Darktrace researchers observed threat actors exploiting reports of Venezuelan President Maduro’s arrest to deliver backdoor malware. Attackers often use ongoing world events make their malicious content appear more credible, increasingly the likelihood of a successful attack.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Tara Gould
Malware Research Lead
Share
09
Jan 2026
Introduction
Threat actors frequently exploit ongoing world events to trick users into opening and executing malicious files. Darktrace security researchers recently identified a threat group using reports around the arrest of Venezuelan President Nicolàs Maduro on January 3, 2025, as a lure to deliver backdoor malware.
Technical Analysis
While the exact initial access method is unknown, it is likely that a spear-phishing email was sent to victims, containing a zip archive titled “US now deciding what’s next for Venezuela.zip”. This file included an executable named “Maduro to be taken to New York.exe” and a dynamic-link library (DLL), “kugou.dll”.
The binary “Maduro to be taken to New York.exe” is a legitimate binary (albeit with an expired signature) related to KuGou, a Chinese streaming platform. Its function is to load the DLL “kugou.dll” via DLL search order. In this instance, the expected DLL has been replaced with a malicious one with the same name to load it.
Figure 1: DLL called with LoadLibraryW.
Once the DLL is executed, a directory is created C:\ProgramData\Technology360NB with the DLL copied into the directory along with the executable, renamed as “DataTechnology.exe”. A registry key is created for persistence in “HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Lite360” to run DataTechnology.exe --DATA on log on.
Figure 2. Registry key added for persistence.
Figure 3: Folder “Technology360NB” created.
During execution, a dialog box appears with the caption “Please restart your computer and try again, or contact the original author.”
Figure 4. Message box prompting user to restart.
Prompting the user to restart triggers the malware to run from the registry key with the command --DATA, and if the user doesn't, a forced restart is triggered. Once the system is reset, the malware begins periodic TLS connections to the command-and-control (C2) server 172.81.60[.]97 on port 443. While the encrypted traffic prevents direct inspection of commands or data, the regular beaconing and response traffic strongly imply that the malware has the ability to poll a remote server for instructions, configuration, or tasking.
Conclusion
Threat groups have long used geopolitical issues and other high-profile events to make malicious content appear more credible or urgent. Since the onset of the war in Ukraine, organizations have been repeatedly targeted with spear-phishing emails using subject lines related to the ongoing conflict, including references to prisoners of war [1]. Similarly, the Chinese threat group Mustang Panda frequently uses this tactic to deploy backdoors, using lures related to the Ukrainian war, conventions on Tibet [2], the South China Sea [3], and Taiwan [4].
The activity described in this blog shares similarities with previous Mustang Panda campaigns, including the use of a current-events archive, a directory created in ProgramData with a legitimate executable used to load a malicious DLL and run registry keys used for persistence. While there is an overlap of tactics, techniques and procedures (TTPs), there is insufficient information available to confidently attribute this activity to a specific threat group. Users should remain vigilant, especially when opening email attachments.
Credit to Tara Gould (Malware Research Lead) Edited by Ryan Traill (Analyst Content Lead)
Indicators of Compromise (IoCs)
172.81.60[.]97 8f81ce8ca6cdbc7d7eb10f4da5f470c6 - US now deciding what's next for Venezuela.zip 722bcd4b14aac3395f8a073050b9a578 - Maduro to be taken to New York.exe aea6f6edbbbb0ab0f22568dcb503d731 - kugou.dll
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Why Kubernetes Security Needs A Behavioral Approach
As Kubernetes adoption accelerates, especially for AI workloads, Darktrace extends behavioral security across runtime activity, delivering visibility, detection, response, forensics, and risk context to identify and contain threats.
Darktrace researchers investigate CikaBika Bot, a Rust-based remote access trojan delivered through a document-themed lure. The malware uses a Nim loader, PowerShell UAC bypass and DLL search-order hijacking before leveraging Discord for C2, reconnaissance, remote execution, and data exfiltration through ngrok in observed malicious activity.
A Chain Reaction: Blockchain-Hosted Infostealer Campaign Targets Windows and macOS
Darktrace detected a blockchain-hosted infostealer campaign targeting Windows and macOS devices, combining ClickFix social engineering with the abuse of legitimate services such as GitHub, blockchain infrastructure, and DGA C2 endpoints to evade disruption and support malware delivery.
