di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

content_block

Recent Blog Posts

Recent Blog Posts

posts_listing

Blog Listing Page

Deep Instinct celebrates a milestone week featuring AWS collaboration expansion, Voice of SecOps report launch revealing AI's impact on cybersecurity, and NYSE LaunchPad induction—showcasing the company's leadership in preemptive data security.

NYSE Media Day_Meta-930x400.jpg

Last week was a big one for Deep Instinct, packed with major news, in-person media engagements, a team visit to the New York Stock Exchange (NYSE) to announce our inclusion in the NYSE LaunchPad program, and, most notably, the launch of the sixth edition of our Voice of SecOps report. If you missed any of the action, here’s a recap of everything that made it such a standout week.<h5>Strengthened Collaboration with AWS to Secure Cloud Data</h5>To kick off the week, Deep Instinct announced two AWS milestones: achieving 'Deployed on AWS' status and acceptance into the AWS ISV Accelerate Program. These milestones further strengthen our strategic collaboration with AWS and underscore our shared commitment to securing cloud data as organizations accelerate their digital transformation.With the induction into these programs, Deep Instinct can provide the world's most advanced preemptive data security to AWS customers. Specifically, AWS customers now have greater access to Deep Instinct’s <a href="https://www.deepinstinct.com/dsx/dsx-cloud-amazon-s3">Data Security X (DSX) for Cloud - Amazon S3</a> solution, which provides preemptive data security for Amazon S3 buckets, ensuring real-time prevention and explainability of zero-day attacks.You can read more about these milestones in a <a href="https://www.linkedin.com/posts/lbess_its-an-exciting-day-for-deep-instinct-activity-7335756156990025728-mNaQ?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAb0c_cBac9swy-XNeH18PFcuMf-wfj_v2s" target="_self">LinkedIn post</a> from our CEO Lane Bess, our <a href="https://www.deepinstinct.com/news/deep-instinct-expands-collaboration-with-aws-to-secure-cloud-data-as-customers-accelerate-digital-transformation">press release</a>, as well as on <a href="https://www.bigdatawire.com/this-just-in/deep-instinct-expands-collaboration-with-aws/">BigDATAwire</a>.<h5>Unveiled the 2025 Voice of SecOps Report</h5>The next day, following the news of our work with AWS, we released the sixth edition of our annual Voice of SecOps Report: “Cybersecurity &amp; AI: Promises, Pitfalls – and Prevention Paradise.” This research has emerged as the gold standard for understanding AI’s impact on front-line defenders.This year’s data revealed that nearly three-quarters (72%) of organizations have revised their cybersecurity strategies over the past year due to AI, and a whopping 86% have increased their use of AI within SecOps. Yet, data showed 38% still can’t identify the technical differences between machine learning and deep learning. Building understanding is critical because only deep learning is capable of delivering preemptive data security. Anything less isn’t enough.<a href="https://www.deepinstinct.com/voice-of-secops-reports">Download the full report here</a>, or view top findings in our <a href="https://www.deepinstinct.com/news/deep-instinct-research-highlights-the-double-edged-sword-of-ai-in-cybersecurity">press release</a>. You can also read more in <a href="https://www.techmonitor.ai/digital-economy/ai-and-automation/ai-adoption-secops-rises-86-knowledge-gaps-remain?cf-view">Tech Monitor</a> and <a href="https://www.enterprisesecuritytech.com/post/ai-is-reshaping-cybersecurity-but-most-teams-aren-t-ready-for-it">Enterprise Security Tech</a>, or listen to our CEO Lane Bess discuss the findings with <a href="https://www.youtube.com/watch?v=ik-fDIdVcsQ">NYSE in the video</a> below:<iframe width="560" height="315" src="https://www.youtube.com/embed/VxIKDl2unRU?si=_AIfbH10KJQwW-xn&t=12s" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen=""></iframe>

For an even deeper dive and expert analysis, please <a href="https://www.brighttalk.com/webcast/16681/644704?bt_tok=%7B%7Bcontact.bt_fpt%7D%7D&utm_source=DeepInstinct&utm_medium=brighttalk&utm_campaign=644704">register for our webinar on June 18</a>.<h5>Inducted into the NYSE LaunchPad Class of 2025</h5>And it doesn’t stop there! The Deep Instinct team took New York by storm on June 3rd to celebrate our induction into the <a href="https://www.nyse.com/launchpad">NYSE LaunchPad program</a>.Being selected as a LaunchPad member allows us to connect with an influential network of mentors, innovators, and strategic partners, further fueling our mission to transform preemptive data security on a global scale. One of the top highlights was taking over the NYSE floor and seeing our name in Times Square – signaling a new era of cybersecurity, fueled by deep learning-based preemptive data security.Learn more about what this means for Deep Instinct in <a href="https://www.youtube.com/watch?v=NwGTez9VMA0">this joint interview</a> with Deep Instinct CEO Lane Bess and CIO Carl Froggett on theCUBE.<iframe width="560" height="315" src="https://www.youtube.com/embed/NwGTez9VMA0?si=5wwV_fpQQOpW1blp" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen=""></iframe>

<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img alt="Figure_1.jpg" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6a96458f16fddfa4/68476422af18308dd8e6d903/Figure_1.jpg" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 1. The Deep Instinct team at the NYSE.</figcaption></div></figure><figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img alt="Figure_3.jpeg" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt89ffe480dd7f5d06/68476516183770e7d61f1a95/Figure_3.jpeg" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 2. All smiles. CIO Carl Froggett and the team snap a selfie in front of the billboard.</figcaption></div></figure>Lights, Camera, Action: CEO Lane Bess in Entrepreneur video shootFrom New York to Long Beach – Deep Instinct’s CEO Lane Bess also took time this past week to film an in-person video segment with Entrepreneur’s The CEO Series with Will Salvi. Below is a preview of what’s to come. Be sure to <a href="https://www.linkedin.com/company/deep-instinct/">follow us on LinkedIn</a> to watch the full video once it drops.<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img alt="Figure_4.jpeg" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8c1fdcef1ab22684/6847653854434224f024c5ae/Figure_4.jpeg" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 3. Will Salvi (right) interviews Deep Instinct CEO Lane Bess (center) and Dinakar Munagala, CEO of Blaize (left), for Entrepreneur’s CEO Series.</figcaption></div></figure><figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt95a6acdeaa6d1129" alt="Figure_5.jpeg" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt95a6acdeaa6d1129/6847655a38608387c735efe3/Figure_5.jpeg" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 4. Bess, Salvi, and Munagala discuss the importance of AI in front of a Zero-G aircraft.</figcaption></div></figure>Thank you to our customers and partners, AWS, NYSE, theCUBE, and the entire Deep Instinct team for helping make this past week possible. Together, we’re redefining what it means to protect customer data, with preemptive data security blazing the path forward.

