Ledger / Jul 2025
Koske Linux cryptominer shows signs of AI-assisted development
Strong
Aqua infers LLM help from verbose, modular, well-commented code; wording is 'likely'.
Aqua Nautilus analyzed a modular Linux miner delivered via image files. They judged its scripts were likely written with an LLM's help.
“Koske, a sophisticated Linux threat, shows clear signs of AI-assisted development, likely with help from a large language model.”Aqua Security
Sources
- AI-Generated Malware in Panda Image Hides Persistent Linux ThreatAqua Security · 24 Jul 2025 · primary source
- Date
- Jul 2025
- Disclosed
- 24 Jul 2025
- Actor
- Unnamed (Koske) (criminal), as attributed by Aqua Security
- Targets
- Misconfigured JupyterLab instances
- What the AI did
- Malware dev, Evasion
- Model
- unspecified LLM
- Model family
- Unspecified
- Model basis
- inferred
- Autonomy
- assist
- Outcome
- Fileless cryptominer with rootkit, delivered through polyglot panda JPEGs.