The AI-Powered Arsenal: How ‘Forbidden Hyena’ Uses Generative AI to Spawn BlackReaperRAT
ID: 8b60789d-d318-5222-85ed-91d668a6459c
STIX ID: report--8b60789d-d318-5222-85ed-91d668a6459c
Feed Name: securityonline.info
Threat Score
**Executive summary:** BI.ZONE identifies an active Forbidden Hyena campaign that leverages AI-assisted development to produce obfuscated variants of a new RAT (BlackReaperRAT) and an updated ransomware family (Milkyway), delivered via malicious RAR archives using a multi-stage batch/VBS loader with decoy documents; the actor abuses legitimate tools and scripts (e.g., VSS-based ntds.ps1, AnyDesk) for credential harvesting, lateral movement, and persistent access.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.