Unit 42 Finds AI Speeds Malware Development, Not Evasion

Summary

Unit 42 analyzed 405 AI-linked malware samples and found that about 97% never reached a real target. Existing defenses detected all 12 samples found on protected endpoints, suggesting AI sped up malware development without making it harder to catch.

Key points

• Unit 42 cross-referenced 405 sample hashes with endpoint telemetry, sandbox traffic, and internal alerts; 12 appeared on protected endpoints.
• Every one of those 12 samples triggered a security alert, using existing detection methods.
• The live-endpoint samples spanned five malware families and three countries, without concentration in a particular industry or region.
• Recipe Lister, a fake recipe app installer carrying a backdoor, appeared across more than 50 organizations and generated about 6,500 endpoint records and 9,600 alerts.
• Other samples included FunkSec ransomware, an Oyster backdoor posing as a Dropbox installer, and a Rhadamanthys information stealer.
• Unit 42 said sandbox analysis, behavior-based detection, unusual digital signatures, and file-packing measurements identified the samples; no new detection method was needed.