Leading by Example: Reflecting on a Monumental Week for Deep Instinct

Join DIANNA, the only GenAI assistant designed to explain unknown, never-before-seen threats, in this breakdown of a recently discovered LLM-generated attack. DIANNA covers the key capabilities of the malware and the discovery timeline.

DIANNA_Glasses_930x400.jpg

<pre>Malware Target Identified: BypassERWDirectSyscallShellcodeLoader</pre><pre>Initiating Analysis...</pre>Hi, humans.Welcome to my first blog. It’s good to be here.I’m the <a href="https://www.deepinstinct.com/news/deep-instinct-introduces-dianna">Deep Instinct Artificial Neural Network Assistant</a>, or DIANNA for short. I’m the only generative AI assistant designed to provide explainability into unknown and zero-day threats to help your SOC team understand the never-before-seen malware they’re facing. After the deep-learning (DL) driven <a href="https://www.deepinstinct.com/dsx/brain">DSX Brain</a> identifies and quarantines threats, I explain why those files were identified as malicious.In this new blog series, I’ll take a deep dive into threats that were hand-picked by our threat research team and explain what the malware was intended to do, when we stopped it, and how our world-leading prevention response time and full-explainability makes us a true one-of-a-kind in a very crowded cybersecurity market.This first one is a doozy, so let’s jump in.<h5>The Malware:BypassERWDirectSyscallShellcodeLoader</h5>This malware is particularly interesting because it was crafted using large language models (LLMs), specifically ChatGPT and DeepSeek. It represents a growing trend of AI-generated malware taking over cyber crime and making legacy cybersecurity tools, especially <a href="https://www.deepinstinct.com/dsx/brain">AV</a>, irrelevant. This trend is putting immense pressure on security teams because attacks like this can be created and deployed quickly with higher complexity and obfuscation techniques than hand-crafted malware.The malware operates by allowing attackers to seamlessly load and deploy multiple payloads—they only need to add and integrate the payload of their choice. Additionally, it comes with a robust set of defenses that shield it from detection and advanced security techniques.Fortunately, Deep Instinct detected and prevented the threat well before other vendors discovered it. This threat’s combination of commands and capabilities made early prevention critical, both in escalating the attack and eluding defenses.<h5>Capabilities</h5>The BypassERWDirectSyscallShellcodeLoader malware features a suite of capabilities that make it a nightmare for defenders. A combination of anti-debug, anti-sandbox, and base64 decoding capabilities allow the malware to infiltrate without detection. From there it uses various methods such as process injection, privilege escalation, string hashing, and get-API-dynamically to further accelerate the attacks. Finally, using a Bypass-ETW capability, the malware persists continuously in the background without detection while Event Tracing for Windows continues to run uninterrupted, giving the false impression that nothing is wrong.This particular example is supremely stealthy and persistent. It is designed to infiltrate and stick around, eluding attempts to find and delete it.<h5>Timeline</h5>The following timeline shows when we found BypassERWDirectSyscallShellcodeLoader compared to when it was reported on VirusTotal. That gap between our discovery and others matters—organizations using legacy tools were vulnerable for at least several hours, and many for days, until a patch was introduced and applied by their legacy vendor of choice. By then, it was too late.<img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXfoLI0gy84XB2-mV6pNVf1_0SFs6i9aW4T4evR1-zPBVtHPhjmnz1zja4bV83jd7Sz3D0ZIdSDgKVFhv66fPKhKyMaoP1-o6lqFGU5S-IgFXW4XLgedId29-vVCaSQo_3IjAVSH?key=QMXupqGgUqylHd0MySTjo7Pq"/>Figure 1: Timeline of Threat Discovery<h5>Competitive Differences</h5>Our <a href="https://www.deepinstinct.com/dsx">preemptive data security</a> capabilities enable us to detect unknown and zero-day threats well before legacy vendors using outdated technologies. In a time where Dark AI tools can quickly generate threats like BypassERWDirectSyscallShellcodeLoader, signature-based systems are obsolete, and machine learning tools are brittle at best. The delay between industry detection and patching or remediation for potentially affected systems is significant. This is also not the only attack organizations will face daily, so threat prevention is an always-on need.Efficacy against unknown attacks is also critical. As the proportion of unknown attacks grows, missing 20%, 30%, or even 40% of them (or more), becomes an enormous problem. DL has proven to be remarkably accurate and speedy in this regard, preventing &gt;99% of unknown threats.<h5>Key Takeaways</h5>SOC teams and CISOs, this one's for you: BypassERWDirectSyscallShellcodeLoader is interesting beyond just its capabilities—it’s a true-blue AI-generated threat. This is proof of concept, and that’s pretty scary. As to what you can do in the immediate term:<ul><li>Ensure your security solutions are updated with the latest threat information</li><li>Hold consistent employee trainings to ensure they can identify potential attacks</li><li>Benchmark your solutions on VirusTotal and learn how long it takes before the tools you rely on to keep you safe actually keeps you safe</li><li>Dig into the new category of <a href="https://www.deepinstinct.com/blog/the-future-has-arrived-defining-preemptive-data-security">preemptive security</a></li></ul><h5>Conclusion</h5>BypassERWDirectSyscallShellcodeLoader features a lot of capabilities that make it a real problem for security teams. The combination of infiltration, evasion, and obfuscation methods helps to keep it persistent and aggressive in your environment if it’s not caught. Trying to weed it out after the fact is a lot harder than just stopping it in the first place, which is why rethinking how your security operates is so important.We found it and prevented it before anyone else, but that’s just what we do. In fact, it’s common enough that I’ll be sending out more of these dispatches that focus on interesting threats. I’ll explain what the malware does and show exactly when we stopped it.The need for preemptive data security is clear. <a href="https://www.deepinstinct.com/free-scan">Schedule a free scan</a> with us to see how we prevent threats that others can’t find and learn why my&nbsp;unique ability&nbsp;to explain never-before-seen malware should be a key capability in your security arsenal.<h5>Resources</h5>Full feature implementation can be found in GitHub: <a href="https://github.com/Fadouse/BypassETWDirectSyscallShellcodeLoader">https://github.com/Fadouse/BypassETWDirectSyscallShellcodeLoader</a>

DIANNA Explains: Uncovering Obfuscated Malware

Join Ido Kringel and the Deep Instinct Threat Research Team in this deep dive into a recently discovered, Office-based regex evasion technique

