Cybersecurity Weekly: From AI-Driven Malware to Dark Web Accountability

In the rapidly shifting landscape of global cybersecurity, the past week has served as a stark reminder of how threat actors are evolving their tactics to exploit modern infrastructure, ranging from open-source AI tools to the foundational security of federal agencies. SecurityWeek’s weekly cybersecurity news roundup provides a vital distillation of these developments, offering a concise yet comprehensive look at the vulnerabilities, policy shifts, and criminal prosecutions that defined the threat environment over the last several days. As organizations continue to integrate advanced automation and artificial intelligence into their workflows, attackers are demonstrating a sophisticated, often patient approach to infiltrating these very systems.

PoeLLM Malware: A Cryptic Approach to Botnet Expansion

One of the most intriguing developments involves the emergence of "PoeLLM," a malware strain identified by Black Lotus Labs that has been active since April 2026. This campaign specifically targets exposed AI services and open-source infrastructure, including LiteLLM, Ollama, Gotenberg, and Gitea. The primary objective of the malware is twofold: the unauthorized mining of cryptocurrency and the expansion of a malicious botnet.

What makes PoeLLM particularly noteworthy is its unconventional command-and-control (C&C) architecture. Rather than hardcoding IP addresses into the malware—which would make it easily detectable by static analysis—the attackers have turned to a GitHub-hosted poem. Infected machines are programmed to extract four specific keywords from this poem, which are then algorithmically converted into the IP address of the current C&C server. This mechanism allows the operator to change the infrastructure at will simply by updating the poem, a tactic that has already been utilized 11 times. Current intelligence assessments suggest the operator is likely an Italian-speaking individual, highlighting the global nature of modern cyber-criminal operations.

Persistent Threats: The GhostAction Supply Chain Campaign

The risks inherent in software supply chains continue to loom large, as evidenced by the resurgence of the "GhostAction" campaign. According to analysis from GitGuardian, this campaign has aggressively pushed secret-stealing GitHub Actions workflows into 772 public repositories belonging to 373 distinct users and organizations between August 31 and September 30.

The scope of this campaign is significant, with researchers identifying the theft of 2,577 sensitive secrets, including SSH keys, Azure and AWS credentials, and various database access tokens. Despite appearing to have paused at times, GitGuardian’s data suggests that the campaign has maintained a persistent presence. The attackers have largely relied on a proven playbook from 2025, updating only their exfiltration servers to maintain the flow of stolen data. This serves as a cautionary tale for organizations relying heavily on third-party integrations, emphasizing the need for robust secret scanning and stricter governance over automated development workflows.

Justice Served in Cryptocurrency Fraud

In a significant legal development, a jury has convicted 36-year-old Jonathan Spalletta of Maryland for his role in the collapse of the decentralized crypto exchange, Uranium Finance. Spalletta was found guilty of computer fraud and money laundering related to two separate hacks in 2021. By exploiting vulnerabilities in the exchange’s smart contracts, Spalletta absconded with approximately $1.4 million in the first attack and a staggering $53.3 million in the second, which ultimately forced the exchange to cease operations.

The laundering process was complex, involving a series of transactions through privacy-focused services like Tornado Cash. Investigators discovered that the illicit funds were subsequently used to purchase an array of high-value collectibles, including rare Pokémon cards, Magic: The Gathering cards, and antique Roman coins. Spalletta now faces a potential sentence of up to 10 years in prison for the fraud count and an additional 20 years for money laundering, marking a major victory for federal prosecutors in the ongoing effort to hold cybercriminals accountable for large-scale financial theft.

Policy and Oversight: CISA and Operational Technology

At the federal level, the Cybersecurity and Infrastructure Security Agency (CISA) has moved to refine its internal human capital strategy. CISA has announced it will maintain its Cybersecurity Retention Incentive program—which can provide bonuses of up to 25% of a base salary—through fiscal year 2027. However, the agency is tightening the criteria for eligibility. Under the new rules, staff must achieve an "exceeds expectations" performance rating and dedicate at least 51% of their time to cyber-specific duties within designated job series. This overhaul follows a critical report from the Department of Homeland Security’s inspector general, which concluded that the program had been applied too broadly and suffered from inadequate management oversight.

Simultaneously, the Operational Technology Cybersecurity Coalition (OTCC) is advocating for more rigorous standards for federal civilian agencies. The coalition has submitted a proposal for a CISA Binding Operational Directive (BOD) specifically targeting Operational Technology (OT). These agencies manage more than 8,000 facilities, many of which rely on legacy systems for HVAC, power management, and building automation. The OTCC is pushing for a requirement that agencies appoint a senior official with direct accountability for OT security and that they prioritize CISA’s Cybersecurity Performance Goals to harden these critical physical systems against potential cyber intrusions.

Credential Stuffing and AI-Linked Attacks

The retail sector continues to grapple with the fallout of credential stuffing attacks. Domino’s recently confirmed that a small number of its customers had their accounts accessed by unauthorized third parties. The company clarified that its own systems were not breached, and no payment information is stored within the compromised accounts; rather, the attackers utilized email and password combinations leaked from unrelated third-party data breaches. As a precautionary measure, the company has initiated account resets for all affected users.

Meanwhile, international concerns are mounting regarding the potential intersection of AI and nation-state cyber activities. South Korean President Lee Jae Myung has publicly noted signs that artificial intelligence may have been employed in recent hacking incidents targeting the nation’s banking sector. While the full scale of the breach—which resulted in the theft of customer personal information—is still under investigation, security firm CrowdStrike has provided compelling evidence during its analysis of the attack infrastructure. Researchers identified Claude Code session histories, ARTEX configuration files, and Claude memory files, leading the firm to conclude with moderate confidence that a financially motivated, Chinese-speaking threat actor is likely responsible for the sophisticated operation.

Dark Web Marketplaces and Hardware Vulnerabilities

The era of the "Empire Market" has officially closed with the sentencing of its co-creator, 30-year-old Raheim Hamilton of Virginia. Hamilton was sentenced to 40 years in federal prison and ordered to pay $5 million in fines after pleading guilty to drug conspiracy charges. Operating from 2018 to 2020, Empire Market facilitated over four million transactions totaling more than $430 million. While primarily a hub for illegal drug sales, the marketplace also served as a clearinghouse for stolen credentials, hacking tools, and counterfeit currency. His partner, Thomas Pavey, is expected to be sentenced later this month.

On the technical front, researchers have disclosed a high-severity vulnerability (CVE-2026-47483) affecting Nvidia’s DCGM Exporter, a tool used for GPU telemetry and monitoring. The flaw allows unauthenticated attackers to overwhelm the exporter’s profiling endpoints, potentially crashing the service and degrading the performance of AI workloads running on the same host. Scans conducted earlier this year revealed that approximately 2,100 hosts were publicly exposing this exporter without authentication, leaving telemetry from more than 12,000 GPUs vulnerable. Nvidia has since released a patch in version 4.8.2, and administrators are being urged to update immediately.

Rounding out the week’s news, the open-source ecosystem saw another supply chain incident involving the "tensorlake" npm SDK. Version 0.5.144 was compromised to include a credential-stealing worm that executes during installation, reminiscent of the "Shai-Hulud" attack methodology. Once installed, the malware harvests credentials for various services, including Kubernetes, AWS, and GitHub, while also scraping configurations from AI coding tools. The compromised package is capable of self-propagation, further emphasizing the extreme caution required when pulling dependencies from public repositories in today’s interconnected development environment.