Threat reportMalwareTL-2026-3792
Guardrail-Free LLM Used to Generate EDR-Evading Malware Undetected by 65 of 73 VirusTotal Engines (Deep Instinct Black Hat Demo)
Guardrail-Free LLM Used to Generate EDR-Evading Malware (TL-2026-3792), also tracked as AI-generated malware demo, is a medium-severity malware campaign, first published 2026-10-17. It has no confirmed attribution, affects Multiple Signature-based endpoint security / antivirus engines, maps to 15 MITRE ATT&CK techniques (T1027, T1059.006, T1106), and is covered by 9 detection rules and 26 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 15MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 26Indicators of compromise
Key facts for TL-2026-3792
- Threat ID
- TL-2026-3792
- Also known as
- AI-generated malware demo, Guardrail-free LLM malware
- Severity
- MEDIUM
- Status
- TRACKING
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, aerospace, defense, telecoms, manufacturing
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in Guardrail-Free LLM Used to Generate EDR-Evading Malware
Malware and tooling: EDRKillShifter, MINIBIKE, MiniBrowse, MiniJunk, RansomHub - S1212
How Guardrail-Free LLM Used to Generate EDR-Evading Malware works
Deep Instinct publicly demonstrated (Black Hat-themed webinar) a guardrail-free LLM generating malware with encryption, sandbox-evasion, security-tool termination and encrypted-import features; the initial Python build was flagged by only 8 of 73 VirusTotal vendors and a Go recompile by 13. This is a vendor-reported demonstration of AI-assisted malware development, not a confirmed in-the-wild campaign.
Deep Instinct (blog by Brian Black, 2025-10-08, accompanying a webinar presented by Ryan Heath) describes a demonstration in which a hacker uses a guardrail-free large language model to author malware. The LLM was not identified. The initial prompt referenced EDRKillShifter-style evasion; the generated code included self-encryption with permission-based file exclusion, sleep commands for sandbox evasion, CPU tick monitoring to detect security software activating, functions to terminate other security-tool processes, and encrypted import sections.
According to the vendor, the first Python variant was detected by 8 of 73 VirusTotal engines (65 missed, ~89% evasion). Recompiling the same logic in Go yielded 13 detections, largely from different vendors, illustrating inconsistent coverage of legacy signature-based tooling. Deep Instinct pitches its DIANNA analysis assistant (analysis in under 10 seconds) as the counterpoint. These detection figures are single-source vendor claims and may be promotional; no malware family name, hashes, delivery vector or in-the-wild use were published.
EDRKillShifter is a real, separately documented EDR killer developed by the RansomHub ransomware group (first documented August 2024; ESET later observed it used by Play, Medusa and BianLian affiliates). It abuses a legitimate vulnerable driver (BYOVD) and its shellcode is protected by a 64-character password. The Deep Instinct article only references it as a technique prompt; it does not claim the LLM output reproduced it.
The article also cites Nimbus Manticore (aka UNC1549, Smoke Sandstorm; Iran-nexus, IRGC-aligned) as an active group targeting aerospace, defense, manufacturing and telecommunications, noting early variants were detected by few VirusTotal vendors. Check Point Research (2025-09-22) documents its MiniJunk/MiniBike backdoors, MiniBrowse stealer, HR-recruiter spear-phishing, multi-stage DLL sideloading, LLVM obfuscation and code signing. The article does not tie Nimbus Manticore to the LLM-generated demo malware, so no actor attribution is made for this threat; the Check Point IOCs below are included as related-context indicators only and are labelled as such.
Defensive takeaway: AI lowers the cost of producing novel, per-build-unique malware variants and language-port recompiles, so hash/signature-centric detection degrades. Prioritize behavioral detection of security-tool termination, BYOVD driver loads, timing/sandbox checks, and unsigned/new binaries performing process-kill sequences against EDR services.
MITRE ATT&CK techniques used in TL-2026-3792
Defense Evasion
T1027 Obfuscated Files or Information; T1497.001 System Checks; T1497.003 Time Based Checks
Execution
T1059.006 Python; T1106 Native API; T1204.002 Malicious File
Discovery
defense-impairment
T1553.002 Code Signing; T1685 Disable or Modify Tools
Credential Access
T1555.003 Credentials from Web Browsers
Initial Access
stealth
Resource Development
T1583.001 Domains; T1583.006 Web Services; T1587.001 Malware; T1588.007 Artificial Intelligence
Affected products and versions in Guardrail-Free LLM Used to Generate EDR-Evading Malware
- Multiple — Signature-based endpoint security / antivirus engines
Vulnerable versions: Legacy signature-centric engines per vendor claim (65 of 73 VirusTotal vendors missed the initial Python variant)
Remediation for Guardrail-Free LLM Used to Generate EDR-Evading Malware
Immediate actions
- Alert on termination, tampering or service-stop of EDR/AV processes from non-administrative or unsigned parent processes
- Enable EDR tamper protection and monitor for tamper-protection bypass attempts
- Block known vulnerable drivers (Microsoft vulnerable driver blocklist / HVCI) to blunt BYOVD EDR killers such as EDRKillShifter
Workarounds
- Application allowlisting (WDAC/AppLocker) to prevent execution of newly compiled unsigned binaries
Longer-term hardening
- Layer behavioral and ML-based detection over signature engines; do not rely on VirusTotal multi-engine verdicts to assess novel samples
- Hunt for sandbox-evasion patterns (long sleeps, tick-count/CPU timing checks) in detonation telemetry
- Restrict Python/Go toolchains and unsigned binary execution on endpoints via application control
Timeline of Guardrail-Free LLM Used to Generate EDR-Evading Malware
- MiniBike (SlugResin) backdoor first reported by Mandiant (month precision, June 2022); later tied to Nimbus Manticore per Check Point
- EDRKillShifter, RansomHub's BYOVD EDR killer, first documented in use by RansomHub actors (month precision, August 2024)
- ESET reports EDRKillShifter use spreading beyond RansomHub to Play, Medusa and BianLian affiliates (month precision, March 2025)
- Nimbus Manticore begins code-signing payloads via SSL.com (month precision, per Check Point)
- Nimbus Manticore re-architects C2 behind Cloudflare and Azure App Service (month precision, per Check Point)
- Check Point Research publishes Nimbus Manticore report on MiniJunk/MiniBike targeting Europe
- Deep Instinct publishes blog on guardrail-free LLM malware demo: initial Python build evaded 65 of 73 VirusTotal vendors; Go recompile detected by 13
Sources cited for Guardrail-Free LLM Used to Generate EDR-Evading Malware
- Watch a Black Hat Hacker Use a Guardrail-Free LLM to Create Malware That Evades 65 of 73 Legacy Cyber Tools
- Nimbus Manticore Deploys New Malware Targeting Europe (Check Point Research)
- ESET Research investigates RansomHub, dives into EDR killers, uncovers ties among rival gangs
- Hackers Repurpose RansomHub's EDRKillShifter (The Hacker News)
- Ransomware gangs increasingly use vulnerable drivers as EDR killers (Cybersecurity Dive)
- ESET: EDRKillShifter, RansomHub's tool against EDR
- Iranian APT group targets aviation and software firms with updated tools (ePlaneAI)
Detection coverage for TL-2026-3792
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3792 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.