AI Makes Reverse Engineering of Software and Malware Easier, Researchers Find
Summary
Intezer researchers used AI-assisted workflows to recreate parts of Slack and Finder and build a working Turla replicant. The article also reports threat actors’ use of AI for reverse engineering and discusses risks to software IP and security.
Key points
- Intezer researchers found that AI made it moderately challenging to recreate Apple's Finder and Salesforce's Slack client; the results did not reproduce every internal or server-side component.
- Their malware-reconstruction harness combined a Python control plane, compiler, virtual machine, static-analysis tools and multiple language models.
- An orchestrator divided the Turla binary into functions for AI agents to reconstruct and test; the resulting replicant included command handling and file-transfer mechanisms.
- Anthropic's report described Midnight Blizzard using Claude over several days to reverse-engineer a stolen proprietary drone-vision SDK.
- The article says a Chinese campaign also used Claude in workstreams that included reverse-engineering endpoint-security products to look for bugs.
- The article notes that the open-source REA tool and MCP server had become the most popular program listed on GitHub the previous month.
- Intezer's researcher says keeping server-side infrastructure from customers can limit what reverse engineers can reproduce; encryption and obfuscation may also frustrate analysis.
Article Details
- Event Type
- Research finding on AI-assisted reverse engineering of mainstream software and malware, alongside reported malicious use of AI models for reverse engineering.
- Impact
- AI tools can make software and malware reverse engineering faster and more accessible, potentially increasing risks of intellectual-property theft and vulnerability discovery. Intezer researchers recreated substantial parts of Slack and Finder and built a working Turla replica. Separately, Anthropic reported that threat actors used Claude to reverse-engineer a stolen drone-vision software development kit and examine security products for bugs.
People
Threat Actors
Malware
Vendors
AnthropicOn Sept. 10, Anthropic released a report describing how threat actors have been abusing its models. Among other cases, it described significant activity from the Russian threat actor Midnight Blizzard, primarilyApplehow easy it is to reverse-engineer software with AI by picking on some high-profile candidates: Slack, Apple's Finder app, and, importantly for security researchers, the Turla malware.SalesforceThey found it only moderately challenging to meaningfully recreate Apple's and Salesforce's proprietary apps from the ground up.
Products
ClaudeFor example, if in one case you can just ask Claude to reconstruct the source code, in another case Claude will refuse.Finderit is to reverse-engineer software with AI by picking on some high-profile candidates: Slack, Apple's Finder app, and, importantly for security researchers, the Turla malware.Slackout how easy it is to reverse-engineer software with AI by picking on some high-profile candidates: Slack, Apple's Finder app, and, importantly for security researchers, the Turla malware.
Tools
Binary Ninjasub-agents. It takes the whole binary and breaks it into smaller functions, based on what tools like Binary Ninja provide. From there it goes through a process of reconstruction that is done by one agent, and anotherREAupstanding masses. Last month, an open source (OSS) tool and Model Context Protocol (MCP) server called "REA" — short for "Reverse Engineer Anything" — became the single most popular program listed on GitHub.
Countries
RussiaThe target was of course unsurprising, given that drones have contributed massively to the war between Russia and Ukraine.Ukraineit described significant activity from the Russian threat actor Midnight Blizzard, primarily targeting Ukraine's government, military, and diplomatic staff. As part of its campaign in Ukraine, Midnight Blizzard had
Industries
CybersecurityCybersecurity researchers from Intezer recently tested out how easy it is to reverse-engineer software with AI by picking on some high-profile candidates: Slack, Apple's Finder app, and, importantly for securityDefenseintelligence (AI) tools — something that security researchers are warning has implications for cyber defense, intellectual property (IP) theft, and beyond.SoftwareMainstream software and malware can be reverse-engineered more easily than ever, thanks to artificial intelligence (AI) tools — something that security researchers are warning has implications for cyber defense,