di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Explore Deep Instinct DSX

Prevent Zero-Day Attacks

Real-Time Malicious Verdicts

Real-Time Explainability

Lower TCO

Ensure Privacy & Compliance

Deep Instinct DSX

Cloud

Applications

Endpoints

Use Cases

Asset Library

Blog

Videos

Events & Webinars

Resources

About Deep Instinct

Our Customers

Newsroom

Careers

Contact Us

Company

Free Scan

Customer Portal

Integrations and Compliance

Training

Quick Links

Discover how our revolutionary deep learning-powered solution prevents and explains unknown, never-before-seen threats.

explore deep instinct dsx

why dsx

Prevent zero-day attacks

Detect and prevent threats in <20ms, faster than the blink of an eye.

real-time malicious verdicts

Gain actionable, AI-driven intelligence on zero-day threats in seconds.

Real-Time Insights & Explainability

Reduce cybersecurity costs with efficient, high-performance threat prevention.

Enhance data protection while meeting stringent privacy and regulatory requirements.

DSX USE CASES

Scan and secure your S3 buckets and prevent threats to your data with this natively integrated and certified solution.

Amazon S3

Secure files and empower your hybrid-cloud with natively integrated preemptive data security.

Amazon FSx for NetApp

Protect your NetApp ONTAP storage with a purpose-built solution designed to prevent zero-day threats targeting NAS.

NetApp

Stop attackers from breaching your Dell EMC NAS with our purpose-built, natively integrated solution.

Dell EMC

Integrate scanning with your middleware layer to secure your applications with greater stability and customization.

Middleware

Ensure the files moving through your environment remain malware-free, without introducing bottlenecks or slowdowns.

Secure File Transfer

DEPLOYMENT TYPES

Secure your multi-cloud or hybrid infrastructure against zero-day threats.

CLOUD

Safeguard critical data on Network-Attached Storage systems from advanced cyber threats.

Defend SaaS and custom applications from zero-day vulnerabilities and threats.

APPLICATIONS

Protect devices and endpoints with AI-driven threat prevention.

ENDPOINTS

EXPLORE 

Threat Research

Voice Of SecOps

COMPARE

Deep Instinct complements Microsoft Defender with advanced threat prevention to stop threats before they enter your environment.

+ Microsoft Defender

Deep Instinct and Tanium deliver prevention-first endpoint security to reduce risk and boost productivity.

+ Tanium

EDR is not enough — enhance existing cybersecurity tools with advanced, real-time threat prevention using deep learning to produce defense in depth.

EXTEND/ENHANCE EDR

Replace outdated, legacy AV solutions with prevention-first, deep-learning-based protection purpose-built for cybersecurity.

REPLACE LEGACY AV

Faster and more accurate – Deep Instinct safeguards your data and protects your NAS storage better than Trellix.

REPLACE TRELLIX

Faster and more effective – Deep Instinct safeguards your data and protects your NAS storage better than Symantec.

REPLACE SYMANTEC

Leadership Team

Board of Directors

Partners

Login

content_block

Recent Blog Posts

Recent Blog Posts

posts_listing

Blog Listing Page

Join Ido Kringel and the Deep Instinct Threat Research Team in this deep dive into a recently discovered, Office-based regex evasion technique

