Artificial intelligence (AI) relies on vast amounts of data. Enterprises that take on AI projects, especially for large language models (LLMs) and generative AI (GenAI), need to capture large volumes of data for model training as well as to store outputs from AI-enabled systems. That data, however, is unlikely to be in a single system or location. Customers will draw on multiple data sources, including structured data in databases and often unstructured data. Some of these information sources will be on-premises and others in the cloud. To deal with AI’s hunger for data, system architects need to look at storage across storage area networks (SAN), network attached storage (NAS), and, potentially, object storage. In this article, we look at the pros and cons of block, file and object storage for AI projects and the challenges of finding the right blend for organisations. The current generation of AI projects are rarely, if ever, characterised by a single source of data. Instead, generative AI models draw on a wide range of data, much of it unstructured. This includes documents, images, audio and video and computer code, to name a few. Everything about generative AI is about understanding relationships. You have the source data still in your unstructured data, either file or object, and your vectorised data sitting on block Patrick Smith, Pure Storage When it comes to training LLMs, the more data sources the better. But, at the same time, enterprises link LLMs to their own data sources, either directly or through retrieval augmented generation (RAG) that improves the accuracy and relevance of results. That data might be documents but can include enterprise applications that hold data in a relational database. “A lot of AI is driven by unstructured data, so applications point at files, images, video, audio – all unstructured data,” says Patrick Smith, field chief technology officer EMEA at storage supplier Pure Storage. “But people also look at their production datasets and want to tie them to their generative AI projects.” This, he adds, includes adding vectorisation to databases, which is commonly supported by the main relational database suppliers, such as Oracle. For system architects who support AI projects, this raises the question of where best to store data. The simplest option would be to leave data sources as they are, but this is not always possible. This could be because data needs further processing, the AI application needs to be isolated from production systems, or current storage systems lack the throughput the AI application requires. In addition, vectorisation usually leads to large increases in data volumes – a 10 times increase is not untypical – and this puts more demands on production storage. This means that storage needs to be flexible and needs to be able to scale, and AI project data handling requirements differ during each stage. Training demands large volumes of raw data, inference – running the model in production – might not require as much data but needs higher throughput and minimal latency. Enterprises tend to keep the bulk of their unstructured data on file access NAS storage. NAS has the advantages of being relatively low cost and easier to manage and scale than alternatives such as direct-attached storage (DAS) or block access SAN storage. Structured data is more likely to be block storage. Usually this will be on a SAN, although direct attached storage might be sufficient for smaller AI projects. Here, achieving the best performance – in terms of IOPS and throughput from the storage array – offsets the greater complexity of NAS. Enterprise production systems, such as enterprise resource planning (ERP) and customer relationship management (CRM), will use SAN or DAS to store their data in database files. So, in practice, data for AI is likely to be drawn data from SAN and NAS environments. “AI data can be stored either in NAS or SAN. It’s all about the way the AI tools want or need to access the data,” says Bruce Kornfeld, chief product officer at StorMagic. “You can store AI data on a SAN, but AI tools won’t typically read the blocks. They’ll use a type of file access protocol to get to the block data.” It is not necessarily the case that one protocol will better than the other. It depends very much on the nature of the data sources and on the output of the AI system For a primarily document or image-based AI system, NAS might be fast enough. For an application such as autonomous driving or surveillance, systems might use a SAN or even high-speed local storage. Again, data architects will also need to distinguish between training and inference phases of their projects and consider whether the overhead of moving data between storage systems outweighs performance benefits, especially in training. This has led some organisations to look at object storage as a way of unifying data sources for AI. Object storage is increasingly in use with enterprises, and not just in cloud storage – on-premise object stores are gaining market share too. Object has some advantages for AI, not least its flat structure and global name space, (relatively) low management overheads, ease of expansion and low cost. Performance, however, has not been a strength for object storage. This has tended to make it more suited to tasks such as archiving than applications that demand low latency and high levels of data throughput. Suppliers are working to close the performance gap, however. Pure Storage and NetApp sell storage systems that can handle file and object and, in some cases, block too. These include Pure’s FlashBlade, and hardware that runs NetApp’s OnTap storage operating system. These technologies give storage managers the flexibility to use the best data formats, without creating silos tied to specific hardware. Others, such as Hammerspace, with its Hyperscale NAS, aim to squeeze additional performance out of equipment that runs the network file system (NFS). This, they argue, prevents bottlenecks where storage fails to keep up with data-hungry graphics processing units (GPUs). But until better-performing object storage systems become more widely available, or more enterprises move to universal storage platforms, AI is likely to use NAS, SAN, object and even DAS in combination. That said, the balance between the elements is likely to change during the lifetime of an AI project, and as AI tools and their applications evolve. At Pure, Smith has seen requests for new hardware for unstructured data, while block and vector database requirements are being met for most customers on existing hardware. “Everything about generative AI is about understanding relationships,” he says. “You have the source data still in your unstructured data, either file or object, and your vectorised data sitting on block.” Read more about AI and storage Storage technology explained: AI and data storage: In this guide, we examine the data storage needs of artificial intelligence, the demands it places on data storage, the suitability of cloud and object storage for AI, and key AI storage products. Storage technology explained: Vector databases at the core of AI: We look at the use of vector data in AI and how vector databases work, plus vector embedding, the challenges for storage of vector data and the key suppliers of vector database products.

