Unit 42 analyzed 405 AI-enabled malware samples and found that about 97% existed only in repositories, sandboxes, or testing environments, while just 12 appeared on production endpoints. The samples that reached real environments were detected and blocked by existing defenses, including FunkSec ransomware, a trojanized Recipe Lister installer, the Oyster backdoor, Rhadamanthys stealer, and a COM hijacking DLL. #FunkSec #RecipeLister #Oyster #Rhadamanthys #CortexXDR #WildFire
Keypoints
- Unit 42 analyzed 405 unique AI-related malware samples from WildFire, VirusTotal Intelligence, and OSINT sources.
- About 97% of the samples were only seen in sandboxes, research repositories, or security validation environments.
- Only 12 samples appeared on Cortex XDR-protected production endpoints, and all were detected and blocked.
- FunkSec ransomware was the most represented real-world family, with seven variants compiled over a six-day period.
- A trojanized NSIS installer posing as Recipe Lister spread widely, reaching more than 50 organizations and generating thousands of alerts.
- Other observed threats included an Oyster backdoor disguised as Dropbox software, a Rhadamanthys stealer payload, and a COM hijacking DLL masquerading as 360 Total Security.
- The report concludes that AI changes how malware is written, not how it executes, so existing behavioral and sandbox-based defenses remain effective.
MITRE Techniques
- [T1055 ] Process Injection – Used when the trojanized application extracted and ran a JavaScript backdoor from a temporary directory, and when loader-style malware executed additional payloads (‘it extracts and runs a JavaScript backdoor from a temporary directory’).
- [T1574.002 ] DLL Side-Loading – The Oyster-related sample dropped an AutoIt loader that side-loaded the Oyster backdoor (‘the installer drops an AutoIt loader that side-loads the Oyster (aka CleanBoost) backdoor’).
- [T1036 ] Masquerading – Multiple samples impersonated legitimate software or products, including Recipe Lister, Dropbox, and 360 Total Security (‘masquerades as a recipe-finding application called Recipe Lister’; ‘masquerading as a component of 360 Total Security’).
- [T1566 ] Phishing – The AI-branded installer and lure-based delivery relied on deceptive naming and social engineering to entice execution (‘AI branding is a social engineering tactic’).
- [T1112 ] Modify Registry – FunkSec disabled Windows Defender through registry modifications (‘Disabling Windows Defender through PowerShell and registry modifications’).
- [T1059.001 ] PowerShell – FunkSec used PowerShell as part of its defense evasion and execution behavior (‘Disabling Windows Defender through PowerShell and registry modifications’).
- [T1497 ] Virtualization/Sandbox Evasion – Samples with proof-of-concept and testing traits were designed or observed in sandbox-like contexts, and some targeted localhost/private ranges rather than real victims (‘They target localhost or private IP address ranges in their configuration’).
- [T1105 ] Ingress Tool Transfer – The trojanized installer delivered a backdoor payload after installation, and the AI-themed lure facilitated payload delivery (‘it extracts and runs a JavaScript backdoor’; ‘lowering the barrier to entry and speeding up the deployment of loaders’).
- [T1484.001 ] Domain or Tenant Policy Modification – FunkSec deleted volume shadow copies to hinder recovery (‘Deleting volume shadow copies’).
- [T1547.001 ] Registry Run Keys / Startup Folder – The COM hijacking DLL implemented persistence through COM object hijacking (‘implements persistence through COM object hijacking’).
- [T1055.011 ] Extra Window Memory Injection – Not explicitly stated; omitted.
Indicators of Compromise
- [SHA-256 hashes] Production samples – 1619bcad3785be31ac2fdee0ab91392d08d9392032246e42673c3cb8964d4cb7, 5226ea8e0f516565ba825a1bbed10020982c16414750237068b602c5b4ac6abd, and 10 more hashes
- [File names] Malicious or masquerading binaries – RecipeLister, redist.exe, 360Util.dll, and other sample names used in the campaign
- [PDB paths] Development/build artifacts found in FunkSec samples – Dev.pdb, Funksec.pdb, and other project-name variants such as Darkzone.pdb and Darkfunk.pdb
- [Signed certificate subject / publisher names] Code-signing impersonation – Global Tech Allies Ltd., Dropbox, Inc.
- [File paths / directory terms] Research-oriented paths seen in non-production samples – research, mal, analysis
Read more: https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/