{"id":10024,"date":"2026-10-16T08:25:00","date_gmt":"2026-10-16T08:25:00","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10024"},"modified":"2026-10-16T08:25:00","modified_gmt":"2026-10-16T08:25:00","slug":"malware-evasion-made-easier-with-ai-but-behavior-still-gives-it-away","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10024","title":{"rendered":"Malware evasion made easier with AI \u2014 but behavior still gives it away"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Fresh research suggests recent panic over AI-generated malware<\/a> may be overblown.<\/p>\n

Last month Anthropic detailed how Russia-linked cyberespionage group Midnight Blizzard used Claude to rebuild malware<\/a> each time security tools flagged its backdoor as malign.<\/p>\n

\u201cWe observed GTG-20006 operate through customized AI-driven workflows that automated much of their operations from development, infrastructure acquisition, phishing, persistence through command and control, to data exfiltration,\u201d the AI company wrote in its report, referring to Midnight Blizzard, aka APT29<\/a> and Cozy Bear, as GTG-20006.<\/p>\n

While the group\u2019s use of AI as part of its operations is notable, what raised eyebrows was how it did so as part of its evasion strategy: \u201cIf their monitoring AI agents identified that any of their deployed malware was detected by a security product, agents would then set about the process of autonomously modifying and rebuilding the malware to evade the existing detections. The agents were designed to continue iterating on GTG-20006\u2019s toolkit until it was undetected,\u201d Anthropic reported.<\/p>\n

That autonomous loop \u2014 from monitoring for detection to rebuilding the malware to fine-tune evasion \u2014 raises the spectre of polymorphic AI malware<\/a>, malicious software that changes its code structure automatically while keeping the same core functionality.<\/p>\n

But threat intelligence company ReversingLabs (RL) has since released a report detailing how its telemetry and behavior-based threat hunting flagged the campaign\u2019s Go backdoor PowerShell stager as malicious on Aug. 1, weeks before Anthropic\u2019s Sept. 10 report.<\/p>\n

RL subsequently saw five versions of the same stager over the course of 25 days. Although each had a different hash, all five behaved the same way. That consistent behavior profile left each iteration open to detection, according to a technical blog post<\/a> by ReversingLabs published last week, as analysts could still hunt for what the malware did and how its files and infrastructure were connected.<\/p>\n

As a result, evasion via AI rebuilds may not yet be as foolproof as first feared.<\/p>\n

Variations on a well-worn theme<\/h2>\n

Changing a file to dodge detection is one of the oldest techniques in the business, and polymorphic malware has been deployed to dodge signatures for decades.<\/p>\n

\u201cWhat stands out with this Midnight Blizzard activity is outsourcing the busywork to an LLM,\u201d says Ben Bernstein, manager of the cybersecurity advisors team at managed detection and response firm Huntress. \u201cThey wired an AI agent to monitor security tools and automatically generate fresh variants without human intervention. We have seen basic script automation do this, but large language models just make the refactoring cleaner and faster.\u201d<\/p>\n

Huntress backs ReversingLabs\u2019 argument that while AI makes malware faster to rebuild it fails to change the hallmarks of its malicious behavior.<\/p>\n

\u201cModels are fantastic at scrambling code structure and swapping variables to bypass static analysis,\u201d says Bernstein. \u201cBut the AI is not inventing novel exploits. It just automates the grunt work of rewriting the same script to ensure the file hashes change.\u201d<\/p>\n

In short, Bernstein says, \u201cthe packaging looks different, but the payload\u2019s core objective remains exactly the same.\u201d<\/p>\n

Malicious experiments in AI-assisted malware development<\/h2>\n

Still, AI-assisted malware rebuilding is an emerging if not unprecedented tactic among malware developers.<\/p>\n

For example, Google documented PromptFlux in late 2025<\/a>, an experimental script that asked Gemini to rewrite its own source every hour, and PromptSteal, which APT28<\/a> used against Ukraine to generate commands at runtime.<\/p>\n

In March 2026, Microsoft released a report describing how the North Korean cluster Coral Sleet is using agentic AI tools <\/a>to generate, test, and deploy payloads.<\/p>\n

\u201cMost of these are early or experimental, and Microsoft\u2019s own assessment is that the capability \u2018remain[s] limited by reliability, latency, and operational risk,\u2019\u201d says Igor Lasic, SVP of engineering at ReversingLabs.<\/p>\n

But this most recent case involving Midnight Blizzard is the \u201cclearest one on record,\u201d according to Lasic, because two independent sources described the same infrastructure: Microsoft on July 31 as CaptiveCrunch<\/a>, naming the files CornFlake and ChocoShell, and Anthropic on Sept. 10 with visibility into how the operator used Claude.<\/p>\n

\u201cWe held both files from July 6 and July 10, before either report,\u201d says Lasic.<\/p>\n

Persistent limitations<\/h2>\n

Still, ReversingLabs\u2019 recent report may reflect only the current state of the art of AI-assisted malware rebuilding, as some of the limitations that characterized the Midnight Blizzard instance could be something more advanced models might overcome, Lasic concedes.<\/p>\n

\u201cToday a model rewrites the file for free but cannot cheaply rewrite the server code that parses the beacon, re-register domains or re-phish victims, so the indicators that survived were the ones that had to change in two places at once,\u201d Lasic explains. \u201cA more capable agent with access to the whole operation could coordinate those changes, and I expect infrastructure indicators to age faster over the next few years, the way hashes already have.\u201d<\/p>\n

While cost and the availability of more sophisticated models is perhaps only a temporary limit for AI-assisted malware rebuilding, two other limits are closer to fundamental: the behavior of malicious code and clues left behind during a malicious campaign that enable detection.<\/p>\n

\u201cAn implant that steals credentials has to read the credential store and one that calls home has to open a connection, whatever built it,\u201d says Lasic. \u201cObfuscation makes that harder to extract, but no rewrite removes a requirement without removing the capability.\u201d<\/p>\n

Furthermore, a model can change the next build but not the builds already observed, timestamped and linked to the same server.<\/p>\n

\u201cRebuilding faster produces more artefacts, and each one is another thread back to the operation,\u201d Lasic concludes.<\/p>\n

Huntress\u2019 Bernstein backs ReversingLabs assessment that behavior-based hunting will remain effective against even AI-assisted malware development.<\/p>\n

\u201cYou can disguise malicious code all day, but if a script tries to dump credentials or establish persistence, most modern EDRs [endpoint detection and response tools] will detect the action itself,\u201d says Bernstein.<\/p>\n

Another limitation of AI-assisted malware development is that even the latest models are trained to abuse known security vulnerabilities.<\/p>\n

\u201cThey [AI models] remix known patterns rather than dreaming up zero-days,\u201d Bernstein concludes. \u201cFuture models might get better if they can actively test their output against live environments to find undiscovered flaws, but for now, they are just recycling known techniques at a higher speed.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Fresh research suggests recent panic over AI-generated malware may be overblown. Last month Anthropic detailed how Russia-linked cyberespionage group Midnight Blizzard used Claude to rebuild malware each time security tools flagged its backdoor as malign. \u201cWe observed GTG-20006 operate through customized AI-driven workflows that automated much of their operations from development, infrastructure acquisition, phishing, persistence […]<\/p>\n","protected":false},"author":0,"featured_media":10025,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-10024","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10024"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10024"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10024\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/10025"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10024"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10024"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10024"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}