The malware, called PromptLock, essentially functions as a hard-coded prompt injection attack on a large language model, inspecting local filesystems, exfiltrating files and encrypting data.

ESET researchers observed tens of thousands of machines infected with AsyncRAT and its variants over the past year. The open-source malware is a popular tool among cybercriminals.

The campaign traces back at least to early 2022, coinciding with the start of Russia’s full-scale invasion of Ukraine.

Beijing's hackers are also using an open-source VPN tool for persistence.

Targets of the operation were given phony coding challenges that delivered a range of malware including a previously-unseen backdoor.

The work has been carried out by a newly identified group dubbed "MustachedBouncer," according to researchers with ESET.

Researches believe the destructive malware is the work of Sandworm, a Russian military unit suspected in a series of Ukrainian cyberattacks.

Active since 2020, the cyberespionage group has targeted a range or mostly Asian public and private entities.

Dragos says the group behind the tools has a "breadth of knowledge" that's "beyond" any previously witnessed.

Russian losses near Kyiv and a looming onslaught in eastern Ukraine may be a factor in the attack, a Ukrainian official said.