# Guardrail-Free LLM Used to Generate EDR-Evading Malware Undetected by 65 of 73 VirusTotal Engines (Deep Instinct Black Hat Demo)

> Deep Instinct publicly demonstrated (Black Hat-themed webinar) a guardrail-free LLM generating malware with encryption, sandbox-evasion, security-tool termination and encrypted-import features; the initial Python build was flagged by only 8 of 73 VirusTotal vendors and a Go recompile by 13. This is a vendor-reported demonstration of AI-assisted malware development, not a confirmed in-the-wild campaign.

- **Published:** 2026-10-17T00:48:08Z
- **Last reviewed:** 2026-10-17T00:48:08Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3792
- **ID:** TL-2026-3792
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** TRACKING
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Deep Instinct (blog by Brian Black, 2025-10-08, accompanying a webinar presented by Ryan Heath) describes a demonstration in which a hacker uses a guardrail-free large language model to author malware. The LLM was not identified. The initial prompt referenced EDRKillShifter-style evasion; the generated code included self-encryption with permission-based file exclusion, sleep commands for sandbox evasion, CPU tick monitoring to detect security software activating, functions to terminate other security-tool processes, and encrypted import sections.

According to the vendor, the first Python variant was detected by 8 of 73 VirusTotal engines (65 missed, ~89% evasion). Recompiling the same logic in Go yielded 13 detections, largely from different vendors, illustrating inconsistent coverage of legacy signature-based tooling. Deep Instinct pitches its DIANNA analysis assistant (analysis in under 10 seconds) as the counterpoint. These detection figures are single-source vendor claims and may be promotional; no malware family name, hashes, delivery vector or in-the-wild use were published.

EDRKillShifter is a real, separately documented EDR killer developed by the RansomHub ransomware group (first documented August 2024; ESET later observed it used by Play, Medusa and BianLian affiliates). It abuses a legitimate vulnerable driver (BYOVD) and its shellcode is protected by a 64-character password. The Deep Instinct article only references it as a technique prompt; it does not claim the LLM output reproduced it.

The article also cites Nimbus Manticore (aka UNC1549, Smoke Sandstorm; Iran-nexus, IRGC-aligned) as an active group targeting aerospace, defense, manufacturing and telecommunications, noting early variants were detected by few VirusTotal vendors. Check Point Research (2025-09-22) documents its MiniJunk/MiniBike backdoors, MiniBrowse stealer, HR-recruiter spear-phishing, multi-stage DLL sideloading, LLVM obfuscation and code signing. The article does not tie Nimbus Manticore to the LLM-generated demo malware, so no actor attribution is made for this threat; the Check Point IOCs below are included as related-context indicators only and are labelled as such.

Defensive takeaway: AI lowers the cost of producing novel, per-build-unique malware variants and language-port recompiles, so hash/signature-centric detection degrades. Prioritize behavioral detection of security-tool termination, BYOVD driver loads, timing/sandbox checks, and unsigned/new binaries performing process-kill sequences against EDR services.

## MITRE ATT&CK

- T1587.001 Malware
- T1588.007 Artificial Intelligence
- T1059.006 Python
- T1685 Disable or Modify Tools
- T1497.003 Time Based Checks
- T1497.001 System Checks
- T1027 Obfuscated Files or Information
- T1497.003 Time Based Checks
- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1574.001 DLL
- T1553.002 Code Signing
- T1106 Native API
- T1583.006 Web Services
- T1583.001 Domains
- T1555.003 Credentials from Web Browsers

## Sources

- [Watch a Black Hat Hacker Use a Guardrail-Free LLM to Create Malware That Evades 65 of 73 Legacy Cyber Tools](https://www.deepinstinct.com/blog/black-hat-hacker-uses-guardrail-free-LLM-to-create-malware-that-evades-legacy-cyber)
- [Nimbus Manticore Deploys New Malware Targeting Europe (Check Point Research)](https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/)
- [ESET Research investigates RansomHub, dives into EDR killers, uncovers ties among rival gangs](https://www.eset.com/us/about/newsroom/research/eset-research-investigates-ransomhub-dives-into-edr-killers-uncovers-ties-among-rival-gangs/)
- [Hackers Repurpose RansomHub's EDRKillShifter (The Hacker News)](https://thehackernews.com/2025/03/hackers-repurpose-ransomhubs.html)
- [Ransomware gangs increasingly use vulnerable drivers as EDR killers (Cybersecurity Dive)](https://www.cybersecuritydive.com/news/ransomware-gangs-vulnerable-drivers-edr-killers-increasing/743709/)
- [ESET: EDRKillShifter, RansomHub's tool against EDR](https://www.eset.com/fr/about/newsroom/press-releases/edrkillshifter-outil-ransomhub-contre-edr/)
- [Iranian APT group targets aviation and software firms with updated tools (ePlaneAI)](https://www.eplaneai.com/es/news/iranian-apt-group-targets-aviation-and-software-firms-with-updated-tools)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3792