Unit 42 Finds Most AI-Enabled Malware Samples Remain Outside Production
Summary
Unit 42 analyzed 405 AI-related malware samples and found about 97% only in research or testing environments. Twelve appeared in protected endpoint telemetry, and Palo Alto Networks reported that its defenses detected and blocked them.
Key points
- Unit 42 examined 405 samples gathered from WildFire, VirusTotal Intelligence and OSINT, using telemetry spanning June 2024 to June 2025 and endpoint data from December 2024 to June 2025.
- About 97% of samples appeared only in research, sandbox or security-testing environments; 12 appeared in Cortex XDR-protected endpoint telemetry.
- Palo Alto Networks reported that Cortex XDR generated alerts for all 12 endpoint-observed samples and that the samples were detected and blocked.
- The production-observed threats included FunkSec ransomware, a trojanized Recipe Lister installer, the Oyster backdoor, Rhadamanthys stealer and a COM-hijacking DLL.
- The Recipe Lister installer appeared across more than 50 organizations and generated over 9,600 XDR alerts; the report says it was blocked across those environments.
- Unit 42 concluded that the samples did not require novel detection methods: existing behavioral analytics, sandboxing, code-signing anomaly detection and entropy analysis detected them.
- The report notes limitations: its dataset included samples with varied or merely branded AI connections, and its telemetry showed no statistically significant targeting pattern.
Article Details
- Publisher
- Unit 42, Palo Alto Networks
- Report Period
- Endpoint telemetry: December 2024–June 2025; WildFire sessions: June 2024–June 2025
- Scope
- Analysis of AI-related malware samples and their prevalence in endpoint, network, alert, and sandbox telemetry.
- Sample Size
- 405 unique samples
- Key Statistics
- Of 405 samples, 12 (3.0%) appeared on Cortex XDR-protected production endpoints.
- All 12 samples observed on production endpoints generated Cortex XDR alerts and were reported as detected and blocked.
- Approximately 97% of the samples were seen only in research repositories, sandboxes, or testing environments.
- The trojanized Recipe Lister installer appeared across more than 50 organizations and generated over 6,500 endpoint profile records and 9,600 XDR alerts during the observation window.
- Recommendations
- Maintain defense in depth using behavioral detection, cloud-based sandboxing, and endpoint analytics.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 1619bcad3785be31ac2fdee0ab91392d08d9392032246e42673c3cb8964d4cb7 | Hash of the trojanized RecipeLister application sample observed on production endpoints. |
| SHA256 | 20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d | Hash of a FunkSec ransomware sample observed on production endpoints. |
| SHA256 | 4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14 | Hash of a Rhadamanthys information stealer sample with active command-and-control communication. |
| SHA256 | 5226ea8e0f516565ba825a1bbed10020982c16414750237068b602c5b4ac6abd | Hash of a FunkSec ransomware sample observed on production endpoints. |
| SHA256 | 66dbf939c00b09d8d22c692864b68c4a602e7a59c4b925b2e2bef57b1ad047bd | Hash of a FunkSec ransomware sample observed on production endpoints. |
| SHA256 | b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb | Hash of a FunkSec ransomware sample observed on production endpoints. |
| SHA256 | bb932056cae8940742e50b4f2b994a802e703f7bc235e7dd647d085ae2b2baf7 | Hash of an Oyster backdoor sample; the installer used an AutoIt loader to side-load it. |
| SHA256 | c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c | Hash of a FunkSec ransomware sample observed on production endpoints. |
| SHA256 | c398b3e06ef860670b9597daed85632834fa961aea87164b8ba8bb2f094a14ef | Hash of a COM-hijacking DLL that masqueraded as a 360 Total Security component. |
| SHA256 | dcf536edd67a98868759f4e72bcbd1f4404c70048a2a3257e77d8af06cb036ac | Hash of a FunkSec ransomware sample observed on production endpoints. |
| SHA256 | dd15ce869aa79884753e3baad19b0437075202be86268b84f3ec2303e1ecd966 | Hash of a FunkSec ransomware sample observed on production endpoints. |
| SHA256 | e622f3b743c7fc0a011b07a2e656aa2b5e50a4876721bcf1f405d582ca4cda22 | Hash of a FunkSec ransomware sample observed on production endpoints. |
MITRE ATT&CK
T1036 · MasqueradingSamples masqueraded as legitimate software, including Recipe Lister, Dropbox software, and a 360 Total Security component.T1059.001 · PowerShellFunkSec used PowerShell as part of disabling Windows Defender.T1112 · Modify RegistryFunkSec modified the registry as part of disabling Windows Defender.T1574.002 · DLL Side-LoadingThe Oyster-related installer dropped an AutoIt loader that side-loaded the Oyster backdoor.
Malware
FunkSecThe samples that reached real environments were detected and blocked by existing defenses, including FunkSec ransomware, a trojanized Recipe Lister installer, the Oyster backdoor, Rhadamanthys stealer, and a COMOysterand blocked by existing defenses, including FunkSec ransomware, a trojanized Recipe Lister installer, the Oyster backdoor, Rhadamanthys stealer, and a COM hijacking DLL.Rhadamanthysdefenses, including FunkSec ransomware, a trojanized Recipe Lister installer, the Oyster backdoor, Rhadamanthys stealer, and a COM hijacking DLL.