LenAI

LenAI is a cybercrime actor associated with the development, advertising, and sale of malware-as-a-service tooling on underground forums and Telegram. The actor is most closely linked to ErrTraffic, a malicious traffic-distribution and ClickFix delivery framework sold to affiliates since at least late 2025, and has also been tied to Aeternum C2, a blockchain-based botnet loader. LenAI’s activity is financially motivated and centered on enabling downstream malware delivery rather than a single exclusive payload family.

ErrTraffic is designed for injection into compromised WordPress sites, where it presents social-engineering lures such as fake verification prompts and deceptive browser or system dialogs to induce victims to execute malicious PowerShell commands. The framework supports geofiltering, referrer filtering, operating-system detection, statistics, and WordPress plugin-based deployment, and has been marketed for Windows, Linux, and macOS targeting. A notable characteristic is its use of Polygon blockchain smart contracts and public RPC infrastructure as a dead-drop resolver to conceal and rotate command-and-control destinations, an EtherHiding-style design that complicates disruption.

Research has linked LenAI most strongly to the active “Beer” ErrTraffic cluster, which appears to be rented to multiple affiliates under a MaaS model. That cluster has delivered a broad range of commodity malware, including stealers, loaders, RATs, and related crimeware. Campaigns associated with ErrTraffic have relied on compromised WordPress infrastructure, stolen administrator credentials, obfuscated JavaScript injectors, clipboard-delivered PowerShell execution, and follow-on malware deployment. In observed intrusions, ErrTraffic has been used in combination with other MaaS offerings, including Cruciferra, to facilitate DLL side-loading, process hollowing, and deployment of information stealers such as Remus; some linked chains also included abuse of a vulnerable signed driver to disable security products.

LenAI has also been associated with Aeternum C2, a native C++ loader and command-and-control framework that stores encrypted tasking in Polygon smart contracts and retrieves instructions through public RPC endpoints. Aeternum includes a web-based management panel, anti-analysis checks such as virtualization detection, and features intended to reduce antivirus detection. The actor publicly advertised pricing for both subscription-style access and source-code sales, indicating a commercial crimeware business model.

Overall, LenAI appears to operate as a cybercriminal service provider focused on initial access enablement, social-engineering-driven malware delivery, resilient blockchain-backed command-and-control, and affiliate support for broader malware distribution ecosystems.