Beyond the Fridge: Exposed Industrial Control Systems
Introduction
In October 2026, hundreds of supermarkets across France were reportedly affected by a cyberattack targeting their refrigeration systems. According to public reports, the attackers gained access to internet-connected controllers and modified their settings, forcing refrigeration units into high and extremely low temperatures and causing significant disruption. Total losses have been reported to reach several million euros.
The incident drew attention to the security of industrial refrigeration systems, particularly older devices with exposed management interfaces and known vulnerabilities.
The exact details of how the attackers gained access have not been confirmed, however it is speculated that the public-facing web server could be accessed with the username “admin” and password being the current date. Researchers from Claroty’s Team82 identified a vulnerability in Danfoss AK-SM 8xxA Series in 2025, “CVE-2025-41450", allowing for administrative access using a time-based “code-of-the-day" for authentication [1].
Default credentials, outdated firmware and publicly accessible administrative interfaces have been an issue for years. And yet these systems continue to appear in internet scans and require little sophistication to gain admin access. A simple search of internet-connected devices shows a range of exposed devices from Programmable Logic Controllers (PLCs) and remote gateways, to, yes, more fridges.
Darktrace malware researchers identified hundreds of IoT and OT devices publicly exposed on the internet, many of which are configured with no authentication, weak credentials, or default credentials. As shown in Figure 1, an exposed Copeland XWEB web interface, used to manage Dixell equipment, including refrigerators, can provide the ability to remotely control connected devices.
Figure 1: Copeland XWEB interface used to control systems including refrigerators and air conditioning.
However, it’s not only fridges; web management interfaces for industrial controls are also publicly accessible, often protected only by weak credentials. Figure 2 shows an example of a publicly exposed WAGO interface. The WAGO management interface is a configuration and administration panel for controllers. Through it, a logged-in user can view device details and diagnostics, manage user accounts and passwords, update firmware, back up or restore the full configuration, set the clock, and manage SD card storage. While it typically doesn’t manage switch outputs or read live process values, someone with access could still disrupt operation by changing network or Modbus settings, loading bad firmware or configurations, or by resetting passwords and enabling insecure services.
Figure 2: WAGO Management interface.
The issue extends beyond management interfaces. During our research, we identified publicly accessible web interfaces belonging to PLCs, including Rockwell Automation Allen-Bradley devices. In each case, the risk arises from how the devices have been deployed and configured, not from a flaw in the vendors’ products.
Figure 3: Web interface for Allen-Bradley CompactLogix controller.
Figure 3 shows the web interface of an Allen-Bradley CompactLogix controller. Unlike the previous examples, this interface provides a view into the controller's operation, including running tasks, network connections, memory usage and diagnostic information. Rockwell Automation's CompactLogix controllers are commonly used to automate industrial processes, from manufacturing and packaging lines to water treatment and material handling systems. Depending on their configuration, these controllers can operate motors, pumps, valves and other physical equipment.
Although in this example the interface shown does not provide direct control over the PLC's logic, it exposes information about the model, firmware, network layout, and connections, which is useful reconnaissance for a bigger attack.
The concern is not necessarily that every exposed interface allows an attacker to immediately manipulate industrial processes. However, these devices are accessible from the public internet in the first place, providing information about systems that may be responsible for controlling physical equipment.
The attacks on refrigeration systems in France highlight the consequences of poorly secured industrial devices. As demonstrated throughout this research, publicly accessible management interfaces are not limited to refrigeration controllers but extend to PLCs and other systems used to manage industrial equipment.
Finding these devices requires little effort. Internet scanners make it possible to identify publicly exposed interfaces quickly, and in some cases these interfaces rely on publicly documented default credentials or have no authentication at all. As attackers increasingly use AI tools, such attacks may be identified and carried out faster and at a greater scale.
The consequences of this access depend on the device and the functionality exposed. While some interfaces provide little more than diagnostic information, others allow users to modify configurations, disrupt communications, or change settings that affect physical equipment. In industrial environments, this can result in operational downtime, damaged equipment and financial losses.
Weak passwords, default credentials and exposed administrative interfaces are not new security issues. Yet their continued presence on internet-connected industrial systems demonstrates how easily preventable weaknesses can leave physical operations vulnerable to attack.