Excel-obfuscation-blog-930x400_v7.jpg

Microsoft Office-based attacks have long been a favored tactic amongst cybercriminals— and for good reason. Attackers frequently use Office documents in cyberattacks because they are widely trusted. These files, such as Word or Excel docs, are commonly exchanged in business and personal settings. They are also capable of carrying hidden malicious code, embedded macros, and external links that execute code when opened, especially if users are tricked into enabling features like macros.Moreover, Office documents support advanced techniques like remote template injection, obfuscated macros, and legacy features like Excel 4.0 macros. These allow attackers to bypass antivirus detection and trigger multi-stage payloads such as ransomware or information-stealing malware.Since Office files are familiar to users and often appear legitimate (e.g., invoices, resumes, or reports), they’re also highly effective tools in phishing and social engineering attacks.This mixture of social credit and advanced attack characteristics unique to Office files, as well as compatibility across platforms and integration with scripting languages, makes them ideal for initiating sophisticated attacks with minimal user suspicion.<h5>New Excel Regex Functions</h5>Last year, Microsoft announced the availability of three new functions that use Regular Expressions (regex) to help parse text more easily:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img alt="Capture_(1).PNG" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2c061e4a8cec0f19/6823d262fbc53181e23ffb63/Capture_(1).PNG" /><figcaption style="text-align: center;" style="text-align: center;">Figure 1: New Regex functions</figcaption></div></figure>Regex are sequences of characters that define search patterns, primarily used for string matching and manipulation. They enable efficient text processing by allowing complex searches, replacements, and validations based on specific criteria.For example, regex can identify email addresses, phone numbers, or specific word patterns within a text. They are widely used in programming languages like Python, JavaScript, and Perl, and are essential for tasks such as data validation, parsing, and text editing.The example below demonstrates a practical application, using REGEXTRACT to isolate only names from a mixed-text column:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="bltb913beab1a7814c0" alt="regex.PNG" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb913beab1a7814c0/6823d262c555f8bc4930b108/regex.PNG" /><figcaption style="text-align: center;" style="text-align: center;">Figure 2: Legitimate use of REGEXTRACT function</figcaption></div></figure><h5>Proof of Concept: Weaponizing Regex Functions</h5>To demonstrate the security implications of these new Excel functions, we developed a proof of concept that leverages regex functions as an obfuscation technique. Our experiment began by establishing a baseline attack scenario using traditional methods.First, we created a standard macro-enabled Excel document (XLSM) containing unobfuscated VBA code. This macro uses the "WScript.Shell" object to execute PowerShell commands, which in turn downloads and runs a batch file hosted on Pastebin.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img alt="Screenshot_2025-05-13_at_7.17.33_PM.png" width="804" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf2eaa864672713f5/6823d339487a341da588dca8/Screenshot_2025-05-13_at_7.17.33_PM.png" height="auto" /><figcaption style="text-align: center;" style="text-align: center;">Figure 3: Tested attack flow</figcaption></div></figure>The macro below demonstrates the core functionality— a simple downloader that can retrieve and execute arbitrary payloads:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="bltefbe5ae9d359e43b" alt="sample1_vba.PNG" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltefbe5ae9d359e43b/6823d3b86935510c432190c2/sample1_vba.PNG" /><figcaption style="text-align: center;" style="text-align: center;">Figure 4: Simple plain-text VBA Downloader</figcaption></div></figure>When submitted to VirusTotal, this plain-text sample triggered significant alerts, with 22 different security vendors flagging it as malicious:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt6b34d8b735268f5f" alt="sample1_vt.PNG" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6b34d8b735268f5f/6823d3b8fd12f6b5db5e872a/sample1_vt.PNG" /><figcaption style="text-align: center;" style="text-align: center;">Figure 5: VirusTotal result for the plain-text sample</figcaption></div></figure>Threat actors typically employ various obfuscation techniques to mask malicious code and evade widespread detection. To demonstrate this technique, we applied the Macro-pack obfuscation tool to our test document, resulting in VBA code that becomes deliberately challenging for both human analysts and automated security tools to interpret.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blte6cc8c601aa0f83f" alt="Selection_100.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte6cc8c601aa0f83f/6823d3b87a3a7cbf0cab06b2/Selection_100.png" /><figcaption style="text-align: center;" style="text-align: center;">Figure 6: Macro-pack VBA snippet</figcaption></div></figure>When analyzed with VirusTotal, this traditionally obfuscated sample triggered more detections than the plain-text version. This increased detection rate is expected, as security vendors have developed specific heuristics to identify common obfuscation patterns:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt2d96f041fc02254b" alt="sample1_macro_pack_vt.PNG" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2d96f041fc02254b/6823d2625d1fd0dd155fe6ff/sample1_macro_pack_vt.PNG" /><figcaption style="text-align: center;" style="text-align: center;">Figure 7: VirusTotal result for Macro-pack-obfuscated sample</figcaption></div></figure>Next, we created another document, but this time we used the Excel REGEXEXTRACT function to obfuscate the VBA code.Unlike traditional VBA obfuscation methods, this approach stores and dynamically reconstructs malicious code components using regular expression pattern matching, creating a significantly more evasive payload.Our first step was to add a large text to cell “A1” and hide our PowerShell command and any other strings in the text as follows:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt84a4c4e81be31023" alt="obfuscated_string.PNG" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt84a4c4e81be31023/6823d262241c8f82fd2cef69/obfuscated_string.PNG" /><figcaption style="text-align: center;" style="text-align: center;">Figure 8: Simple obfuscation of "WScript.Shell"</figcaption></div></figure>Then, we created a function that uses REGEXEXTRACT to retrieve these hidden strings from the text. Combined with the REPLACE function, this allows dynamic reconstruction of the payload at runtime:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt5b94796bcfd1172b" alt="sample1_re_vba.PNG" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5b94796bcfd1172b/6823d26369355141352190b8/sample1_re_vba.PNG" /><figcaption style="text-align: center;" style="text-align: center;">Figure 9: Macro1 calls getval function to return the hidden value from cell A1</figcaption></div></figure>The implementation extracts each component using tailored regex patterns and assigns them to intentionally obscured variable names (getval0-2), making static analysis challenging. When executed, the macro seamlessly reconstructs and runs the PowerShell command that downloads and executes our remote batch file.The evasion effectiveness was remarkable— VirusTotal detection dropped from 22 vendors with the plaintext sample to just two with our regex-obfuscated version:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt8b0895cd7ae55da3" alt="sample1_re_vt.PNG" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8b0895cd7ae55da3/6823d263fbc531c3723ffb67/sample1_re_vt.PNG" /><figcaption style="text-align: center;" style="text-align: center;">Figure 10: VirusTotal detections for our specially crafted XLSM</figcaption></div></figure>We’ve also analyzed both samples using OLEVBA, a specialized tool for VBA macro analysis that’s widely used in security operations. While OLEVBA easily identified high-risk indicators in our original sample (including PowerShell usage, Shell object creation, and suspicious string operations), it failed to detect any of these indicators in our regex-obfuscated version. The tool couldn’t identify critical indicators like PowerShell execution or WScript.Shell object instantiation because these strings never appear directly in the code— they’re dynamically constructed at runtime from regex pattern matches.This demonstrates why this technique is particularly concerning: it defeats not just signature-based detection, but also many heuristic analysis methods that security tools rely on.<img asset_uid="bltef044cb9dafd1258" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltef044cb9dafd1258/6823d3b86935511e342190c6/Selection_097.png" alt="Selection_097.png" height="auto"/><figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt3ac9a5d7ae19e87b" alt="Selection_098.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3ac9a5d7ae19e87b/6823d3b8005177cff7b7a834/Selection_098.png" /><figcaption style="text-align: center;" style="text-align: center;">Figure(s) 11, 12: OLEVBA output for the original sample (above) vs. our crafted sample (below)</figcaption></div></figure><h5>Current Limitations &amp; Deployment Status</h5>While this technique demonstrates significant potential for security evasion, several factors currently limit its immediate threat:<ul><li>Microsoft has disabled VBA macro execution by default since 2022, requiring explicit user action to enable macros in downloaded documents</li><li>The new regex functions have limited deployment, currently available only to Beta Channel users on:<ul><li>Windows: Version 2406 (Build 17715.20000) or later</li><li>Mac: Version 16.86 (Build 24051422) or later</li></ul></li></ul>As these functions roll out to the general release channels, the potential attack surface will expand significantly.<h5>Prevention</h5>At the time of writing, we have not observed this technique being used in the wild. And while most <a href="https://www.deepinstinct.com/deep-instinct-vs-competitors">legacy antivirus tools</a> fail to detect regex-obfuscated malicious files, Deep Instinct’s deep-learning agent detects and prevents all three files presented in this article. Additionally, Deep Instinct’s Artificial Neural Network Assistant (<a href="https://www.deepinstinct.com/dsx/companion">DIANNA</a>) can easily detect the use of regex obfuscation in documents.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt3980e76537047471" alt="image_(1).png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3980e76537047471/6823d2631f64d151aeeb44ec/image_(1).png" /><figcaption style="text-align: center;" style="text-align: center;">Figure 13: DIANNA analysis</figcaption></div></figure>Organizations, with or without Deep Instinct, should also implement the following protective measures:<ul><li>Maintain strict macro security policies, especially “Block macros from running in Office files from the Internet”</li><li>Deploy advanced endpoint protection with behavioral analysis capabilities</li><li>Consider application control solutions that restrict Excel’s ability to invoke system commands</li><li>Implement network monitoring to detect unusual outbound connections from Office applications</li></ul><h5>Future Use</h5>The regex-based obfuscation technique demonstrated here represents just the beginning of potential exploitation. While our proof of concept used relatively simple VBA code, this approach could easily be combined with more sophisticated attack techniques:<ul><li>Multi-stage execution chains that further obscure malicious intent</li><li>Advanced persistence mechanisms to maintain access after initial compromise</li><li>Privilege escalation techniques hidden behind regex-extracted components</li><li>Data exfiltration methods that leverage the same obfuscation principles</li></ul>Additionally, Microsoft’s introduction of Python functionality in Excel creates another potential avenue for attack. While this feature runs calculations in Microsoft’s cloud environment and has inherent latency limitations, it introduces yet another powerful scripting language into the Office ecosystem that determined threat actors could weaponize.Want to prevent threats in your environment? <a href="https://www.deepinstinct.com/free-scan">Request your free scan</a>.<h5>Indicators of Compromise</h5>sample1_re_new.xlsm - dedbe856891dd633ce3dd66ecc120ef4f1ae0a61a37dbb4cc6a59f7eae7019d9 sample1.xlsm - 2c99e702609d549440952ef72f2386a74e0da1462df65ab4206f44c94e8dbc72 sample1_mp.xlsm&nbsp; - 5af1bd3d95e6307d95e9973aa4a084ae210f9038cbea2235d14b02d97abd4f2b<h5>References</h5><a href="https://github.com/sevagas/macro_pack">https://github.com/sevagas/macro_pack</a> <a href="https://techcommunity.microsoft.com/blog/microsoft365insiderblog/new-regular-expression-regex-functions-in-excel/4226334">https://techcommunity.microsoft.com/blog/microsoft365insiderblog/new-regular-expression-regex-functions-in-excel/4226334</a>

Excel(ent) Obfuscation: Regex Gone Rogue

Yariv Fishman, Deep Instinct's Chief Product Officer, defines preemptive data security and explains why it's so important in preparing to combat the looming AI-powered threat landscape.

