In mid-July 2025, a novel campaign emerged in which cybercriminals weaponized generative AI to fabricate deepfake images of government IDs, embedding them within spear-phishing messages that bypassed traditional antivirus safeguards.

These emails impersonated military and security institutions, complete with convincing visual assets generated by ChatGPT.

Recipients were urged to review “draft” ID cards, triggering the download of malicious archives that executed obfuscated scripts.

The sophistication of this operation underscores a troubling evolution in adversary tactics, blending artificial intelligence with legacy evasion techniques to infiltrate sensitive networks.

The threat actor, attributed to the Kimsuky group, leveraging both AutoIt and PowerShell, delivered a multi-stage payload from South Korean C2 servers.

Initially, a compressed archive contained a shortcut file masquerading as a legitimate document.

When opened, this shortcut invoked a batch command via cmd[.]exe to assemble malicious instructions stored in an environment variable.

These commands drove a series of HTTP requests to retrieve a deepfake PNG file and a batch script, both of which executed immediately upon arrival.

Genians analysts identified that the batch script employed environment-variable slicing—extracting characters one at a time using expressions like "% ab901ab [:] ~ 7,1 %"—to reconstruct the commands required for payload deployment.

This technique not only conceals malicious intent from signature-based engines but also evades heuristic detection by delaying visible actions until the full command string is built.

Metadata within the downloaded image confirmed its AI-generated origin, flagging it as a deepfake with 98% probability when analyzed through a specialized detector.

Despite its reliance on advanced AI heuristics, the campaign still hinged on classic persistence and obfuscation strategies.

Victims’ machines registered scheduled tasks under the guise of legitimate software updates, ensuring the payload ran at regular intervals.

The combined use of generative-AI assets and automated scripting created a hybrid threat that challenges conventional antivirus products.

Security teams must therefore augment their defenses with behavioral analysis and endpoint detection and response (EDR) solutions capable of monitoring script activity and scheduled-task creation in real time.

Infection Mechanism

The initial wave began with a spear-phishing email disguised as a draft review of government ID cards.

Recipients clicking the link received a ZIP archive named Government_ID_Draft[.]zip containing Government_ID_Draft[.]lnk.

This shortcut launched cmd[.]exe with a long string assigned to an environment variable, then leveraged character slicing to rebuild the malicious PowerShell command dynamically.

Upon reconstruction, the script fetched two payloads: a deepfake PNG file rendered by ChatGPT and an accompanying batch script.

The batch script then created a scheduled task named "HncAutoUpdateTaskMachine", disguised as a Hancom Office update, to execute HncUpdateTray[.]exe and its accompanying config[.]bin on a seven-minute interval.

Obfuscation persisted within the AutoIt-compiled script, which used a variation of the Vigenère cipher to encrypt configuration strings and hinder static analysis.

This layered approach to infection and persistence illustrates a new level of adversary innovation, integrating generative AI with traditional malware delivery pipelines.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Hackers Using Generative AI ‘ChatGPT’ to Evade Anti-virus Defenses appeared first on Cyber Security News.

The BlackNevas ransomware group has emerged as a significant threat since November 2024, continuously launching devastating attacks against businesses and critical infrastructure organizations across Asia, North America, and Europe.

This sophisticated malware operation combines file encryption with data theft tactics, threatening to leak stolen information if ransom demands are not met within seven days.

The ransomware demonstrates a particularly aggressive targeting strategy, with approximately 50% of its attacks focused on the Asia-Pacific region.

Countries including Japan, Thailand, and South Korea have experienced substantial impacts, while European targets span Western Europe and the Baltic Sea region, including the United Kingdom, Italy, and Lithuania. In North America, the group has specifically targeted organizations in Connecticut.

ASEC researchers identified that BlackNevas operates independently without following the traditional Ransomware-as-a-Service model.

The threat actors maintain their own data leak site and claim partnerships with affiliated groups to pressure victims into compliance.

The malware appends the distinctive “.-encrypted” extension to compromised files, making the encryption immediately apparent to victims.

Unlike many ransomware variants that incorporate anti-debugging or sandbox evasion techniques, BlackNevas takes a different approach by supporting multiple command-line arguments that modify its behavior.

The malware includes parameters such as “/fast” for encrypting only one percent of file content, “/full” for complete file encryption, and “/stealth” for changing extensions and creating ransom notes during the encryption process.

Advanced Encryption Implementation and File Targeting Strategy

The ransomware employs a sophisticated dual-encryption approach combining AES symmetric keys with RSA public key cryptography.

During the encryption process, BlackNevas generates a unique AES key for each file, encrypts the content, then secures the AES key using an embedded RSA public key before appending it to the end of the encrypted file.

