Threat video1:00
W32/SkyAI Windows Malware With LLM Prompt Injection
Skynet hides an LLM prompt injection to fool AI analysis and reaches C2 over Tor. 9 detection rules, 19 IOCs, 16 ATT&CK techniques and a free Splunk SPL rule.
Read the full threat intel for W32/SkyAI Windows Malware With LLM Prompt Injection →
Chapters
- 0:00The hookSix evasion functions with AI tricks.
- 0:04The storyAI tricks embedded in malware.
- 0:10Attack pathReproduced in lab; runs six sandbox checks.
- 0:24AttributionNo threat actor: this was defensive research.
- 0:29Indicators of compromise10 indicators to hunt: 2 URLs, 1 SHA-256 hash and 2 registry keys, and more.
- 0:38MITRE ATT&CK techniques16 ATT&CK techniques, from resource development to command and control.
- 0:43Remediation4 steps now: Block/alert on the two identified Tor onion-service addresses.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Six evasion functions with AI tricks.
0:05AI tricks embedded in malware.
0:07Failed against frontier LLM models.
0:11Reproduced in lab; runs six sandbox checks.
0:14Steals SSH keys and system hosts.
0:17Decrypts embedded Tor malware and stages it.
0:19Connects to .onion C2 endpoints remotely.
0:25No threat actor: this was defensive research.
0:2910 indicators to hunt: 2 URLs, 1 SHA-256 hash and 2 registry keys, and more.
0:3816 ATT&CK techniques, from resource development to command and control.
0:444 steps now: Block/alert on the two identified Tor onion-service addresses.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.