RESEARCH
November 2024: LLM agents run pentests, a suspected RPKI backdoor, IoT updates at risk
Supply chainOT and industrial securityRansomware
November 2024 shows LLM agents able to automate a penetration test and backdoors that leak documents from RAG systems. On the infrastructure side, a critical flaw in an RPKI validator may be an intentional backdoor. Nearly half the apps updating IoT devices have flaws, and an e-scooter becomes the target of battery ransomware.
Archive: reconstruction written in November 2026
1. PentestAgent: Incorporating LLM Agents to Automated Penetration Testing
arXiv · Xiangmin Shen, Lingzhi Wang, Zhenyuan Li, Yan Chen et al. · AI & LLM Security
In short: An LLM-based multi-agent system automates intelligence gathering, vulnerability analysis and exploitation.
Manual penetration testing is costly and needs scarce skills. PentestAgent uses several LLM agents and retrieval-augmented generation to bring pentest knowledge into the model and automate reconnaissance, vulnerability analysis and exploitation with little human input. It is evaluated on a comprehensive benchmark of test scenarios.
Why it matters. The automation that lowers testing costs for companies also lowers the cost of attacks.
2. Data Extraction Attacks in Retrieval-Augmented Generation via Backdoors
arXiv · Yuefeng Peng, Junda Wang, Hong Yu, Amir Houmansadr · AI & LLM Security
In short: A backdoor planted during fine-tuning makes a RAG system leak its knowledge base documents verbatim.
Prompt-injection extraction attacks depend on the model's willingness to follow instructions and fail on less compliant models. The authors instead poison a small share of fine-tuning data: once integrated in a RAG system, the compromised model leaks documents when it sees a trigger. With 5% poisoned data on Gemma-2B-IT, verbatim extraction succeeds 94.1% of the time.
Why it matters. An already compromised third-party model can expose the company documents connected to it, with no obvious sign.
3. Poster: From Fort to Foe: The Threat of RCE in RPKI
ACM Conference on Computer and Communications Security · Oliver Jacobsen, Haya Schulmann, Niklas Vogel, Michael Waidner · AI & LLM Security
In short: A buffer overflow in the Fort RPKI validator enables remote code execution, with signs of an intentional backdoor.
RPKI protects Internet routing by verifying who may announce which addresses. The authors find a flaw in Fort that allows remote code execution, assigned CVE-2024-45237 with a 9.8 score. RPKI's design makes exploitation easy at scale and opens the way to attacks on border routers. The analysis finds indications that the flaw may be a backdoor rather than a mistake.
Why it matters. A flaw in a shared routing component can hit many networks at once: an accumulation scenario worth keeping in mind.
4. Update If You Dare: Demystifying Bare-Metal Device Firmware Update Security of Appified IoT Systems
IEEE Transactions on Dependable and Secure Computing · Lei Xue, Yuxiao Yan, Qiyi Tang, Le Yu et al. · CPS & IoT Security
In short: Of 1,637 apps managing IoT devices, 710 have flaws in firmware updates.
Bare-metal IoT devices, cheap and low-power, are updated over the air through a smartphone app. The authors analyse firmware and app together with BareDFU, a tool that automates the work. Across 1,637 IoT apps, 710 contain vulnerabilities in the update process, which can become a channel to compromise the devices.
Why it matters. Updating is the control meant to reduce IoT risk; when it is insecure it becomes an attack vector.
5. E-Trojans: Ransomware, Tracking, DoS, and Data Leaks on Battery-powered Embedded Systems
arXiv · Marco Casagrande, Riccardo Cestaro, Eleonora Losiouk, Mauro Conti et al. · Web & Mobile Security
In short: Four attacks on Xiaomi e-scooters, including ransomware that locks the battery.
First security assessment of the internals of battery-powered embedded systems: Xiaomi M365 and ES3 e-scooters and the Mi Home app. Reverse engineering reveals four design flaws, including remote code execution in the battery management system. Four attacks follow, remote or in proximity: battery ransomware to extort money, user tracking, denial of service and data leaks.
Why it matters. Ransomware reaches consumer products: an issue for product liability and for sharing fleets.
6. RanSMAP: Open dataset of Ransomware Storage and Memory Access Patterns for creating deep learning based ransomware detectors
Computers & Security · Manabu Hirano, Ryotaro Kobayashi · Malware & Threat Intelligence
In short: An open dataset of storage and memory access patterns to train hypervisor-level ransomware detectors.