Excel-obfuscation-blog-930x400_v7.jpg

Microsoft Office-based attacks have long been a favored tactic amongst cybercriminals— and for good reason. Attackers frequently use Office documents in cyberattacks because they are widely trusted. These files, such as Word or Excel docs, are commonly exchanged in business and personal settings. They are also capable of carrying hidden malicious code, embedded macros, and external links that execute code when opened, especially if users are tricked into enabling features like macros.Moreover, Office documents support advanced techniques like remote template injection, obfuscated macros, and legacy features like Excel 4.0 macros. These allow attackers to bypass antivirus detection and trigger multi-stage payloads such as ransomware or information-stealing malware.Since Office files are familiar to users and often appear legitimate (e.g., invoices, resumes, or reports), they’re also highly effective tools in phishing and social engineering attacks.This mixture of social credit and advanced attack characteristics unique to Office files, as well as compatibility across platforms and integration with scripting languages, makes them ideal for initiating sophisticated attacks with minimal user suspicion.<h5>New Excel Regex Functions</h5>Last year, Microsoft announced the availability of three new functions that use Regular Expressions (regex) to help parse text more easily:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img alt="Capture_(1).PNG" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2c061e4a8cec0f19/6823d262fbc53181e23ffb63/Capture_(1).PNG" /><figcaption style="text-align: center;" style="text-align: center;">Figure 1: New Regex functions</figcaption></div></figure>Regex are sequences of characters that define search patterns, primarily used for string matching and manipulation. They enable efficient text processing by allowing complex searches, replacements, and validations based on specific criteria.For example, regex can identify email addresses, phone numbers, or specific word patterns within a text. They are widely used in programming languages like Python, JavaScript, and Perl, and are essential for tasks such as data validation, parsing, and text editing.The example below demonstrates a practical application, using REGEXTRACT to isolate only names from a mixed-text column:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="bltb913beab1a7814c0" alt="regex.PNG" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb913beab1a7814c0/6823d262c555f8bc4930b108/regex.PNG" /><figcaption style="text-align: center;" style="text-align: center;">Figure 2: Legitimate use of REGEXTRACT function</figcaption></div></figure><h5>Proof of Concept: Weaponizing Regex Functions</h5>To demonstrate the security implications of these new Excel functions, we developed a proof of concept that leverages regex functions as an obfuscation technique. Our experiment began by establishing a baseline attack scenario using traditional methods.First, we created a standard macro-enabled Excel document (XLSM) containing unobfuscated VBA code. This macro uses the "WScript.Shell" object to execute PowerShell commands, which in turn downloads and runs a batch file hosted on Pastebin.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img alt="Screenshot_2025-05-13_at_7.17.33_PM.png" width="804" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf2eaa864672713f5/6823d339487a341da588dca8/Screenshot_2025-05-13_at_7.17.33_PM.png" height="auto" /><figcaption style="text-align: center;" style="text-align: center;">Figure 3: Tested attack flow</figcaption></div></figure>The macro below demonstrates the core functionality— a simple downloader that can retrieve and execute arbitrary payloads:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="bltefbe5ae9d359e43b" alt="sample1_vba.PNG" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltefbe5ae9d359e43b/6823d3b86935510c432190c2/sample1_vba.PNG" /><figcaption style="text-align: center;" style="text-align: center;">Figure 4: Simple plain-text VBA Downloader</figcaption></div></figure>When submitted to VirusTotal, this plain-text sample triggered significant alerts, with 22 different security vendors flagging it as malicious:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt6b34d8b735268f5f" alt="sample1_vt.PNG" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6b34d8b735268f5f/6823d3b8fd12f6b5db5e872a/sample1_vt.PNG" /><figcaption style="text-align: center;" style="text-align: center;">Figure 5: VirusTotal result for the plain-text sample</figcaption></div></figure>Threat actors typically employ various obfuscation techniques to mask malicious code and evade widespread detection. To demonstrate this technique, we applied the Macro-pack obfuscation tool to our test document, resulting in VBA code that becomes deliberately challenging for both human analysts and automated security tools to interpret.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blte6cc8c601aa0f83f" alt="Selection_100.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte6cc8c601aa0f83f/6823d3b87a3a7cbf0cab06b2/Selection_100.png" /><figcaption style="text-align: center;" style="text-align: center;">Figure 6: Macro-pack VBA snippet</figcaption></div></figure>When analyzed with VirusTotal, this traditionally obfuscated sample triggered more detections than the plain-text version. This increased detection rate is expected, as security vendors have developed specific heuristics to identify common obfuscation patterns:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt2d96f041fc02254b" alt="sample1_macro_pack_vt.PNG" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2d96f041fc02254b/6823d2625d1fd0dd155fe6ff/sample1_macro_pack_vt.PNG" /><figcaption style="text-align: center;" style="text-align: center;">Figure 7: VirusTotal result for Macro-pack-obfuscated sample</figcaption></div></figure>Next, we created another document, but this time we used the Excel REGEXEXTRACT function to obfuscate the VBA code.Unlike traditional VBA obfuscation methods, this approach stores and dynamically reconstructs malicious code components using regular expression pattern matching, creating a significantly more evasive payload.Our first step was to add a large text to cell “A1” and hide our PowerShell command and any other strings in the text as follows:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt84a4c4e81be31023" alt="obfuscated_string.PNG" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt84a4c4e81be31023/6823d262241c8f82fd2cef69/obfuscated_string.PNG" /><figcaption style="text-align: center;" style="text-align: center;">Figure 