bpfdoor telecom networks sleeper cells threat research report
Rapid7
March 26, 2026
A months-long investigation by Rapid7 Labs has uncovered evidence of an advanced China-nexus threat actor, Red Menshen, placing some of the stealthiest digital sleeper cells the team has ever seen in telecommunications networks. The goal of these campaigns is to carry out high-level espionage, including against government networks.
See publication
Tags: Cybersecurity, IT Leadership, Telecom
Everyone Says AI Is Insecure, So I Measured It
HackerNoon
February 27, 2026
If you follow the discourse surrounding AI security today, you'd be forgiven for thinking we're standing on the edge of an existential cliff. The headlines and security warnings are relentless, painting a picture of an immediate and unprecedented threat landscape.
Every week brings a new, dire headline that seems to amplify the sense of impending crisis:
AI agents can be tricked into attacking systems
This often refers to research demonstrating how autonomous AI systems, designed to perform helpful tasks, can be manipulated via subtle inputs known as adversarial examples or jailbreaking techniques to perform malicious actions, bypass safety guardrails, or even launch sophisticated attacks against underlying infrastructure. The core worry here is the loss of control over powerful, autonomous agents.
See publication
Tags: AI, AI Governance, Cybersecurity
From .pth to p0wned: Abuse of Pickle Files in AI Model Supply Chains
Rapid7
July 01, 2025
Recent threat research highlights a growing risk in the Python and machine learning (ML) ecosystem: the exploitation of serialized model files, specifically those using Python’s pickle module. While commonly used for saving and loading ML models, pickle files can execute arbitrary code upon deserialization — a feature increasingly abused by threat actors.
Our investigation uncovered malicious PyTorch model files uploaded to trusted platforms like Hugging Face. These weaponized .pth files contain embedded backdoors that, when loaded, execute system-level commands to download and run remote access trojans (RATs). In one case, the payload was a Go-based ELF binary reaching out to a command-and-control server hidden behind Cloudflare Tunnel — a technique designed to evade attribution and traditional network defenses.
This attack vector underscores the need for stronger validation of third-party ML models, tighter controls on deserialization behavior, and heightened awareness of the risks tied to open-source dependencies in AI and data science workflows.
See publication
Tags: AI, AI Governance, Cybersecurity
bpfdoor telecom networks sleeper cells threat research report