VirLabs Blog https://www.virlabs.ai/blog/ Technical findings and notes from our malware research. en knock-outd: an undetected port-knocking backdoor in the wild https://www.virlabs.ai/blog/knock-outd/ https://www.virlabs.ai/blog/knock-outd/ Ivan Kwiatkowski Fri, 02 Oct 2026 00:00:00 GMT An undetected Linux launcher uses libpcap to bind to the nerwork interface, and waits for three packets before executing a missing companion. CLOSEDQUORUM's paint is still wet https://www.virlabs.ai/blog/closedquorum/ https://www.virlabs.ai/blog/closedquorum/ Ivan Kwiatkowski Tue, 29 Sep 2026 00:00:00 GMT CLOSEDQUORUM offers a glimpse of LLM-directed malware in the making, complete with hardcoded decisions, broken injection and a decision loop that only decides once. Autonomy remains a work in progress. Tracing SIXZUT and JITTERLY in the wild https://www.virlabs.ai/blog/red-heron/ https://www.virlabs.ai/blog/red-heron/ Ivan Kwiatkowski Fri, 25 Sep 2026 00:00:00 GMT VirLabs links additional JITTERLY samples to a populated SIXZUT configuration and artifacts reported in HestiaCP compromises. The findings complement Acronis and GreyNoise research into related activity around 981666.xyz.