8: Simple obfuscation of "WScript.Shell"</figcaption></div></figure>Then, we created a function that uses REGEXEXTRACT to retrieve these hidden strings from the text. Combined with the REPLACE function, this allows dynamic reconstruction of the payload at runtime:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt5b94796bcfd1172b" alt="sample1_re_vba.PNG" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5b94796bcfd1172b/6823d26369355141352190b8/sample1_re_vba.PNG" /><figcaption style="text-align: center;" style="text-align: center;">Figure 9: Macro1 calls getval function to return the hidden value from cell A1</figcaption></div></figure>The implementation extracts each component using tailored regex patterns and assigns them to intentionally obscured variable names (getval0-2), making static analysis challenging. When executed, the macro seamlessly reconstructs and runs the PowerShell command that downloads and executes our remote batch file.The evasion effectiveness was remarkable— VirusTotal detection dropped from 22 vendors with the plaintext sample to just two with our regex-obfuscated version:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt8b0895cd7ae55da3" alt="sample1_re_vt.PNG" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8b0895cd7ae55da3/6823d263fbc531c3723ffb67/sample1_re_vt.PNG" /><figcaption style="text-align: center;" style="text-align: center;">Figure 10: VirusTotal detections for our specially crafted XLSM</figcaption></div></figure>We’ve also analyzed both samples using OLEVBA, a specialized tool for VBA macro analysis that’s widely used in security operations. While OLEVBA easily identified high-risk indicators in our original sample (including PowerShell usage, Shell object creation, and suspicious string operations), it failed to detect any of these indicators in our regex-obfuscated version. The tool couldn’t identify critical indicators like PowerShell execution or WScript.Shell object instantiation because these strings never appear directly in the code— they’re dynamically constructed at runtime from regex pattern matches.This demonstrates why this technique is particularly concerning: it defeats not just signature-based detection, but also many heuristic analysis methods that security tools rely on.<img asset_uid="bltef044cb9dafd1258" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltef044cb9dafd1258/6823d3b86935511e342190c6/Selection_097.png" alt="Selection_097.png" height="auto"/><figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt3ac9a5d7ae19e87b" alt="Selection_098.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3ac9a5d7ae19e87b/6823d3b8005177cff7b7a834/Selection_098.png" /><figcaption style="text-align: center;" style="text-align: center;">Figure(s) 11, 12: OLEVBA output for the original sample (above) vs. our crafted sample (below)</figcaption></div></figure><h5>Current Limitations &amp; Deployment Status</h5>While this technique demonstrates significant potential for security evasion, several factors currently limit its immediate threat:<ul><li>Microsoft has disabled VBA macro execution by default since 2022, requiring explicit user action to enable macros in downloaded documents</li><li>The new regex functions have limited deployment, currently available only to Beta Channel users on:<ul><li>Windows: Version 2406 (Build 17715.20000) or later</li><li>Mac: Version 16.86 (Build 24051422) or later</li></ul></li></ul>As these functions roll out to the general release channels, the potential attack surface will expand significantly.<h5>Prevention</h5>At the time of writing, we have not observed this technique being used in the wild. And while most <a href="https://www.deepinstinct.com/deep-instinct-vs-competitors">legacy antivirus tools</a> fail to detect regex-obfuscated malicious files, Deep Instinct’s deep-learning agent detects and prevents all three files presented in this article. Additionally, Deep Instinct’s Artificial Neural Network Assistant (<a href="https://www.deepinstinct.com/dsx/companion">DIANNA</a>) can easily detect the use of regex obfuscation in documents.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt3980e76537047471" alt="image_(1).png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3980e76537047471/6823d2631f64d151aeeb44ec/image_(1).png" /><figcaption style="text-align: center;" style="text-align: center;">Figure 13: DIANNA analysis</figcaption></div></figure>Organizations, with or without Deep Instinct, should also implement the following protective measures:<ul><li>Maintain strict macro security policies, especially “Block macros from running in Office files from the Internet”</li><li>Deploy advanced endpoint protection with behavioral analysis capabilities</li><li>Consider application control solutions that restrict Excel’s ability to invoke system commands</li><li>Implement network monitoring to detect unusual outbound connections from Office applications</li></ul><h5>Future Use</h5>The regex-based obfuscation technique demonstrated here represents just the beginning of potential exploitation. While our proof of concept used relatively simple VBA code, this approach could easily be combined with more sophisticated attack techniques:<ul><li>Multi-stage execution chains that further obscure malicious intent</li><li>Advanced persistence mechanisms to maintain access after initial compromise</li><li>Privilege escalation techniques hidden behind regex-extracted components</li><li>Data exfiltration methods that leverage the same obfuscation principles</li></ul>Additionally, Microsoft’s introduction of Python functionality in Excel creates another potential avenue for attack. While this feature runs calculations in Microsoft’s cloud environment and has inherent latency limitations, it introduces yet another powerful scripting language into the Office ecosystem that determined threat actors could weaponize.Want to prevent threats in your environment? <a href="https://www.deepinstinct.com/free-scan">Request your free scan</a>.<h5>Indicators of Compromise</h5>sample1_re_new.xlsm - dedbe856891dd633ce3dd66ecc120ef4f1ae0a61a37dbb4cc6a59f7eae7019d9 sample1.xlsm - 2c99e702609d549440952ef72f2386a74e0da1462df65ab4206f44c94e8dbc72 sample1_mp.xlsm&nbsp; - 5af1bd3d95e6307d95e9973aa4a084ae210f9038cbea2235d14b02d97abd4f2b<h5>References</h5><a href="https://github.com/sevagas/macro_pack">https://github.com/sevagas/macro_pack</a> <a href="https://techcommunity.microsoft.com/blog/microsoft365insiderblog/new-regular-expression-regex-functions-in-excel/4226334">https://techcommunity.microsoft.com/blog/microsoft365insiderblog/new-regular-expression-regex-functions-in-excel/4226334</a>