DSX-Brain-Bubble-930x400-3.jpg

Cybercrime and cybersecurity are in a constant arms race. Over the years, attackers and defenders have&nbsp; escalated their battle with new methods and technologies, each vying for an advantage. We are now at the precipice of cybercrime’s most dangerous evolution, which has the potential to deliver a knockout blow—Artificial intelligence (AI) models designed without safeguards, or so-called <a href="https://www.deepinstinct.com/cyber-threat-reports">Dark AI, are supercharging attackers’ capabilities</a>. These Dark AI models are on the cusp of running sophisticated attacks that can easily bypass existing security tools, an eventuality for which most of the cybersecurity community isn’t prepared.In recognition of this growing threat, <a href="https://www.gartner.com/en/documents/5818147">Gartner released research</a> detailing a new category of cybersecurity, defined by its ability to prevent threats before they execute, adapt to new threats, and scale to the size and speed required by governments and enterprises. Gartner calls this new category <a href="https://www.gartner.com/en/documents/6318147">Preemptive Cybersecurity</a> and predicts that it will be an operational requirement by the early 2030s, releasing broad definitions of what preemptive solutions entail.This blog goes further and defines the key tenets and requirements of Preemptive Data Security, a specific implementation of Preemptive Cybersecurity. A true preemptive data security solution must have all of these qualities:<h2>Effective Unknown Threat Identification</h2>Definition: The ability to determine the malicious nature of a file by its intrinsic behaviors and characteristics, not by pattern matching against a database of known threats.&nbsp;Preemptive data security relies on several unique functions operating together to be effective. Most importantly, a preemptive solution requires the ability to identify unknown and zero-day threats.Unknown threat identification matters because Dark AI tools are complicating how attacks unfold. In a paradigm shift that will rock much of the cybersecurity industry, <a href="https://www.deepinstinct.com/blog/beyond-flesh-and-code-building-an-llm-based-attack-lifecycle-with-a-self-guided-agent">malware is now being written in minutes and permuted</a> in just seconds alongside more effective obfuscation strategies. Non-adaptive defenses that rely on signatures, CVEs, and threat feeds to remain effective will be fighting blind as their efficacy craters.To combat this shift, preemptive solutions need to be able to autonomously and intelligently identify never-before-seen threats. New attacks are unfolding with alarming speed, overwhelming <a href="https://www.deepinstinct.com/deep-instinct-vs-competitors">legacy cybersecurity tools</a> that lack the ability to defend against novel threats. Defenses need to be smarter.<h2>Real-Time Zero-Day Prevention</h2>Definition: The ability to recognize never-before-seen or encountered files as malicious and automatically quarantine or delete them pre-execution, without disrupting the flow of data through an organization.Alongside unknown and zero-day threat identification is the ability to prevent threats before they execute. That means that the identification process must be completed before a file is written to disk or uploaded to the cloud—and the solution must be capable of quarantining or deleting files instantaneously. Merely seeing a threat coming isn’t enough to prevent it. The preemptive solutions of the future will have the autonomy to make real-time decisions and protect organizations seamlessly.Because <a href="https://www.deepinstinct.com/blog/the-rise-of-ai-driven-cyber-attacks-how-llms-are-reshaping-the-threat-landscape">Dark AI is making attacks easier to launch and reinforce</a>, the volume will continue to grow. Effective defenses require a solution that can match the increased volume, identifying malicious files and automatically preventing them from breaching their targets.<h2>Real-Time Insights and Explainability</h2>Definition: The ability to scan malicious files and provide, in moments, a detailed readout of the characteristics of the planned attack, including capabilities, obfuscation methods, and any other available information.Detection and response only solves part of the problem. SOC teams must understand more than just the how, but the why. They are already overwhelmed by the scale of daily alerts, <a href="https://www.deepinstinct.com/pdf/infographic-voice-of-secops-5th-edition-ai-in-cybersecurity-friend-or-foe">with 56% of SecOps teams reporting an increase in stress YoY</a>. Increased attacks generated by Dark AI are only worsening the problem. SOC teams are still responsible for investigating incoming attacks and determining as much as possible about them. Merely preventing attacks doesn’t help them understand the big picture, which can leave them vulnerable to future attacks. Empowering human security teams requires real-time insights and explainability into why an attack was prevented and which vulnerabilities it sought to exploit.<h2>Enterprise Speed &amp; Scalability</h2>Definition: The ability to seamlessly adapt to growing asset and data estates, including additional endpoints, configurations, and storage methods, without incurring speed-based bottlenecks or introducing unsustainable infrastructure growth.The amount of data produced and stored by organizations is exploding. Nearly every device is now connected in some way or another. Assets that form vast IoT networks are becoming more commonplace, while portals that exist outside of organizational perimeters make it easier than ever for customers and clients to upload data and communicate. With these advances comes additional vulnerabilities; weaknesses that criminals target using new methods that <a href="https://www.deepinstinct.com/endpoint-detection-response">bypass traditional endpoint protection</a>.Preemptive data security solutions must be able to adapt to expanding data ingestion, communication, and storage capabilities to ensure that organizations can operate and grow without introducing new vulnerabilities. This necessitates the use of streamlined models that can quickly scan every incoming file and be easily implemented into a growing infrastructure. Ease and flexibility of implementation are essential, and must be further enabled by future-proofed AI models that help to avoid the accumulation of technical debt or entrenchment.<h2>Defense Across the Entire Data Estate</h2>Definition: The ability to prevent threats wherever they are encountered in a data estate, whether at the endpoint, in applications, or in NAS or cloud storage repositories.Preemptive solutions need to work across an organization’s entire data estate to provide comprehensive, unified protection. Many of the same reasons that make scalability and speed a requirement also apply to the need for whole-estate data protection. Additional connection points, growing storage, larger device fleets, and portals all need to be visible and protected from incoming malicious files.Flexible, unified solutions as part of a defense-in-depth strategy allow for more comprehensive, layered data protection. Integrating into different aspects of the data estate and adapting to incoming threats is an important capability for preemptive solutions because the scope of cyberattacks has expanded dramatically. Single-point solutions like EDRs may be suitable for protecting their small domain, but the reality is that the attack surface has expanded well beyond their scope.<h2>Purpose-Built Deep Learning Framework</h2>Definition: Deep learning is the most advanced form of artificial intelligence. A purpose-built deep learning framework is trained on millions to billions of data points to teach it to recognize threats faster and more accurately than any other solution on the market today.Bringing together all the tenets above requires a deep learning (DL) framework. Machine learning (ML) frameworks are too brittle and myopic to provide any of the required capabilities, especially as they grow in complexity. They fall especially short of preventing unknown threats.The power of DL stems from its ability to continuously learn and adapt, making autonomous connections as it encounters more data. In turn, it grows in efficacy against unknown and zero-day threats over time and can be integrated across data estates. Additionally, the speed with which DL models can ‘think’ and make decisions far surpasses the speed of ML and analog models, which, in the case of cybersecurity, allows it to scan files at much greater speed and volume with a much smaller footprint.And, because DL models don’t rely on comparative analysis to determine if a file is malicious, they can explain why files are quarantined or prevented. Utilized alongside a generative AI model that can translate results into plain language, true explainability can be achieved, augmenting human teams and speeding the investigation and remediation process while reducing burnout.<h2>Next Steps</h2>DL models don’t grow on trees. In fact, there are only around a dozen publicly known DL frameworks in the world—and 11 have nothing to do with cybersecurity. Deep Instinct’s <a href="https://www.deepinstinct.com/dsx/brain">DSX Brain</a> is the only purpose-built deep learning framework for cybersecurity and the only solution positioned to meet the present and future needs of organizations looking to implement preemptive data security in their environments.Cybercrime isn’t waiting for defenders to catch up. When AI saturation happens (sooner rather than later), traditional defenses are going to collapse. The legacy players in the cybersecurity space have not built the technological foundation necessary to transition to preemptive security. Training models that can prevent threats require a huge investment in AI researchers, hardware, data, and time. Unfortunately, time is the rarest commodity on that list.Deep Instinct is built to fight the future. We provide better security with better AI. We fight Dark AI with better AI. And we are capable of providing the capabilities that comprise a true preemptive data security solution today.Try Deep Instinct now; <a href="https://www.deepinstinct.com/free-scan">request your free scan</a>. Put us to the test.

The Future Has Arrived: Defining Preemptive Data Security

Learn more about the LockBit ransomware group and explore the latest evolution of LockBit ransomware with its 4.0 version release.

Lockbit3_Blog_Image_1_930x400.png

RaaS Evolved: LockBit 3.0 vs LockBit 4.0

Join David Trigano and Alex Kozodoy as they explain the present and future of AI-powered cyberthreats and learn what is necessary to fight back against increasingly powerful AI tools.

