VirLabs Blog

Research and updates.

Technical findings and notes from our malware research.

The discovery of an unknown malware family affecting MikroTik CCR1000 routers. Unpacking it reveals file transfer, process execution, layered encryption, and cleanup, but leaves its deployment and operator unresolved.

By VirLabs · 2026-10-15

Tessera: reverse-engineering a backdoor on forgotten silicon

The discovery of an unknown malware family affecting MikroTik CCR1000 routers. Unpacking it reveals file transfer, process execution, layered encryption, and cleanup, but leaves its deployment and operator unresolved.

Read article →

CLOSEDQUORUM offers a glimpse of LLM-directed malware in the making, complete with hardcoded decisions, broken injection and a decision loop that only decides once. Autonomy remains a work in progress.

By Ivan Kwiatkowski · 2026-10-02

knock-outd: an undetected port-knocking backdoor in the wild

An undetected Linux launcher uses libpcap to bind to the nerwork interface, and waits for three packets before executing a missing companion.

Read article →

By Ivan Kwiatkowski · 2026-09-29

CLOSEDQUORUM's paint is still wet

CLOSEDQUORUM offers a glimpse of LLM-directed malware in the making, complete with hardcoded decisions, broken injection and a decision loop that only decides once. Autonomy remains a work in progress.

Read article →

VirLabs links additional JITTERLY samples to a populated SIXZUT configuration and artifacts reported in HestiaCP compromises. The findings complement Acronis and GreyNoise research into related activity around 981666.xyz.

By Ivan Kwiatkowski · 2026-09-25

Tracing SIXZUT and JITTERLY in the wild

VirLabs links additional JITTERLY samples to a populated SIXZUT configuration and artifacts reported in HestiaCP compromises. The findings complement Acronis and GreyNoise research into related activity around 981666.xyz.

Read article →