# MetaDefender Aether™ v3.2.0 Release: Introducing Five-Layer Zero-Day Detection > Source: > Published: 2026-08-03 01:00:00+00:00 **MetaDefender Aether 3.2.0 expands OPSWAT’s zero-day detection pipeline from four layers to five. The release adds Predictive Alin AI as a pre-execution static analysis layer, improves threat attribution and PE emulation, and extends detection across emerging evasion, malware, and social engineering techniques.** **Key Takeaways** - MetaDefender Aether™ 3.2.0 adds Predictive Alin AI as Layer 2, expanding zero-day detection from four coordinated layers to five - Predictive Alin AI classifies supported high-risk executable files before execution, with engineered verdict times of P90 at 50 milliseconds and P99 below 100 milliseconds - Files with uncertain or conflicting signals continue to MetaDefender Aether’s emulation-based adaptive sandbox for deeper behavioral analysis - MetaDefender Aether creates a continuous feedback loop between prediction, emulation, reputation, and threat hunting, allowing new evidence to strengthen future file decisions - Executable analysis now captures more complete behavior from malware that depends on specific files or paths, while giving analysts greater control over the conditions used during investigation - New and improved detections cover EtherHiding, malformed .NET assemblies, remote template injection, wiper malware, ClickFix campaigns, and additional malware families - Syslog management moves to the Admin Panel with broader audit coverage; existing configurations require manual reconfiguration after upgrade ## What Is New in MetaDefender Aether™ 3.2.0? [MetaDefender Aether](https://www.opswat.com/products/metadefender/aether) 3.2.0 introduces a new pre-execution decision point and a set of analysis and detection improvements. The main architectural change is [Predictive Alin AI](https://www.opswat.com/technologies/predictive-alin-ai) as Layer 2, positioned between Threat Reputation and Dynamic Analysis. MetaDefender Aether is OPSWAT’s unified zero-day detection solution designed to combine adaptive sandboxing, threat intelligence, threat scoring, and machine-learning similarity search in a coordinated detection pipeline. Version 3.2.0 adds predictive static analysis without removing any existing analysis stage. The five layers are: **Threat Reputation:** Checks files and infrastructure against known intelligence**Static Analysis:** Uses Predictive Alin AI to assess malicious intent before execution**Dynamic Analysis:** Emulates suspicious and unresolved files to expose runtime behavior**Threat Scoring:** Correlates evidence into a confidence-based risk score and verdict**Threat Hunting:** Connects samples to related malware families, infrastructure, and campaigns The former Layers 2, 3, and 4 become Layers 3, 4, and 5. The new layer does not force every file through another long analysis stage. It helps decide how much additional inspection each file needs. ## Inside the Five-Layer Zero-Day Detection Architecture The five-layer pipeline applies progressively deeper analysis based on the evidence available for each file. Known threats can be identified early, high-confidence predictions can receive a pre-execution verdict, and ambiguous files can continue to emulation and threat hunting without weakening the final decision. ### Layer 1: Threat Reputation Threat Reputation identifies known threats and attacker infrastructure. MetaDefender Aether checks available intelligence for file hashes, URLs, IP addresses, and domains using online or offline reputation sources. Files without a conclusive reputation result continue to Static Analysis. Offline reputation also supports regulated and air-gapped environments where cloud intelligence may be unavailable. ### Layer 2: Static Analysis with Predictive Alin AI Predictive Alin AI analyzes structural, semantic, and behavioral file indicators before execution, detonation, or runtime monitoring. The AI-powered malware detection engine delivers machine-learning verdicts in milliseconds and can run online or fully offline. Layer 2 supports two primary outcomes: **Deflection**: High-confidence clean files can avoid unnecessary sandbox analysis **Detection**: High-confidence malicious files can be identified and blocked before execution, including files traditional antivirus engines may not recognize For supported high-risk executable files, Predictive Alin AI is engineered for P90 verdict times of 50 milliseconds and P99 verdict times below 100 milliseconds. Files that do not meet the required confidence threshold continue to Dynamic Analysis rather than relying on a weak static verdict. Predictive Alin AI also extends static inspection to supported AI and machine learning model files. The analysis helps identify embedded arbitrary code that may execute when a model is loaded. ### Layer 3: Dynamic Analysis Dynamic Analysis sends suspicious and unresolved samples to MetaDefender Aether’s emulation-based [adaptive sandbox](https://www.opswat.com/technologies/adaptive-sandbox). MetaDefender Aether emulates instructions, file operations, scripts, and relevant operating system interactions instead of relying on a conventional virtual machine. Instruction-level emulation helps expose malware that uses anti-VM checks, delayed execution, malformed structures, or environmental conditions to disrupt automated analysis. MetaDefender Aether can reveal runtime behavior, loader