“`html

Cyber Pulse: Backdoor Scanners, Stealthy RATs, and the Critical 90 Seconds of Incident Response

The digital threat landscape is evolving at a breakneck pace, with adversaries refining both their tools and tradecraft. Today’s headlines underscore a dual narrative: the relentless innovation of threat actors in exploiting trusted systems and software, and the security industry’s race to develop more intelligent, proactive defenses. From novel malware delivery mechanisms to sophisticated espionage campaigns targeting government entities, organizations must navigate a complex web of risks. This analysis dives into five critical stories, breaking down the technical nuances and strategic implications for cybersecurity professionals tasked with safeguarding their digital perimeters in an increasingly volatile environment.

🔍 Microsoft Develops Scanner to Detect Backdoors in Open-Weight LLMs

Microsoft’s AI Security team has announced a significant step towards securing the foundational models powering the AI revolution. Their newly developed “lightweight scanner” is designed to detect backdoors deliberately planted within open-weight large language models (LLMs). These backdoors could allow malicious actors to trigger hidden, harmful behaviors in an otherwise functional model. The scanner operates by analyzing three distinct, observable signals within the model’s architecture and weights, aiming to reliably flag these compromises while crucially maintaining a low rate of false positives—a key requirement for practical, large-scale deployment.

This tool addresses a growing concern as organizations increasingly fine-tune and deploy open-source LLMs. The “open-weight” ecosystem, while driving innovation, presents a supply chain risk where a poisoned model could be distributed widely. Microsoft’s move signifies a shift from purely output-based AI safety (post-generation filtering) to integrity checking of the model itself. By providing a method to vet these models before integration into enterprise systems, the scanner could become a critical checkpoint in the AI development lifecycle, helping to establish a chain of trust for AI components similar to software bill of materials (SBOM) initiatives.

Why this matters: As AI integration becomes ubiquitous, the security of the models themselves is paramount. This scanner represents a foundational tool for AI supply chain security, helping prevent scenarios where embedded backdoors could lead to data leaks, biased outputs, or system compromises triggered by specific inputs.
Read Source

☠️ DEAD#VAX Malware Campaign Deploys AsyncRAT via IPFS-Hosted VHD Phishing Files

A new malware campaign dubbed DEAD#VAX is demonstrating advanced evasion techniques by leveraging decentralized infrastructure and legitimate system features. Threat actors are distributing phishing emails containing links to Virtual Hard Disk (VHD) files hosted on the InterPlanetary File System (IPFS), a peer-to-peer network. This method complicates takedowns and attribution, as content on IPFS is distributed and resilient. The VHD files, when mounted, execute heavily obfuscated scripts that perform runtime decryption and in-memory loading of the final payload, AsyncRAT, avoiding writing malicious files to disk.

The campaign’s sophistication lies in its “disciplined tradecraft.” By using VHDs, it exploits a trusted Windows feature often used for legitimate software distribution. The extreme obfuscation and in-memory execution are designed to bypass signature-based antivirus and many behavioral detection tools. AsyncRAT itself is a powerful, open-source remote access trojan that gives attackers full control over a compromised system, enabling data theft, surveillance, and further network penetration. This multi-layered approach shows a clear understanding of modern defense-in-depth strategies and how to systematically bypass them.

Why this matters: DEAD#VAX highlights the trend of attackers abusing decentralized web protocols and trusted system features to enhance persistence and evade detection. It forces defenders to look beyond traditional web filters and file scanning, emphasizing the need for robust endpoint detection and response (EDR) capable of monitoring script behavior and in-memory activity.
Read Source

🐉 China-Linked Amaranth-Dragon Exploits WinRAR Flaw in Espionage Campaigns

A newly identified threat cluster, tracked as Amaranth-Dragon and linked to the broader APT 41 ecosystem, has been conducting cyber espionage campaigns throughout 2025. The group is targeting government and law enforcement agencies across Southeast Asia, with confirmed victims in Cambodia. Their operations leverage a critical vulnerability (CVE-2023-38831) in the widely used WinRAR file archiving utility, allowing them to execute arbitrary code when a victim opens a crafted archive file, such as a seemingly harmless .JPG or .PDF within a RAR archive.

