https://news.aibase.com/news/27628

Cross-border Dark Horse Tops Two Charts! Shengshu
Technology Launches MotuBrain, Defining a New Standard for Embodied
Intelligence Brain

Published in Latest AI News

Time :Apr 30, 2026

Read :5minute

The identity of the "mysterious model" that has
been lingering in the field of embodied intelligence for three weeks has
finally been revealed. Previously, a model named MotuBrain quietly
topped two major international benchmarks for physical world understanding and
action execution, sparking widespread speculation in the industry.
Recently, Shengshu Technology, which has gained fame through the video
large model Vidu, officially announced that this model is its latest commercial
achievement in the field of embodied intelligence.

This "cross-border" effort is no mere experiment.
MotuBrain set new records in WorldArena (assessing physical world
understanding) and RoboTwin 2.0 (assessing action execution). Especially in
complex environments with simulated random disturbances, it was the only model
to achieve an average score above 95, demonstrating strong generalization
capabilities.

"See and Act": Breaking the Boundaries Between
Perception and Action

Differing from traditional "imagine first, then
act" models, MotuBrain adopts an innovative "World Action
Model" approach. This "see and act" design allows robots to
simulate while making decisions, ensuring that prediction and execution errors
do not amplify each other, greatly improving response speed.

In practical demonstrations, the robot equipped with this
system showed a high level of intelligence. In a hot pot scenario, the robot
could visually determine if the spoon was empty and decide autonomously whether
to retrieve it again, rather than rigidly repeating preset actions. This
"reading the room" ability marks the transition of robots from simple
mechanical execution to true intelligent decision-making.

One Brain, Multiple Forms: Smooth Integration of
Long-Term Tasks

The core advantage of MotuBrain lies in its strong
versatility. It not only supports "one brain, multiple forms,"
adapting to different degrees of freedom and sensor-equipped robot bodies, but
also possesses long-term task processing capabilities. In demonstrations such
as flower arranging, mixing cocktails, and tidying up the sofa, the robot can
complete more than 10 atomic actions continuously, with a smooth process
requiring no human intervention.

Data shows that as the variety of tasks increases, the
learning success rate of MotuBrain tends to rise. This indicates that
the model has mastered the universal underlying laws of the physical world,
rather than memorizing action templates. The more diverse the tasks, the better
its performance.

Establishing a Presence in the Physical World, Pursuing
Dual Tracks of Digital and Physical Realms

The strength demonstrated by Shengshu
Technology stems from its deep technical foundation. Through the
world-first U-ViT architecture, the company achieved unification between
digital world generation (VGM) and physical world execution (WAM). On one
hand, Vidu generates virtual worlds, while on the
other, MotuBrain drives physical interactions. This dual-track
strategy gives it a significant advantage in data acquisition costs and model
iteration speed.

Funksec is a newly identified extortion group that has
claimed 11 victims across various sectors, including media, IT, and education,
operating a Tor-based DLS to centralize its ransomware activities. The group
advertises a free DDoS tool and may develop its own ransomware binary,
indicating significant technical capability. The DLS was likely created in late
November to early December 2024, with the first advertisement titled “Funksec
Ransomware” posted on 3 December 2024. Currently, there is limited publicly
available information on Funksec's TTPs, and it is not known to be associated
with any other threat groups.

FunkSec is an AI-assisted
ransomware-as-a-service (RaaS) group that emerged in late 2024 and
rapidly gained notoriety for claiming over 120 victims across
industries including government, healthcare, and finance.  The group
is characterized by its double extortion tactics, combining data
encryption with theft, and its use of hacktivist rhetoric alongside
financially motivated attacks. 

Key operational details include:

• Malware: The
  group uses FunkLocker, a Rust-based ransomware
  that encrypts files using ChaCha20 and appends the .funksec extension. 


• AI
  Integration: FunkSec leverages Generative AI to
  assist in malware development, phishing template creation, and code
  refinement, lowering the barrier for less experienced actors. 


• Access
  Methods: Initial access is typically gained through phishing
  emails, credential stuffing, and exploiting unpatched
  vulnerabilities in exposed systems like RDP and VPNs. 


• Extortion
  Strategy: The group demands unusually low ransoms (sometimes
  as low as $10,000) and additionally sells stolen data to third
  parties at discounted prices on dark web markets. 


• Geographic
  Base: Technical analysis suggests the primary developer is likely
  based in Algeria, with the group targeting organizations in
  the U.S., India, Spain, and Mongolia. 

What are the specific indicators of FunkLocker malware?

FunkLocker (FunkSec) — Specific Indicators of Compromise

File Hashes (SHA-256)

File & Artifact Indicators

• Encrypted
  file extension: .funksec


• Ransom
  note names: README-[random_string].md, readme.txt (e.g., README-ZasRvdSR44.md)


• Source
  code artifact: *ransomware.rs* (Rust source)


• Hardcoded
  strings in binary: RansomwarePassword123, "device has
  been successfully infiltrated by funksec ransomware!" 

