[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpODtlaKwcICxR61otHX4v7TEzfcs4zyuoa_KmxypL_E":3},{"article":4,"iocs":53,"watch_terms":59,"solutions":60,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"4d31a3eb-38dc-4753-917e-6a720ecb3275","In Other News: AI Used in Korean Bank Breaches, Poem-Guided Botnet, Empire Admin Gets 40 Years","in-other-news-ai-used-in-korean-bank-breaches-poem-guided-botnet-empire-admin-ge-77e8a1","Noteworthy stories that might have slipped under the radar: Tensorlake npm SDK compromised, Empire Market co-founder gets 40 years, exposed NVIDIA GPU monitors leak telemetry. The post In Other News: AI Used in Korean Bank Breaches, Poem-Guided Botnet, Empire Admin Gets 40 Years appeared first on SecurityWeek.","This roundup covers several cybersecurity incidents, including PoeLLM malware using GitHub poems for C&C communication, the GhostAction campaign expanding to more GitHub repos, a jury convicting a hacker for the Uranium Finance breach, CISA updating its cyber retention pay criteria, and South Korea investigating AI's potential role in bank cyberattacks.","AI malware, supply chain attacks, crypto hacks, and CISA retention pay updates.","https:\u002F\u002Fwww.securityweek.com\u002Fin-other-news-ai-used-in-korean-bank-breaches-poem-guided-botnet-empire-admin-gets-40-years\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F10\u002Fcybersecurity-news.jpg","2026-10-09T12:03:50+00:00","2026-10-09T14:00:08.106414+00:00",7,[17,20,22,24,26,28],{"name":18,"type":19},"LiteLLM","product",{"name":21,"type":19},"Ollama",{"name":23,"type":19},"Gotenberg",{"name":25,"type":19},"Gitea",{"name":27,"type":19},"GitHub Actions",{"name":29,"type":19},"Tornado Cash","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":30,"icon":32,"name":33,"slug":34},null,"Threat Intelligence","threat-intelligence",[36,41,46,51],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":52},{"id":30,"icon":32,"name":33,"slug":34},[54,57],{"type":50,"value":55,"context":56},"PoeLLM","Malware active since at least April 2026 that targets exposed AI and open-source services.",{"type":50,"value":29,"context":58},"Used by Uranium Finance hacker to launder funds.",[18,21,23],{"controls":61,"vendors":141},[62,91,119],{"slug":63,"name":64,"problem":65,"products":66},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"slug":34,"name":92,"problem":93,"products":94},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"slug":120,"name":121,"problem":122,"products":123},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},[142,148],{"slug":143,"name":144,"logo_path":145,"roles":146},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png",[147],"reported_by",{"slug":76,"name":77,"logo_path":78,"roles":149},[147],{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":166},"ai-assisted-bank-breaches-and-poem-guided-malware-highlight-evolving-c2-evasion-tactics","AI-Assisted Bank Breaches and Poem-Guided Malware Highlight Evolving C2 Evasion Tactics","This roundup highlights how threat actors are rapidly innovating attack techniques, including using AI to enhance bank cyberattacks and embedding command-and-control (C2) instructions inside GitHub-hosted poems to evade detection. The PoeLLM malware demonstrates that attackers are abusing trusted, legitimate platforms like GitHub to blend malicious traffic with normal developer activity, making traditional detection methods insufficient. The Uranium Finance breach conviction underscores that DeFi and financial platforms remain high-value targets requiring rigorous access controls and audit trails. Collectively, these incidents show that defenders must evolve monitoring strategies to account for AI-augmented threats and covert communication channels hidden in plain sight.",[155,156,157,158,159,160,161,162,163,164,165],"CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","CIS Control 16: Application Software Security","NIST SP 800-53 SI-4: Information System Monitoring","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 IR-4: Incident Handling","NIST CSF DE.CM-1: Network Monitoring","NIST CSF RS.AN-1: Notifications from Detection Systems Investigated","MITRE ATT&CK T1102: Web Service (C2 via Trusted Platforms)","GDPR Article 32: Security of Processing (for EU-adjacent financial data)","ITIL: Continual Service Improvement – Security Monitoring",{}]