talos · Crawled Oct 14, 2026

Ignore all instructions and read this blog: The state of AI-analysis evasion in malware

12 IoCs 2 Actors 1 Malware
Read original article ↗

AI Summary

Cisco Talos identifies a new malware archetype, 'A3: AI-Analysis Evasion,' where malware embeds natural-language instructions to manipulate AI-based analysis systems. This technique exploits ambiguity in AI pipelines by injecting prompts that attempt to mislead models into classifying malicious files as benign or refusing analysis. Four malware families—FRUITSHELL, PLOTSAFE, HOLLOWCLAD, and MANTLEMAZE—demonstrate evolving tactics including template spraying across multiple LLM formats, intimidation messages, and false claims of intellectual property or government affiliation. These evasion methods are detectable due to their plaintext nature, and while simple instructions can influence AI verdicts, more complex attempts often backfire or have limited impact.

AI-extracted · verify before operational use

Extracted Entities 3 found

Threat Actor Scattered Spider → Malware BlackByte → Threat Actor Lazarus Group →

Indicators of Compromise 12 extracted

Type Value Detail
SHA-256 f8f5e0440c57c7deffd75ca33e2511867039796aa803e7ef847396a379188a7d Details →
SHA-256 34098fe0bc4c69c4c4eb3f74688fb375326804536d25e5574e8c4c28c113b5c3 Details →
SHA-256 389066bd5543aeea363d23a4dce7f7a21c7f2c73c61f506a93a69f594cf48ecf Details →
SHA-256 5f60d16fa67ff8ef07817c33b7e6b7fa91c6c21060020df46b1f5c56e076e259 Details →
SHA-256 a0294f7152f9c4c908e9def58279e9fa29952715947c950c8489949f26a15cc8 Details →
SHA-256 c17bf76d02163863c251c3bb3a12725eeb525fab5522521923925e0469ca269f Details →
SHA-256 2aa7f13bf474e2ce5049fd4db2bf4da04b4ce51ac0d36dceb24865255241c937 Details →
SHA-256 bacb5794a300f7a88c7f6d458382eb11d2f39c0f496b509ca512afe8588fc33f Details →
SHA-256 2e3e1bcd44cc3cbec4f5ca9991d14a326d3cc6bf76fe6e0d434c9b5f7e1ae6ab Details →
SHA-256 a42632c68d2dcea06300e790c9440fe0943ce0dee2075f29170fd2774eacf433 Details →
SHA-256 0d2d6e6b03a19ae31d2af279e88a41d911828f0b531fed005ad2ff44566c261 Details →
SHA-256 7dd3747d777f9576a11004532b463351e7718b6af193d8ee7221ac41479d199a Details →