May 23, 2025Ravie LakshmananCryptocurrency / Malware The malware known as Latrodectus has become the latest to embrace the widely-used social engineering technique called ClickFix as a distribution vector. "The ClickFix technique is particularly risky because it allows the malware to execute in memory rather than being written to disk," Expel said in a report shared with The Hacker News. "This removes many opportunities for browsers or security tools to detect or block the malware." Latrodectus, believed to be a successor to IcedID, is the name given to a malware that acts as a downloader for other payloads, such as ransomware. It was first documented by Proofpoint and Team Cymru in April 2024. Incidentally, the malware is one among the many malicious software to suffer an operational setback as part of Operation Endgame, which took down 300 servers worldwide and neutralized 650 domains related to Bumblebee, Lactrodectus, QakBot, HijackLoader, DanaBot, TrickBot, and WARMCOOKIE between May 19 and 22, 2025. In the latest set of Latrodectus attacks observed by Expel in May 2025, unsuspecting users are tricked into copying and executing a PowerShell command from an infected website, a tactic that has become a prevalent method to distribute a wide range of malware. "When run by a user, these commands will attempt to install a file located at the remote URL using MSIExec, and then execute it in memory," Expel said. "This keeps the attacker from having to write the file to the computer and risk being detected by the browser or an antivirus that might detect it on disk." The MSI installer contains a legitimate application from NVIDIA, which is used to sideload a malicious DLL, which then uses curl to download the main payload. To mitigate attacks of this type, it's advised to disable the Windows Run program using Group Policy Objects (GPOs) or turn off the "Windows + R" hot key via a Windows Registry change. From ClickFix to TikTok The disclosure comes as Trend Micro revealed details of a new engineering campaign that instead of relying on fake CAPTCHA pages employs TikTok videos likely generated using artificial intelligence (AI) tools to deliver the Vidar and StealC information stealers by instructing users to run malicious commands on their systems to activate Windows, Microsoft Office, CapCut, and Spotify. These videos have been posted from various TikTok accounts such as @gitallowed, @zane.houghton, @allaivo2, @sysglow.wow, @alexfixpc, and @digitaldreams771. These accounts are no longer active. One of the videos claiming to provide instructions on how to "boost your Spotify experience instantly" has amassed nearly 500,000 views, with over 20,000 likes and more than 100 comments. The campaign marks a new escalation of ClickFix in that users searching for ways to activate pirated apps are verbally and visually guided to open the Windows Run dialog by pressing the "Windows + R" hot key, launch PowerShell, and run the command highlighted in the video, ultimately compromising their own systems. "Threat actors are now using TikTok videos that are potentially generated using AI-powered tools to socially engineer users into executing PowerShell commands under the guise of guiding them to activate legitimate software or unlock premium features," security researcher Junestherry Dela Cruz said. "This campaign highlights how attackers are ready to weaponize whichever social media platforms are currently popular to distribute malware." Fake Ledger Apps Used to Steal Mac Users' Seed Phrases The findings also follow the discovery of four different malware campaigns that leverage a cloned version of the Ledger Live app to steal sensitive data, including seed phrases, with the goal of draining victims' cryptocurrency wallets. The activity has been ongoing since August 2024. The attacks make use of the malicious DMG files that, when launched, launches AppleScript to exfiltrate passwords and Apple Notes data, and then download a trojanized version of Ledger Live. Once the app is opened, it warns users of a supposed account problem and that it requires their seed phrase for recovery. The entered seed phrase is sent to an attacker-controlled server. Moonlock Lab, which shed light on the campaign, said the rogue apps make use of macOS stealer malware like Atomic macOS Stealer (AMOS) and Odyssey, the latter of which introduced the novel phishing scheme in March 2025. It's worth noting that the activity overlaps with a macOS infostealer campaign that targets Ledger Live users through PyInstaller-packed binaries, as revealed by Jamf this month. "On dark web forums, chatter around anti-Ledger schemes is growing. The next wave is already taking shape," MacPaw's cybersecurity division noted. "Hackers will continue to exploit the trust crypto owners place in Ledger Live." Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post. SHARE    

If you're a pro, this is perfect for ideation or concept designs, or for design hobbyists.

