Skip to navigation

Threat reportThreat IntelligenceTL-2026-5646

AI Lowers the Barrier to Reverse Engineering Mainstream Software and Malware (Intezer: Slack, Apple Finder, Turla)

lowTRACKING

Dark Reading reports Intezer research showing AI-assisted reverse engineering lowers the skill needed to rebuild proprietary software and malware. Researchers rebuilt Slack and Apple's Finder with only moderate difficulty and produced a working Turla replicant, raising IP-theft and cyber-defense concerns.

Key facts

IdentifiersTL-2026-5646
SeverityLOW
First disclosed
Affected productsSlack / Salesforce Slack desktop application; Apple macOS Finder
MalwareAgent.BTZ/ComRAT, Agent.btz - S0092, ComRAT, Turla, Turla replicant (AI-assisted)
ToolsTurla
MITRE ATT&CK techniquesT1059 Command and Scripting Interpreter, T1070.004 Indicator Removal: File Deletion, T1105 Ingress Tool Transfer, T1587.001 Develop Capabilities: Malware, T1588.007 Obtain Capabilities: Artificial Intelligence
MotivationUNKNOWN
Target sectorstechnology, software
Target regionsGlobal
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage

As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5646 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Turla-Style Reconnaissance Burst from a Single Parent Process (TL-2026-5646)

Detects four or more distinct built-in reconnaissance utilities (systeminfo, ipconfig, netstat, tasklist, whoami, net, nltest, arp, nbtstat) launched by one parent process within five minutes. This is the operator-driven command receive-and-execute pattern that Intezer's Turla replicant reproduces (TL-2026-5646). The pattern is generic hands-on-keyboard discovery rather than a Turla-unique signature.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1059.003, T1082, T1016, T1033, T1057
  • Data sources: Sysmon EventCode 1 (index=sysmon), Microsoft Defender for Endpoint DeviceProcessEvents
  • Severity: medium
  • Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
| eval tool=lower(OriginalFileName)
| where match(tool,"^(sysinfo|ipconfig|netstat|tasklist|whoami|net|net1|nltest|arp|nbtstat)[.]exe$")
| fillnull value="" ParentCommandLine ParentImage ParentProcessGuid
| bin _time span=5m
| stats dc(tool) as distinct_tools values(tool) as tools values(CommandLine) as commands by host ParentProcessGuid ParentImage ParentCommandLine _time
| where distinct_tools>=4
| table _time host ParentImage ParentCommandLine distinct_tools tools commands

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("systeminfo.exe", "ipconfig.exe", "netstat.exe", "tasklist.exe", "whoami.exe", "net.exe", "net1.exe", "nltest.exe", "arp.exe", "nbtstat.exe")
| summarize distinct_tools = dcount(tolower(FileName)), tools = make_set(tolower(FileName), 20), commands = make_set(ProcessCommandLine, 20), first_seen = min(Timestamp) by DeviceName, InitiatingProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine, bin(Timestamp, 5m)
| where distinct_tools >= 4
| order by first_seen desc

Sigma

title: Turla-Style Reconnaissance Utility Burst (Base)
name: tl_5646_recon_tool_exec
id: e51a9c28-4d07-4b3e-8f62-a7c0b9d15e04
status: experimental
description: Base rule matching built-in Windows reconnaissance utilities by original file name. Used by the correlation rule below.
references:
    - https://www.darkreading.com/application-security/ai-reverse-engineering-apps
author: Threadlinqs Team
date: 2026-11-10
tags:
    - attack.discovery
    - attack.t1082
    - attack.t1016
    - attack.t1033
    - attack.t1057
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        OriginalFileName:
            - 'sysinfo.exe'
            - 'ipconfig.exe'
            - 'NETSTAT.EXE'
            - 'tasklist.exe'
            - 'whoami.exe'
            - 'net.exe'
            - 'nltest.exe'
            - 'arp.exe'
            - 'nbtstat.exe'
    condition: selection
falsepositives:
    - Used only through the correlation rule
level: informational
---
title: Turla-Style Reconnaissance Burst from a Single Parent Process
id: 0a7d3f95-c86b-4e12-9b40-5d2e8a1f6c05
status: experimental
description: Four or more distinct reconnaissance utilities launched by the same parent process within five minutes, consistent with operator-driven command execution reproduced in the Turla replicant research (TL-2026-5646).
references:
    - https://www.darkreading.com/application-security/ai-reverse-engineering-apps
author: Threadlinqs Team
date: 2026-11-10
tags:
    - attack.discovery
    - attack.execution
    - attack.t1059.003
    - attack.t1082
    - attack.t1016
    - attack.t1033
    - attack.t1057
correlation:
    type: value_count
    rules:
        - tl_5646_recon_tool_exec
    group-by:
        - ParentProcessGuid
    timespan: 5m
    condition:
        gte: 4
        field: OriginalFileName
falsepositives:
    - IT admin troubleshooting scripts and inventory tools
    - Endpoint management agents running discovery batches
level: medium

Known false positives:

  • IT troubleshooting scripts and inventory agents that run several of these tools together
  • Vulnerability scanners and EDR response actions that collect system information