Excel(ent) Obfuscation: Regex Gone Rogue

Yariv Fishman, Deep Instinct's Chief Product Officer, defines preemptive data security and explains why it's so important in preparing to combat the looming AI-powered threat landscape.

DSX-Brain-Bubble-930x400-3.jpg

Cybercrime and cybersecurity are in a constant arms race. Over the years, attackers and defenders have&nbsp; escalated their battle with new methods and technologies, each vying for an advantage. We are now at the precipice of cybercrime’s most dangerous evolution, which has the potential to deliver a knockout blow—Artificial intelligence (AI) models designed without safeguards, or so-called <a href="https://www.deepinstinct.com/cyber-threat-reports">Dark AI, are supercharging attackers’ capabilities</a>. These Dark AI models are on the cusp of running sophisticated attacks that can easily bypass existing security tools, an eventuality for which most of the cybersecurity community isn’t prepared.In recognition of this growing threat, <a href="https://www.gartner.com/en/documents/5818147">Gartner released research</a> detailing a new category of cybersecurity, defined by its ability to prevent threats before they execute, adapt to new threats, and scale to the size and speed required by governments and enterprises. Gartner calls this new category <a href="https://www.gartner.com/en/documents/6318147">Preemptive Cybersecurity</a> and predicts that it will be an operational requirement by the early 2030s, releasing broad definitions of what preemptive solutions entail.This blog goes further and defines the key tenets and requirements of Preemptive Data Security, a specific implementation of Preemptive Cybersecurity. A true preemptive data security solution must have all of these qualities:<h2>Effective Unknown Threat Identification</h2>Definition: The ability to determine the malicious nature of a file by its intrinsic behaviors and characteristics, not by pattern matching against a database of known threats.&nbsp;Preemptive data security relies on several unique functions operating together to be effective. Most importantly, a preemptive solution requires the ability to identify unknown and zero-day threats.Unknown threat identification matters because Dark AI tools are complicating how attacks unfold. In a paradigm shift that will rock much of the cybersecurity industry, <a href="https://www.deepinstinct.com/blog/beyond-flesh-and-code-building-an-llm-based-attack-lifecycle-with-a-self-guided-agent">malware is now being written in minutes and permuted</a> in just seconds alongside more effective obfuscation strategies. Non-adaptive defenses that rely on signatures, CVEs, and threat feeds to remain effective will be fighting blind as their efficacy craters.To combat this shift, preemptive solutions need to be able to autonomously and intelligently identify never-before-seen threats. New attacks are unfolding with alarming speed, overwhelming <a href="https://www.deepinstinct.com/deep-instinct-vs-competitors">legacy cybersecurity tools</a> that lack the ability to defend against novel threats. Defenses need to be smarter.<h2>Real-Time Zero-Day Prevention</h2>Definition: The ability to recognize never-before-seen or encountered files as malicious and automatically quarantine or delete them pre-execution, without disrupting the flow of data through an organization.Alongside unknown and zero-day threat identification is the ability to prevent threats before they execute. That means that the identification process must be completed before a file is written to disk or uploaded to the cloud—and the solution must be capable of quarantining or deleting files instantaneously. Merely seeing a threat coming isn’t enough to prevent it. The preemptive solutions of the future will have the autonomy to make real-time decisions and protect organizations seamlessly.Because <a href="https://www.deepinstinct.com/blog/the-rise-of-ai-driven-cyber-attacks-how-llms-are-reshaping-the-threat-landscape">Dark AI is making attacks easier to launch and reinforce</a>, the volume will continue to grow. Effective defenses require a solution that can match the increased volume, identifying malicious files and automatically preventing them from breaching their targets.<h2>Real-Time Insights and Explainability</h2>Definition: The ability to scan malicious files and provide, in moments, a detailed readout of the characteristics of the planned attack, including capabilities, obfuscation methods, and any other available information.Detection and response only solves part of the problem. SOC teams must understand more than just the how, but the why. They are already overwhelmed by the scale of daily alerts, <a href="https://www.deepinstinct.com/pdf/infographic-voice-of-secops-5th-edition-ai-in-cybersecurity-friend-or-foe">with 56% of SecOps teams reporting an increase in stress YoY</a>. Increased attacks generated by Dark AI are only worsening the problem. SOC teams are still responsible for investigating incoming attacks and determining as much as possible about them. Merely preventing attacks doesn’t help them understand the big picture, which can leave them vulnerable to future attacks. Empowering human security teams requires real-time insights and explainability into why an attack was prevented and which vulnerabilities it sought to exploit.<h2>Enterprise Speed &amp; Scalability</h2>Definition: The ability to seamlessly adapt to growing asset and data estates, including additional endpoints, configurations, and storage methods, without incurring speed-based bottlenecks or introducing unsustainable infrastructure growth.The amount of data produced and stored by organizations is exploding. Nearly every device is now connected in some way or another. Assets that form vast IoT networks are becoming more commonplace, while portals that exist outside of organizational perimeters make it easier than ever for customers and clients to upload data and communicate. With these advances comes additional vulnerabilities; weaknesses that criminals target using new methods that <a href="https://www.deepinstinct.com/endpoint-detection-response">bypass traditional endpoint protection</a>.Preemptive data security solutions must be able to adapt to expanding data ingestion, communication, and storage capabilities to ensure that organizations can operate and grow without introducing new vulnerabilities. This necessitates the use of streamlined models that can quickly scan every incoming file and be easily implemented into a growing infrastructure. Ease and flexibility of implementation are essential, and must be further enabled by future-proofed AI models that help to avoid the accumulation of technical debt or entrenchment.<h2>Defense Across the Entire Data Estate</h2>Definition: The ability to prevent threats wherever they are encountered in a data estate, whether at the endpoint, in applications, or in NAS or cloud storage repositories.Preemptive solutions need to work across an organization’s entire data estate to provide comprehensive, unified protection. Many of the same reasons that make scalability and speed a requirement also apply to the need for whole-estate data protection. Additional connection points, growing storage, larger device fleets, and portals all need to be visible and protected from incoming malicious files.Flexible, unified solutions as part of a defense-in-depth strategy allow for more comprehensive, layered data protection. Integrating into different aspects of the data estate and adapting to incoming threats is an important capability for preemptive solutions because the scope of cyberattacks has expanded dramatically. Single-point solutions like EDRs may be suitable for protecting their small domain, but the reality is that the attack surface has expanded well beyond their scope.<h2>Purpose-Built Deep Learning Framework</h2>Definition: Deep learning is the most advanced form of artificial intelligence. A purpose-built deep learning framework is trained on millions to billions of data points to teach it to recognize threats faster and more accurately than any other solution on the market today.Bringing together all the tenets above requires a deep learning (DL) framework. Machine learning (ML) frameworks are too brittle and myopic to provide any of the required capabilities, especially as they grow in complexity. They fall especially short of preventing unknown threats.The power of DL stems from its ability to continuously learn and adapt, making autonomous connections as it encounters more data. In turn, it grows in efficacy against unknown and zero-day threats over time and can be integrated across data estates. Additionally, the speed with which DL models can ‘think’ and make decisions far surpasses the speed of ML and analog models, which, in the case of cybersecurity, allows it to scan files at much greater speed and volume with a much smaller footprint.And, because DL models don’t rely on comparative analysis to determine if a file is malicious, they can explain why files are quarantined or prevented. Utilized alongside a generative AI model that can translate results into plain language, true explainability can be achieved, augmenting human teams and speeding the investigation and remediation process while reducing burnout.<h2>Next Steps</h2>DL models don’t grow on trees. In fact, there are only around a dozen publicly known DL frameworks in the world—and 11 have nothing to do with cybersecurity. Deep Instinct’s <a href="https://www.deepinstinct.com/dsx/brain">DSX Brain</a> is the only purpose-built deep learning framework for cybersecurity and the only solution positioned to meet the present and future needs of organizations looking to implement preemptive data security in their environments.Cybercrime isn’t waiting for defenders to catch up. When AI saturation happens (sooner rather than later), traditional defenses are going to collapse. The legacy players in the cybersecurity space have not built the technological foundation necessary to transition to preemptive security. Training models that can prevent threats require a huge investment in AI researchers, hardware, data, and time. Unfortunately, time is the rarest commodity on that list.Deep Instinct is built to fight the future. We provide better security with better AI. We fight Dark AI with better AI. And we are capable of providing the capabilities that comprise a true preemptive data security solution today.Try Deep Instinct now; <a href="https://www.deepinstinct.com/free-scan">request your free scan</a>. Put us to the test.