android-hacker4-930x400.png

The cyberattack lifecycle has been supercharged by generative AI. It is faster, more effective, and more dangerous than ever before. Large Language Models (LLMs) are being<a href="https://www.deepinstinct.com/blog/beyond-flesh-and-code-building-an-llm-based-attack-lifecycle-with-a-self-guided-agent"> </a><a href="https://www.deepinstinct.com/blog/beyond-flesh-and-code-building-an-llm-based-attack-lifecycle-with-a-self-guided-agent">leveraged for malicious purposes</a>, aiding in recon, crafting highly convincing phishing campaigns, generating proof-of-concept (PoC) exploits, and even assisting in malware development. As these capabilities continue to grow in sophistication, AI will reshape the threat landscape, posing significant challenges for cybersecurity professionals.The following blog explores several ways AI is already being used to shape cybercrime and cybersecurity. It delves into the methods empowered by LLM capabilities with key use cases. The future of AI-based and powered attacks isn’t a far-flung possibility, it’s here now—and it’s incredibly dangerous.<h5>AI-Driven Reconnaissance</h5>Building an understanding of an organization and identifying key targets within it has been significantly accelerated through the use of AI. Advanced Persistent Threat (APT) groups from China, Iran, North Korea, and Russia have reportedly used AI to automate this process, allowing them to achieve the following:<ul><li>Identify and prioritize high-value targets via analysis of organizational hierarchies, business disclosures, and employee social media&nbsp;</li></ul><ul><li>Conduct large-scale scanning of networks and systems for potential traffic changes and vulnerabilities</li></ul><ul><li>Optimize attack strategies based on collected intelligence, such as C-Suite travel and communication patterns, allowing for targeted attacks at opportune times, sometimes aided by advanced phishing and vishing techniques</li></ul>Google’s Threat Intelligence Group<a href="https://cloud.google.com/blog/topics/threat-intelligence/adversarial-misuse-generative-ai"> </a><a href="https://cloud.google.com/blog/topics/threat-intelligence/adversarial-misuse-generative-ai">reported that APT42, an Iran-backed group, were the heaviest users of Gemini</a>, using it to perform recon on defense experts and organizations and craft advanced phishing campaigns. They combined their usage with other open-source tools and tactics to breach key targets in both the public and private sectors, demonstrating the effectiveness of early-stage LLM usage.<h5>AI-Powered Phishing and Social Engineering Attacks</h5>In conjunction with advanced recon techniques, attackers are using AI to enhance phishing and social engineering tactics. In recent months, APTs—particularly those from North Korea, China, and Iran—have been observed deploying AI-generated phishing campaigns with increased sophistication. Notable AI-enhanced social engineering tactics include the following:<ul><li>Automated Spear-Phishing: Using data gathered by AI during the recon phase, attackers leveraged AI to generate massive amounts of highly personalized phishing emails that are both contextually relevant and persuasive, increasing the likelihood of successful intrusions. This method has been used extensively by Iran against both American and Israeli targets.</li></ul><ul><li>Deepfake Scams: Attackers employ AI-generated deepfake audio and video to impersonate trusted individuals. These deepfakes deceive targets into taking malicious actions, such as transferring funds or divulging sensitive information. In the <a href="https://www.cnn.com/2024/05/16/tech/arup-deepfake-scam-loss-hong-kong-intl-hnk/index.html" target="_self">Arup Group attack</a>, for example,&nbsp; AI-generated voice and images were used to fraudulently extract $25 million dollars from the multinational design and engineering company.</li></ul>With AI continuously improving the realism of phishing lures and impersonations (and utilizing more powerful research methods), <a href="https://www.deepinstinct.com/deep-instinct-vs-competitors" target="_self">legacy cybersecurity detection tools</a> are struggling to keep up. The fidelity of the fakes and the information used to produce them has even fooled trained professionals.<h5>AI Vulnerability Discovery and Exploitation</h5>Beyond reconnaissance and phishing, AI tools are also being deployed to discover technical vulnerabilities and quickly exploit them. Attackers are using AI to achieve the following:<ul><li>Identify and exploit security weaknesses in software and networks, including reverse-engineering patches</li></ul><ul><li>Discover potential zero-day exploits, proven conceptually by Google’s ‘Big Sleep’ agent</li></ul><ul><li>Generate code that can exploit weaknesses and vulnerabilities faster than defenders can respond</li></ul>Google’s proof that AI agents could discover potential zero-day vulnerabilities is a chilling sign of what’s to come. The acceleration of zero-day attacks powered by AI discovery and exploitation tools will likely put defenders on the back foot, especially if they are not given tech solutions that can preemptively prevent attacks or respond at speed to breaches.<h5>AI-Assisted Malware Development</h5>Although AI-generated malware is not highly advanced yet, attackers have found ways to jailbreak mainstream LLMs (such as OpenAI’s models or Gemini) to aid in malware development. Simultaneously, a stable of malicious LLMs specifically tailored for criminal activities, including WormGPT, WolfGPT, EscapeGPT, FraudGPT, and GhostGPT, are also being developed, removing the safeguards put in place in the mainstream models. Threat actors currently use AI chatbots to:<ul><li>Generate and troubleshoot malicious code; GhostGPT is particularly adept and costs only $50. It is marketed to hackers and lacks any of the ethical blocks that mainstream models have, enabling quick vulnerability discovery and exploitation.</li></ul><ul><li>Localizing malware to bypass regional security measures. A Russian APT group used Gemini to morph existing malicious code to skirt known security measures, rather than developing entirely new malware.</li></ul>The speed with which AI has advanced means that AI-generated malware will become extremely complex very quickly. With the increasing availability of advanced “open” AI chatbots like DeepSeek, attackers are able to refine their malware toolsets, making them more adaptive and evasive.<h5>The Next Phase: AI-Generated Polymorphic Malware</h5>One of the most alarming possibilities is the potential for AI to generate polymorphic malware. This type of malware continuously mutates its code, making traditional signature-based detection methods ineffective. As AI enhances malware’s ability to autonomously modify its structure and evade security defenses, security teams must adopt more advanced behavioral analysis techniques to counter this growing threat.<h6>The Looming Future: AI-Powered Autonomous Malware</h6>Soon, attackers will move beyond ‘simple’ AI-generated malware and begin developing AI-powered autonomous malware, enabling smarter, far more devastating attacks. Unlike traditional malware, AI-powered malware will be smarter, performing functions autonomously to bypass security. If it reaches the level that experts fear, it will be able to:<ul><li>Adapt its behavior in real time to evade detection and bypass legacy protection mechanisms across the data estate</li></ul><ul><li>Alter its attack techniques based on an environment’s defenses, making incident response significantly more challenging</li></ul><ul><li>Leverage reinforcement learning to optimize attack strategies, continuously improving effectiveness against evolving security measures</li></ul>This step beyond polymorphic malware could lead to an unprecedented surge in sophisticated cyberattacks, specifically designed to overwhelm existing defense systems and react to attempts to stop it.<h5>The Impact on Attribution and Threat Intelligence</h5>As AI-generated attacks grow in complexity, attribution will become increasingly difficult. AI can mimic the attack patterns, tools, and techniques of other threat actors, effectively masking the true origin of an attack. This obfuscation has already been used by Russian and Iranian APT groups to achieve the following:<ul><li>Complicate forensic investigations and <a href="https://researchonline.nd.edu.au/cgi/viewcontent.cgi?article=1089&context=law_article#:~:text=In%20particular%2C%20identifying%20who%20is,and%20potentially%20who%20is%20responsible.">confuse national defense planning and response</a></li></ul><ul><li>Hinder intelligence-sharing efforts, especially amongst groups relying on multi-member input, such as Five Eyes</li></ul><ul><li>Reduce the effectiveness of traditional attribution methodologies</li></ul>Each of these complicates the already<a href="https://www.deepinstinct.com/voice-of-secops-reports"> </a><a href="https://www.deepinstinct.com/voice-of-secops-reports">stressful role of security teams and researchers</a>, ratcheting up the pressure on defenders while slowing down national response to legitimate threats.The nature of stolen data reveals insightful details about the plans of an adversary; the industries they’re targeting, patterns of attack, and what they are focused on disrupting. However, if the adversary can’t be reliably identified, defenders are left trying to strategize for multiple scenarios, complicating response and planning efforts.<h5>Preparing for the AI-Driven Threat Landscape</h5>To stay ahead of these emerging threats, organizations must adopt what Gartner has recently dubbed preemptive cybersecurity solutions–technologies designed to prevent cyberattacks before they achieve their objectives. Key steps to reaching a preemptive cybersecurity posture include:<ul><li>Investing in AI-driven cybersecurity solutions that can detect and mitigate AI-generated threats. Attackers are using AI that is too advanced to be stopped by legacy tools or human response alone. Keeping organizations operational and breach free requires defensive solutions that can outpace offensive AI.</li></ul><ul><li>Implementing a deep learning-based security approach: Deep learning provides the most advanced defense against AI-driven threats by enabling real-time anomaly detection and automated threat analysis using the most advanced version of AI. Unlike traditional security models, deep learning solutions can:<ul><li>Identify and classify sophisticated attack patterns</li><li>Adapt to emerging cyber threats without reliance on static rules</li><li>Analyze large-scale datasets to detect zero-day exploits and AI-powered malware</li></ul></li></ul>Purpose-built<a href="https://www.deepinstinct.com/blog/-detect-and-respond-is-not-the-answer-the-need-for-proactive-zero-day-data-security"> </a><a href="https://www.deepinstinct.com/blog/-detect-and-respond-is-not-the-answer-the-need-for-proactive-zero-day-data-security">zero-day data security</a> measures are the necessary foundation of preemptive cybersecurity, empowering defenders to prevent attacks with solutions built from the ground up to combat the growing threat of AI attacks. By focusing on proactive defense mechanisms that neutralize threats before they can exploit vulnerabilities, security teams gain the upper hand and push back against ever-more aggressive attackers.<h5>A Final Prediction:</h5>By 2026, AI-powered malware and automated vulnerability discovery will become standard tools in cybercriminal arsenals. AI will enable attackers to conduct real-time, autonomous exploit development and deployment, significantly reducing the time between vulnerability discovery and exploitation. They will be able to perform these attacks at scale and speed using virtual ‘ai-factories’ equipped with agentic AI and other technologies, increasing the need for a zero-day response that can keep up.As AI-driven threats evolve, organizations that rely on traditional security methods will find themselves unable to cope with the speed and scale of modern cyberattacks. The adoption of AI-driven threat detection, deep learning-based behavioral analysis, and zero-day data security solutions is critical to mitigating these emerging threats. Organizations that fail to invest in these technologies will face an increasingly hostile and overwhelming cyber landscape.<h5>Conclusion</h5>The future of cybersecurity will be defined by the ongoing battle between AI-powered attacks and AI-driven defenses, making it imperative for organizations to continually refine their strategies to stay ahead of the curve.Traditional security measures are no longer sufficient in an AI-driven threat environment. Organizations must adopt a preemptive cybersecurity approach and leverage real-time deep learning-driven techniques to prevent and explain threats before they can cause harm. Security professionals need solutions that ensure even novel, previously unknown attack vectors can be identified and mitigated before exploitation occurs. This proactive defense strategy is essential to countering AI-generated threats and maintaining cybersecurity resilience. Experience preemptive cybersecurity in your own environment. <a href="https://info.deepinstinct.com/request-a-demo?_ga=2.104260868.58286214.1741716281-2103417061.1736868269" target="_self">Request your free scan now</a>.