Check Point Research’s attribution to China-linked actors underscores the persistent threat of state-sponsored espionage aimed at gathering intelligence and potentially influencing geopolitical dynamics in the region. The use of a known but potentially unpatched vulnerability in ubiquitous software demonstrates how attackers continue to find success with proven techniques, especially against targets that may have slower patch cycles. The “Amaranth-Dragon” moniker adds to the complex web of identified subgroups within prolific threat ecosystems, illustrating the specialization and compartmentalization of these advanced persistent threat (APT) operations.

Why this matters: This campaign is a stark reminder that known vulnerabilities remain a primary attack vector, even years after disclosure. It highlights the critical importance of consistent and timely patch management, especially for common utilities, and the ongoing risk of state-sponsored espionage to government and critical infrastructure entities worldwide.
Read Source

🆔 Orchid Security Introduces Continuous Identity Observability for Enterprise Applications

Orchid Security is tackling a fundamental shift in the identity and access management (IAM) landscape with its concept of “Continuous Identity Observability.” The core challenge they identify is that in modern enterprises, identity logic has sprawled far beyond the traditional IAM stack. It now resides within application code, APIs, service accounts, and custom authentication mechanisms, creating a vast “shadow identity” surface that is largely ungoverned by centralized tools.

Their solution aims to discover, analyze, and govern this dispersed identity usage. Traditional IAM tools were designed for managing users in directories, but they lack visibility into how identities are actually used and enforced within individual applications. This gap can lead to privilege creep, misconfigurations, and hidden paths for lateral movement. By providing continuous observability, Orchid’s platform seeks to map the entire identity fabric of an organization’s application portfolio, identifying anomalies, over-permissioned accounts, and deviations from security policy in real-time.

Why this matters: As enterprises digitize, identity becomes the new perimeter. This innovation addresses the critical gap between centralized IAM policy and decentralized identity implementation, which is a major risk for data breaches. It moves identity security from a static, configuration-based model to a dynamic, runtime monitoring discipline.
Read Source

⏱️ The First 90 Seconds: How Early Decisions Shape Incident Response Investigations

An expert perspective on incident response (IR) highlights a non-technical but critical factor in success: the initial moments after a detection. The argument posits that many IR failures stem not from a lack of tools or skill, but from poor decisions made under high pressure when information is scarce. The actions—or reactions—taken in the first 90 seconds can set an investigation on a path to recovery or lead to irreversible loss of control, evidence, or containment.

The commentary draws a distinction between technical capability and investigative discipline. Teams can overcome sophisticated attacks with limited data if they follow a calm, methodical process. Conversely, even well-equipped teams can falter if they rush to contain without scoping, inadvertently alert the adversary, or corrupt forensic artifacts. This emphasizes the need for pre-defined playbooks, clear communication protocols, and trained leadership that can manage the human factors of crisis response. It’s about institutionalizing a response mindset that values deliberate action over reflexive reaction.

Why this matters: This underscores that effective incident response is as much about process and psychology as it is about technology. Investing in tabletop exercises, clear escalation procedures, and war-room discipline is essential. The initial response phase is a strategic pivot point that determines the cost, duration, and ultimate success of handling a breach.
Read Source

Key Takeaways for Security Teams:

• AI Security is Now Supply Chain Security: Vet open-source and pre-trained AI models with the same rigor as any third-party software library.
• Decentralized Tech is a Double-Edged Sword: Attackers are leveraging platforms like IPFS for resilience. Defenses must adapt to monitor traffic to and from these networks.
• Patch Ubiquitous Software Relentlessly: Common utilities like WinRAR are high-value targets for espionage groups. Maintain aggressive patch management programs.
• Identity Sprawl is a Top Risk: Seek solutions that provide visibility into identity usage inside applications, not just at the directory level.
• Incident Response Starts with Discipline: Train your team for the first 90 seconds. Have playbooks, practice calm decision-making, and prioritize scoping over immediate action.

“`