Malware Uses Human-Behavior and CPU Timing Checks to Evade Sandboxes
Summary
Picus Security’s Red Report 2026 describes Blitz system and CPU-timing checks and LummaC2’s cursor-motion geometry test, techniques that can prevent malware payloads from executing in automated analysis environments.
Key points
- Picus says its 2025 analysis covered more than 1.1 million malicious files and 15.5 million MITRE ATT&CK actions.
- The report places Virtualization/Sandbox Evasion (T1497) at No. 4, found in 20% of 221,054 analyzed malware samples.
- Blitz is described as checking CPU count, screen resolution, and sandbox-related driver strings before deciding whether to execute.
- LummaC2 v4.0 reportedly samples five cursor positions and evaluates movement distances and angles to distinguish human input from automated movement.
- Blitz is also described as comparing concurrent CPUID-loop and floating-point execution to detect hypervisor-related timing overhead.
- The article argues that file analysis alone can miss payloads that do not execute in sandboxes, and recommends validating security controls against evasive behavior.
Article Details
- Attack Vectors
- Blitz checks processor count, screen resolution, and driver strings associated with analysis tools, and aborts in restricted or sandbox-like environments.
- LummaC2 v4.0 samples five consecutive cursor positions with GetCursorPos() and evaluates movement distance and angles to distinguish human interaction from synthetic input.
- Blitz compares the execution time of a CPUID loop with concurrent floating-point calculations to detect hypervisor-related timing overhead.
- Defensive Notes
- Validate defenses by safely simulating real-world evasion and persistence behaviors against the actual security stack, then check whether controls block execution, detections fire, and response mechanisms activate.
- Use behavioral analysis and monitoring alongside file analysis, since sandboxed samples may return clean results when their payloads do not execute.
MITRE ATT&CK
T1497 · Virtualization/Sandbox EvasionThe article reports a rise in virtualization and sandbox evasion, including system, user-activity, and time-based checks used by Blitz and LummaC2.T1497.001 · System ChecksBlitz checks processor count, screen resolution, and sandbox-driver strings before deciding whether to execute.T1497.002 · User Activity Based ChecksLummaC2 v4.0 evaluates sampled cursor positions and movement angles to determine whether input appears human or automated.T1497.003 · Time Based ChecksBlitz compares a CPUID loop with concurrent floating-point calculations to detect timing overhead associated with a hypervisor.