The malware may also be controlled by an AI model due to multiple references to this in the code. The use of test infrastructure indicates the malware is still under development and may soon appear in real-world attacks. The analyzed samples contain a zero-filled fine-tuned DistilBERT multilingual model file, likely because the threat actor used these samples to test detection while avoiding the disclosure of the actual model. Malicious APK hash: f80321b8690194d48219fcd12265d7a1

Many organizations prepare for sophisticated attacks, but real-world incident response tells a different story. According to investigations from Kaspersky’s Global Emergency Response Team and Managed Detection and Response experts, attackers most often succeed by exploiting familiar weaknesses like stolen credentials, excessive privileges, and long-unpatched vulnerabilities. See how three real incidents unfolded and what organizations can learn from them: kas.pr/md1y