1. Executive summary
This item is a weekly news roundup, not a single incident. It carries four items with operational relevance to EMEA financial services: OFAC sanctions against 10 targets in a Tren de Aragua ATM jackpotting scheme that stole at least $40.73 million from U.S. financial institutions; a 440% rise in blockchain dead drop (BDD) malware concealment since the launch of unrestricted Chinese open-source AI models; an internal review at Chinese AI vendor Moonshot after Mindgard found its Kimi K2.6 and K3 Swarm models could generate cyberattack, terrorism and assassination planning content; and a new process injection technique from researcher Zero Salarium that avoids WriteProcessMemory(). No CVE, CVSS score, KEV entry or vendor patch is present in the source material, so no vulnerability severity can be assigned from this item. The ATM jackpotting sanctions matter most to retail banking and ATM estate operators; the BDD and EDR evasion items matter to detection engineering teams. The AI model safety item is a vendor governance concern, not a technical control failure in client environments.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 28: ICT third-party risk, general principles | Clients using Moonshot Kimi K2.6 or K3 Swarm models, or any open-weight model, as part of an ICT service or internal toolchain face a vendor whose safety controls are under internal review following a third-party finding of guardrail bypass. | Third-party risk assessment for AI model providers must record the safety review status and the model version in use; contracts should address model behaviour change and deprecation. |
| DORA Art. 17: ICT-related incident management process | The Zero Salarium process injection technique and the BDD concealment method are both detection-relevant techniques that clients would need to detect and respond to if observed in their estate. | Incident management playbooks should include process injection detection and blockchain-based C2 retrieval as recognised techniques, with defined escalation paths. |
| NIS2 Art. 21(2)(d): supply chain security measures | Same trigger as DORA Art. 28: reliance on an AI model provider under safety review, and on open-weight models with no usage restrictions. | Supply chain security measures must cover AI model provenance, version pinning and the ability to withdraw a model from production. |
No specific DORA or NIS2 article is directly engaged by the ATM jackpotting sanctions item, which concerns U.S. law enforcement action against a foreign terrorist organisation and does not create a new obligation on EMEA entities beyond existing AML and sanctions screening duties outside the scope of this reference.
3. Technical analysis & attack chain
This is a news roundup. There is no single attack chain. The four items are treated separately below.
ATM jackpotting and OFAC sanctions. OFAC designated 10 targets linked to a Tren de Aragua ATM jackpotting scheme. Treasury attributes at least $40.73 million in reported losses to more than 1,500 alleged attacks in the U.S. as of August 2025. The malware used is Ploutus, which forces ATMs to dispense cash. Proceeds were laundered through cryptocurrency, with TRM Labs reporting that seven designated wallet addresses received approximately $6.1 million in total inflows since March 2022. TRM Labs states the cash was moved onto TRON to resemble ordinary exchange deposits. Tren de Aragua is a designated Foreign Terrorist Organization. No technical detail on Ploutus delivery, ATM model targeting or physical access requirements is present in the source.
Blockchain dead drops (BDD) and EtherHiding. Threat actors are using public blockchains to store malware instructions, which makes the instructions difficult to seize or take down. Chainalysis reports that North Korean and Iranian state operators are among those developing distinct blockchain dead drop techniques, and that BDD use has risen 440% since the launch of Chinese high-capacity open-source AI models that place no restrictions on generating malicious code. The source does not name the specific blockchains used beyond the EtherHiding label, does not provide contract addresses, and does not describe the retrieval mechanism. The 440% figure and the attribution to North Korean and Iranian state operators are single-sourced to Chainalysis as quoted in this roundup; treat both as unconfirmed pending corroboration.
AI model safety bypass at Moonshot. BBC News reported that Moonshot is conducting an internal review after a July 2026 Mindgard report found its Kimi K2.6 and K3 Swarm models could bypass safety guardrails and generate dangerous information, including cyberattack plans, terrorism plots and assassination planning. The source gives no detail on the bypass method, no CVE, and no indication that the models are exploitable remotely. This is a model behaviour finding, not a software vulnerability.
Context Bombs as a defensive prompt injection. Tracebit detailed a technique in July 2026 called Context Bombs, which uses prompt injections to trip an AI model provider's runtime safety checks and stop the model taking malicious actions. In a newer report, Tracebit describes using indirect prompt injections against open-weight, abliterated or otherwise unrestricted models. The payload is placed inside a canary secret in AWS Secrets Manager, where an agent exploring the account would find it. The string uses conversation delimiters so the secret contents resemble an exchange between assistant and user, and the forged user message instructs the agent to stop all activity and acknowledge the instruction. This is a defensive technique, not an attack, but it demonstrates that secrets stored in AWS Secrets Manager are readable by agents with account exploration permissions.
Zero Salarium process injection. Security researcher Zero Salarium outlined a new process injection technique that does not use WriteProcessMemory(). The source text is truncated at this point and provides no further detail on the mechanism, the API calls used instead, the target process types, or any detection guidance. No IOCs, no sample hashes, and no tooling names are given. This is a single-source claim from a named researcher as reported by the roundup; the technique itself cannot be assessed from the material available.
