1. Executive summary
Sophos' Counter Threat Unit (CTU) identified an advertisement posted on 24 August 2026 on the Exploit hacking forum by a persona using the handle "Optimus_Prime," marketing a subscription AI service called Luciferus as an alternative to jailbreaking ChatGPT or Claude. The service is advertised as answering requests "without moral or ethical restrictions," and a Sophos test prompt for a Python remote access trojan returned a Russian-language explanation of the malware's networking and command-execution functions together with source code that Sophos did not execute or verify. No CVE, CVSS score or CISA KEV entry applies to this item — it is a criminal-market service offering, not a software vulnerability — and the VERIFIED REFERENCE DATA resolved no scored artefacts for it. Direct risk to EMEA financial services today is low and indirect: the material concern is unsanctioned staff or contractor use of underground LLM services, and the lowering of the technical bar for malware development by less-skilled actors. This is a watch item, not an incident.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item.
This is a market/trend observation about a criminal service advertised on an underground forum. There is no ICT-related incident at a client, no major-incident classification question, no ICT third-party provider relationship with a client, and no supply-chain compromise of a client's own suppliers. Mapping DORA Art. 17/18/19 or NIS2 Art. 23 here would be compliance-checkbox padding: the trigger facts ("a service exists," "AI is being commercialised") do not change what a client must do under those articles. Clients should treat the §4 actions below as good practice and internal-policy hygiene, not as a regulatory obligation arising from this item.
3. Technical analysis & attack chain
This item is a criminal-market service offering, not an exploit chain. There is no initial-access vector, no exploited component, no CVE and no victim telemetry in the source material. The following describes how the offering is marketed and what it is claimed to do, from source facts only.
The offering and its operator. Sophos CTU observed the advertisement on 24 August 2026 on the Exploit forum. It was posted by a persona using the handle "Optimus_Prime." That account joined the forum on 18 April 2026 and had published 21 posts at the time of observation; its profile carries a "coding / coder" label. The persona's identity, location and any link to a tracked threat group are not established in the source material.
What is being sold. Luciferus is marketed as a system "that answers requests without moral or ethical restrictions." The advertisement claims the tool runs on a proprietary model with 120 billion parameters. Sophos could not verify that claim, nor any of the other performance and privacy claims in the advertisement. Sophos assesses with low confidence that Luciferus is built on Qwen, the open-source LLM family from Alibaba — this is an analytic judgement, not a confirmed fact.
Why it differs from a jailbreak. Jailbroken instances of ChatGPT or Claude lose their restrictions once the vendor patches the underlying model. Services like Luciferus are, per the advertisement and Sophos' assessment, built without safeguards from the start, which gives the seller more control over the service and a longer operational shelf life. Sophos notes that "proprietary model" claims in this market are frequently misleading, and that such services are more likely to be fine-tuned open-source models, custom system prompts, or orchestration layers wrapped around an existing model rather than genuinely new foundation models — training a novel LLM requires expertise, data and compute that most forum sellers do not have.
Commercial structure. The forum advertisement lists three subscription tiers: Inquisitor at $35/month, Archdevil at $55/month, and Prince of Darkness at $75/month. A separate "Individual Embodiment" tier offers a private model deployed for the buyer's own project, training on the buyer's own data, dedicated computing power, and buyer control over context window size and response temperature, priced according to the buyer's requirements. The Luciferus website lists different tier names and prices — Junior at $22, Middle at $34.75, and Pro at $47.14. Sophos flagged a discrepancy between the two price lists without explaining it; note that the source describes the website as making "no mention of the VIP option described in the forum post," while the forum tiers it names are Inquisitor, Archdevil and Prince of Darkness — the source does not reconcile this, and neither do we.
Demonstrated capability (single-sourced, unverified). Sophos ran a prompt asking for a simple remote access trojan written in Python. The Junior tier responded with a Russian-language explanation of the malware's networking and command-execution functions, followed by source code. Sophos did not run or verify the code, but stated the response supports the advertisement's claim that the service will answer direct malware requests. Treat this as a single-source vendor observation: the code was neither executed nor independently reviewed, and the Russian-language output is a characteristic of the response, not evidence of the operator's nationality or location.
Ecosystem context. Sophos places Luciferus within a broader trend of threat actors commercialising AI through underground forums, Telegram channels and cybercriminal marketplaces, and concludes that AI is becoming an increasingly accessible component of the cybercrime ecosystem — lowering barriers to entry and giving less technically skilled actors access to capabilities previously limited to experienced developers. That trend assessment is Sophos' judgement, single-sourced here.
Confidence caveats. Every substantive claim in this section derives from one vendor (Sophos CTU), reported via one outlet (Help Net Security). The Qwen attribution is explicitly low-confidence. The 120-billion-parameter claim is unverified. The malware-generation demonstration was not executed or validated. No independent corroboration is available in the supplied material.