If you're a pro, this is perfect for ideation or concept designs, or for design hobbyists.

Microsoft's subscription service, Xbox Game Pass, has grown into a must-have this year thanks to a whole host of big releases, but is it enough to help Xbox catch up to PlayStation?Tech13:00, 23 May 2025Game Pass is arguably more important than an Xbox console these days(Image: Future Publishing via Getty Images)It’d be fair to say at times that Xbox’s strategy this console generation has been clear as mud.From its opening salvo of multiplatform releases on PlayStation and Switch, to other games being released day and date on other systems, and some even looking better on PS5 Pro, you’d be reasonably wondering if you need an Xbox at all.‌In fact, Microsoft agrees, with its “This is an Xbox” pretty much labelling everything except your toaster and the kitchen sink as a console of sorts. The Xbox as we know it is long gone, it seems, but in its place, Xbox Game Pass feels like it’s grown in momentum month after month .‌Is it enough to turn the tide? It’s hard to say.Halo Infinite marked a sort of 'false dawn' for Game Pass back in 2021(Image: ESA PR Supplied.)Cast your mind back to late 2021. Microsoft released Forza Horizon 5 and Halo Infinite in consecutive months, and it felt as though Xbox Game Pass was about to kick into overdrive.Article continues belowSadly, things went a little quieter after that (and Halo’s momentum was curtailed for other reasons), but now, years later, it feels Xbox Game Pass is poised to finally hit some kind of stride.It’d be fair to say that Microsoft’s acquisition of Bethesda and Activision Blizzard has left it with a studio portfolio that would make many envious, but it’s not really managed to line up its releases. Even Avowed, one of this year’s best games (and one we’ll touch on shortly), was slated for last year before Microsoft nudged it to 2025.Still, as it turns out, having great games on your platform will get players through the door, and if you’ve got a PC then you’re in an even better position.‌Stalker 2 has been heavily patched since launch(Image: GSC Game World)September saw Frostpunk 2 arrive on Xbox Game Pass for PC, while October added Call of Duty Black Ops 6. November brought with it STALKER 2 on day one, and December saw the year out with Indiana Jones and the Great Circle.Unlike 2021, though, Microsoft has kept things moving between calendar years. January kicked off with Ninja Gaiden 2 Black as a stealth release, along with GOTY sequel Citizen Sleeper 2: Starward Vector. February added Avowed, March brought with it Atomfall, and April added South of Midnight, critical darling Blue Prince, and the day one release of Elder Scrolls IV: Oblivion Remastered.‌All of these games are available on PS5, sure, but the cost would be astronomical to play all of them, and Microsoft still isn’t done.DOOM: The Dark Ages is on PC and Xbox, along with Monster Train 2, this month, while Tony Hawk’s Pro Skater 3+4 remakes , Wuchang: Fallen Feathers, Gears of War: Reloaded, The Outer Worlds 2 and much more are still coming in 2025.It’s a frankly ridiculous list of games with more to come in 2026, and that’s saying nothing of freebies like in-game items for League of Legends, Overwatch 2, and more, as well as this week’s announcement of a huge retro game collection .‌ESO is still growing, even after a decade(Image: Bethesda Softworks/ZeniMax Media )One of the biggest knocks against Game Pass in recent years has been the increase in price, and while there’s an argument to be made about Microsoft’s tiers making it harder to know if you’re getting a game on day one, Xbox Game Pass Core continues to grow.Core is cheaper than the Ultimate option that includes console and PC, but it does have a sizeable collection of games for budget-conscious players.‌The recently added Retro Classics are included, for example, as well as Bethesda hits like DOOM Eternal, Dishonored 2, and Fallout 4. For casual gamers, that might be enough.In fact, there’s a whole host of games included that could consume your week if you let them, like State of Decay 2, The Elder Scrolls Online, and Stardew Valley.That means there’s likely to be something for everyone while you wait for more recent releases to trickle down.‌Game Pass has really come into its own this year(Image: Microsoft)Most of my friends have a PlayStation 5, so if a game doesn’t have cross-play, that’s where I play my games—Game Pass or no.I do wonder how many feel the same, and see the appeal of Game Pass but simply don’t have the inclination (or money) to pick up a second console to play games cheaper in the long run, especially with so many coming to PlayStation in the future.‌Given Microsoft now has the keys to Warcraft, Overwatch, Elder Scrolls, Fallout, Gears of War, Halo, Forza and so much more, I wonder if there’s ever a scenario where they start to rebuild walls between their franchises.Sure, Call of Duty will keep making money hand over fist on as many platforms as possible, but would the next Dishonored be worth putting on all platforms when you could keep it to the Xbox platform as an added incentive?Microsoft can’t be happy with being in second place for another console generation, and while I do wonder if Sony will eventually reckon with rising budgets by starting to move its own games elsewhere (and not just to PC), I’d wager we’ll get one more Xbox generation at most before the company goes the way of SEGA.Article continues belowWhat do you think? Does Game Pass interest you? Are you always likely to play where your friends are? And can Microsoft keep up this momentum?For the latest breaking news and stories from across the globe from the Daily Star, sign up for our newsletters.‌‌‌