Exposed devices often come from third-party suppliers and contractors, who frequently install refrigeration controllers, gateways and PLCs without the organization ever being aware they are connected to the internet. Asset visibility remains an important foundation, but organizations should assume that some unknown assets and services will exist. Effective security therefore also depends on continuous monitoring, anomaly detection, network segmentation and rapid response, so that risky exposure and unusual activity can be identified and addressed before it becomes disruptive.
Copeland, Dixell, WAGO, Rockwell Automation, Allen-Bradley and CompactLogix are trademarks of their respective owners. Their use here is for identification only and does not imply any affiliation with or endorsement by those owners.
Why Kubernetes Security Needs A Behavioral Approach
Kubernetes has become a foundational technology for modern cloud-native infrastructure. It can orchestrate everything from customer-facing applications to data pipelines and, increasingly, AI workloads. This is due to the highly scalable nature of Kubernetes, making it cost efficient and reliable.
Gartner projects that by 2028, 95% of new AI deployments will run on Kubernetes, up from less than 30% today1. However, the same qualities that make Kubernetes powerful also make it uniquely challenging to secure, leaving many organizations with limited visibility into their clusters. This lack of visibility increases risk - it’s difficult to secure what you can’t see.
However, this risk is often looked at as purely a posture management challenge. While Cloud Security Posture Management (CSPM) solutions can tell you how a cluster should be configured, they don’t tell you what it is doing in real time. This requires runtime behavioral monitoring of clusters to detect active threats.
Yet existing approaches to securing Kubernetes by most Cloud Detection and Response (CDR) and Network Detection and Response (NDR) vendors often have limited coverage or require a third-party integration to forward traffic and metadata. This means that capabilities can be limited and detections can lack the context of the wider environment, which slows down triage, investigation and response.
Why Kubernetes is hard to secure
Traditional security tooling was built for persistent, long-term infrastructure such as servers and virtual machines with fixed identities that last months or years. Some elements of Kubernetes environments can have a much shorter lifespan, breaking many assumptions those tools rely on:
Increased complexity
Kubernetes environments can be complex in comparison to traditional infrastructure, with many different elements to consider such as nodes, clusters, containers, pods and the workloads themselves.
Ephemeral by design
Kubernetes pods can spin up and terminate in seconds. A container that was compromised may no longer exist by the time a deeper investigation is required, leaving no artifact to analyze. This poses a unique challenge for security operations.
Weaker workload boundaries
Kubernetes containers use lightweight, shared-kernel isolation rather than separate virtual machines, improving efficiency but reducing separation between workloads and the host. As a result, a compromised container may have a greater potential impact on the node and neighboring workloads than a compromised virtual machine (VM).2
Recent vulnerabilities have shown that threat actors can escape a container and gain access to the underlying host.3, 4
Everything is API-driven
Dozens or hundreds of microservices communicate over internal APIs, and the Kubernetes control plane itself is an API. This creates a large and dynamic attack surface, making it difficult to distinguish legitimate activity from malicious behavior.
Without identity-aware runtime visibility, threat actors can move laterally between pods and exploit misconfigured role-based access controls (RBAC) with little chance of detection.
Rising to the challenge of securing Kubernetes
With the release of Darktrace 7.2, Darktrace / HYBRID NETWORK can extend behavioral security into Kubernetes, delivering visibility, detection and response capabilities across runtime activity. Darktrace addresses the challenges of securing Kubernetes environments in several ways.
Behavioral detection, not static rules
Many Kubernetes runtime tools rely on predefined rules and signatures - a fixed list of “bad” behaviors to match against. That approach struggles with novel attacks and generates noise at scale. Darktrace takes a different approach: our Adaptive AI builds a Unique Behavioral Profile for each organization from the ground up, learning the normal behavior of every workload, node and identity in your cluster. It then uses this understanding to detect meaningful deviations from expected behavior, which serves as the basis for surfacing suspicious and malicious activity.
A pod reaching out to an unfamiliar destination, an unexpected executable launching inside a workload, or an identity performing an action it has never performed, all surface as anomalies without anyone having to write a rule in advance.
Darktrace surfaces unexpected Kubernetes activity that does not align with an organization’s Unique Behavioral Profile
Visibility across the network, the process, and the control plane
Darktrace monitors Kubernetes at three levels that together provide comprehensive runtime visibility:
Network-layer
Traffic between pods, across nodes and out to the internet. This helps to detect lateral movement and unusual connectivity, whether internal or external.