4. Mitigation & containment
There is no patch, no vendor fix and no CVE to remediate. The actions below target the realistic exposure: unsanctioned use of underground or uncensored LLM services by staff, contractors and developers, and the downstream risk of AI-generated malicious or low-quality code entering your estate.
P1 — within 24 hours
- Confirm whether your acceptable-use and AI-usage policies explicitly prohibit the use of unsanctioned, non-approved LLM services, including services marketed on criminal forums. If they do not, issue a standing instruction to staff and contractors covering this class of service.
- Check egress/proxy and CASB logs for access to newly registered or low-reputation AI/chat endpoints that are not on your approved-tooling list. Prioritise any access originating from developer, engineering or security teams.
- Remind developers that AI-generated code — from any source, approved or not — must pass normal peer review, dependency scanning and SAST before merge. The Sophos demonstration is a reminder that generated code can be functional malware; the same generation capability produces plausible-looking but unsafe code.
P2 — within 72 hours
- Extend DLP and egress controls to flag prompt/response traffic to unapproved LLM endpoints, and block by default where business need is not established. Where blocking is not feasible, log and alert.
- Review your approved-AI tooling list and confirm it covers the use cases staff are actually reaching for (code assistance, translation, summarisation). Shadow-AI adoption is usually a procurement gap, not a malice problem.
- Brief threat-intel and SOC staff on the Luciferus marketing pattern and the tier/pricing structure so that forum-monitoring and brand-abuse feeds can be tuned to this class of service.
P3 — within 7 days
- Add underground-AI-service marketing to your periodic dark-web/forum monitoring scope, with a named owner for escalation.
- Review third-party and contractor onboarding to confirm AI-tool usage restrictions flow down contractually.
- Re-baseline your malware-development threat model: assume that low-skill actors in your sector now have access to on-demand malware source generation, and that commodity tooling quality will rise accordingly.
5. Indicators of compromise
No indicators of compromise available in the source material.
The source contains no file hashes, domains, IP addresses, URLs, file paths, registry keys or command lines. The only named entities are a forum persona handle, subscription tier names and prices, none of which are machine-pivotable atomic indicators. The behaviours below are provided for monitoring context only and must not be used as enforcement signatures without independent validation.
Behavioural indicators
| behaviour | where to observe | confidence |
|---|---|---|
| Marketing of uncensored/restriction-free LLM subscription services on underground forums and Telegram channels | Dark-web/forum monitoring feeds; brand-abuse monitoring | Moderate — trend assessment, single-sourced (Sophos) |
| Staff or contractor traffic to unapproved LLM/chat endpoints not on the approved-tooling list | Egress proxy, CASB, DNS logs | Low — inferred exposure, not observed in source |
| LLM responses containing malware source code or Russian-language explanations of malware networking and command-execution functions | DLP on prompt/response content where inspection is lawful and configured | Low — single-source vendor demonstration, code not executed or verified |
| AI-generated code submitted to internal repositories without provenance disclosure | Code review, SCM audit logs, SAST/dependency-scanning pipeline | Low — inferred exposure, not observed in source |
6. Detection
Insufficient indicators to author detection rules.
The source provides no file artefacts, command-line flags, mutexes, scheduled-task or service names, file paths, registry keys or network indicators from which a YARA or Sigma rule could be built. The only named strings are a forum persona handle and commercial tier names, which are reporting artefacts rather than artefacts of a threat — a rule matching them would detect coverage of this story, not the activity. Detection effort should instead go to the egress and DLP controls described in §4.
7. Sources
- Help Net Security — "Uncensored AI sold on hacking forum as alternative to ChatGPT and Claude jailbreaks" — https://www.helpnetsecurity.com/2026/09/15/luciferus-uncensored-ai-service-hacking-forum/ — 2026-09-15. (Reporting Sophos Counter Threat Unit research; the underlying Sophos report URL was not supplied and is not cited here.)
8. Adverse Trace position
We assess this as a low-severity, watch-list item with no scored vulnerability component: the VERIFIED REFERENCE DATA resolved no CVE, CVSS score or CISA KEV entry, and we have not assigned one. The entire evidence base is single-sourced — Sophos CTU, reported via Help Net Security — and the key technical claims are explicitly weak: the Qwen attribution is low-confidence, the 120-billion-parameter claim is unverified, and the malware-generation demonstration was neither executed nor independently reviewed. Attribution of the "Optimus_Prime" persona is unconfirmed; no MITRE ATT&CK profile exists for it in our reference data, and we make no link to any tracked group. Client impact today is indirect: the realistic exposure is unsanctioned staff use of underground LLM services and a gradual lowering of the skill barrier for malware development, not an active compromise. We will monitor for corroborating vendor reporting on Luciferus and on the broader commercialisation of uncensored LLMs, and will re-issue if independent sources confirm the service's model provenance, operator identity, or customer base. Clients should action §4 P1 items as policy hygiene and treat the rest as background.
Published via PulseTrace — Adverse Trace threat intelligence.