chains, hidden payloads, and indicators of compromise. Newly discovered indicators can feed the local reputation database and improve future Layer 1 decisions. Confirmed zero-day findings strengthen future reputation and predictive analysis, helping Aether identify related variants earlier in the pipeline. ### Layer 4: Threat Scoring Threat Scoring correlates evidence from reputation, static analysis, and dynamic analysis into a confidence-based risk score. The scoring engine consolidates signals such as persistence, process injection, payload delivery, suspicious file modification, and command-and-control activity. The resulting verdict can support policy enforcement and help analysts prioritize threats that require immediate investigation. A consolidated score also reduces the need to interpret disconnected findings across multiple analysis tools. ### Layer 5: Threat Hunting Threat Hunting adds attribution and campaign context to the file verdict. ML (machine-learning) similarity search connects related samples, malware families, shared infrastructure, and campaigns. These relationships help analysts determine whether a detection is an isolated file, a modified version of known malware, or part of a wider operation. Machine-readable results and extracted indicators can support SIEM (Security Information and Event Management), SOAR (Security Orchestration, Automation, and Response), MISP (Malware Information Sharing Platform), STIX (Structured Threat Information Expression), investigation, and response workflows. Current internal benchmark testing indicates that detection efficacy increases as evidence is added across the five layers, reaching 99.5% after Threat Hunting.* **Based on internal benchmark testing. * ## Faster Pre-Execution Decisions with Predictive Alin AI Predictive Alin AI adds a fast checkpoint before resource-intensive dynamic analysis. The layer reduces unnecessary sandbox demand while adding another opportunity to identify malicious intent before runtime behavior appears. The previous architecture moved unresolved files from Threat Reputation directly into Dynamic Analysis. Version 3.2.0 can now route each file according to confidence: **High-confidence clean files** can move forward without unnecessary emulation **High-confidence malicious files** can be stopped before detonation **Uncertain files** continue to the adaptive sandbox for deeper inspection The routing model focuses Dynamic Analysis on files where behavioral evidence adds the most value. MetaDefender Aether still performs deep emulation when a file requires it. ## Centralized Syslog Management and Broader Audit Visibility Syslog configuration is now managed through the Aether Admin Panel, giving administrators a more accessible and centralized way to control logging. Coverage has also expanded beyond scan-result summaries to include authentication events and administrator setting changes, providing stronger visibility for security monitoring, auditing, and change tracking. ## Stronger and More Actionable Threat Attribution MetaDefender Aether 3.2.0 provides clearer, evidence-backed classifications that communicate a threat’s likely identity and intent. Analysts can understand results faster and carry stronger context into Threat Scoring, Threat Hunting, and downstream response. Threat attribution is calculated independently for the submitted file and for downloaded or extracted files discovered during analysis, helping analysts distinguish the role and risk of each component in a multi-stage attack. ## More Complete Executable Behavior Analysis MetaDefender Aether 3.2.0 improves analysis of executable malware that relies on specific files, paths, or resources to reveal its behavior. A configurable virtual file system allows samples MetaDefender Aether 3.2.0 improves the analysis of executable malware that depends on specific files, paths, or resources during execution. A configurable virtual file system allows samples to interact with the files and paths they expect to find during Portable Executable (PE) emulation, helping MetaDefender Aether capture more complete execution flows, uncover additional payload activity and indicators of compromise, and reduce the risk that environment-dependent behavior remains hidden. Analysts can also define files expected by a sample, providing greater control when investigating complex malware with specific file system dependencies. ## What New Threats and Evasion Techniques Can MetaDefender Aether 3.2.0 Detect? MetaDefender Aether 3.2.0 improves detections across blockchain-based infrastructure concealment, malformed executables, document-based payload delivery, destructive malware, and social engineering. The release also expands malware configuration extraction and local reputation coverage. ### EtherHiding EtherHiding conceals malicious instructions, URLs, or attacker-controlled infrastructure in blockchain transactions and smart contracts. Decentralized services can make conventional blocking and takedown more difficult. New detection logic helps analysts identify activity associated with EtherHiding and inspect the infrastructure referenced by an analyzed sample. ### Intentionally Malformed .NET Assemblies Malformed .NET assemblies can be engineered to make parsers, decompilers, or automated analysis tools fail before reaching malicious code. MetaDefender Aether now adds detection for malformed .NET structures associated with analysis