The Future Has Arrived: Defining Preemptive Data Security

Learn more about the LockBit ransomware group and explore the latest evolution of LockBit ransomware with its 4.0 version release.

Lockbit3_Blog_Image_1_930x400.png

RaaS Evolved: LockBit 3.0 vs LockBit 4.0

Join David Trigano and Alex Kozodoy as they explain the present and future of AI-powered cyberthreats and learn what is necessary to fight back against increasingly powerful AI tools.

android-hacker4-930x400.png

The cyberattack lifecycle has been supercharged by generative AI. It is faster, more effective, and more dangerous than ever before. Large Language Models (LLMs) are being<a href="https://www.deepinstinct.com/blog/beyond-flesh-and-code-building-an-llm-based-attack-lifecycle-with-a-self-guided-agent"> </a><a href="https://www.deepinstinct.com/blog/beyond-flesh-and-code-building-an-llm-based-attack-lifecycle-with-a-self-guided-agent">leveraged for malicious purposes</a>, aiding in recon, crafting highly convincing phishing campaigns, generating proof-of-concept (PoC) exploits, and even assisting in malware development. As these capabilities continue to grow in sophistication, AI will reshape the threat landscape, posing significant challenges for cybersecurity professionals.The following blog explores several ways AI is already being used to shape cybercrime and cybersecurity. It delves into the methods empowered by LLM capabilities with key use cases. The future of AI-based and powered attacks isn’t a far-flung possibility, it’s here now—and it’s incredibly dangerous.<h5>AI-Driven Reconnaissance</h5>Building an understanding of an organization and identifying key targets within it has been significantly accelerated through the use of AI. Advanced Persistent Threat (APT) groups from China, Iran, North Korea, and Russia have reportedly used AI to automate this process, allowing them to achieve the following:<ul><li>Identify and prioritize high-value targets via analysis of organizational hierarchies, business disclosures, and employee social media&nbsp;</li></ul><ul><li>Conduct large-scale scanning of networks and systems for potential traffic changes and vulnerabilities</li></ul><ul><li>Optimize attack strategies based on collected intelligence, such as C-Suite travel and communication patterns, allowing for targeted attacks at opportune times, sometimes aided by advanced phishing and vishing techniques</li></ul>Google’s Threat Intelligence Group<a href="https://cloud.google.com/blog/topics/threat-intelligence/adversarial-misuse-generative-ai"> </a><a href="https://cloud.google.com/blog/topics/threat-intelligence/adversarial-misuse-generative-ai">reported that APT42, an Iran-backed group, were the heaviest users of Gemini</a>, using it to perform recon on defense experts and organizations and craft advanced phishing campaigns. They combined their usage with other open-source tools and tactics to breach key targets in both the public and private sectors, demonstrating the effectiveness of early-stage LLM usage.<h5>AI-Powered Phishing and Social Engineering Attacks</h5>In conjunction with advanced recon techniques, attackers are using AI to enhance phishing and social engineering tactics. In recent months, APTs—particularly those from North Korea, China, and Iran—have been observed deploying AI-generated phishing campaigns with increased sophistication. Notable AI-enhanced social engineering tactics include the following:<ul><li>Automated Spear-Phishing: Using data gathered by AI during the recon phase, attackers leveraged AI to generate massive amounts of highly personalized phishing emails that are both contextually relevant and persuasive, increasing the likelihood of successful intrusions. This method has been used extensively by Iran against both American and Israeli targets.</li></ul><ul><li>Deepfake Scams: Attackers employ AI-generated deepfake audio and video to impersonate trusted individuals. These deepfakes deceive targets into taking malicious actions, such as transferring funds or divulging sensitive information. In the <a href="https://www.cnn.com/2024/05/16/tech/arup-deepfake-scam-loss-hong-kong-intl-hnk/index.html" target="_self">Arup Group attack</a>, for example,&nbsp; AI-generated voice and images were used to fraudulently extract $25 million dollars from the multinational design and engineering company.</li></ul>With AI continuously improving the realism of phishing lures and impersonations (and utilizing more powerful research methods), <a href="https://www.deepinstinct.com/deep-instinct-vs-competitors" target="_self">legacy cybersecurity detection tools</a> are struggling to keep up. The fidelity of the fakes and the information used to produce them has even fooled trained professionals.<h5>AI Vulnerability Discovery and Exploitation</h5>Beyond reconnaissance and phishing, AI tools are also being deployed to discover technical vulnerabilities and quickly exploit them. Attackers are using AI to achieve the following:<ul><li>Identify and exploit security weaknesses in software and networks, including reverse-engineering patches</li></ul><ul><li>Discover potential zero-day exploits, proven conceptually by Google’s ‘Big Sleep’ agent</li></ul><ul><li>Generate code that can exploit weaknesses and vulnerabilities faster than defenders can respond</li></ul>Google’s proof that AI agents could discover potential zero-day vulnerabilities is a chilling sign of what’s to come. The acceleration of zero-day attacks powered by AI discovery and exploitation tools will likely put defenders on the back foot, especially if they are not given tech solutions that can preemptively prevent attacks or respond at speed to breaches.<h5>AI-Assisted Malware Development</h5>Although AI-generated malware is not highly advanced yet, attackers have found ways to jailbreak mainstream LLMs (such as OpenAI’s models or Gemini) to aid in malware development. Simultaneously, a stable of malicious LLMs specifically tailored for criminal activities, including WormGPT, WolfGPT, EscapeGPT, FraudGPT, and GhostGPT, are also being developed, removing the safeguards put in place in the mainstream models. Threat actors currently use AI chatbots to:<ul><li>Generate and troubleshoot malicious code; GhostGPT is particularly adept and costs only $50. It is marketed to hackers and lacks any of the ethical blocks that mainstream models have, enabling quick vulnerability discovery and exploitation.</li></ul><ul><li>Localizing malware to bypass regional security measures. A Russian APT group used Gemini to morph existing malicious code to skirt known security measures, rather than developing entirely new malware.</li></ul>The speed with which AI has advanced means that AI-generated malware will become extremely complex very quickly. With the increasing availability of advanced “open” AI chatbots like DeepSeek, attackers are able to refine their malware toolsets, making them more adaptive and evasive.