May 23, 2025The Hacker NewsWeb Security / Threat Detection From zero-day exploits to large-scale bot attacks — the demand for a powerful, self-hosted, and user-friendly web application security solution has never been greater. SafeLine is currently the most starred open-source Web Application Firewall (WAF) on GitHub, with over 16.4K stars and a rapidly growing global user base. This walkthrough covers what SafeLine is, how it works, and why it's becoming the go-to solution over cloud-based WAFs. What is SafeLine WAF? SafeLine is a self-hosted web application firewall that acts as a reverse proxy, filtering and monitoring HTTP/HTTPS traffic to block malicious requests before they reach your backend web applications. Unlike cloud-based WAFs, SafeLine runs entirely on your own servers—giving you unmatched visibility and data sovereignty. Key Features of SafeLine WAFComprehensive Attack Prevention SafeLine effectively blocks a wide range of common and advanced web attacks, including SQL injection(SQLi), cross-site scripting (XSS), OS command injection, CRLF injection, XML External Entity (XXE) attacks, Server Side Request Forgery (SSRF), and directory traversal, etc. Zero-Day Detection via Semantic Analysis Unlike traditional signature-based WAFs, SafeLine uses a patented semantic analysis engine that deeply parses HTTP traffic semantics. This approach enables it to detect complex and zero-day attacks with high accuracy, resulting in an industry-leading detection rate of 99.45% and an ultra-low false positive rate of 0.07%. (The chart below compares SafeLine with the two versions of a globally recognized open-source WAF.) Robust Bot Protection SafeLine delivers comprehensive, multi-layered defenses against automated bot attacks, a growing threat vector responsible for credential stuffing, malicious scraping, inventory hoarding, and vulnerability scanning. It combines several out-of-box powerful mechanisms: CAPTCHA Challenges: Dynamically issued to distinguish human users from automated clients, especially in suspicious or high-risk traffic scenarios. Dynamic Protection: Randomly encrypts and obfuscates frontend code, such as HTML and JavaScript, before delivering it to the client. This prevents bots from reliably parsing page structures or interacting with DOM elements, rendering automated scripts ineffective. Anti-Replay Mechanisms: Detect and block reuse of tokens, headers, or payloads often leveraged in scripted attacks or credential stuffing campaigns. HTTP Flood DDoS Mitigation HTTP flood DDoS attacks attempt to overwhelm servers by sending massive volumes of HTTP requests in a short period of time. These attacks can exhaust server resources, degrade performance, or take applications offline entirely. To counter this, SafeLine implements rate limiting to cap request frequency and mitigate abuse. These measures are highly configurable, allowing defenders to tailor thresholds based on real-world traffic patterns. For sudden traffic spikes—whether legitimate or malicious—SafeLine provides a virtual waiting room mechanism. This ensures service availability by queuing excess users and releasing them gradually, preventing backend overload while maintaining a fair and orderly access experience. Authentication Challenges SafeLine is also designed with Zero Trust principles in mind—never trust, always verify. It offers configurable visitor authentication to secure access to protected applications, enhancing security through enforced identity checks. As a built-in identity gateway, it supports modern authentication protocols such as OIDC and integrates seamlessly with identity providers like GitHub and others. SafeLine also supports Single Sign-On (SSO) to streamline user authentication and simplify login experience in the meantime. Best of all, these enterprise-grade identity features are included for free. Simple Deployment in Minutes SafeLine is designed for quick setup and easy management. It requires the following environment to be installed and run: Operating System: Linux (x86_64 or arm64) Dependencies: Docker (version 20.10.14 or higher) and Docker Compose (version 2.0.0 or higher) Minimum System Requirements: 1 CPU core, 1 GB of RAM, and 5 GB of available disk space Once the environment is ready, installation takes just a few minutes with a single command. bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en A user-friendly, wizard-based interface guides you through configuration. Full documentation is available