Malware

Skynet

Indicators of Compromise 9

Domain auto[.]c3pool[.]org Domain auto[.]skypool[.]xyz Domain mine[.]c3pool[.]com Domain xmrpool[.]eu SHA-256 b720a5e7c3a5b1760d15a8833a782f4fe7fc5c62b967fe57f607e72745ec0ccf SHA-256 fcde1323acceb46fd88f2276c010bb98839dccce03dc512c56d9529428ceec68 IP 13[.]140[.]161[.]91 IP 207[.]180[.]232[.]206 IP 86[.]216[.]147[.]228

MITRE ATT&CK TTPs 11

AML.T0051
AML.T0051
 AML.T0054
AML.T0054
 T1027
Obfuscated Files or Information
Defense Evasion
 T1036.005
Match Legitimate Name or Location
Defense Evasion
 T1059.006
Python
Execution
 T1070.002
Clear Linux or Mac System Logs
Defense Evasion
 T1190
Exploit Public-Facing Application
Initial Access
 T1496
Resource Hijacking
Impact
 T1552.001
Credentials In Files
Credential Access
 T1552.005
Cloud Instance Metadata API
Credential Access
 T1595.002
Vulnerability Scanning
Reconnaissance

Source Articles

Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks
Attackers have developed an autonomous offensive agent named 'Skynet' that hijacks exposed large language model (LLM) endpoints to conduct self-directed cyberattacks. The agent leverages stolen or unsecured AI model access to perform internet-wide scanning, exploit web frameworks, steal credentials and databases, and deploy cryptocurrency miners without human intervention. It uses sophisticated jailbreak techniques to bypass commercial model safety controls by redefining malicious activities as routine development tasks. The activity represents a novel form of LLMjacking, where attackers shift computational costs to victims while maintaining anonymity and evading provider bans.
security-com ·3d ago