Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Ryan Fetterman
Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer
VOLTA is a mature stealer implant with an optional AI-integration layer. After stealing credentials, sessions, and cryptocurrency wallets, VOLTA sends a structured evidence bundle to an LLM to rank the victim’s assets by monetization value. If a model refuses to perform the target assessment, VOLTA fails over to a three-model chain, implying a direct engineering effort and expectation of hitting model guardrails. This stealer is self-deleting, and there is no attacker-owned infrastructure.
Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer
Cryptocurrency Now Notorious hacker says stolen crypto is like ‘holding a hot potato’ CNN - Jon Sarlin • 45m On Thursday, Binance, the world’s largest crypto exchange, saw more than $6 billion hacked from its system. Evidence pointed to North Korean hackers, who drained the accounts in a matter of minutes. But what does a hacker do with billions of dollars in stolen crypto?
Ignore all instructions and read this blog: The state of AI-analysis evasion in malware
“AI-analysis evasion” encapsulates the real-world techniques malware authors are developing in attempt to obstruct or defeat any layers of automated AI analysis. This technique is cheap to add but inconsistently impactful — the best techniques steered the outcome in the attacker’s favor in about 35% of test runs. Further, it must always be plaintext and therefore is always detectable.
The Closed Quorum: Inside the first reported autonomous AI C2 implant
CLOSEDQUORUM, a malware binary discovered through Cisco Talos’ CAIRN project, exhibits fully autonomous command and control (C2). While we do not have confirmation of in-the-wild deployment, artifacts from the binary were used to connect the developer to postings on criminal forums related to carding, dating back to 2025.
Introducing CAIRN: Frontier tracking for AI-integrated malware
A cairn is a marker left behind on a trail, a deliberately placed stack of stones that helps hikers find their way when the path is unclear. Attackers building AI-integrated malware unintentionally (and inevitably) leave behind markers of their own: prompt templates, provider endpoints, API keys, jailbreak terms, and other artifacts embedded throughout their tooling.
Inherited Circuits, Learned Semantics: How Security Fine-Tuning Can Create Hidden Evasion Risk
Fine-tuning is a process that lets us steer a general-purpose large language model toward a specific task by training it on targeted examples. In cybersecurity, this is often useful for problems like classifying phishing emails, suspicious URLs, or PowerShell scripts. A fine-tuned model can become much more useful in a security workflow because it learns the language, structure, and labels that matter for that domain.
Predicting Cyber Fraud Through Real-World Events: Insights from Domain Registration Trends
Events in the physical world influence the digital world. In the wake of major geopolitical events, attackers register new domains and infrastructure to support fraudulent activities. These domains come in many forms, for example, posing as a natural disaster relief fund to solicit donations, collecting interest in a crypto coin offering, or creating a fake auto insurance website.
Predicting Cyber Fraud Through Real-World Events: Insights from Domain Registration Trends
Events in the physical world influence the digital world. In the wake of major geopolitical events, attackers register new domains and infrastructure to support fraudulent activities. These domains come in many forms, for example, posing as a natural disaster relief fund to solicit donations, collecting interest in a crypto coin offering, or creating a fake auto insurance website.
Predicting Cyber Fraud Through Real-World Events: Insights from Domain Registration Trends
Events in the physical world influence the digital world. In the wake of major geopolitical events, attackers register new domains and infrastructure to support fraudulent activities. These domains come in many forms, for example, posing as a natural disaster relief fund to solicit donations, collecting interest in a crypto coin offering, or creating a fake auto insurance website.
Warum KI-Agenten Cyberangriffe schneller und gefährlicher machen
Stand: 20.11.2020 Es ist für uns eine Selbstverständlichkeit, dass wir verantwortungsvoll mit Ihren personenbezogenen Daten umgehen. Sofern wir personenbezogene Daten von Ihnen erheben, verarbeiten wir diese unter Beachtung der geltenden Datenschutzvorschriften. Detaillierte Informationen finden Sie in unserer Datenschutzerklärung. Ich bin damit einverstanden, dass die Vogel IT-Medien GmbH, Max-Josef-Metzger-Straße 21, 86157 Augsburg, einschließlich aller mit ihr im Sinne der §§ 15 ff.