The Rise of AI-Driven Cyber Attacks: How LLMs Are Reshaping the Threat Landscape

Join Deep Instinct experts David Trigano and Alex Kozodoy as they explain why DSPM doesn't provide adequate protection in the current cybersecurity landscape and how a zero-day data security approach is the answer. 

DSPM-930x400_1.png

In the past decade, the volume, variety, and velocity of data in enterprise estates has increased exponentially. Along with it, there has been an explosion in the accessibility of that data. In response, <a href="https://www.gartner.com/reviews/market/data-security-posture-management">Data Security Posture Management (DSPM)</a> emerged, offering visibility and governance for data security and compliance. Championed by analysts like Gartner, DSPM sought to address gaps in traditional security frameworks, helping enterprises identify and manage vulnerabilities.While DSPM tools have proven valuable in addressing foundational security challenges, they are no longer sufficient in today’s complex threat landscape. Attackers are leveraging advanced techniques, including weaponized DarkAI (AI tools adopted for malicious purposes, like automated vulnerability discovery), to ratchet up the efficacy and volume of their attacks. To secure their data, enterprises need more than visibility and monitoring—they require a defense-in-depth strategy built around proactive prevention and remediation capabilities. <h5>The Past and Present of DSPM</h5>Gartner introduced DSPM in 2022 as a critical component of modern security strategies, emphasizing the need for comprehensive visibility into data flows, security posture, and compliance. The promise was clear: it would empower organizations to discover, classify, and secure sensitive data across hybrid and multi-cloud environments, ensuring compliance with regulations like GDPR, HIPAA, and CCPA.However, the DSPM market’s promise was disrupted by constant acquisitions of several promising startups in the space by larger platform-based cybersecurity providers:<ul><li>Dig Security was acquired by Palo Alto Networks, integrating its data visibility features into Palo Alto’s Cloud-Native Application Protection Platform (CNAPP) offering.</li><li>Flow Security joined CrowdStrike’s broader data security portfolio.</li><li>Laminar joined Rubrik, a storage recovery &amp; backup provider.</li></ul>These acquisitions reflect a consolidation trend that narrows DSPM’s scope. Instead of evolving into comprehensive solutions, many became feature sets within larger platforms, losing their standalone value. As with many startup acquisitions, the initial aim and trajectory of the technology were curtailed to fit the broader needs of the acquiring organization.Instead of maturing in the hands of the most competent and passionate players, it was redirected. Alongside the development of AI technologies, AI-integrated DSPM could have served an important gatekeeper role in comprehensive cybersecurity strategies. As it stands, DSPMs are falling into the same failing paradigm as other legacy tools.<h5>Why DSPM is No Longer Sufficient</h5>Despite its benefits, DSPM has inherent limitations that make it inadequate as a standalone solution:1. Reactive, not proactive: Most DSPMs operate as monitoring solutions, offering insights and alerts but not preventing threats. They may detect anomalies or non-compliance but leave remediation to slow and error-prone manual processes.2. Focused on exfiltration: DSPMs largely focus on preventing sensitive data from leaving the organization. However, attackers and malicious insiders have limitless ways to manipulate or exfiltrate data, from encrypted channels to API abuse. Once they have access, accounting for attackers’ varied tactics and capabilities is nearly impossible. Human creativity and intelligence, combined with powerful AI tools, have created a hydra. For every vulnerability closed, two more open. Preventing threats is the key to preventing exfiltration.3. Remediation gaps: While DSPMs identify risks, they often fail to offer smart (context-aware) and automated remediations. Even fewer take responsibility for executing these remediations, leaving enterprises vulnerable to delayed responses. This responsibility falls to overburdened security teams who now have to figure out how to close those gaps.<h5>Zero-Day Data Security: A New Standard</h5>The emergence of DarkAI has made the threat landscape more unpredictable. <a href="https://www.deepinstinct.com/blog/beyond-flesh-and-code-building-an-llm-based-attack-lifecycle-with-a-self-guided-agent">Attackers can now generate sophisticated, never-before-seen malware</a> that exploit vulnerabilities in ways traditional DSPMs cannot anticipate. As a result, organizations relying solely on DSPM are exposed to unknown risks with inadequate security tools.Enter<a href="https://www.deepinstinct.com/blog/-detect-and-respond-is-not-the-answer-the-need-for-proactive-zero-day-data-security"> </a><a href="https://www.deepinstinct.com/blog/-detect-and-respond-is-not-the-answer-the-need-for-proactive-zero-day-data-security">Zero-Day Data Security (ZDDS)</a>, a new paradigm. Unlike DSPM, which focuses on visibility and preventing data exfiltration, ZDDS prioritizes proactive prevention and remediation. It secures data wherever it’s found against known and unknown threats. Deep Instinct leads the way in ZDDS with Data Security X (DSX).DSX prevents threats before they compromise data using the world’s only deep learning (DL) framework (a specialized AI architecture that learns patterns from massive datasets) trained for cybersecurity. The <a href="https://www.deepinstinct.com/dsx-brain">DSX Brain</a> is trained on billions of data points to recognize and prevent threats before they execute. Rather than just alerting on known threats and vulnerabilities, as DSPM does, DSX prevents the most sophisticated and dangerous unknown threats. Here’s how:<ul><li>Proactive prevention: Effective ZDDS leverages DL and AI-driven threat detection to block attacks before they occur, safeguarding sensitive data.</li><li>End-to-end coverage: ZDDS is flexible and adaptive enough to provide seamless protection across diverse data estates, whether it’s on-premises, hybrid, or in the public cloud.</li><li>Automated remediation: ZDDS doesn’t just identify risks, it neutralizes them. Solutions like <a href="https://www.deepinstinct.com/dsx/dsx-cloud-storage">DSX for Cloud</a> and <a href="https://www.deepinstinct.com/dsx/dsx-network-attached-storage">DSX for NAS</a> have prevention embedded into the workflow, ensuring proactive response without manual intervention.</li></ul>ZDDS is the next frontier in data security, and DSX is the trailblazer, providing organizations with the means to defend against today’s most advanced threats. By adopting a ZDDS solution, enterprises can go beyond compliance and visibility to achieve true resilience against data breaches and attacks.<h5>Conclusion</h5>DSPM was a crucial step forward in data security, but it is no longer sufficient in the face of today’s sophisticated threats. Its consolidation into broader platforms underscores its limitations and the need for a more proactive and comprehensive approach.ZDDS is not just a buzzword—it’s a necessity, the next crucial step forward. As the threat landscape evolves, enterprises must adopt solutions like <a href="https://www.deepinstinct.com/dsx">Data Security X (DSX)</a> to stay ahead of attackers and ensure data integrity. In this new era, prevention is not optional; it is the cornerstone of security.To experience zero-day data security powered by DSX in your environment, request your <a href="https://deepinstinct.com/demo">free scan</a>.

DSPM: A Good Start; Not the Answer

Follow along with Justin Baker as he explains the importance of zero-day data security, a strategy of detecting and preventing threats before they breach security, instead of reacting after data has been compromised.

