LenAI
LenAI is a cybercrime actor associated with the advertisement and sale of at least two malware/crimeware offerings: ErrTraffic and Aeternum C2. Since at least December 2025, LenAI has advertised and sold ErrTraffic on the Exploit.IN forum and Telegram under a Malware-as-a-Service model. Sekoia assessed with high confidence that LenAI operates the ErrTraffic "Beer" cluster and rents it to affiliates through a subscription model. ErrTraffic is a malicious JavaScript framework and traffic distribution system injected into compromised WordPress sites to display ClickFix lures and deliver malware. Reported features advertised by LenAI include a malicious WordPress plugin, AES and JavaScript obfuscation, Polygon smart contract resolution, ClickFix lures, geofiltering, OS detection, PowerShell payload delivery, and visit/execution statistics. The Beer cluster used multiple Polygon smart contracts and Quicknode RPC endpoints to resolve C2 infrastructure, and delivered malware including Vidar, Stealc, Remus, Salat, SmokeLoader, RATs, and other loaders. Supporting reporting also links LenAI to Aeternum C2, a C++ botnet loader advertised on underground forums for $200, later offered as a full toolkit sale for $10,000. Aeternum C2 uses the public Polygon blockchain for command-and-control by writing commands into smart contracts and having infected bots retrieve them via public RPC endpoints. It is operated through a web-based panel and includes anti-analysis features such as virtualization checks and options to reduce antivirus detection. Known alias in the provided content: LenAI.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Software & Services
- Academia & Research
- Financial Services
Where they target
Geographies tied to known operations.
- 🇺🇸 United States
- 🇨🇦 Canada
- 🇦🇺 Australia
Tradecraft
9 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
2 malware families attributed to this actor across reporting.
Observables
6 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Operator and seller of the ErrTraffic Malware-as-a-Service offering; assessed to operate the 'Beer' cluster and provide affiliates with a ClickFix/TDS framework for malware delivery.
Advertised and attempted to sell the Aeternum C2 botnet loader/toolkit, which uses a blockchain-based C2 design (Polygon smart contracts) to issue commands to infected bots and includes anti-analysis and AV-evasion features.
Advertises and sells the Aeternum C2 botnet loader/toolkit (including panel access and allegedly full C++ source code), and is also linked to the ErrTraffic crimeware solution used to automate ClickFix-style social engineering on compromised websites.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.