<h5>The Next Phase: AI-Generated Polymorphic Malware</h5>One of the most alarming possibilities is the potential for AI to generate polymorphic malware. This type of malware continuously mutates its code, making traditional signature-based detection methods ineffective. As AI enhances malware’s ability to autonomously modify its structure and evade security defenses, security teams must adopt more advanced behavioral analysis techniques to counter this growing threat.<h6>The Looming Future: AI-Powered Autonomous Malware</h6>Soon, attackers will move beyond ‘simple’ AI-generated malware and begin developing AI-powered autonomous malware, enabling smarter, far more devastating attacks. Unlike traditional malware, AI-powered malware will be smarter, performing functions autonomously to bypass security. If it reaches the level that experts fear, it will be able to:<ul><li>Adapt its behavior in real time to evade detection and bypass legacy protection mechanisms across the data estate</li></ul><ul><li>Alter its attack techniques based on an environment’s defenses, making incident response significantly more challenging</li></ul><ul><li>Leverage reinforcement learning to optimize attack strategies, continuously improving effectiveness against evolving security measures</li></ul>This step beyond polymorphic malware could lead to an unprecedented surge in sophisticated cyberattacks, specifically designed to overwhelm existing defense systems and react to attempts to stop it.<h5>The Impact on Attribution and Threat Intelligence</h5>As AI-generated attacks grow in complexity, attribution will become increasingly difficult. AI can mimic the attack patterns, tools, and techniques of other threat actors, effectively masking the true origin of an attack. This obfuscation has already been used by Russian and Iranian APT groups to achieve the following:<ul><li>Complicate forensic investigations and <a href="https://researchonline.nd.edu.au/cgi/viewcontent.cgi?article=1089&context=law_article#:~:text=In%20particular%2C%20identifying%20who%20is,and%20potentially%20who%20is%20responsible.">confuse national defense planning and response</a></li></ul><ul><li>Hinder intelligence-sharing efforts, especially amongst groups relying on multi-member input, such as Five Eyes</li></ul><ul><li>Reduce the effectiveness of traditional attribution methodologies</li></ul>Each of these complicates the already<a href="https://www.deepinstinct.com/voice-of-secops-reports"> </a><a href="https://www.deepinstinct.com/voice-of-secops-reports">stressful role of security teams and researchers</a>, ratcheting up the pressure on defenders while slowing down national response to legitimate threats.The nature of stolen data reveals insightful details about the plans of an adversary; the industries they’re targeting, patterns of attack, and what they are focused on disrupting. However, if the adversary can’t be reliably identified, defenders are left trying to strategize for multiple scenarios, complicating response and planning efforts.<h5>Preparing for the AI-Driven Threat Landscape</h5>To stay ahead of these emerging threats, organizations must adopt what Gartner has recently dubbed preemptive cybersecurity solutions–technologies designed to prevent cyberattacks before they achieve their objectives. Key steps to reaching a preemptive cybersecurity posture include:<ul><li>Investing in AI-driven cybersecurity solutions that can detect and mitigate AI-generated threats. Attackers are using AI that is too advanced to be stopped by legacy tools or human response alone. Keeping organizations operational and breach free requires defensive solutions that can outpace offensive AI.</li></ul><ul><li>Implementing a deep learning-based security approach: Deep learning provides the most advanced defense against AI-driven threats by enabling real-time anomaly detection and automated threat analysis using the most advanced version of AI. Unlike traditional security models, deep learning solutions can:<ul><li>Identify and classify sophisticated attack patterns</li><li>Adapt to emerging cyber threats without reliance on static rules</li><li>Analyze large-scale datasets to detect zero-day exploits and AI-powered malware</li></ul></li></ul>Purpose-built<a href="https://www.deepinstinct.com/blog/-detect-and-respond-is-not-the-answer-the-need-for-proactive-zero-day-data-security"> </a><a href="https://www.deepinstinct.com/blog/-detect-and-respond-is-not-the-answer-the-need-for-proactive-zero-day-data-security">zero-day data security</a> measures are the necessary foundation of preemptive cybersecurity, empowering defenders to prevent attacks with solutions built from the ground up to combat the growing threat of AI attacks. By focusing on proactive defense mechanisms that neutralize threats before they can exploit vulnerabilities, security teams gain the upper hand and push back against ever-more aggressive attackers.<h5>A Final Prediction:</h5>By 2026, AI-powered malware and automated vulnerability discovery will become standard tools in cybercriminal arsenals. AI will enable attackers to conduct real-time, autonomous exploit development and deployment, significantly reducing the time between vulnerability discovery and exploitation. They will be able to perform these attacks at scale and speed using virtual ‘ai-factories’ equipped with agentic AI and other technologies, increasing the need for a zero-day response that can keep up.As AI-driven threats evolve, organizations that rely on traditional security methods will find themselves unable to cope with the speed and scale of modern cyberattacks. The adoption of AI-driven threat detection, deep learning-based behavioral analysis, and zero-day data security solutions is critical to mitigating these emerging threats. Organizations that fail to invest in these technologies will face an increasingly hostile and overwhelming cyber landscape.<h5>Conclusion</h5>The future of cybersecurity will be defined by the ongoing battle between AI-powered attacks and AI-driven defenses, making it imperative for organizations to continually refine their strategies to stay ahead of the curve.Traditional security measures are no longer sufficient in an AI-driven threat environment. Organizations must adopt a preemptive cybersecurity approach and leverage real-time deep learning-driven techniques to prevent and explain threats before they can cause harm. Security professionals need solutions that ensure even novel, previously unknown attack vectors can be identified and mitigated before exploitation occurs. This proactive defense strategy is essential to countering AI-generated threats and maintaining cybersecurity resilience. Experience preemptive cybersecurity in your own environment. <a href="https://info.deepinstinct.com/request-a-demo?_ga=2.104260868.58286214.1741716281-2103417061.1736868269" target="_self">Request your free scan now</a>.

The Rise of AI-Driven Cyber Attacks: How LLMs Are Reshaping the Threat Landscape

Join Deep Instinct experts David Trigano and Alex Kozodoy as they explain why DSPM doesn't provide adequate protection in the current cybersecurity landscape and how a zero-day data security approach is the answer. 

