Threat IntelligenceOct 9, 2026

In Other News: AI Used in Korean Bank Breaches, Poem-Guided Botnet, Empire Admin Gets 40 Years

AI malware, supply chain attacks, crypto hacks, and CISA retention pay updates.

This roundup covers several cybersecurity incidents, including PoeLLM malware using GitHub poems for C&C communication, the GhostAction campaign expanding to more GitHub repos, a jury convicting a hacker for the Uranium Finance breach, CISA updating its cyber retention pay criteria, and South Korea investigating AI's potential role in bank cyberattacks.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

Vendor Watch

Run LiteLLM?

Get an email when a new story names LiteLLM, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works Privacy

The lesson from this incident

Full lesson

This roundup highlights how threat actors are rapidly innovating attack techniques, including using AI to enhance bank cyberattacks and embedding command-and-control (C2) instructions inside GitHub-hosted poems to evade detection. The PoeLLM malware demonstrates that attackers are abusing trusted, legitimate platforms like GitHub to blend malicious traffic with normal developer activity, making traditional detection methods insufficient. The Uranium Finance breach conviction underscores that DeFi and financial platforms remain high-value targets requiring rigorous access controls and audit trails. Collectively, these incidents show that defenders must evolve monitoring strategies to account for AI-augmented threats and covert communication channels hidden in plain sight.

What helps against this

How we list vendors

GitGuardian research Palo Alto Networks research

Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
For exampleGitHub Advanced Security Palo Alto Networks Idira Secrets Management HashiCorp Vault all options
Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
For exampleRecorded Future Cyber Operations Dataminr Agentic Threat Intelligence Platform Google Threat Intelligence all options
Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
For exampleSnyk Open Source Sonatype Firewall GitHub Advanced Security all options

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

malware — PoeLLM
malware — Tornado Cash

Entities

LiteLLM (product)Ollama (product)Gotenberg (product)Gitea (product)GitHub Actions (product)Tornado Cash (product)