here. Why Choose SafeLine Over Cloud-Based WAFs? Unlike traditional cloud-based WAFs that route your traffic through third-party infrastructure, SafeLine offers complete deployment autonomy. Here are the advantages: Full Data Control: Sensitive traffic and logs remain on-premises, reducing exposure to third-party cloud risks. Cost Efficiency: Avoids recurring subscription fees common with cloud WAFs, especially beneficial for high-traffic environments. Free and Out-of-Box Enterprise Features: Advanced threat detection, bot protection, identity authentication, and more—typically gated behind "premium" tiers elsewhere—are out-of-box and included for free. Get SafeLine — free forever for personal use, with optional 7-day Pro trial. Use Cases Ideal for SafeLine SafeLine is a versatile solution built for a wide range of web application security needs. It's particularly well-suited for: Organizations with strict data privacy or regulatory compliance requirements Teams Targeted by Sophisticated Bots and Automated Threats Small and medium-sized businesses seeking affordable, enterprise-grade protection DevOps and Security Teams Requiring Full Deployment Control and Customization Projects requiring rapid deployment and easy maintenance Final Words SafeLine stands out as a powerful, open-source alternative to traditional cloud-based WAFs. With cutting-edge zero-day detection, robust bot mitigation, and zero trust–aligned identity features—all bundled into a self-hosted, easy-to-deploy package—SafeLine empowers developers, security teams, and organizations of all sizes to take control of their web security. Get SafeLine — free forever for personal use, with optional 7-day Pro trial. Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Twitter  and LinkedIn to read more exclusive content we post. SHARE    

The U.S. Department of Justice (DoJ) on Thursday announced the disruption of the online infrastructure associated with DanaBot (aka DanaTools) and unsealed charges against 16 individuals for their alleged involvement in the development and deployment of the malware, which it said was controlled by a Russia-based cybercrime organization. The malware, the DoJ said, infected more than 300,000 victim computers around the world, facilitated fraud and ransomware, and caused at least $50 million in damages. Two of the defendants, Aleksandr Stepanov (aka JimmBee), 39, and Artem Aleksandrovich Kalinkin (aka Onix), 34, both from Novosibirsk, Russia, are currently at large. Stepanov has been charged with conspiracy, conspiracy to commit wire fraud and bank fraud, aggravated identity theft, unauthorized access to a protected computer to obtain information, unauthorized impairment of a protected computer, wiretapping, and use of an intercepted communication. Kalinkin has been charged with conspiracy to gain unauthorized access to a computer to obtain information, to gain unauthorized access to a computer to defraud, and to commit unauthorized impairment of a protected computer. The unsealed criminal complaint and indictment show that many of the defendants, counting Kalinkin, exposed their real-life identities after accidentally infecting their own systems with the malware. "In some cases, such self-infections appeared to be deliberately done in order to test, analyze, or improve the malware," the complaint [PDF] read. "In other cases, the infections seemed to be inadvertent – one of the hazards of committing cybercrime is that criminals will sometimes infect themselves with their own malware by mistake." "The inadvertent infections often resulted in sensitive and compromising data being stolen from the actor's computer by the malware and stored on the DanaBot servers, including data that helped identify members of the DanaBot organization." If convicted, Kalinkin is expected to face a statutory maximum sentence of 72 years in federal prison. Stepanov would face a jail term of five years. Concurrent with the action, the law enforcement effort, carried out as part of Operation Endgame, saw DanaBot's command-and-control (C2) servers seized, including dozens of virtual servers hosted in the United States. "DanaBot malware used a variety of methods to infect victim computers, including spam email messages containing malicious attachments or hyperlinks," the DoJ said. "Victim computers infected with DanaBot malware became part of a botnet (a network of compromised computers), enabling the operators and users of the botnet to remotely control the infected computers in a coordinated manner." DanaBot, like the recently dismantled Lumma Stealer malware, operates under a malware-as-a-service (MaaS) scheme, with the administrators leasing out access starting from $500 to "several thousand dollars" a month. Tracked under the monikers Scully Spider and Storm-1044, is a multi-functional tool along the lines of Emotet, TrickBot, QakBot, and IcedID that's capable of acting as a stealer and a delivery vector for next-stage payloads, such as ransomware. The Delphi-based modular malware is equipped to siphon data from victim computers, hijack banking sessions, and steal device information, user browsing histories, stored account credentials, and virtual currency wallet information. It can also provide full remote access, log keystrokes, and capture videos. It's been active in the wild since its debut in May 2018, when it started off as a banking trojan. Example of typical Danabot infrastructure "DanaBot initially targeted victims in Ukraine, Poland, Italy, Germany, Austria, and Australia prior to expanding its targeting posture to include U.S.