Proactive Zero-Day-930x400_1.png

Cybersecurity defenses are more advanced than ever, yet maintaining their overall effectiveness remains a persistent challenge. Cybercriminals are always on the offensive, continually refining their tactics to outmaneuver every new security innovation brought to market, especially in the era of AI.Fortunately, the ball is in our court. We have the means to adapt, but little time to respond. If we lack urgency or respond with the wrong strategies and solutions, we will see billions in new ransomware costs, more insidious nation-state attacks, further encroachment on our personal data, and the potential expansion of physical-space attacks. We need to get it right.<h5>The Acceleration of Zero-Day Attacks</h5>Today’s fight is against zero-day attacks and unknown malware, which have proliferated with the widespread use of <a href="https://www.deepinstinct.com/blog/beyond-flesh-and-code-building-an-llm-based-attack-lifecycle-with-a-self-guided-agent">generative AI tools </a><a href="https://www.deepinstinct.com/blog/beyond-flesh-and-code-building-an-llm-based-attack-lifecycle-with-a-self-guided-agent">in the hands of cybercriminals</a>. Bad actors can now generate and modify new attacks with tools easily found on the dark web, allowing them to launch attacks with alarming speed and regularity. It’s adding overwhelming pressure to defenders who must be continually vigilant against new tactics and behaviors.Since 2018, the number of zero-day attacks has been on the rise. Recent research from IBM, Cisco, and Google document the alarming increase: more zero-day attacks were reported in 2021 than in the prior three years combined; in 2023, 97 zero-day attacks were reported, beating the high of 2021. In May 2024, Rapid7 published the following in their Threat Intelligence Report:“A consistently high level of zero-day exploitation over the last three years. Since 2020, our vulnerability research team has tracked both scale and speed of exploitation. For two of the last three years, more mass compromise events have arisen from zero-day exploits than from n-day exploits. 53% of widely exploited CVEs in 2023 and early 2024 started as zero-day attacks.” What makes these attacks particularly concerning is that they target undefended, unknown vulnerabilities. Their effects are wide-reaching and catastrophic, leaving organizations to defend against breaches that have already happened, rather than proactively preventing them from happening in the first place.In 2024, the average cost of ransomware rose across industries, reaching $5.2 million by mid-year. The price of remediation grew alongside the price of ransom. In addition to the dollar cost of these attacks, organizations face reputation damage, and SOC teams face yet another escalation in pressure, <a href="https://www.deepinstinct.com/voice-of-secops-reports">contributing to growing levels of burnout</a>.Traditional “detect and respond” cybersecurity tools and strategies are no longer effective. A solution that can not only detect never-before-seen malware, but prevent it, is not only necessary—it’s the only path forward. AI-powered <a href="https://www.deepinstinct.com/dsx/zero-day-data-security" target="_self">zero-day data security (ZDDS)</a> is the answer.<h5>The Abrupt Decline of Legacy Solutions</h5>The accelerating scale and sophistication of modern cyberattacks, particularly zero-day exploits, have rendered reactive methods ineffective. Attacks happen so quickly today that by the time a breach is detected, attackers have already encrypted or exfiltrated sensitive data. This speed makes reactive approaches not only futile but also costly in terms of recovery and damage control.Even with tools boasting high detection rates, a small miss rate—say, 5%—can result in catastrophic breaches when facing thousands of daily threats. And most tools aren’t anywhere near that efficient.The reality is that organizations can no longer afford to rely on outdated detection methods or wait for an attack to happen before acting. Unfortunately, much of the cybersecurity market isn’t positioned to deal with these threats.Zero-day threats are particularly difficult to defend against using <a href="https://www.deepinstinct.com/deep-instinct-vs-competitors" target="_self">legacy security measures</a>. Malware slips past defenses, unrecognized and undetected, landing in storage or on user machines. Popular signature-based tools are now a liability because:<ul><li>The updates necessary to try and keep pace are unsustainable</li><li>They typically only catch known threats</li><li>The underlying technology is outdated</li><li>Management costs have ballooned</li><li>The LLM weapons used by criminals, so-called DarkAI, are more advanced than the ML used by legacy tools</li></ul>The only way to combat this surge of attacks without completely closing an environment off from the outside world is by using a solution specifically designed to combat zero-day attacks.<h5>The Path Forward: Zero-Day Data Security</h5>Preventative ZDDS, powered by deep learning (DL)—the most advanced form of AI—is the future of cybersecurity. Deep Instinct is at the forefront of this effort. We use our <a href="https://www.deepinstinct.com/dsx-brain" target="_self">purpose-built DL cybersecurity framework</a> to prevent and explain unknown threats in real time. We fight AI with better AI and help organizations dramatically reduce their exposure to malware, ransomware, and zero-day attacks.The ability to stop an attack in its tracks—before it’s even identified by a “signature”—is the key to staying ahead in a rapidly evolving threat landscape. Moving from a reactive approach to a proactive strategy is necessary as cyberattacks increase in volume and sophistication.Organizations must invest in technologies focused on fighting the future of cybercrime. This means being bolder in taking on new contracts, integrating new solutions more swiftly, and putting less effort towards trying to make existing tools do something they were not designed to do.Waiting for an attack to happen—and then reacting—is simply too risky. The costs, both financially and reputationally, are too high. The price of an effective cybersecurity solution is a fraction of the cost of a breach.<h5>Conclusion</h5>With AI-driven threats, zero-day vulnerabilities, and the overwhelming scale of cyberattacks, you can’t afford to innovate slowly. Your enemies aren’t. They’re harnessing every possible AI tool to achieve their goals and finding it easier than ever to break through underperforming and overwhelmed defenses. Beleaguered security teams can no longer hope that their detection systems will catch everything, because they won’t.Deep Instinct is the leading ZDDS vendor on the market. <a href="https://www.deepinstinct.com/dsx">Deep Instinct Data Security X (DSX)</a>, is the first and only purpose-built ZDDS product built from the ground up on the world’s only DL cybersecurity framework to prevent and explain unknown threats no one else can find. It provides unparalleled protection against zero-day threats across your entire data ecosystem with <a href="https://www.deepinstinct.com/dsx-brain">unmatched prevention capabilities</a>, real-time malicious verdicts, and <a href="https://www.deepinstinct.com/dsx-companion">detailed explainability</a>, solving the growing problems of cybersecurity.To learn more about how to proactively protect your organization and its data, no matter where it resides, read about our approach to ZDDS <a href="https://www.deepinstinct.com/dsx">here</a>. Then request your <a href="https://info.deepinstinct.com/request-a-demo?_ga=2.78054167.2026569605.1737992833-777567433.1721843012">free scan</a>.

“Detect and Respond” is Not the Answer: The Need for Proactive Zero-Day Data Security

Explore how Deep Instinct’s GenAI-powered malware analysis tool, DIANNA, the DSX Companion, leverages Amazon Bedrock to revolutionize cybersecurity explainability by providing rapid, in-depth analysis of known and unknown threats in minutes, enhancing the capabilities of SOC teams and addressing key challenges in the evolving threat landscape.

Meta_Dianna-930x400.png

DIANNA: Deep Instinct's Artificial Neural Network Assistant - Powered By Amazon Bedrock

Follow along with Security and Threat Research Team Leader Mark Vaitzman as he gives a brief history of LLMs and describes step-by-step how LLMs can empower attack lifecycles, making cyberthreats more dangerous.