RanSMAP uses a thin hypervisor to record storage and memory access patterns of six ransomware samples, seven Conti variants and six benign applications, also running simultaneously, on machines with varied hardware. Detection at this level keeps working even if operating system defenses are compromised. Adding memory access patterns improves detection by 2.3%.
Why it matters. A detection layer below the operating system is exactly what remains once ransomware has disabled the antivirus.
7. Lateral Movement Detection via Time-aware Subgraph Classification on Authentication Logs
arXiv · Jiajun Zhou, Jiacheng Yao, Xuanze Chen, Shanqing Yu et al. · Identity & Authentication
In short: A graph model spots attackers' lateral movement in authentication logs.
After initial access, attackers move through the internal network, masking their actions among seemingly unrelated operations. LMDetect builds a heterogeneous graph from host authentication logs, extracts time-aware subgraphs centred on events and analyses them with local and global attention. On two real-world datasets it outperforms existing methods.
Why it matters. Stopping lateral movement is what separates a contained intrusion from an incident that hits the whole network.
8. Translating C To Rust: Lessons from a User Study
arXiv · Ruishi Li, Bo Wang, Tianyu Li, Prateek Saxena et al. · Systems & Software Security
In short: People can translate C code into safe Rust; current automatic tools cannot.
Rust offers memory safety that C does not guarantee. In a user study, participants translate real-world C programs into safe Rust, which the best automatic translators fail to do. Human strategies differ sharply from the tools' and often use zero-cost static abstractions for temporal safety, a major runtime cost in other defenses.
Why it matters. Migrating to safe languages removes a whole class of vulnerabilities, but today it still requires human work.
9. Quantum-Safe Hybrid Key Exchanges with KEM-Based Authentication
arXiv · Christopher Battarbee, Christoph Striecks, Ludovic Perret, Sebastian Ramacher et al. · Identity & Authentication
In short: A hybrid, quantum-safe key exchange that authenticates with KEMs instead of post-quantum signatures.
Muckle+ combines classical, post-quantum and quantum key distribution material into one shared key, but authenticates with post-quantum signatures, still inefficient in large networks. Muckle# instead uses key encapsulation mechanisms for implicit authentication, inspired by KEMTLS, with new formal proof techniques and a slightly different message flow.
Why it matters. It makes the post-quantum transition more practical in networks with many connections, where signatures are the bottleneck.
Trends of the month
AI & LLM Security
168 papers this month on this topic
LLM agents enter offensive security: multi-agent systems automate pentest stages that used to need specialists. In parallel, attention grows on the model supply chain: a backdoor planted in fine-tuning turns a RAG system into a document leakage channel. Together the two strands point to cheaper attacks and to risk arriving with third-party models.
Papers cited:
- PentestAgent: Incorporating LLM Agents to Automated Penetration Testing
- Data Extraction Attacks in Retrieval-Augmented Generation via Backdoors
CPS & IoT Security
46 papers this month on this topic
The month's thread is devices and infrastructure beyond the classic IT perimeter. Nearly half the apps updating IoT devices have flaws, an e-scooter can be locked by battery ransomware, and an RPKI validator, a component of Internet routing, contains a critical and possibly intentional flaw. For insurers, these are product liability scenarios and accumulation scenarios on shared components.
Papers cited:
- Update If You Dare: Demystifying Bare-Metal Device Firmware Update Security of Appified IoT Systems
- E-Trojans: Ransomware, Tracking, DoS, and Data Leaks on Battery-powered Embedded Systems
- Poster: From Fort to Foe: The Threat of RCE in RPKI
Malware & Threat Intelligence
40 papers this month on this topic
On the defensive side, two papers target points where a control changes an attack's outcome. Hypervisor-level ransomware detection stays active even when the system antivirus is disabled. Lateral movement detection in authentication logs can stop an attacker before reaching critical systems. These controls reduce loss severity, not just the likelihood of the event.
Papers cited:
- RanSMAP: Open dataset of Ransomware Storage and Memory Access Patterns for creating deep learning based ransomware detectors
- Lateral Movement Detection via Time-aware Subgraph Classification on Authentication Logs
How this digest is made
This issue belongs to the digest archive, reconstructed after the fact. The month's papers were collected from arXiv, the IACR ePrint archive and the main security conferences and journals; the selection also weighs the citations received since publication. An AI model assessed the candidates and wrote the summaries, which are based on the abstracts: the original paper is the reference for details.
Papers of the month assessed: 1216.