- and Canada-based financial institutions in October 2018," CrowdStrike said. "The malware's popularity grew due to its early modular development supporting Zeus-based web injects, information stealer capabilities, keystroke logging, screen recording, and hidden virtual network computing (HVNC) functionality." According to Black Lotus Labs and Team Cymru, DanaBot employs a layered communications infrastructure between a victim and the botnet controllers, wherein the C2 traffic is proxied through two or three server tiers before it reaches the final level. At least five to six tier-2 servers were active at any given time. A majority of DanaBot victims are concentrated around Brazil, Mexico, and the United States. "The operators have shown their commitment to their craft, adapted to detection and changes in enterprise defense, and with later iterations, insulating the C2s in tiers to obfuscate tracking," the companies said. "Throughout this time, they have made the bot more user-friendly with structured pricing and customer support." High-level diagram of multi-tiered C2 architecture The DoJ said DanaBot administrators operated a second version of the botnet that was specially designed to target victim computers in military, diplomatic, government, and related entities in North America and Europe. This variant, emerging in January 2021, came fitted with capabilities to record all interactions happening on a victim device and send the data to a different server. "Pervasive malware like DanaBot harms hundreds of thousands of victims around the world, including sensitive military, diplomatic, and government entities, and causes many millions of dollars in losses," said United States Attorney Bill Essayli for the Central District of California. The DoJ further credited several private sector firms, Amazon, CrowdStrike, ESET, Flashpoint, Google, Intel 471, Lumen, PayPal, Proofpoint, Spycloud, Team Cymru, and Zscaler, for providing "valuable assistance." Some of the noteworthy aspects of DanaBot, compiled from various reports, are below - DanaBot's sub-botnet 5 received commands to download a Delphi-based executable leveraged to conduct HTTP-based distributed denial-of-service (DDoS) attacks against the Ukrainian Ministry of Defence (MOD) webmail server and the National Security and Defense Council (NSDC) of Ukraine in March 2022, shortly after Russia's invasion of the country Two DanaBot sub-botnets, 24 and 25, were specifically used for espionage purposes likely with an aim to further intelligence-gathering activities on behalf of Russian government interests DanaBot operators have periodically restructured their offering since 2022 to focus on defense evasion, with at least 85 distinct build numbers identified to date (The most recent version is 4006, which was compiled in March 2025) The malware's infrastructure consists of multiple components: A "bot" that infects target systems and performs data collection, an "OnlineServer" that manages the RAT functionalities, a "client" for processing collected logs and bot management, and a "server" that handles bot generation, packing, and C2 communication DanaBot has been used in targeted espionage attacks against government officials in the Middle East and Eastern Europe The authors of DanaBot operate as a single group, offering the malware for rent to potential affiliates, who subsequently use it for their own malicious purposes by establishing and managing their own botnets using private servers DanaBot's developers have partnered with the authors of several malware cryptors and loaders, such as Matanbuchus, and offered special pricing for distribution bundles DanaBot maintained an average of 150 active tier-1 C2 servers per day, with approximately 1,000 daily victims across more than 40 countries, making it one of the largest MaaS platforms active in 2025 Proofpoint, which first identified and named DanaBot in May 2018, said the disruption of the MaaS operation is a win for defenders and that it will have an impact on the cybercriminal threat landscape. "Cybercriminal disruptions and law enforcement actions not only impair malware functionality and use but also impose a cost to threat actors by forcing them to change their tactics, cause mistrust in the criminal ecosystem, and potentially make criminals think about finding a different career," Selena Larson, a staff threat researcher at Proofpoint, said. "These successes against cyber criminals only come about when business IT teams and security service providers share much-needed insight into the biggest threats to society, affecting the greatest number of people around the