Tuning notes: Exclude known management-agent parent images such as SCCM, Tanium and Rapid7. Raise distinct_tools to 5 for noisy estates. Prioritise hits where the parent is a scripting host, an unsigned binary or a user-writable path.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Reverse-Engineering Tooling Host with LLM API Egress (AI-Assisted RE, TL-2026-5646) · unlock with TL Creds
  • Interpreter-Hosted Command Receive-and-Execute Pipeline (Turla Replicant Behaviour, TL-2026-5646) · unlock with TL Creds
  • Interpreter- or LOLBin-Dropped Payload Executed from User-Writable Path (File Transfer, TL-2026-5646) · unlock with TL Creds
  • macOS Binary Inspection Tools Run Against Finder or Slack Bundles (TL-2026-5646) · unlock with TL Creds
  • Chained Reconnaissance Commands in a Single cmd.exe Invocation (Turla-Style, TL-2026-5646) · unlock with TL Creds
  • Agent.btz Publicly Reported File Artifacts (Turla-Linked Background, TL-2026-5646) · unlock with TL Creds
  • Slack Electron App ASAR Unpack / JavaScript Deobfuscation (AI-Assisted Reverse Engineering, TL-2026-5646) · unlock with TL Creds
  • Periodic HTTP POST Beaconing to a Single Destination (C2 Pipeline, Turla Replicant, TL-2026-5646) · unlock with TL Creds

Indicators of compromise

As of 2026-11-10, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-5646.

12 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

This is a trend and research item, not an exploited vulnerability. Per Dark Reading's coverage of Intezer research (researcher quoted: Nicole Fishbein), the team tested AI-assisted reverse engineering against three targets: Slack, Apple's Finder app, and the Turla malware.

Slack was the easier target because it offered little that the researchers could not unpack by reverse-engineering its JavaScript source code. Finder was harder because it relies on files managed by cloud services and on actions whose results depend on other macOS services. Rebuilding Apple's and Salesforce's proprietary applications from the ground up was reported as only moderately difficult. Turla malware proved the most difficult to wrangle, yet Fishbein and a colleague ultimately built a Turla replicant with its full working pipeline: how it receives and executes commands, and its file transfer mechanisms.

The stated implications are intellectual-property theft (cloning proprietary apps) and effects on cyber defense, since AI shortens the time and skill needed to analyze malware and, by extension, to reproduce it. The article also notes that even a straightforward reproduction of the Slack client would not recreate its entire implementation, so vendors may need to be more careful with their intellectual property without assuming full cloning is trivial.

VERIFICATION LIMITS: direct fetch of the Dark Reading article returned HTTP 403 and Intezer's primary write-up could not be located, so details come from search-result excerpts only. The article date of 2026-11-10 comes from a search-result description. No CVE, IOC, CVSS, exploitation status or malware-sample hashes were verified. No network indicators exist to correlate in BeaconBeagle.

MITRE ATT&CK techniques by tactic:

Execution

T1059 Command and Scripting Interpreter

Defense Evasion

T1070.004 Indicator Removal: File Deletion

Command and Control

T1105 Ingress Tool Transfer

Resource Development

T1587.001 Develop Capabilities: Malware; T1588.007 Obtain Capabilities: Artificial Intelligence

Remediation

Immediate actions

  • Treat client-side JavaScript and shipped binaries as readable by adversaries; avoid embedding secrets or sensitive logic in them
  • Review which proprietary client applications ship unobfuscated source or easily decompiled code

Longer-term hardening

  • Adopt behavior-based malware detection rather than relying on code-similarity or signature novelty, since AI-built replicants may evade static matching
  • Move sensitive business logic server-side and enforce licensing and access controls there
  • Use AI-assisted reverse engineering defensively to speed malware triage

Affected and fixed versions

  • Slack / Salesforce — Slack desktop application
  • Apple — macOS Finder

Timeline

Last updated · revalidated 1× · latest source

  • Approximate (year only sourced): Agent.BTZ, a Turla-linked RAT later analyzed by Intezer, is reported as the threat that hit the Pentagon in 2008.
  • Approximate (year only sourced): Intezer and Check Point Research publish a joint study mapping code connections across Russian APT malware, including Turla.
  • Compile timestamp of the TinyTurla-NG x64 DLL (291,840 bytes) that Intezer later used as its hard reconstruction target.
  • Intezer publishes 'When Everything Becomes Open-Source' (Nicole Fishbein, Eran Segal): AI agents rebuilt Slack, Finder and TinyTurla-NG source from binaries; BinDiff paired 1,034 functions at 92.8% whole-program similarity (structure, not behavior). Slack rebuild was extended with a local-model autocomplete feature.
  • Research phase completed for TL-2026-5646 as a low-severity trend item with no CVE, IOC or exploitation evidence.
  • Direct fetch of the Dark Reading article returned HTTP 403 and the Intezer primary write-up was not located; findings rest on search-result excerpts.
  • Reported findings: Slack easiest (JavaScript source unpackable), Finder harder (cloud-managed files, other macOS services), and a Turla replicant built with full command handling and file transfer.
  • Dark Reading publishes 'AI Makes Reverse Engineering Mainstream Software & Malware Easy' covering Intezer's tests (date per search-result description).

Update history

Sources cited

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats