Topic
The practice of reverse engineering malicious software to uncover its code, behavior, communication protocols, and evasion techniques.
UAC-0099's ASHVEIN malware carries a nuclear-weapons prompt meant to make an LLM analyst refuse the script, a dev.to post says. The post tests no model, but any pipeline that sends a whole script to an LLM in one prompt can check itself for the flaw.
Reality
Cisco Talos says the best text that malware authors plant to steer AI analysis tools tipped results their way in about 35% of test runs. The text has to sit in plaintext, so each attempt also gives defenders a string to hunt for.
Reality
Zscaler ThreatLabz traced August 2026 attacks on Indian and Afghan government and defense targets to a new Rust backdoor that takes orders from private GitHub repositories. Its encryption key is a hash of a token sitting in cleartext in the sample.
Reality
Malbear Labs found PavokwiLoader resolves the 48 ntdll functions it uses by hash while importing 68 KERNEL32 functions it never calls. Static and import-based detection see nothing, so reading it means emulating the loader's own resolver.
Reality
Cisco Talos released its CAIRN framework on September 22nd to hunt prompts, provider endpoints and API-key prefixes in malware metadata. Its first case study polls four commercial models and runs the winner.
Reality
Security Weekly News #615 credits Google's threat tracker with malware carrying text meant to make an LLM scanner decline to analyse it. The exposed decision is what the pipeline writes when the model returns no verdict.
Reality
The public account is a single Risky Business Features episode from September 11, 2026, in which OpenSourceMalware founder Paul McCarty describes how researchers pull malicious packages apart and what one family does after removal.
Reality
FlexenseActivator.exe stays quiet until something answers its connectivity check. Simulating the network, rather than isolating the host harder, is what made the payload observable.
Reality
Zscaler says a Rust backdoor tied to ransomware activity moved its command channel onto GitHub. The first version beaconed once a second to a bare HTTP endpoint. The second one does not need a domain at all.
Reality