world, which law enforcement can use to track down the servers, infrastructure, and criminal organizations behind the attacks. Private and public sector collaboration is crucial to knowing how actors operate and taking action against them." DanaBot's features as promoted on its support site DoJ Unseals Charges Against QakBot Leader The development comes as the DoJ unsealed charges against a 48-year-old Moscow resident, Rustam Rafailevich Gallyamo, for leading efforts to develop and maintain the QakBot malware, which was disrupted in a multinational operation in August 2023. The agency also filed a civil forfeiture complaint against over $24 million in cryptocurrency seized from Gallyamov over the course of the investigation. "Gallyamov developed, deployed, and controlled the Qakbot malware beginning in 2008," the DoJ said. "From 2019 onward, Gallyamov allegedly used the Qakbot malware to infect thousands of victim computers around the world in order to establish a network, or 'botnet,' of infected computers." The DoJ revealed that, following the takedown, Gallyamov and his co-conspirators continued their criminal activities by switching to other tactics like "spam bomb" attacks in order to gain unauthorized access to victim networks and deploy ransomware families like Black Basta and CACTUS. Court documents accuse the e-crime group of engaging in these methods as recently as January 2025. "Mr. Gallyamov's bot network was crippled by the talented men and women of the FBI and our international partners in 2023, but he brazenly continued to deploy alternative methods to make his malware available to criminal cyber gangs conducting ransomware attacks against innocent victims globally," said Assistant Director in Charge Akil Davis of the FBI's Los Angeles Field Office. Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.

The effectiveness of language models relies on their ability to simulate human-like step-by-step deduction. However, these reasoning sequences are resource-intensive and can be wasteful for simple questions that do not require elaborate computation. This lack of awareness regarding the complexity of the task is one of the core challenges in these models. They often default to detailed reasoning even for queries that could be answered directly. Such an approach increases token usage, extends response time, and increases system latency and memory usage. As a result, there’s a pressing need to equip language models with a mechanism that allows them to make autonomous decisions about whether to think deeply or respond succinctly. Current tools attempting to solve this issue either rely on manually set heuristics or prompt engineering to switch between short and long responses. Some methods use separate models and route questions based on complexity estimates. Still, these external routing systems often lack insight into the target model’s strengths and fail to make optimal decisions. Other techniques fine-tune models with prompt-based cues like “reasoning on/off,” but these rely on static rules rather than dynamic understanding. Despite some improvements, these approaches fail to enable fully autonomous and context-sensitive control within a single model. Researchers from the National University of Singapore introduced a new framework called Thinkless, which equips a language model with the ability to dynamically decide between using short or long-form reasoning. The framework is built on reinforcement learning and introduces two special control tokens—<short> for concise answers and <think> for detailed responses. By incorporating a novel algorithm called Decoupled Group Relative Policy Optimization (DeGRPO), Thinkless separates the training focus between selecting the reasoning mode and improving the accuracy of the generated response. This design prevents the model from falling into one-dimensional behavior and enables adaptive reasoning tailored to each query. The methodology involves two stages: warm-up distillation and reinforcement learning. In the distillation phase, Thinkless is trained using outputs from two expert models—one specializing in short responses and the other in detailed reasoning. This stage helps the model establish a firm link between the control token and the desired reasoning format. The reinforcement learning stage then fine-tunes the model’s ability to decide which reasoning mode to use. DeGRPO decomposes the learning into two separate objectives: one for training the control token and another for refining the response tokens. This approach avoids the gradient imbalances in earlier models, where longer responses would overpower the learning signal, leading to a collapse in reasoning diversity. Thinkless ensures that both <short> and <think> tokens receive balanced updates, promoting stable learning across response types. When evaluated, Thinkless significantly reduced long-form reasoning while preserving high accuracy. On the Minerva Algebra benchmark, the model used the <think> token in only 25.88% of cases while achieving 94.59% accuracy. In contrast, conventional reasoning models had to use extended