"The payload isn't hidden inside the file content or a macro, it's encoded directly in the filename itself. Through clever use of shell command injection and Base64-encoded Bash payloads, the attacker turns a simple file listing operation into an automatic malware execution trigger."

The technique, the cybersecurity company added, takes advantage of a simple yet dangerous pattern commonly observed in shell scripts that arises when file names are evaluated with inadequate sanitization, thereby causing a trivial command like eval or echo to facilitate the execution of arbitrary code.

What's more, the technique offers the added advantage of getting around traditional defenses, as antivirus engines don't typically scan file names.

The starting point of the attack is an email message containing a RAR archive, which includes a file with a maliciously crafted file name: "ziliao2.pdf`{echo,<Base64-encoded command>}|{base64,-d}|bash`"

Specifically, the file name incorporates Bash-compatible code that's engineered to execute commands when it's interpreted by the shell. It's worth noting that simply extracting the file from the archive does not trigger execution. Rather, it occurs only when a shell script or command attempts to parse the file name.

Warlock: From SharePoint Vulnerability Exploit to Enterprise Ransomware

Organizations continue to grapple with increasingly complex cyberthreats, as ransomware groups rapidly evolve their tactics. In a recent attack wave, the Warlock ransomware group exploited internet-exposed, unpatched on-premise Microsoft SharePoint servers, abusing newly discovered vulnerabilities to gain initial access to their target’s system. Other groups such as Linen Typhoon and Violet Typhoon have also been observed exploiting these vulnerabilities against internet-facing SharePoint servers. More details on these vulnerabilities and how Trend mitigates their impact can be found in the relevant knowledge base entry.

This multi-stage attack highlights how vulnerabilities in public-facing applications, combined with stealthy lateral movement and advanced payloads, can lead to swift and devastating compromise across enterprise environments.

The Warlock ransomware campaign exemplifies how quickly threat actors can weaponize enterprise vulnerabilities for high-impact extortion activities. Through the exploitation of the SharePoint vulnerabilities, attackers were able to bypass authentication, achieve remote code execution (RCE), and rapidly pivot across compromised networks.

In this entry, Warlock provides an in-depth analysis of this ransomware campaign, including a comprehensive technical breakdown of the observed tactics, intent behind each command, and actionable recommendation guidelines. This report is intended for defenders, information security professionals, and IT administrators looking to understand the threat in detail.

ESET Discovers PromptLock, the First AI-Powered Ransomware

ESET researchers have uncovered a new type of ransomware that leverages generative artificial intelligence (GenAI) to execute attacks. Named PromptLock, the malware runs a locally accessible AI language model to generate malicious scripts in real time. During infection, the AI autonomously decides which files to search, copy, or encrypt — marking a potential turning point in how cybercriminals operate.

“The emergence of tools like PromptLock highlights a significant shift in the cyber threat landscape,” said Anton Cherepanov, senior malware researcher at ESET, who analyzed the malware alongside fellow researcher Peter Strýček.

PromptLock creates Lua scripts that are compatible across platforms, including Windows, Linux, and macOS. It scans local files, analyzes their content, and—based on predefined text prompts—determines whether to exfiltrate or encrypt the data. A destructive function is already embedded in the code, though it remains inactive for now.

The ransomware uses the SPECK 128-bit encryption algorithm and is written in Golang. Early variants have already surfaced on the malware analysis platform VirusTotal. While ESET considers PromptLock a proof of concept, the threat it represents is very real.

“With the help of AI, launching sophisticated attacks has become dramatically easier—eliminating the need for teams of skilled developers,” added Cherepanov. “A well-configured AI model is now enough to create complex, self-adapting malware. If properly implemented, such threats could severely complicate detection and make the work of cybersecurity defenders considerably more challenging.”

PromptLock uses a freely available language model accessed via an API, meaning the generated malicious scripts are served directly to the infected device. Notably, the prompt includes a Bitcoin address reportedly linked to Bitcoin creator Satoshi Nakamoto.

ESET has published technical details to raise awareness within the cybersecurity community. The malware has been classified as Filecoder.PromptLock.A.

Refer a Colleague

Would you like others at your company to be added to the NMFTA Headline Newsletter email distribution list? Send them this link or fill out the form for them on their behalf below!