Process-layer
What is executing inside your containers. If a process reads a sensitive credential file or spawns an unexpected shell inside a production pod, Darktrace can identify that activity and use it as context for further detections.
Controlplane
Activity against the Kubernetes API itself: someone executes a command in a running pod, RBAC changes, or unusual administrative actions. Many high-impact security events involve the control plane, an area that is often less visible to solutions that only analyze or scan network-layer telemetry.
Misconfiguration and vulnerability awareness
Runtime detection is strongest when combined with posture and exposure management. Darktrace surfaces risky pod configurations, such as privileged containers, host networking, and over-permissive service accounts as workloads are deployed, and links CVEs from images to the workloads running them. Security teams can go beyond simply knowing that a vulnerability exists and see exactly where it is in the cluster. When combined with behavior-based detections, this provides invaluable context that can help prioritize incidents and proactively identify areas that need further attention. For example, anomalous workload behavior on its own might not be very interesting to a security team at first, but if that same workload is known to host sensitive data, is known to have critical vulnerabilities associated with it, or is publicly accessible, then this narrative becomes much more suspicious and demanding of their attention.
Darktrace highlights Kubernetes misconfigurations such as privileged containers, host networking, and missing security controls, helping teams prioritize runtime alerts with valuable exposure and risk context
Response, tailored to Kubernetes
Detection is most effective when paired with response. Darktrace can take precise actions on Kubernetes workloads, including blocking a malicious connection at the pod level, helping to safely contain threats while security teams investigate. Response actions can be taken fully autonomously or via a human-in-the-loop process, which is completely configurable depending on the desired level of autonomy and scope. Darktrace is expanding the number of Kubernetes-native response actions to give customers even more flexibility when containing threats.
Forensics that survive the workload
Because containers are so short-lived, evidence disappears fast and this can make it very difficult to answer questions related to the initial detections. Darktrace solves this with Forensic Acquisition & Investigation capabilities that extend to Kubernetes containers, allowing investigations to be triggered manually by an analyst, or automatically from an alert, preserving evidence before the workload is gone.
For incident responders, this addresses a key challenge in container security: being able to answer “what actually happened?” after an ephemeral workload has vanished.
One platform, not another silo
Kubernetes doesn't exist in isolation, and neither should its security. Darktrace correlates cluster activity with the surrounding cloud environment, including AWS, Azure and GCP identities, network activity and cloud assets, allowing analysts to pivot between a Kubernetes workload and its wider context. A single anomalous action can be traced from the control plane to the pod, and from the pod to the cloud identity behind it, all within a single investigation workflow. This can also include alerts from other areas of hybrid infrastructure or third-party sources where relevant, adding more context to investigations and speeding up workflows for human analysts.
Built to deploy easily
Operational complexity can be a barrier to security adoption. Darktrace / HYBRID NETWORK for Kubernetes installs with a single command, and for teams that manage their infrastructure as code, it supports raw manifests so the deployment can live in a Git repository and be managed through existing GitOps workflows. The same deployment approach works across Kubernetes environments in AWS, Azure, Google Cloud, and on-premises infrastructure. Early adopters of Darktrace’s Kubernetes capabilities have highlighted the simplicity of deployment and time to value.
Darktrace can deploy across your Kubernetes environment and wider hybrid infrastructure, while also providing visibility into Kubernetes deployment structure and status
Next steps
Kubernetes environments are dynamic, ephemeral and API-driven in ways that challenge traditional security tooling. With Kubernetes usage increasing due to widespread AI adoption, it is essential to secure Kubernetes environments as part of securing what AI can do. Darktrace / HYBRID NETWORK addresses these challenges by learning normal behavior in Kubernetes environments across network, process and control-plane layers, identifying meaningful threats and enabling targeted response. Combined with the context of wider hybrid infrastructure and forensic investigation capabilities, Darktrace provides visibility into both emerging threats and active incidents.
To see how Darktrace can help secure your Kubernetes environment and your wider hybrid infrastructure, get in touch to arrange your free trial. Existing customers can contact their Darktrace Account Team for more information about deployment options and licensing.
Sources
[1] Gartner, Container Management research, 2025: "By 2028, 95% of new AI deployments will use Kubernetes, up from less than 30% today." https://www.gartner.com/en/documents/7913109. (quote reproduced under Gartner reprint at https://www.kubermatic.com/magic-quadrant-and-critical-capabilities-for-container-management/)
.jpeg)
