A security firm reports AI-generated malware was used in a recent cyber attack. The malware was created by prompting an AI assistant with no manual coding required.
The script had many unique elements that easily identified it as AI-generated. Aspects of the tool revealed a back-and-forth process with a large language model in which elements were cut and pasted until it worked. The cyber criminal behind the attack also failed to edit and left in a placeholder server name the AI generated as an example.
Other signs that the tool was AI-generated included significant over-engineering of the script, five separate fallback methods where a human would likely pick one, colorful console output, and an HTML report summarizing the theft.
Adding to the threat landscape, Google has discovered a new kind of AI-powered malware which uses large language models during their execution to generate malicious scripts.
These tools generate malware scripts, muddle their own code, and utilize AI models to create malicious functions on demand instead of hard-coding those functions into the malware.
One example is PromptLock, which uses a large language model to generate malicious scripts on the spot at runtime to engage reconnaissance, data encryption, and data exfiltration.
Source: https://www.infosecurity-magazine.com/news/vibe-coded-malware-ai-powershell/; https://www.infosecurity-magazine.com/news/aienabled-malware-actively/
Commentary
According to experts, one of the problems with AI-generated and AI-assisted malware is detection.
AI-assisted malware can mutate its code on demand which makes traditional signature reliant detection methods ineffective. AI-generated malware, written by AI instead of with manual coding, is also novel and one-of-a-kind, meaning it likely has never been seen before and unlikely to appear in the same exact form again. Anti-virus tools relying on file hashes and signatures would not be useful in detecting it because of its novelty.
Signature-based defenses are designed to detect reused malware. After analyzing a sample, the hash pattern could be added to blocklists and future encounters with that code would be blocked. Code that is generated by AI on demand and discarded after use has no signature with future value.
Experts recommend utilizing behavioral analytics to identify the underlying malware actions that can't be hidden. Signs like unusual process creation or unexpected outbound traffic can signal malware. Correlating the behavioral signs of malware across endpoints may help organizations spot novel AI-generated malware when traditional signature-based detection methods fail.
The final takeaway is that signature-based defense tools will continue to have a place in malware detection, but to detect AI-generated malware, organizations need more. Capitalizing on behavioral analytics within a system to detect suspicious activity may help organizations avoid the detection risks of AI-generated malware.
