Podcast Detail

SANS Stormcast Tuesday, September 1st, 2026: LLM Honeypot; PaperCut Update; TerminalFix Malware;

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10076.mp3

previous
Podcast Logo
LLM Honeypot; PaperCut Update; TerminalFix Malware;
00:00

My Next Class

Click HERE to learn more about classes Johannes is teaching for SANS

Podcast Transcript

 Hello and welcome to the Tuesday, September 1st, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich, recording today from New York
 City, New York. And this episode is brought to you by
 the SANS.edu graduate certificate program in Purple
 Team Operations. Well, and Renato today wrote about some
 of the risks that you may be encountering if you are
 connecting your AI agent to models that well you may not
 be owning or that you may not have authorized access to. So
 one big thing that we are seeing in our honeypots for
 quite a while now is that attackers are looking to steal
 credentials being used to connect to certain AI models
 and AI vendors but also just the scans that are looking for
 exposed AI models often like they're using conventions that
 you often see for example in OLLAMA. Now one thing that
 Renato did, Renato set up a dedicated honeypot that
 pretends to be an OLLAMA instance. It does advertise
 some benign locally hosted models so nothing really all
 that terribly exciting necessarily but what Renato
 then saw after the model or after the endpoint got
 discovered was that well now other people were connecting
 to that endpoint and they were looking for or attempting to
 connect to models that Renato's endpoint wasn't
 actually well dealing with so wasn't actually offering. So
 what apparently happened here was that the attacker found
 the endpoint and then advertised it to their clients
 telling them hey this is actually well you know some
 the latest Opus or whatever model and now they try to use
 it as such. So this in itself of course bears some risk
 you're actually using here a model that's way less capable
 than what you're expecting and secondly of course well that
 model may respond with whatever so now you could
 actually trick the user here the client connecting to the
 endpoint to execute arbitrary commands. So this is one of
 those you know supply chain issues as Renato puts out
 there so definitely you know anything that your that your
 AI agent connects to make sure that you know what it's
 connecting to that you trust the vendor offering that
 particular model. It's just like the good old game that we
 had you know with hacked games and such that often contain
 malware. The same you have to assume if you're connecting to
 a hacked model which essentially is what you're
 doing here. And then just a quick update to the paper cut
 exploitation. So again paper cut has been exploited by some
 threat actors starting at least last week. There is no
 real patch for it. There is a preliminary patch available
 from paper cut that you should apply. But the news now is
 that yes there is a public exploit in the form of a
 Metasploit module. With this you really have to either
 disconnect paper cut from the public internet or apply the
 emergency patch from a paper cut in order to limit the
 likelihood of getting actually exploited here. No new update
 yet regarding a final patch for this issue. Paper cut just
 updated their advisory that they're still working on a
 final patch. And microsoft published a good write-up of a
 new malware that they're calling terminal fix. Now the
 similarity in naming to click fix is not accidental. It
 starts out as what's commonly referred to as a click fix
 attack meaning that the victim is being asked to copy paste
 terminal command from capture into a shell and then execute
 it. They are emulating the cloudflare capture in this
 particular case. But what happens then is more complex
 than what you often see with click fix. With click fix
 usually the next thing is you download the infostealer and
 it's being installed and run. Here there are a couple more
 steps happening. So first it downloads a zip file that then
 does dll side loading in order to execute its malicious code
 which then downloads a png image and here actual real
 sort of steganography is being used with adjusted pixel
 values. So not just some piece of a powershell being added to
 the end of an image. There is a number of persistent
 mechanisms there using and in the end that's also different
 than what you typically see from click fix. It will
 establish a back door for the attacker to send additional
 commands and also set up a Socks proxy. So that way the
 attacker will have access to your network. So this is
 really more of the beginning of the attack and now the
 attacker has access to your network and now they can do
 whatever ransomware probably I think would be like the next
 step here or for some of the attackers that are after your
 information they now have a entry point in your network
 but you can just monitor and see what you're doing and then
 exfiltrate secret and sensitive documents at will.
 Well, and that's it for today. Thanks for listening. Thanks
 for subscribing. Thanks for liking and recommending this
 podcast and Remember in the show notes. I usually have a
 link to classes. I'll be teaching in the near future.
 So thanks and talk to you again tomorrow. Bye