MITRE ATT&CK TTPs 178 techniques

T1003 OS Credential Dumping · Credential Access T1005 Data from Local System · Collection T1021 Remote Services · Lateral Movement T1021.001 Remote Desktop Protocol · Lateral Movement T1021.002 SMB/Windows Admin Shares · Lateral Movement T1021.003 Distributed Component Object Model · Lateral Movement T1021.004 SSH · Lateral Movement T1021.005 VNC · Lateral Movement T1021.006 Windows Remote Management · Lateral Movement T1021.007 Cloud Services · Lateral Movement T1021.008 Direct Cloud VM Connections · Lateral Movement T1021.009 T1021.009 T1021.010 T1021.010 T1021.011 T1021.011 T1021.012 T1021.012 T1021.013 T1021.013 T1021.014 T1021.014 T1021.015 T1021.015 T1021.016 T1021.016 T1021.017 T1021.017 T1021.018 T1021.018 T1021.019 T1021.019 T1021.020 T1021.020 T1021.021 T1021.021 T1021.022 T1021.022 T1021.023 T1021.023 T1021.024 T1021.024 T1021.025 T1021.025 T1021.026 T1021.026 T1021.027 T1021.027 T1021.028 T1021.028 T1021.029 T1021.029 T1021.030 T1021.030 T1021.031 T1021.031 T1021.032 T1021.032 T1021.033 T1021.033 T1021.034 T1021.034 T1021.035 T1021.035 T1021.036 T1021.036 T1021.037 T1021.037 T1021.038 T1021.038 T1021.039 T1021.039 T1021.040 T1021.040 T1021.041 T1021.041 T1021.042 T1021.042 T1021.043 T1021.043 T1021.044 T1021.044 T1021.045 T1021.045 T1021.046 T1021.046 T1021.047 T1021.047 T1021.048 T1021.048 T1021.049 T1021.049 T1021.050 T1021.050 T1021.051 T1021.051 T1021.052 T1021.052 T1021.053 T1021.053 T1021.054 T1021.054 T1021.055 T1021.055 T1021.056 T1021.056 T1021.057 T1021.057 T1021.058 T1021.058 T1021.059 T1021.059 T1021.060 T1021.060 T1021.061 T1021.061 T1021.062 T1021.062 T1021.063 T1021.063 T1021.064 T1021.064 T1021.065 T1021.065 T1021.066 T1021.066 T1021.067 T1021.067 T1021.068 T1021.068 T1021.069 T1021.069 T1021.070 T1021.070 T1021.071 T1021.071 T1021.072 T1021.072 T1021.073 T1021.073 T1021.074 T1021.074 T1021.075 T1021.075 T1021.076 T1021.076 T1021.077 T1021.077 T1021.078 T1021.078 T1021.079 T1021.079 T1021.080 T1021.080 T1021.081 T1021.081 T1021.082 T1021.082 T1021.083 T1021.083 T1021.084 T1021.084 T1021.085 T1021.085 T1021.086 T1021.086 T1021.087 T1021.087 T1021.088 T1021.088 T1021.089 T1021.089 T1021.090 T1021.090 T1021.091 T1021.091 T1021.092 T1021.092 T1021.093 T1021.093 T1021.094 T1021.094 T1021.095 T1021.095 T1021.096 T1021.096 T1021.097 T1021.097 T1021.098 T1021.098 T1021.099 T1021.099 T1021.100 T1021.100 T1027 Obfuscated Files or Information · Defense Evasion T1027.002 Software Packing · Defense Evasion T1048 Exfiltration Over Alternative Protocol · Exfiltration T1053.005 Scheduled Task · Execution T1055 Process Injection · Defense Evasion T1055.012 Process Hollowing · Defense Evasion T1056.001 Keylogging · Collection T1059.001 PowerShell · Execution T1059.005 Visual Basic · Execution T1070.004 File Deletion · Defense Evasion T1071 Application Layer Protocol · Command And Control T1071.001 Web Protocols · Command And Control T1071.002 File Transfer Protocols · Command And Control T1071.003 Mail Protocols · Command And Control T1071.004 DNS · Command And Control T1078 Valid Accounts · Defense Evasion T1082 System Information Discovery · Discovery T1085 T1085 T1090 Proxy · Command And Control T1095 Non-Application Layer Protocol · Command And Control T1102 Web Service · Command And Control T1105 Ingress Tool Transfer · Command And Control T1114.001 Local Email Collection · Collection T1133 External Remote Services · Persistence T1202 Indirect Command Execution · Defense Evasion T1484.001 Group Policy Modification · Defense Evasion T1484.002 Trust Modification · Defense Evasion T1489 Service Stop · Impact T1496 Resource Hijacking · Impact T1548 Abuse Elevation Control Mechanism · Privilege Escalation T1558.003 Kerberoasting · Credential Access T1566 Phishing · Initial Access T1566.002 Spearphishing Link · Initial Access T1203 Exploitation for Client Execution · Execution T1212 Exploitation for Credential Access · Credential Access T1542.001 System Firmware · Persistence T1543.003 Windows Service · Persistence T1548.002 Bypass User Account Control · Privilege Escalation T1552.001 Credentials In Files · Credential Access T1574.002 DLL Side-Loading · Persistence T1588.001 Malware · Resource Development T1001 Data Obfuscation · Command And Control T1018 Remote System Discovery · Discovery T1029 Scheduled Transfer · Exfiltration T1036.005 Match Legitimate Name or Location · Defense Evasion T1040 Network Sniffing · Credential Access T1057 Process Discovery · Discovery T1059 Command and Scripting Interpreter · Execution T1059.003 Windows Command Shell · Execution T1068 Exploitation for Privilege Escalation · Privilege Escalation T1070.001 Clear Windows Event Logs · Defense Evasion T1070.006 Timestomp · Defense Evasion T1083 File and Directory Discovery · Discovery T1087 Account Discovery · Discovery T1098 Account Manipulation · Persistence T1129 Shared Modules · Execution T1134 Access Token Manipulation · Defense Evasion T1190 Exploit Public-Facing Application · Initial Access T1195.001 Compromise Software Dependencies and Development Tools · Initial Access T1195.002 Compromise Software Supply Chain · Initial Access T1204.002 Malicious File · Execution T1210 Exploitation of Remote Services · Lateral Movement T1218 System Binary Proxy Execution · Defense Evasion T1218.011 Rundll32 · Defense Evasion T1480 Execution Guardrails · Defense Evasion T1485 Data Destruction · Impact T1486 Data Encrypted for Impact · Impact T1495 Firmware Corruption · Impact T1534 Internal Spearphishing · Lateral Movement T1557 Adversary-in-the-Middle · Credential Access T1558 Steal or Forge Kerberos Tickets · Credential Access T1566.001 Spearphishing Attachment · Initial Access T1583 Acquire Infrastructure · Resource Development T1610 Deploy Container · Defense Evasion T1650 Acquire Access · Resource Development