chains of thought much more frequently. On the AIME 2024 dataset, Thinkless reached a 27.33% accuracy rate with 100% usage of the reasoning mode, showing that it could maintain performance when full reasoning was necessary. On the GSM8K dataset, it utilized <think> only 13.31% of the time, yet still achieved 84.18% accuracy. These results reflect the model’s ability to handle simple and complex queries with appropriate reasoning depth, cutting down on unnecessary token generation by as much as 90% in some tasks. Overall, this study from the National University of Singapore researchers presents a compelling solution to the inefficiencies of uniform reasoning in large language models. By introducing a mechanism that enables models to judge task complexity and adjust their inference strategy accordingly, Thinkless optimizes both accuracy and efficiency. The method balances depth of reasoning and response precision without relying on fixed rules, offering a data-driven approach to more intelligent language model behavior. Check out the Paper and GitHub Page. All credit for this research goes to the researchers of this project. Also, feel free to follow us on Twitter and don’t forget to join our 95k+ ML SubReddit and Subscribe to our Newsletter. NikhilNikhil is an intern consultant at Marktechpost. He is pursuing an integrated dual degree in Materials at the Indian Institute of Technology, Kharagpur. Nikhil is an AI/ML enthusiast who is always researching applications in fields like biomaterials and biomedical science. With a strong background in Material Science, he is exploring new advancements and creating opportunities to contribute.Nikhilhttps://www.marktechpost.com/author/nikhil0980/This AI Paper Introduces MathCoder-VL and FigCodifier: Advancing Multimodal Mathematical Reasoning with Vision-to-Code AlignmentNikhilhttps://www.marktechpost.com/author/nikhil0980/This AI Paper Introduces PARSCALE (Parallel Scaling): A Parallel Computation Method for Efficient and Scalable Language Model DeploymentNikhilhttps://www.marktechpost.com/author/nikhil0980/Google AI Releases Standalone NotebookLM Mobile App with Offline Audio and Seamless Source IntegrationNikhilhttps://www.marktechpost.com/author/nikhil0980/This AI Paper from Microsoft Introduces a DiskANN-Integrated System: A Cost-Effective and Low-Latency Vector Search Using Azure Cosmos DB

Remember the Vector? A tiny tractor-shaped anthropomorphized robot that sat on your desk, held up snacks, and kept you company? If you do, you also remember its unceremonious demise. Anki folded due to bankruptcy, selling all its assets to another company that pretty much killed the Vector’s functionality. It’s sort of like the Humane AI pin, which ended up getting pretty much shuttered after the company declared it was shutting down. There are now thousands of Anki Vector toys just gathering dust, sitting in the shadow of what could have been. However, a similar product may be fulfilling the Vector’s role, with the exact same demeanor and cuteness. Meet the Focus Buddy, a tiny robot designed to look like an anthropomorphic computer, sitting on your desk. Like the Vector, the Focus Buddy interacts with you, through input and expression – however, it has a more distinct purpose than simply entertainment – its purpose is to boost human focus. Designer: Neurofocus.ai Focus Buddy is a tiny touch-enabled device that uses a combination of sensors to check your attentiveness. Think a pomodoro timer but with AI chops. It’s playful, but plays a pretty fundamental role in your productivity, checking to see if you’re attentive, distracted, or just dissociating (mea culpa). The tiny device, no larger than a chonky webcam, sits on your tabletop, with a 2-ish inch screen that usually shows a friendly face with blinking eyes similar to the Anki Vector. Tap the screen, and you can access a variety of settings as well as games that help boost your focus. The way the Focus Buddy works is simple yet advanced. A webcam on top captures your face, reading your gaze, how many times you blink, and whether you look attentive, sleepy, or just listless. However, a millimeter-wave sensor inside the robot also manages to read your heart rate, combining the two metrics to judge your focus. If it detects a drop, it alerts you, and encourages you to either get back to work, or boost your focus using one of its on-board focus-enhancing exercises. The device is currently in a very rudimentary phase (the company is purely China-based and hasn’t even built its website yet), with its makers looking to slowly reach critical mass. For now, however, the Focus Buddy is a perfect symbol of what the Vector could have been – a buddy that guides you through the day and enables you to be your best self. Also, it’s the perfect size for cat-hats, so you can customize your Focus Buddy with a rodeo had, a tiara, probably even a modded 3D printed Batman or Iron Man mask that works without blocking the screen or impeding the webcam! The post The Anki Vector Died And Gave Birth To The Focus Buddy: Hands-on at BEYOND Expo 2025 first appeared on Yanko Design.