{"slug": "malware-evasion-made-easier-with-ai-but-behavior-still-gives-it-away", "title": "Malware evasion made easier with AI — but behavior still gives it away", "summary": "ReversingLabs flagged the Go backdoor PowerShell stager used in the Russia-linked Midnight Blizzard (APT29/Cozy Bear) campaign as malicious on Aug. 1, weeks before Anthropic's Sept. 10 report detailed how the group used Claude to autonomously rebuild malware, according to a ReversingLabs technical blog post. ReversingLabs observed five versions of the same stager over 25 days, each with a different hash but identical behavior, allowing behavior-based threat hunting to keep detecting it. Huntress manager Ben Bernstein said the AI automates the busywork of rewriting scripts to change file hashes but does not invent novel exploits, so \"the packaging looks different, but the payload's core objective remains exactly the same.", "body_md": "Fresh research suggests recent panic over [AI-generated malware](https://www.csoonline.com/article/4225264/ai-malware-just-removed-the-human-from-the-attack-loop.html) may be overblown.\n\nLast month Anthropic detailed how Russia-linked cyberespionage group Midnight Blizzard [used Claude to rebuild malware](https://www.anthropic.com/threat-intelligence-report-september-2026) each time security tools flagged its backdoor as malign.\n\n“We observed GTG-20006 operate through customized AI-driven workflows that automated much of their operations from development, infrastructure acquisition, phishing, persistence through command and control, to data exfiltration,” the AI company wrote in its report, referring to Midnight Blizzard, aka [APT29](https://www.csoonline.com/article/3964203/russia-linked-apt29-targets-european-diplomats-with-new-malware.html) and Cozy Bear, as GTG-20006.\n\nWhile the group’s use of AI as part of its operations is notable, what raised eyebrows was how it did so as part of its evasion strategy: “If their monitoring AI agents identified that any of their deployed malware was detected by a security product, agents would then set about the process of autonomously modifying and rebuilding the malware to evade the existing detections. The agents were designed to continue iterating on GTG-20006’s toolkit until it was undetected,” Anthropic reported.\n\nThat autonomous loop — from monitoring for detection to rebuilding the malware to fine-tune evasion — raises the spectre of [polymorphic AI malware](https://www.csoonline.com/article/4101491/polymorphic-ai-malware-exists-but-its-not-what-you-think.html), malicious software that changes its code structure automatically while keeping the same core functionality.\n\nBut threat intelligence company ReversingLabs (RL) has since released a report detailing how its telemetry and behavior-based threat hunting flagged the campaign’s Go backdoor PowerShell stager as malicious on Aug. 1, weeks before Anthropic’s Sept. 10 report.\n\nRL subsequently saw five versions of the same stager over the course of 25 days. Although each had a different hash, all five behaved the same way. That consistent behavior profile left each iteration open to detection, according to a [technical blog post](https://www.reversinglabs.com/blog/anthropic-midnight-blizzard-what-reversinglabs-found-first) by ReversingLabs published last week, as analysts could still hunt for what the malware did and how its files and infrastructure were connected.\n\nAs a result, evasion via AI rebuilds may not yet be as foolproof as first feared.\n\nChanging a file to dodge detection is one of the oldest techniques in the business, and polymorphic malware has been deployed to dodge signatures for decades.\n\n“What stands out with this Midnight Blizzard activity is outsourcing the busywork to an LLM,” says Ben Bernstein, manager of the cybersecurity advisors team at managed detection and response firm Huntress. “They wired an AI agent to monitor security tools and automatically generate fresh variants without human intervention. We have seen basic script automation do this, but large language models just make the refactoring cleaner and faster.”\n\nHuntress backs ReversingLabs’ argument that while AI makes malware faster to rebuild it fails to change the hallmarks of its malicious behavior.\n\n“Models are fantastic at scrambling code structure and swapping variables to bypass static analysis,” says Bernstein. “But the AI is not inventing novel exploits. It just automates the grunt work of rewriting the same script to ensure the file hashes change.”\n\nIn short, Bernstein says, “the packaging looks different, but the payload’s core objective remains exactly the same.”\n\nStill, AI-assisted malware rebuilding is an emerging if not unprecedented tactic among malware developers.