Ankura CTIX FLASH Update - July 29, 2025

Malware Activity

AI-Enhanced Cryptomining Malware Campaigns Exploit Cloud Vulnerabilities Across Platforms

Two (2) advanced malware campaigns tracked as Soco404 and Koske have emerged as significant threats to cloud environments, exploiting misconfigurations and software vulnerabilities to deploy cryptocurrency miners across Linux and Windows systems. Soco404, identified by Wiz, uses fake 404 pages on Google Sites to deliver platform-specific payloads targeting PostgreSQL, Apache Tomcat, Struts, and Confluence servers. It employs diverse post-exploitation tools like PowerShell, certutil, and wget to maintain persistence, escalate privileges, and evade detection through log tampering and service disruption. Meanwhile, Aqua Security has uncovered Koske, a Linux-based malware strain believed to be partially developed using large language models (LLMs). Distributed via misconfigured JupyterLab instances, Koske delivers payloads hidden within polyglot JPEG