The malware demonstrates selective targeting by excluding critical system files to maintain system stability.

Protected extensions include sys, dll, exe, log, bmp, vmem, vswp, vmxf, vmsd, scoreboard, nvram, and vmss files, along with specific files like “NTUSER.DAT” and its own ransom note “how_to_decrypt.txt”.

Interestingly, BlackNevas creates two distinct filename patterns during encryption: standard files receive randomized names with the “-encrypted” extension, while specific document types including doc, docx, hwp, jpg, pdf, png, rtf, and txt files are prefixed with “trial-recovery” as a demonstration of decryption capabilities.

The encryption verification process involves checking 8-byte values at file endings to determine encryption status and file type classification.

This methodology eliminates local decryption possibilities, as the RSA private key remains exclusively with the attackers, making file recovery impossible without paying the ransom or possessing advanced cryptographic capabilities.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post BlackNevas Ransomware Encrypts Files and Steals Sensitive Data From Affected Companies appeared first on Cyber Security News.

The cybersecurity landscape witnessed a significant escalation in July 2025 when the China-aligned threat actor Hive0154, commonly known as Mustang Panda, deployed sophisticated new malware variants designed to breach air-gapped systems.

This advanced persistent threat group introduced SnakeDisk, a novel USB worm, alongside an updated Toneshell9 backdoor, representing a calculated evolution in their cyber espionage capabilities targeting East Asian networks.

The campaign demonstrates Mustang Panda’s strategic focus on circumventing traditional network security measures through physical propagation methods.

SnakeDisk operates with geographical precision, executing only on systems with Thailand-based IP addresses, suggesting highly targeted operations coinciding with recent geopolitical tensions between Thailand and Cambodia.

The malware’s selective activation mechanism reflects the group’s sophisticated operational security and desire to minimize exposure while maximizing impact against specific targets.

IBM analysts identified these malware variants through a comprehensive analysis of weaponized archives uploaded from Singapore and Thailand throughout mid-2025.

The researchers discovered that SnakeDisk shares significant code overlaps with previous Tonedisk variants while introducing enhanced evasion techniques and air-gap penetration capabilities.

The USB worm’s deployment alongside the Yokai backdoor indicates a multi-stage infection strategy designed to establish persistent access across isolated network environments.

The threat actor’s operational methodology involves distributing weaponized archives through cloud storage platforms like Box, often disguised as legitimate documents from government agencies.

These archives contain trojanized software that sideloads malicious DLLs, initiating the infection chain. Once established, the malware establishes persistence through scheduled tasks and registry modifications, ensuring continued access even after system reboots.

PDF containing download link for weaponized archive deploying Toneshell7 (Source – IBM)

The emergence of these tools coincides with escalating border conflicts between Thailand and Cambodia, suggesting state-sponsored motivations behind the campaign.

Mustang Panda’s ability to develop geographically-targeted malware demonstrates their advanced technical capabilities and strategic intelligence gathering operations.

Advanced USB Propagation and Air-Gap Penetration Mechanisms

SnakeDisk employs sophisticated techniques to weaponize USB devices and penetrate air-gapped systems.

The malware begins execution by parsing a configuration file using a custom two-phase XOR decryption algorithm with a 320-byte key.

This configuration contains 18 string values that define the worm’s operational parameters, including directory structures, file names, and persistence mechanisms.

The USB infection process starts with comprehensive device detection using the Windows API IOCTL_STORAGE_GET_HOTPLUG_INFO to identify removable storage devices.

Upon detecting a USB drive, SnakeDisk creates a sophisticated file structure that hides the user’s original files within subdirectories while placing a weaponized executable in the root directory.

The malware uses both SHFileOperationW and robocopy commands to relocate existing files, as demonstrated in the following operation:

robocopy <drive_letter>:\ <drive_letter>:\<urd>\<uud>\ /XD "<drive_letter>:\<urd>\" /XF "<drive_letter>:\<unendl_org>" /E /MOVE

This process creates multiple hidden directories with SYSTEM and HIDDEN attributes, effectively concealing the malicious infrastructure while maintaining the appearance of a normal USB device.

The worm establishes a Windows message loop to monitor for WM_DEVICECHANGE events, enabling real-time detection of USB insertion and removal events.

When a device is removed, SnakeDisk triggers payload execution, dropping the Yokai backdoor into the C:\Users\Public\ directory through a series of concatenated encrypted files that reconstruct the final malicious executable upon deployment.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Mustang Panda With SnakeDisk USB Worm and Toneshell Backdoor Seeking to Penetrate Air-Gap Systems appeared first on Cyber Security News.