\n\nFor example, [Google documented PromptFlux in late 2025](https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools/), an experimental script that asked Gemini to rewrite its own source every hour, and PromptSteal, which [APT28](https://www.csoonline.com/article/575135/russian-cyber-spy-group-apt28-backdoors-cisco-routers-via-snmp.html) used against Ukraine to generate commands at runtime.\n\nIn March 2026, Microsoft released a report [describing how the North Korean cluster Coral Sleet is using agentic AI tools](https://www.microsoft.com/en-us/security/blog/2026/03/06/ai-as-tradecraft-how-threat-actors-operationalize-ai/) to generate, test, and deploy payloads.\n\n“Most of these are early or experimental, and Microsoft’s own assessment is that the capability ‘remain[s] limited by reliability, latency, and operational risk,’” says Igor Lasic, SVP of engineering at ReversingLabs.\n\nBut this most recent case involving Midnight Blizzard is the “clearest one on record,” according to Lasic, because two independent sources described the same infrastructure: [Microsoft on July 31 as CaptiveCrunch](https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/), naming the files CornFlake and ChocoShell, and Anthropic on Sept. 10 with visibility into how the operator used Claude.\n\n“We held both files from July 6 and July 10, before either report,” says Lasic.\n\nStill, ReversingLabs’ recent report may reflect only the current state of the art of AI-assisted malware rebuilding, as some of the limitations that characterized the Midnight Blizzard instance could be something more advanced models might overcome, Lasic concedes.\n\n“Today a model rewrites the file for free but cannot cheaply rewrite the server code that parses the beacon, re-register domains or re-phish victims, so the indicators that survived were the ones that had to change in two places at once,” Lasic explains. “A more capable agent with access to the whole operation could coordinate those changes, and I expect infrastructure indicators to age faster over the next few years, the way hashes already have.”\n\nWhile cost and the availability of more sophisticated models is perhaps only a temporary limit for AI-assisted malware rebuilding, two other limits are closer to fundamental: the behavior of malicious code and clues left behind during a malicious campaign that enable detection.\n\n“An implant that steals credentials has to read the credential store and one that calls home has to open a connection, whatever built it,” says Lasic. “Obfuscation makes that harder to extract, but no rewrite removes a requirement without removing the capability.”\n\nFurthermore, a model can change the next build but not the builds already observed, timestamped and linked to the same server.\n\n“Rebuilding faster produces more artefacts, and each one is another thread back to the operation,” Lasic concludes.\n\nHuntress’ Bernstein backs ReversingLabs assessment that behavior-based hunting will remain effective against even AI-assisted malware development.\n\n“You can disguise malicious code all day, but if a script tries to dump credentials or establish persistence, most modern EDRs [endpoint detection and response tools] will detect the action itself,” says Bernstein.\n\nAnother limitation of AI-assisted malware development is that even the latest models are trained to abuse known security vulnerabilities.\n\n“They [AI models] remix known patterns rather than dreaming up zero-days,” Bernstein concludes. “Future models might get better if they can actively test their output against live environments to find undiscovered flaws, but for now, they are just recycling known techniques at a higher speed.”", "url": "https://wpnews.pro/news/malware-evasion-made-easier-with-ai-but-behavior-still-gives-it-away", "canonical_source": "https://www.csoonline.com/article/4235447/malware-evasion-made-easier-with-ai-but-behavior-still-gives-it-away.html", "published_at": "2026-10-16 08:25:00+00:00", "updated_at": "2026-10-16 08:40:53.693847+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence", "large-language-models", "ai-agents"], "entities": ["Anthropic", "Midnight Blizzard", "APT29", "Cozy Bear", "ReversingLabs", "Claude", "Huntress", "Ben Bernstein"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/malware-evasion-made-easier-with-ai-but-behavior-still-gives-it-away", "markdown": "https://wpnews.pro/news/malware-evasion-made-easier-with-ai-but-behavior-still-gives-it-away.md", "text": "https://wpnews.pro/news/malware-evasion-made-easier-with-ai-but-behavior-still-gives-it-away.txt", "jsonld": "https://wpnews.pro/news/malware-evasion-made-easier-with-ai-but-behavior-still-gives-it-away.jsonld"}}