LESIS Bulletin #4 - AI in cyberattacks, vulnerabilities primitives and a new SCA project

Introduction

This month we highlight recent research from the LESIS team, share an open-source tool designed for security investigations, and look at a development shaping the industrial cybersecurity landscape.

Research & Articles

Our first observation of an AI-assisted malicious group targeting small and medium-sized Brazilian fintech companies

LESIS investigated a malicious group targeting small and medium-sized Brazilian fintech companies. The analysis showed the use of AI to support exploit development, payload adaptation, offensive tooling, and attempts to bypass model safeguards.

The findings suggest that AI did not create a new type of attacker, but helped reduce costs, accelerate experimentation, and adapt attacks more quickly.

Primitives and vulnerabilities

This article explores how vulnerability research can become more structured by analyzing systems through “primitives”: small actions performed by a function, endpoint, component, or feature.

The approach is based on three questions: what is this component supposed to do, what does it actually do, and what becomes possible because of that behavior? By comparing intent and reality, researchers can identify discrepancies, understand what an attacker could control, and evaluate whether the behavior creates real security impact.

The article also connects this reasoning to the use of LLMs in vulnerability research. While finding valid vulnerabilities still depends on technical judgment, describing primitives, expected behavior, real behavior, and possible impact can make the investigation process clearer, more repeatable, and easier to support with automation.

Tool Spotlight

Bunkai (分解) — Dependency-aware SCA for Perl projects

Bunkai is a Software Composition Analysis tool designed to help teams identify and manage dependency risks in Perl projects. It analyzes a project’s cpanfile to map declared dependencies, verify versions, detect outdated modules, and surface known vulnerabilities with CVE details and remediation guidance.

By bringing together dependency visibility, version analysis, and vulnerability information, Bunkai helps teams understand the security posture of their Perl dependencies and identify packages that may require updates or further review. This makes it easier to reduce exposure to known vulnerabilities and improve consistency in dependency management across projects.

The tool can be used from the command line as part of local development workflows, and it also supports SARIF output for integration with GitHub Advanced Security. Bunkai can also run as a GitHub Action, allowing dependency checks to be incorporated into automated security workflows.

The project is open source and available for use and contribution.

​

Closing

LESIS is an applied security research entity focused on developing effective offensive technologies in support of critical operations. Its approach is grounded in a thorough attacker’s perspective and rigorous, research-driven thinking

If you found this issue interesting, feel free to share it with colleagues working in security research.
​