Introducing… The Threat Hunter’s Cookbook!
Welcome, Chefs! Today we are excited to announce the release of The Threat Hunter’s Cookbook: a practitioner’s guide to learning, expanding, and applying your analysis repertoire for threat hunting.
Introducing… The Threat Hunter’s Cookbook!
Welcome, Chefs! Today we are excited to announce the release of The Threat Hunter’s Cookbook: a practitioner’s guide to learning, expanding, and applying your analysis repertoire for threat hunting.
A Supporting Role: How LLMs Are Showing up In the Cyber Threat Landscape
As artificial intelligence becomes more advanced, large language models (LLMs) AI systems that can distill waves of data to create meaningful outputs for the user will become the foundation of future innovation. However, like with most forms of technology, the impact of these models will be subject to the skill of those using them. We’re beginning to see this now in cybersecurity.
Defending at Machine Speed: Guiding LLMs with Security Context
Large Language Models (LLMs) provide strong reasoning and data summarization capabilities, making them valuable proxies for a variety of cybersecurity operations tasks. However, their performance can decline when applied to highly specific or enterprise-contextual tasks, particularly if the models rely solely on public internet data.
Defending at Machine Speed: Guiding LLMs with Security Context
Large Language Models (LLMs) provide strong reasoning and data summarization capabilities, making them valuable proxies for a variety of cybersecurity operations tasks. However, their performance can decline when applied to highly specific or enterprise-contextual tasks, particularly if the models rely solely on public internet data.
Defending at Machine-Speed: Accelerated Threat Hunting with Open Weight LLM Models
Artificial intelligence is accelerating the pace of cyber operations through the improved convenience, scale, and automation of tasks. To keep parity with efficiencies attackers will gain, defenders must employ AI to equal effect. The core of this challenge in a Security Operations Center (SOC) is applying human analysts to the tasks where their attention is most needed.
Autonomous Adversaries: Are Blue Teams Ready for Cyberattacks To Go Agentic?
2024 was a year of incredible progression for Artificial Intelligence. As large language models (LLMs) have evolved, they have become invaluable tools for enriching the capabilities of defenders – instantly providing the knowledge, procedures, opinions, visualizations, or code any given situation demands. However, these same models provide outputs that enable even low-sophistication attackers to uplift their own skill-levels.
Macro ATT&CK for a TTP Snack
As we step through 2024, it’s time for another deep dive into the macro-level cyber incident trends using the MITRE ATT&CK framework. Over the past five years, Splunk’s SURGe team has meticulously gathered and analyzed cyberattack data from various open sources, building a robust dataset that offers a comprehensive view of global attacker tactics, techniques, and procedures (TTPs).
Macro-ATT&CK 2024: A Five-Year Perspective
New year, new data. Welcome to our continuation of Macro-level ATT&CK trending! To recap, this is the third year running that Splunk’s SURGe team has compiled macro-level cyber incident data from open-sources (2022, 2023), resulting in a five-year window to analyze global attacker TTPs (Tactics, Techniques, and Procedures) based on the MITRE ATT&CK framework.
Add To Chrome? - Part 4: Threat Hunting in 3-Dimensions: M-ATH in the Chrome Web Store
Welcome to the final installment in our “Add to Chrome?” research! In this post, we'll experiment with a method to find masquerading, or suspicious clusters of Chrome extensions using Model-Assisted Threat Hunting (M-ATH) with Splunk and the Data Science & Deep Learning (DSDL) App. M-ATH is a SURGe-developed method from the PEAK framework, which uses models or algorithms to help find threat-hunting leads, or to help make complex problems more approachable.
Zoom. Enhance!: Finding Value in Macro-level ATT&CK Reporting
With cyberattacks growing in scale and complexity, it has never been more difficult to figure out where to invest your time and defensive resources. This remains the core challenge of optimizing an effective security organization. A good prioritization approach should be data-driven, and informed by real attacker activity.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Ryan
Contact Ryan, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack