Malware Brief: Trusted software, AI, and post-quantum ransomware

DarkVigil, PromptSpy, and Kyber show how malware developers are putting trusted application functionality, generative AI, and post-quantum cryptography to malicious use.

Key takeaways

• Malware developers are finding new ways to exploit trusted software and adopt emerging technologies
• Generative AI and post-quantum cryptography are moving from concepts and defensive technologies into functional malware
• Behavioral visibility becomes increasingly important as malicious activity blends with trusted applications, legitimate services, and new technologies

DarkVigil, PromptSpy, and Kyber show malware adapting technologies designed for legitimate use. Trusted application functions can become delivery mechanisms, generative AI can guide malware behavior at runtime, and post-quantum cryptography can protect ransomware encryption keys.

DarkVigil: A modular surveillance backdoor delivered through hijacked trusted applications

At a glance

• Type: Modular Windows backdoor and .NET cyberespionage toolset
• Targets: Windows systems targeted in cyberespionage operations
• How it gets in: Trusted applications manipulated to retrieve or execute attacker-controlled components
• What it does: Profiles systems and supports modular delivery of surveillance capabilities

DarkVigil has been distributed by manipulating legitimate functions in trusted applications, including a background promotion feature in Sogou Input Method, to create a malware delivery mechanism. Once installed, the malware surveys the system and connects to a command-and-control (C&C) server. DarkVigil operators can then deliver additional plugins to the infected device and load them into the .NET environment as needed. This gives attackers a modular foothold for cyberespionage, allowing them to profile compromised systems and add surveillance capabilities over time.

Watch for

• Unusual DLL side-loading by trusted applications
• Unexpected DNS or network traffic from trusted software
• Encoded .NET modules stored in the Windows registry
  

PromptSpy: An Android backdoor built for AI-guided device control

At a glance

• Type: Android spyware and remote-access trojan
• Targets: Android users, with signs of financially motivated targeting in Argentina
• How it gets in: Bank-themed apps distributed through dedicated download or phishing sites; victims sideload a dropper and manually install a payload presented as an update
• What it does: Provides VNC-based remote control, captures lock-screen credentials and authentication gestures, records screens, resists removal, and uses generative AI to automate device interaction

PromptSpy is the first known Android malware to put generative AI directly into its execution flow by sending information about the current screen to Google Gemini and receiving instructions for actions such as clicks and swipes. Later analysis by the Google Threat Intelligence Group (GTIG) found that the AI component was designed to support broader autonomous device interactions. Google has since disabled assets associated with the activity, and widespread deployment has not been established. PromptSpy is an example of AI-guided malware that uses LLM-generated actions at runtime rather than depending on predefined automation.

Watch for

• Sideloaded bank-branded APKs and fake update prompts
• Unexpected Accessibility use or automated device interaction
• Invisible overlays or blocked uninstall attempts

Kyber: Ransomware puts post-quantum cryptography into practice

At a glance

• Type: Cross-platform ransomware family
• Targets: Enterprise Windows file servers and VMware ESXi infrastructure; experimental Hyper-V capability
• How it gets in: Deployed after attackers gain privileged access; the original intrusion method has not been publicly confirmed
• What it does: Encrypts files and virtual-machine datastores and disrupts management and recovery capabilities

Kyber’s Windows variant provides a rare, real-world example of ransomware adopting post-quantum cryptography. It uses Kyber1024 alongside X25519 to protect the AES keys used for file encryption, bringing post-quantum cryptography into functional ransomware.

The contrasting ESXi variant, which advertises Kyber1024 but uses conventional cryptography, also demonstrates why malware capabilities must be verified separately across variants rather than inferred from ransom notes or family-level claims.

Watch for

• Unusual ESXi VM shutdown or management activity
• Shadow-copy, backup, or boot-recovery deletion
• Kyber ransom notes or encrypted-file extensions

What these threats tell us

Malware is adaptable. As threats make greater use of legitimate software behavior, emerging technologies, and multiple platforms, recognizing a known malicious file becomes only one part of detecting an attack. Behavioral context increasingly matters too.

What defenders can do now

• Reduce exposure: Control software installation and mobile sideloading and tightly restrict privileged access to virtualization infrastructure.
• Improve visibility: Monitor trusted applications, mobile-device behavior, and virtualization infrastructure for activity that deviates from normal patterns.
• Build resilience: Isolate backup and recovery infrastructure from ordinary administrative access and test recovery of complete workloads, including virtual machines and supporting services.

Barracuda can help

Barracuda Managed XDR combines 24/7 SOC monitoring with detection and response across endpoints, servers, networks, email, and cloud services, helping organizations identify suspicious behavior across the attack surface.