TA547 Uses an LLM-Generated Dropper to Infect German Orgs

Proofpoint observed a TA547 phishing campaign targeting German organizations that used password-protected ZIP attachments containing LNK files which executed a PowerShell dropper to deploy the Rhadamanthys infostealer; researchers noted the dropper's code contained LLM-style, hyper-specific comments consistent with AI-generated code and discussed the operational implications of attackers leveraging AI for malware development.