Threat Intelligence Center

Connor Riley Moucka, an individual known in criminal circles by the handles Waifu and Judische, has pleaded guilty in connection with the Snowflake hacking case and faces a maximum sentence of up to 32 years in prison.

Adversaries are moving beyond experimenting with AI and folding it into working tradecraft. Reporting ties Altered Spider, Cordial Spider, Snarky Spider, TeamPCP, Stardust Chollima and Chinese APT groups to activity involving AI coding assistants such as Claude Code, Cursor, CodeX and Gemini, alongside tooling and artifacts including the Axios npm package, malicious CLAUDE.

HollowFrame is a loader tracked alongside Matryoshka-style nested staging that disguises itself as a legitimate Python runtime component, python311.dll, to avoid Microsoft Defender detection on Windows systems. The activity also involves certutil, a signed Windows binary commonly abused for file staging and decoding, plus sideloadable libraries including version.dll and wtsapi32.dll.

A reseller known as Poison Claude markets discounted Claude access, but the arrangement routes user activity through an operator who can see every customer prompt. The service is associated with Ecomagent.in, and reporting also references DeepSeek, MiniMax, and Moonshot AI.

A toolkit tracked as Kali365 is being used against US companies, abusing Microsoft authentication workflows rather than exploiting a traditional software flaw. Because the activity rides on authentication processes employees already trust, it can be difficult to separate from normal sign-in behavior.

Trojanized Adobe and Zoom update installers are being used to drop ConnectWise ScreenConnect, giving attackers hands-on remote access that survives reboots and blends in with legitimate remote support traffic. Related tooling observed in this activity includes MemoryLoader.cs, the Powercat PowerShell utility, the WsgiDAV file server, cloudflared for tunneling, and a fake Xeno Executor installer.