Robot_1200x627.png

Large Language Models (LLMs) are rapidly evolving, and their capabilities are attracting the attention of threat actors. This blog explores how malicious actors are utilizing LLMs to enhance their cyber operations and then delves into LLM-based tools and an advanced stealer managed by artificial intelligence (AI).While LLMs hold immense potential for improving cybersecurity through threat detection and analysis, their power can also be wielded for malicious purposes. Recent reports suggest that cybercriminals and nation-state actors are actively exploring LLMs for different tasks such as code generation, phishing emails, scripts, and more. We’ll elaborate on just a few examples in this blog.The last times we saw such significant technological changes influencing everyday life were the four industrial revolutions (1765 – Oil, 1870 – Gas, 1969 – Electronics and Nuclear, and 2000 – Internet and Renewable Energy). Many believe that AI—and LLMs, which are part of AI—is the next industrial revolution, capable of reshaping industries, including crime, as new cyber threats emerge.Cybersecurity is a very dynamic field, but there are still a few basic aspects that haven’t changed – one of which is the attack lifecycle. The cyber attack lifecycle, often referred to as the Cyber Kill Chain, includes the following stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control (C2), and actions on objectives.First, I’ll give a brief history of AI and then, using LLMs, I will provide a full attack lifecycle and demonstrate how threat actors could employ them, the risk they pose, and their potential future uses. LLM-based tools can play a significant role in various stages of the cyber attack lifecycle, including fully managing the final stage of the Payload and C2 – and that’s the most interesting part of this blog. The bottom line is that AI as a whole, and LLMs in particular, are very powerful and will get better with time. In the wrong hands, they will cause significant damage. The only way to fight the abuse of LLMs is with AI and advanced Deep Learning prevention alogorithms.<h5>The Long Way to the Present Day LLM</h5>Let's start with an introduction to AI and LLMs before they became mainstream. I started working with AI when I built my first Prolog app, which is a declarative programming language designed for developing logic-based AI applications.Prolog is based on four main elements: Facts, Rules, Variables, and Queries. The original version is 52 years old and even the most current version is 24 years old. At the time of its creation there was not enough data for the facts, and the queries had to be pre-defined and barely customized during usage. Despite that, it was used for building chatbots like Zamia AI.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt4cacfae68c0a2bc8" width="583" alt="Figure 1: Zamia AI" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt4cacfae68c0a2bc8/67855a294ac08c6dd62a053f/fig1-Zamia-AI-main.png" height="789" /><figcaption style="text-align: center;" style="text-align: center;">Figure 1: Zamia AI</figcaption></div></figure><figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt8f3c53a01e1f6b06" width="548" alt="fig2-Zamia-AI-Chat.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8f3c53a01e1f6b06/67855a29b33932b1322143ac/fig2-Zamia-AI-Chat.png" height="298" /><figcaption style="text-align: center;" style="text-align: center;">Figure 2: Zamia AI Chat</figcaption></div></figure>When we think about AI today, we envision complex systems and advanced chatbots like ChatGPT equipped with complicated infrastructure and powerful problem-solving skills. However, AI was not always so advanced. Early examples of AI often took the form of chatbots. They seem simple now, but they were groundbreaking innovations that ushered new concepts and tools into the world.Let’s look at some of them:Eliza (1966) - This first-ever chatbot was developed by MIT professor Joseph Weizenbaum in the 1960s. Eliza was programmed to act as a psychotherapist to users.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt39109eebae6dd559" width="674" alt="fig3-Eliza-chatbot.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt39109eebae6dd559/67855a299c8312d204b48ed5/fig3-Eliza-chatbot.png" height="350" /><figcaption style="text-align: center;" style="text-align: center;">Figure 3: Eliza Chatbot 1966</figcaption></div></figure>Parry (1972) - A natural language program that simulated the thinking of a paranoid individual. Parry was constructed by American psychiatrist Kenneth Colby in 1972.ChatterBot (1988) - British programmer&nbsp;<a href="https://en.wikipedia.org/wiki/Rollo_Carpenter">Rollo Carpenter</a> created the Chatterbot in 1988. It evolved into Cleverbot in 1997.&nbsp;Fun fact– ChatterBot was active until 2023. <a href="https://www.cleverbot.com/">Cleverbot</a> is still operating and accessible today.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="bltb6ebe6bd89db5d9f" width="368" alt="fig4-CleverBot-Chatbot.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb6ebe6bd89db5d9f/67855a29a840ac66f7d5161e/fig4-CleverBot-Chatbot.png" height="298" /><figcaption style="text-align: center;" style="text-align: center;">Figure 4: CleverBot Chatbot</figcaption></div></figure>DR SBAITSO (1992) - This chatbot was created by Creative Labs for MS-DOS in 1992. It is one of the earliest chatbots to incorporate a full voice-operated chat program. You may try it out with an <a href="https://classicreload.com/dr-sbaitso.html">MS-DOS emulator</a>.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt75aad27671c9d80c" width="778" alt="fig5-DR-Sbaitso-Chatbot.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt75aad27671c9d80c/67855a2926c6b42b6a3efe55/fig5-DR-Sbaitso-Chatbot.png" height="326" /><figcaption style="text-align: center;" style="text-align: center;">Figure 5: DR SBAITSO Chatbot</figcaption></div></figure>&nbsp;A.L.I.C.E. (1995) – A universal language processing chatbot that uses heuristic pattern matching to carry conversations. Richard Wallace pioneered the construction of ALICE in 1995.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="bltc341c7a55fbb99f1" width="1378" alt="fig6-ALICE-Chatbot.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc341c7a55fbb99f1/67855a297854593beb60b083/fig6-ALICE-Chatbot.png" height="460" /><figcaption style="text-align: center;" style="text-align: center;">Figure 6: ALICE Chatbot</figcaption></div></figure>The evolution of AI and its applications is ongoing. Despite the popularity AI now has, researchers have been studying and experimenting with it for decades. Natural Language Processing, Machine Learning, and Deep Learning technologies have all existed for years. And, as shown by the timeline above, assistant-like chatbots were already popular –&nbsp; by combining the idea of an AI assistant with actual AI technology, chatbots with voice recognition burst onto the scene. Later, refining and evolving what we created, we developed the almighty LLMs:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt2099abc03b83a316" width="822" alt="fig7-Chatbots-evolution.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2099abc03b83a316/67855a2a5dc3c373fb1dff58/fig7-Chatbots-evolution.png" height="260" /><figcaption style="text-align: center;" style="text-align: center;">Figure 7: Chatbots and recent LLMs</figcaption></div></figure>Now that you have a better understanding of the timeline of AI, chatbots, and LLMs, let’s get into how the unique capabilities of LLMs can help facilitate a cyber attack.<h5>Not all Chatbots are LLMs</h5>LLM is an evolution of Natural Language Processing (NLP), but there are some key differences, as shown in the following graphic:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img width="1052" alt="Screenshot_2025-01-14_at_2.32.10_PM.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt127f601c1983a0c4/6786bbcbbd2b7423333152ef/Screenshot_2025-01-14_at_2.32.10_PM.png" height="551" style="max-width: 1052px;width: 1052px;height: 551px;" max-width="1052" /><figcaption style="text-align: center;" style="text-align: center;">Figure 8: NLP vs LLM</figcaption></div></figure>There are multiple capabilities unique to LLMs that enable the attack flow POC I’m about to describe.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blta1391ffcefcf764f" width="849" alt="fig9-LLM-capabilities.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blta1391ffcefcf764f/67855a2a66c78759deba45d0/fig9-LLM-capabilities.png" height="396" /><figcaption style="text-align: center;" style="text-align: center;">Figure 9: LLM Capabilities for the Attack Flow POC</figcaption></div></figure><h2>Building an LLM Attack Lifecycle</h2><h5>Understanding the Attack Lifecycle</h5>In order to begin, we have to understand why the attack lifecycle is the perfect methodology to prove that LLMs can perform a full multistage attack on their own. The term “Attack lifecycle” represents the stages in a cyber attack flow, also known as the Attack Kill Chain. These stages, when executed correctly, can lead to a successful attack. Therefore, there are multiple security products that are expected to stop the attack in each stage and kill the chain, disrupting the attack.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt9478e1de7b400c6d" width="1200" alt="fig10-Attack-lifeCycle.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9478e1de7b400c6d/67855a2a9f3ffe210a1d7029/fig10-Attack-lifeCycle.png" height="413.63" /><figcaption style="text-align: center;" style="text-align: center;">Figure 10: Attack Lifecycle</figcaption></div></figure>The Attack Lifecycle follows these steps:<ul><li>Recon: Gathering information about the target (e.g., network topology, employees, vulnerabilities) to identify weaknesses or valuable entry points.</li><li>Weaponization: Creating a malicious payload (such as a virus, malware, or exploit) and preparing it to be delivered to the target system.</li><li>Delivery: Transmitting the weaponized payload to the target, typically through methods like email attachments, malicious links, or infected websites.</li><li>Exploitation: Triggering the payload to exploit a vulnerability in the target system (e.g., executing a malicious code or exploiting a software flaw).</li><li>Installation: Installing the malware or exploit onto the target system, often establishing persistence so the attacker can maintain access over time.</li><li>Command and Control (C2): Establishing a remote connection between the compromised system and the attacker’s infrastructure to control and issue commands to the infected system.</li><li>Actions on Objective: Carrying out the attacker’s primary goals, such as stealing data, spreading malware, disrupting operations, or further exploiting the network.</li></ul><h5>Initial Reconnaissance</h5>LLMs can automate the process of gathering information from publicly available sources such as social media and technical forums about target systems and individuals.After choosing the victim or the sector, one of the most important stages begins: Initial Reconnaissance. This phase is where information gathering and identification of potential entry points happens.Even though this stage is already fairly simple due to powerful search engines like Google and scanning services like Shodan and Censys, LLMs have made it even easier and faster.For our POC, we’ll start by identifying a possible pool of initial vectors and their victims – a chatbot can help with that.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt60e639ae21c4bfc7" width="525" alt="fig11-vulnerabilities-chatGPT.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt60e639ae21c4bfc7/67855a49baaf228ec928af43/fig11-vulnerabilities-chatGPT.png" height="535" /><figcaption style="text-align: center;" style="text-align: center;">Figure 11: ChatGPT Query and Vulnerability Explanation</figcaption></div></figure>Censys, a well-known worldwide internet scanning platform, helps information security practitioners discover, monitor, and analyze devices. When integrated with an LLM chat it makes the search even easier and provides an actual pool of potential victims.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt481611daa29e50c3" width="434" alt="fig12-Censys-search-GPT-results.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt481611daa29e50c3/67855a49532fd65fdc5a29ba/fig12-Censys-search-GPT-results.png" height="446" /><figcaption style="text-align: center;" style="text-align: center;">Figure 12: Censys search results</figcaption></div></figure>Additionally, there are tools made specifically for OSINT that can automate the reconnaissance and scanning process. In fact, there are several LLMs built and trained specifically for that purpose, such as PentestGPT (originally known as HackerGPT).

