The attackers used publicly known flaws to gain access and leveraged AI-powered tools for reconnaissance, exploit development, and other actions.
BTR_CLI can be used as anu00a0EDR/AVu00a0bypass technique, disabling security solutions using au00a0trusted Windows driver, without relyingu00a0on typicalu00a0BYOVDu00a0techniques.
The attacks reportedly start with ZIP files that use shortcut (.LNK) files to begin the infection.
In brief: Threat actors are actively exploiting flaws in Apple, Microsoft, Zimbra, and other software; Russian hackers target defense and aerospace sectors in Europe and the US; and more.
The malware appears to have been developed mainly by human operators, but shows signs of AI-assisted development.
The indictment expands on a 2018 case and adds new defendants.
In the Dahua case, attacks involved a persistent backdoor account named p2pwn, paired with the password p2password.