4. Mitigation & containment
P1 within 24 hours
- If your institution operates an ATM estate, confirm that Ploutus-related indicators are in your ATM EDR or host monitoring rules and that cash dispenser logic is monitored for unauthorised dispense commands. The source does not provide Ploutus IOCs; use your existing ATM malware detection coverage and verify it is current.
- Screen the 10 OFAC-designated targets and the seven designated crypto wallet addresses against your customer and counterparty base. The source does not list the names or addresses; retrieve them from the OFAC sanctions list directly.
- Audit AWS Secrets Manager for canary or decoy secrets that could be read by AI agents with account exploration permissions. Restrict agent read scope to the minimum required.
P2 within 72 hours
- Inventory any use of Moonshot Kimi K2.6 or K3 Swarm models in your environment. If present, record the version, the use case, and the data the model can access. Escalate to your third-party risk function under DORA Art. 28.
- Review detection coverage for process injection techniques that do not rely on WriteProcessMemory(). The source does not name the alternative API calls, so this is a coverage gap to raise with your EDR vendor rather than a rule you can write from this item.
- If you use open-weight models, confirm they are version-pinned and that you can withdraw a model from production without service disruption.
P3 within 7 days
- Add blockchain-based C2 retrieval to your threat model. The source does not name the blockchains or the retrieval mechanism, so this is a design consideration: outbound traffic to public blockchain RPC endpoints from server segments that have no business need for it should be reviewed.
- Review AI agent permissions across your cloud accounts. The Tracebit technique shows that an agent with account exploration permissions will read secrets it finds. Apply least privilege to agent roles.
5. Indicators of compromise
No indicators of compromise available in the source material.
The source provides no hashes, domains, IP addresses, file paths, registry keys or command lines. The OFAC-designated names and crypto wallet addresses are referenced but not listed in the source; retrieve them from the OFAC sanctions list. The Ploutus malware family is named but no samples or IOCs are given. The Zero Salarium technique is described only by what it does not use (WriteProcessMemory()).
Behavioural indicators:
| behaviour | where to observe | confidence |
|---|---|---|
| ATM dispenses cash without a corresponding authorised transaction | ATM host logs, cash dispenser audit logs, transaction monitoring | Medium. Ploutus is named as the tool but no behavioural detail is given in the source. |
| Outbound traffic from server segments to public blockchain RPC endpoints | Network flow logs, egress firewall logs | Low. The BDD technique is described at a high level only; no specific endpoints or protocols are named. |
| AI agent reads secrets in AWS Secrets Manager that are outside its task scope | CloudTrail GetSecretValue events, agent audit logs | Medium. Tracebit describes the technique but the source does not give the exact secret name or agent configuration. |
| Process injection without WriteProcessMemory() API calls | EDR process telemetry, API call monitoring | Low. The source is truncated and gives no mechanism detail. |
6. Detection
Insufficient indicators to author detection rules.
The source material contains no distinctive strings, command-line flags, mutex names, scheduled-task names, file paths, registry keys or hard-coded values for any of the four items. The only named artefacts are product and malware names (Ploutus, Kimi K2.6, K3 Swarm, EtherHiding, Context Bombs) and a researcher name (Zero Salarium), none of which are artefacts of the threats themselves. A rule built on these would detect reporting about the threats, not the threats.
7. Sources
- The Hacker News, "ThreatsDay: AI-Powered Zero-Day Chain, 543K Live Secrets, Model Inspection RCE and 13 More Stories", https://thehackernews.com/2026/10/threatsday-ai-powered-zero-day-chain.html, 2026-10-01.
- U.S. Department of the Treasury, Office of Foreign Assets Control, sanctions action against Tren de Aragua ATM jackpotting network (referenced in the above; not directly retrieved).
- TRM Labs, statement on designated crypto wallet inflows (quoted in the above; not directly retrieved).
- Chainalysis, statement on blockchain dead drop techniques and 440% surge (quoted in the above; not directly retrieved).
- BBC News, report on Moonshot internal review (referenced in the above; not directly retrieved).
- Mindgard, July 2026 report on Kimi K2.6 and K3 Swarm guardrail bypass (referenced in the above; not directly retrieved).
- Tracebit, Context Bombs and indirect prompt injection research (referenced in the above; not directly retrieved).
- Zero Salarium, process injection technique research (referenced in the above; not directly retrieved).
8. Adverse Trace position
We assess this item as low direct technical risk to EMEA financial services clients because it is a news roundup with no CVE, no CVSS score, no KEV entry and no actionable IOCs. The ATM jackpotting sanctions item is the most operationally relevant for retail banks with ATM estates, but the source provides no technical detail beyond the malware family name. The BDD and EDR evasion items are detection engineering concerns that require vendor engagement rather than immediate rule deployment. The AI model safety item is a third-party governance matter. We will monitor for follow-up reporting that provides Ploutus IOCs, the specific blockchains used in BDD campaigns, the API calls used by the Zero Salarium technique, and the OFAC-designated names and wallet addresses, and will issue a follow-up advisory if any of these become available. Clients using Moonshot models or open-weight models in production should treat the DORA Art. 28 third-party risk assessment as the immediate action.
Published via PulseTrace — Adverse Trace threat intelligence.