disruption and evasion. ### More Accurate Remote Template Injection Detection MetaDefender Aether 3.2.0 more accurately distinguishes malicious remote template injection from ordinary embedded links. The update reduces false positives from legitimate URLs while detecting malicious IP addresses concealed through octal encoding. This gives threat analysts stronger coverage for obfuscated document attacks without adding unnecessary investigation noise. ### Wiper Malware Wiper malware is designed to destroy, corrupt, or make data and systems unavailable. New detection engineering improves identification of destructive malware that may offer no recovery path. Earlier detection is especially valuable in critical infrastructure, government, and manufacturing environments where operational availability is a priority. As explored in our earlier blog, [wipers are among the most common weapons used in OT attacks](https://www.opswat.com/blog/before-the-wiper-hits-why-wipers-are-the-most-common-weapon-in-ot-attacks?utm_source=chatgpt.com). ### ClickFix CAPTCHA Campaigns ClickFix campaigns use fake browser errors, verification prompts, and CAPTCHA-style interfaces to persuade users to execute malicious commands. MetaDefender Aether 3.2.0 expands OCR (Optical Character Recognition)-based CAPTCHA identification, including support for obfuscated but visually rendered fake CAPTCHAs. The analysis considers what a user sees on the rendered page even when the underlying content is structured to evade text-based detection. Our earlier blog examines [how to detect and stop ClickFix attacks before they reach endpoints](https://www.opswat.com/blog/detecting-and-stopping-clickfix-attacks-before-they-reach-your-endpoints?utm_source=chatgpt.com). ### Malware Configuration Extraction and Local Reputation New configuration extractors support PrivateLoader and Quasar RAT. Extracted configurations can reveal command-and-control infrastructure, campaign identifiers, execution parameters, and other details used in investigation and response. The local reputation database also receives broader IOC coverage. Expanded offline intelligence strengthens detection in air-gapped environments where cloud lookups are unavailable. ## When Should Organizations Use MetaDefender Aether 3.2.0? MetaDefender Aether 3.2.0 is designed for file workflows that require zero-day detection before content reaches users or protected systems. The five-layer pipeline is particularly relevant when analysis speed, deployment control, and behavioral depth must coexist. **High-volume file inspection:** Predictive Alin AI can make fast decisions before files enter deeper emulation **Air-gapped or regulated environments:** Reputation, predictive analysis, and MetaDefender Aether deployment options can operate without cloud connectivity **Evasive malware analysis:** Emulation exposes behaviors designed to bypass virtual-machine sandboxes and static tools **SOC and threat-hunting workflows:** Consolidated verdicts, attribution, IOCs, and similarity search support prioritization and campaign analysis ## Move Zero-Day Detection Earlier Files enter organizations through email, managed file transfer, cloud applications, web uploads, removable media, software updates, and supply chain workflows. MetaDefender Aether 3.2.0 helps IT and OT security teams inspect these files before they reach users or protected systems. High-confidence decisions reduce unnecessary sandbox analysis and analysis latency, helping high-volume file workflows keep moving while uncertain samples receive deeper inspection. Consolidated verdicts, clearer attribution, and campaign context help SOC teams spend less time correlating disconnected findings and focus investigations on the threats that require action. A continuous feedback loop between prediction, emulation, reputation, and threat hunting allows new evidence to strengthen future detection and file decisions. Learn more about [MetaDefender Aether](https://www.opswat.com/products/metadefender/aether) or contact OPSWAT to discuss upgrading to version 3.2.0. ## Frequently Asked Questions **What is the biggest change in MetaDefender Aether 3.2.0?** Predictive Alin AI becomes the new Layer 2 for pre-execution static analysis. The addition expands MetaDefender Aether from four layers to five and routes files to deeper analysis according to confidence. **Does Predictive Alin AI replace MetaDefender Aether’s adaptive sandbox? ** No. Predictive Alin AI adds a decision point before the adaptive sandbox, while uncertain or conflicting samples still proceed to emulation-based Dynamic Analysis. **Can MetaDefender Aether 3.2.0 operate in an air-gapped environment? ** Yes. MetaDefender Aether and Predictive Alin AI support offline operation, and the expanded local reputation database provides additional IOC coverage where cloud intelligence is unavailable. **How fast is Predictive Alin AI?** Predictive Alin AI is engineered for P90 verdict times of 50 milliseconds and P99 verdict times below 100 milliseconds for supported high-risk executable files. Actual performance can vary by file type, deployment, and workload. **What new detection areas are included in MetaDefender Aether 3.2.0? ** The release adds or improves detections for EtherHiding, malformed .NET assemblies, remote template injection, wiper malware, ClickFix CAPTCHA campaigns, PrivateLoader, and Quasar RAT. It also broadens local IOC reputation coverage.