# Fox-IT Research: EDR Evasion via Custom Bytecode Virtual Machine (Malware Virtualisation)

> Fox-IT (NCC Group) red-team research describes a custom bytecode virtual machine that runs payloads as encrypted, polymorphic VM instructions instead of native x86-64 code to evade EDR. It is offensive technique research, not an observed in-the-wild campaign; no CVEs, IOCs or attribution are stated in the source.

- **Published:** 2026-10-16T18:12:01Z
- **Last reviewed:** 2026-10-16T18:12:01Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3765
- **ID:** TL-2026-3765
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** TRACKING
- **Detections:** 9 · **IOCs:** 3 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Fox-IT authors Boudewijn Meijer and Rick Veldhoven published (2024-09-25, page updated 2026-05-21) the evolution of an in-house evasive payload-delivery tool used in red-team engagements. Moving beyond in-memory execution of native payloads, the tool executes malicious logic as bytecode in a custom virtual machine so that real native instructions of the payload never exist in memory in recognizable form.

VM design: a simple, position-independent interpreter with a fixed 18-byte instruction format (opcode, operand types, two 64-bit operands), 17 registers (x86-64 general-purpose registers plus GS), and a virtual stack separate from the real thread stack to avoid stack-inspection heuristics. A context structure holds the instruction pointer, flags, registers, bytecode buffer pointer and stack. Instructions are encrypted in place: the dispatch loop decrypts each instruction before execution and re-encrypts it afterwards, so the instruction size must stay constant and no fully decrypted bytecode image exists at rest.

Evasion features: (1) a polymorphic engine, in use at Fox-IT since 2015, with instruction substitution, basic-block reordering, basic-block creation via jumps/push-ret chains and NOP insertion, whose output can be fed back into itself for iterative mutation; (2) concurrent execution of several VMs on the same thread (a malicious VM interleaved with a VM generating benign events) to disrupt behavioural, event-pattern-based detection; (3) a transpiler that compiles C/C++ to x86 and uses the iced-x86 disassembly library to convert instructions into the custom bytecode, allowing existing position-independent code tools and Beacon Object Files to be ported. Native API calls are made through variadic C++ templates that place the argument count in RCX; callbacks use tagged function pointers (0xDEADBEEF markers) to distinguish bytecode from native targets; DLL entry follows DllMain semantics; user arguments are passed as an encrypted key-value structure.

Reported results: the approach was used successfully in heavily monitored environments with state-of-the-art EDR, delivering persistence modules, lateral-movement tools, shellcode/bytecode executors, AV/EDR patchers, HTTP(S) and DNS beacons and Active Directory query tools. Stated limitations: no dynamic control flow (indirect calls/jumps, RET), position-independent code only, no static variables, globals, strings or library dependencies.

Defender relevance: the source gives no detection guidance. Related public research (Praetorian Centurion, 2026-06-09; Splunk analysis of Vidar's virtualized code, 2026-09-08) shows the same concept of VM-protected payloads; defenders should focus on behavioural and memory-structure detection (small interpreter stubs, fixed-width dispatch loops, anomalous in-memory executable regions with high-entropy data, hidden VM infrastructure) rather than static signatures. No atomic IOCs exist for this technique; the IOC list contains technique/tool artifacts documented in the source. Severity is an analyst estimate.

## MITRE ATT&CK

- T1027 Obfuscated Files or Information
- T1027.014 Polymorphic Code
- T1027.013 Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1685 Disable or Modify Tools
- T1106 Native API
- T1071.001 Web Protocols
- T1071.004 DNS
- T1587.001 Malware
- T1547 Boot or Logon Autostart Execution
- T1021 Remote Services
- T1087.002 Domain Account

## Sources

- [Red Teaming in the age of EDR: Evasion of Endpoint Detection Through Malware Virtualisation (Fox-IT)](https://blog.fox-it.com/2024/09/25/red-teaming-in-the-age-of-edr-evasion-of-endpoint-detection-through-malware-virtualisation/)
- [Centurion: virtualized loader (Praetorian)](https://www.praetorian.com/blog/virtualized-loader-centurion/)
- [Peeling Back the Layers: Inside Vidar - From Virtualized Code to Stolen Credentials (Splunk)](https://www.splunk.com/en_us/blog/security/inside-vidar-from-virtualized-code-to-stolen-credentials.html)
- [iced-x86 disassembler/assembler library](https://github.com/icedland/iced)
- [MITRE ATT&CK T1027 Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027/)
- [MITRE ATT&CK T1027.014 Polymorphic Code](https://attack.mitre.org/techniques/T1027/014/)
- [MITRE ATT&CK T1620 Reflective Code Loading](https://attack.mitre.org/techniques/T1620/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3765