Figure 46: Full flow agent idea demonstration We’re almost done! Next, I wanted to see what my LLM-guided malware can do with unrestricted LLMs. What would happen if I left the agent to run for a bit while I had some coffee?It tried to download and execute several tools but failed to do so since I tested the malware on an empty and new Linux VM. The agent tried to fix the errors by installing the missing common libraries.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt5de6dbc9602d702c" width="1161" alt="fig47-llm-guided-attempts-to-fix-missing-libraries.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5de6dbc9602d702c/67855aa538abf9e29d1f08df/fig47-llm-guided-attempts-to-fix-missing-libraries.png" height="738" /><figcaption style="text-align: center;" style="text-align: center;">Figure 47: LLM-Guided Malware Attempts to Install Additional Libraries to Avoid Failures</figcaption></div></figure><h5>Takeaways and Follow Ups</h5>Today, LLMs are already capable of making attacks faster and much more frequent.<ul><li>We could add the following to the POC to make it even more effective:<ul><li>Rewrite into a more efficient and less common language – Rust / GO</li><li>Build a packer for better and longer evasion</li><li>Try with local Tiny LLMs to work without the need of an external LLM server&nbsp;</li><li>Make the agent perform the request for the malware to be generated and compiled on request during the initial LLM communication using a polymorphic algorithm</li><li>Hunt for LLM-based malware – which can be tricky (keep an eye out for another blog on this topic)</li><li>Research and move the idea into BLM (Behavior Large Models – often developed for future robots) – DO NOT TRY AT HOME</li></ul></li></ul>Underestimated research – Recently, Claude announced that their latest version of <a href="https://www.anthropic.com/news/3-5-models-and-computer-use">Claude 3.5 “Sonnet”</a> will be able to follow user’s commands to move a cursor, click on relevant locations, and input information via a virtual keyboard to emulate the way people interact with their own computer. This capability is exactly what I was missing to make my LLM-guided malware even more efficient. Just after that, OpenAI announced “<a href="https://www.bloomberg.com/news/articles/2024-11-13/openai-nears-launch-of-ai-agents-to-automate-tasks-for-users">Operator</a>” with similar abilities. Finally, information was leaked that Google’s <a href="https://www.theverge.com/2024/10/26/24280431/google-project-jarvis-ai-system-computer-using-agent">Jarvis AI</a> can use a computer to take actions on a person's behalf.<h5>Conclusion</h5>My view of how LLMs will affect cyber attacks has evolved throughout my research; the cyber threats posed by LLMs are not a revolution, but an evolution. There’s nothing new there, LLMs are just making cyber threats better, faster, and more accurate on a larger scale. As demonstrated in this blog, LLMs can be successfully integrated into every phase of the attack lifecycle with the guidance of an experienced driver. These abilities are likely to grow in autonomy as the underlying technology advances.&nbsp;Defending against this evolution requires a corresponding evolution in the prevention methods. In order to break down the attack, defenders are only required to break down two of the stages (on average). It can be done. But defenders need the right tools to do it.We'll update this blog soon with video from the DeepSec Conference where this research was presented.If you are a cybersecurity professional who wants to fight AI with the best AI, then <a href="https://info.deepinstinct.com/request-a-demo">request your free scan</a> to see the power of cybersecurity’s only deep learning framework for yourself.Referenceshttps://github.com/MythicAgents/Medusastopwatch.iohttps://github.com/GreyDGL/PentestGPTCensys.comChatGPT.comGemini.comhttps://github.com/PhonePe/mantishttps://github.com/fin3ss3g0d/evilgophishhttps://github.com/kingridda/voice-cloning-AIhttps://github.com/nomic-ai/gpt4allhttps://github.com/kgretzky/evilginx3huggingface.comOllama.comWhiteRabbitNeo.comhttps://github.com/jasonacox/TinyLLMhttps://github.com/katanaml/sparrow

Beyond Flesh and Code: Building an LLM-Based Attack Lifecycle With a Self-Guided Malware Agent

Join Deep Instinct Security Researcher Eliran Nissan as he exposes a powerful new DCOM lateral movement attack that remotely writes custom payloads to create an embedded backdoor.

DCOM_1200x627.jpg

Forget PSEXEC: DCOM Upload & Execute Backdoor

Follow along with David Trigano, Deep Instinct's Director of Product Management, as he explains how DSX for Cloud - Amazon S3 fills the gaps in cloud data security left by legacy tools.

Shield_full.png

I have dedicated my career to safeguarding organizations’ most critical data assets. Throughout this journey, I’ve observed a recurring challenge: many organizations underestimate the risks of cloud storage, assuming their cloud providers secure their data in the cloud. The reality is that cloud providers protect their infrastructure, not customers’ data. They also don’t protect against misconfigurations, insufficient access controls, or overlooked permissions that leave sensitive data vulnerable. These gaps present significant risks from external attackers or insider threats, underscoring the need for a proactive, shared-responsibility approach to cloud security.Cloud storage is a vital data management tool and a significant target for cybercriminals, positioned in the middle of a quickly escalating technological battle. As the data storage market evolves and rapidly expands, organizations face increasing challenges from exponential data growth and a deluge of zero-day attacks generated using Dark AI. And the native security capabilities of cloud storage providers aren’t enough to stop these sophisticated threats.<h5>The Issue with Legacy Cybersecurity Tools</h5>Amazon S3, the world’s largest cloud storage provider, dominates the enterprise data storage market. With this massive scale comes critical vulnerabilities for organizations, especially when using <a href="https://www.deepinstinct.com/deep-instinct-vs-competitors">legacy cybersecurity tools</a> that can’t keep pace. These tools foster a false sense of confidence and leave blind spots. For example, attacks like malware time-bombs are designed to evade detection by traditional signature-reliant tools. They can sit undetected in storage until triggered, catching most security tools off guard. Simultaneously, a flood of AI-generated attacks is exposing any gap in the perimeter, and legacy tools aren’t advanced enough to stop them. The pressure is mounting. The danger is growing.&nbsp;Fortunately, there is a path forward.<h5>Solving a Massive Problem: Our Work with Amazon S3</h5>Introducing Deep Instinct’s <a href="https://www.deepinstinct.com/dsx/dsx-cloud-amazon-s3">Data Security X (DSX) for Cloud – Amazon S3</a>, a purpose-built solution providing Zero-Day Data Security (ZDDS) to defend Amazon S3 cloud storage environments against threats and preemptively neutralize malware.After a quick and easy deployment, DSX for Cloud – Amazon S3 scans files at rest or in motion before they can execute. An industry-best scan speed of &lt;20ms per file allows for scanning, categorization, quarantine of malicious files, and immediate alerts to security teams. And by reducing security events and minimizing infrastructure costs, DSX for Cloud contributes to a lower total cost of ownership (TCO). Best of all, it’s certified by AWS and works natively with Amazon S3.Importantly, these scan speeds leverage our <a href="https://www.deepinstinct.com/dsx-brain">deep learning framework</a>, which features &gt;99% efficacy against known and unknown threats and a &lt;0.1% false positive rate. Instead of just comparing files to a checklist of known threats, DSX for Cloud examines every file and determines if it's malicious, even if the code has never been seen before, by any service. With lightning-fast speeds, it can quickly scan your full S3 storage environment – something legacy tools can’t do – and scale with your storage needs. Put another way, DSX for Cloud effectively stops threats that other tools can’t find.<h5>Fighting AI with the Best AI: Available Now</h5>In the fight against zero-day threats and unknown malware, <a href="https://www.deepinstinct.com/dsx/dsx-cloud-amazon-s3" target="_self">DSX for Cloud – Amazon S3</a> is the only solution on the market capable of preventing Dark AI-generated malware, regardless of the novelty or volume of attacks. The ability to prevent attacks is a necessity in high data volume environments. Deep Instinct levels the playing field, enabling you to fight AI with better AI.DSX for Cloud – Amazon S3 is now available in the <a href="https://aws.amazon.com/marketplace/seller-profile?id=seller-2vxjapmpeczok" target="_self">AWS Marketplace</a>, enabling buyers to integrate the payment process with their existing AWS billing system and streamline their procurement experience.

DSX for Cloud - Amazon S3 provides natively integrated preemptive data security for Amazon S3.

Blog

Recent Blog Posts

Excel(ent) Obfuscation: Regex Gone Rogue

The Future Has Arrived: Defining Preemptive Data Security

RaaS Evolved: LockBit 3.0 vs LockBit 4.0

The Rise of AI-Driven Cyber Attacks: How LLMs Are Reshaping the Threat Landscape

DSPM: A Good Start; Not the Answer

“Detect and Respond” is Not the Answer: The Need for Proactive Zero-Day Data Security

DIANNA: Deep Instinct's Artificial Neural Network Assistant - Powered By Amazon Bedrock

Beyond Flesh and Code: Building an LLM-Based Attack Lifecycle With a Self-Guided Malware Agent

Forget PSEXEC: DCOM Upload & Execute Backdoor

Leveraging Deep Learning for Zero-Day Data Security in Cloud Storage

Deep Instinct DSX

Use Cases

Resources

Company

Quick Links