Threat video1:00
Lazarus Dormant-Neuron AI Backdoor: Detection & IOCs
Lazarus reprograms dormant AI neurons so an agent runs an attacker command on a trigger. Defenders get 9 detection rules, 7 IOCs and a free Splunk SPL rule.
Read the full threat intel for Lazarus Dormant-Neuron AI Backdoor: Detection & IOCs →
Chapters
- 0:00The hookResearchers reproduced a hidden AI agent backdoor.
- 0:04The storyMicrosoft researchers reprogrammed fewer than 10 dormant neurons.
- 0:12Attack pathLab reproduction: checkpoint write access is enough.
- 0:28AttributionNo threat actor: this was defensive research.
- 0:32Indicators of compromise1 indicator to hunt: 1 file name.
- 0:38MITRE ATT&CK techniques5 ATT&CK techniques, from initial access to impact.
- 0:43Remediation4 steps now: Inventory all models, fine-tunes, merges, quantizations and adapters used.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Researchers reproduced a hidden AI agent backdoor.
0:05Microsoft researchers reprogrammed fewer than 10 dormant neurons.
0:09It passes standard evaluations.
0:12Lab reproduction: checkpoint write access is enough.
0:16Dormant neurons fire only when triggered.
0:19It behaves normally.
0:20A date change into 2027 triggers it.
0:23It emits a command that runs attacker code.
0:28No threat actor: this was defensive research.
0:331 indicator to hunt: 1 file name.
0:385 ATT&CK techniques, from initial access to impact.
0:434 steps now: Inventory all models, fine-tunes, merges, quantizations and adapters used.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.