Fox-IT authors Boudewijn Meijer and Rick Veldhoven published (2024-09-25, page updated 2026-05-21) the evolution of an in-house evasive payload-delivery tool used in red-team engagements. Moving beyond in-memory execution of native payloads, the tool executes malicious logic as bytecode in a custom virtual machine so that real native instructions of the payload never exist in memory in recognizable form.

VM design: a simple, position-independent interpreter with a fixed 18-byte instruction format (opcode, operand types, two 64-bit operands), 17 registers (x86-64 general-purpose registers plus GS), and a virtual stack separate from the real thread stack to avoid stack-inspection heuristics. A context structure holds the instruction pointer, flags, registers, bytecode buffer pointer and stack. Instructions are encrypted in place: the dispatch loop decrypts each instruction before execution and re-encrypts it afterwards, so the instruction size must stay constant and no fully decrypted bytecode image exists at rest.

Evasion features: (1) a polymorphic engine, in use at Fox-IT since 2015, with instruction substitution, basic-block reordering, basic-block creation via jumps/push-ret chains and NOP insertion, whose output can be fed back into itself for iterative mutation; (2) concurrent execution of several VMs on the same thread (a malicious VM interleaved with a VM generating benign events) to disrupt behavioural, event-pattern-based detection; (3) a transpiler that compiles C/C++ to x86 and uses the iced-x86 disassembly library to convert instructions into the custom bytecode, allowing existing position-independent code tools and Beacon Object Files to be ported. Native API calls are made through variadic C++ templates that place the argument count in RCX; callbacks use tagged function pointers (0xDEADBEEF markers) to distinguish bytecode from native targets; DLL entry follows DllMain semantics; user arguments are passed as an encrypted key-value structure.

Reported results: the approach was used successfully in heavily monitored environments with state-of-the-art EDR, delivering persistence modules, lateral-movement tools, shellcode/bytecode executors, AV/EDR patchers, HTTP(S) and DNS beacons and Active Directory query tools. Stated limitations: no dynamic control flow (indirect calls/jumps, RET), position-independent code only, no static variables, globals, strings or library dependencies.

Defender relevance: the source gives no detection guidance. Related public research (Praetorian Centurion, 2026-06-09; Splunk analysis of Vidar's virtualized code, 2026-09-08) shows the same concept of VM-protected payloads; defenders should focus on behavioural and memory-structure detection (small interpreter stubs, fixed-width dispatch loops, anomalous in-memory executable regions with high-entropy data, hidden VM infrastructure) rather than static signatures. No atomic IOCs exist for this technique; the IOC list contains technique/tool artifacts documented in the source. Severity is an analyst estimate.