Network / Infrastructure IOCs

Behavioral / Command-Line IOCs

These are the specific commands FunkLocker executes
via living-off-the-land tools:

MITRE ATT&CK Mapping

YARA Rule (for endpoint scanning) 

rule funklocker_ransomware {

   meta:

      description =
"Detects Funklocker ransomware or similar variants"

      author =
"Oluwaseyi Soneye"

      reference =
"Strings output analysis"

      date =
"2025-11-10"

   strings:

      $x1 =
"Set-MpPreference -DisableRealtimeMonitoring" nocase

      $x2 =
"wevtutil sl Security /e:false" nocase

      $x3 =
"wevtutil sl Application /e:false" nocase

      $x4 =
"Set-ExecutionPolicy Bypass -Scope Process" nocase

      $x5 =
"Set-MpPreference -DisableRealtimeMonitoring $truewevtutil sl Security
/e:falsewevtutil sl Application /e:falseSet-ExecutionPolicy" nocase

      $x6 =
"vssadmindelete shadows/all/quiet" nocase

      $x7 =
"taskkill/F/IM" nocase

      $x8 =
"RansomwarePassword123" nocase

      $x9 =
"device has been successfully infiltrated by funksec ransomware!"
nocase

      $x10 =
"funksec" nocase

   condition:

      uint16(0) ==
0x5a4d and

        (

          (5 of ($x1,
$x2, $x3, $x4, $x5, $x6, $x7)) or

          (2 of ($x8,
$x9, $x10))

        )

}

Note: Avast Labs released a public
decryptor for FunkLocker victims due to the group's weak operational
security (reused BTC wallets and hardcoded keys).  The No
More Ransom portal also provides recovery guidance. 

What are the symptoms of infection?

Symptoms of a FunkLocker Infection

Immediate / User-Visible Symptoms

• Files
  encrypted with the .funksec extension
  (e.g., report.pdf → report.pdf.funksec)


• Desktop
  wallpaper turns black (Shell Experience Host service is
  terminated)


• Ransom
  note (README-[random_string].md) dropped on the desktop — though
  due to system instability, victims often cannot see it until after
  a reboot


• Applications
  crash or stop working — the malware force-terminates ~50 common
  processes (Office, browsers, taskmgr, etc.)


• System
  becomes largely unusable — services are stopped, leaving the OS
  in a broken state 

System-Level Symptoms (observable in logs / monitoring)

Post-Encryption / Extortion Phase

• Within 24–48
  hours, a leak site posting appears on the dark web
  (.onion), threatening to publish exfiltrated data


• Ransom
  note directs the victim to a Tor site with a unique victim ID and
  a Bitcoin wallet address


• Payment
  deadline of 3–5 days is typically stated


• The
  note warns against contacting authorities, using antivirus, or modifying
  the system 

Important Context

Threat actors typically infiltrate the system 2–4
weeks before encryption occurs.  By the time visible
symptoms appear, data has already been exfiltrated.  The encryption
event itself is fast (local-only, no C2 callback), but the overall attack
timeline spans weeks. 

Antivirus Detections (at execution time)

• Microsoft: Trojan:Win32/Wacatac.B!ml


• Kaspersky: Trojan.Win32.DelShad.myd


• ESET: A
  Variant Of Generik.GZBNBIS

If any of these symptoms are observed, the recommended
immediate actions are: disconnect from the network, do not reboot
or restore from backups (to preserve forensic evidence), and engage an incident
response team. 

What specific malware families are similar to FunkLocker?

Malware Families Similar to FunkLocker

Similarity depends on which axis you're comparing. Here are
the closest matches by shared characteristic:

Rust-Based Ransomware (same language)

AI-Assisted / AI-Generated Code (same development
pattern)

Local-Only Encryption (no C2 callback during encryption)

Shared TTPs (defense evasion + disruption)

Families that share FunkLocker's specific "disable AV →
disable logging → delete VSS → kill processes → encrypt" kill chain:

• LockBit
  3.0 — same VSS deletion, service stopping, but far more sophisticated
  (AES-256 + RSA-2048, self-propagating)


• Phobos —
  similar TTPs, uses Smokeloader/Cobalt Strike/Mimikatz, targets public
  sector


• Black
  Basta — Conti code lineage, double extortion, service disruption


• RansomHub —
  dominant post-LockBit RaaS, double extortion 

Closest Overall Analogue

BlackCat/ALPHV is the most frequently cited
comparison point: both are Rust, both use ChaCha20, both operate as RaaS with
double/triple extortion, and both target cross-platform
environments.  The key distinction is that BlackCat is a mature,
well-funded operation while FunkLocker is a low-skill, AI-assisted operation
with inconsistent code quality and weaker operational security (reused wallets,
hardcoded keys).

Cicada3301 is technically the closest match —
Rust + ChaCha20 + cross-platform + similar configuration patterns — but it
emerged independently and is more polished. 

What specific AI tools generated FunkLocker's code?

Specific AI Tools Used to Generate FunkLocker's Code

The short answer: no single specific LLM model has
been definitively identified as the code
generator.  Researchers consistently refer to "LLM agents"
generically. However, two specific tools/platforms have been confirmed:

Confirmed Tools

What Researchers Could NOT Confirm

The actual code-generating LLM (the one that
produced the Rust source in ransomware.rs) was never pinned to a specific
model (e.g., GPT-4, Claude, Llama, etc.). The evidence points to a generic
"LLM agent" workflow:

• "Ask
  AI → Get snippet → Paste snippet" development cycle (ANY.RUN)


• Perfect
  English code comments vs. very basic English in the group's other
  communications (Check Point, Kaspersky, CSO Online)


• Generic
  placeholder comments like "placeholder for actual check" (Kaspersky)


• Technical
  inconsistencies — commands for different operating systems mixed in the
  same file (Kaspersky, Red Hot Cyber)


• Declared
  but unused functions and modules (Kaspersky)


• Redundant
  call functions and repeating control flow (Check Point)


• Seven
  distinct builds compiled in six days — a pace consistent with prompt-based
  iteration rather than manual development (Palo Alto Unit 42, August
  2026)