DSPM-930x400_1.png

In the past decade, the volume, variety, and velocity of data in enterprise estates has increased exponentially. Along with it, there has been an explosion in the accessibility of that data. In response, <a href="https://www.gartner.com/reviews/market/data-security-posture-management">Data Security Posture Management (DSPM)</a> emerged, offering visibility and governance for data security and compliance. Championed by analysts like Gartner, DSPM sought to address gaps in traditional security frameworks, helping enterprises identify and manage vulnerabilities.While DSPM tools have proven valuable in addressing foundational security challenges, they are no longer sufficient in today’s complex threat landscape. Attackers are leveraging advanced techniques, including weaponized DarkAI (AI tools adopted for malicious purposes, like automated vulnerability discovery), to ratchet up the efficacy and volume of their attacks. To secure their data, enterprises need more than visibility and monitoring—they require a defense-in-depth strategy built around proactive prevention and remediation capabilities. <h5>The Past and Present of DSPM</h5>Gartner introduced DSPM in 2022 as a critical component of modern security strategies, emphasizing the need for comprehensive visibility into data flows, security posture, and compliance. The promise was clear: it would empower organizations to discover, classify, and secure sensitive data across hybrid and multi-cloud environments, ensuring compliance with regulations like GDPR, HIPAA, and CCPA.However, the DSPM market’s promise was disrupted by constant acquisitions of several promising startups in the space by larger platform-based cybersecurity providers:<ul><li>Dig Security was acquired by Palo Alto Networks, integrating its data visibility features into Palo Alto’s Cloud-Native Application Protection Platform (CNAPP) offering.</li><li>Flow Security joined CrowdStrike’s broader data security portfolio.</li><li>Laminar joined Rubrik, a storage recovery &amp; backup provider.</li></ul>These acquisitions reflect a consolidation trend that narrows DSPM’s scope. Instead of evolving into comprehensive solutions, many became feature sets within larger platforms, losing their standalone value. As with many startup acquisitions, the initial aim and trajectory of the technology were curtailed to fit the broader needs of the acquiring organization.Instead of maturing in the hands of the most competent and passionate players, it was redirected. Alongside the development of AI technologies, AI-integrated DSPM could have served an important gatekeeper role in comprehensive cybersecurity strategies. As it stands, DSPMs are falling into the same failing paradigm as other legacy tools.<h5>Why DSPM is No Longer Sufficient</h5>Despite its benefits, DSPM has inherent limitations that make it inadequate as a standalone solution:1. Reactive, not proactive: Most DSPMs operate as monitoring solutions, offering insights and alerts but not preventing threats. They may detect anomalies or non-compliance but leave remediation to slow and error-prone manual processes.2. Focused on exfiltration: DSPMs largely focus on preventing sensitive data from leaving the organization. However, attackers and malicious insiders have limitless ways to manipulate or exfiltrate data, from encrypted channels to API abuse. Once they have access, accounting for attackers’ varied tactics and capabilities is nearly impossible. Human creativity and intelligence, combined with powerful AI tools, have created a hydra. For every vulnerability closed, two more open. Preventing threats is the key to preventing exfiltration.3. Remediation gaps: While DSPMs identify risks, they often fail to offer smart (context-aware) and automated remediations. Even fewer take responsibility for executing these remediations, leaving enterprises vulnerable to delayed responses. This responsibility falls to overburdened security teams who now have to figure out how to close those gaps.<h5>Zero-Day Data Security: A New Standard</h5>The emergence of DarkAI has made the threat landscape more unpredictable. <a href="https://www.deepinstinct.com/blog/beyond-flesh-and-code-building-an-llm-based-attack-lifecycle-with-a-self-guided-agent">Attackers can now generate sophisticated, never-before-seen malware</a> that exploit vulnerabilities in ways traditional DSPMs cannot anticipate. As a result, organizations relying solely on DSPM are exposed to unknown risks with inadequate security tools.Enter<a href="https://www.deepinstinct.com/blog/-detect-and-respond-is-not-the-answer-the-need-for-proactive-zero-day-data-security"> </a><a href="https://www.deepinstinct.com/blog/-detect-and-respond-is-not-the-answer-the-need-for-proactive-zero-day-data-security">Zero-Day Data Security (ZDDS)</a>, a new paradigm. Unlike DSPM, which focuses on visibility and preventing data exfiltration, ZDDS prioritizes proactive prevention and remediation. It secures data wherever it’s found against known and unknown threats. Deep Instinct leads the way in ZDDS with Data Security X (DSX).DSX prevents threats before they compromise data using the world’s only deep learning (DL) framework (a specialized AI architecture that learns patterns from massive datasets) trained for cybersecurity. The <a href="https://www.deepinstinct.com/dsx-brain">DSX Brain</a> is trained on billions of data points to recognize and prevent threats before they execute. Rather than just alerting on known threats and vulnerabilities, as DSPM does, DSX prevents the most sophisticated and dangerous unknown threats. Here’s how:<ul><li>Proactive prevention: Effective ZDDS leverages DL and AI-driven threat detection to block attacks before they occur, safeguarding sensitive data.</li><li>End-to-end coverage: ZDDS is flexible and adaptive enough to provide seamless protection across diverse data estates, whether it’s on-premises, hybrid, or in the public cloud.</li><li>Automated remediation: ZDDS doesn’t just identify risks, it neutralizes them. Solutions like <a href="https://www.deepinstinct.com/dsx/dsx-cloud-storage">DSX for Cloud</a> and <a href="https://www.deepinstinct.com/dsx/dsx-network-attached-storage">DSX for NAS</a> have prevention embedded into the workflow, ensuring proactive response without manual intervention.</li></ul>ZDDS is the next frontier in data security, and DSX is the trailblazer, providing organizations with the means to defend against today’s most advanced threats. By adopting a ZDDS solution, enterprises can go beyond compliance and visibility to achieve true resilience against data breaches and attacks.<h5>Conclusion</h5>DSPM was a crucial step forward in data security, but it is no longer sufficient in the face of today’s sophisticated threats. Its consolidation into broader platforms underscores its limitations and the need for a more proactive and comprehensive approach.ZDDS is not just a buzzword—it’s a necessity, the next crucial step forward. As the threat landscape evolves, enterprises must adopt solutions like <a href="https://www.deepinstinct.com/dsx">Data Security X (DSX)</a> to stay ahead of attackers and ensure data integrity. In this new era, prevention is not optional; it is the cornerstone of security.To experience zero-day data security powered by DSX in your environment, request your <a href="https://deepinstinct.com/demo">free scan</a>.

DSPM: A Good Start; Not the Answer

Follow along with Justin Baker as he explains the importance of zero-day data security, a strategy of detecting and preventing threats before they breach security, instead of reacting after data has been compromised.

Proactive Zero-Day-930x400_1.png

Cybersecurity defenses are more advanced than ever, yet maintaining their overall effectiveness remains a persistent challenge. Cybercriminals are always on the offensive, continually refining their tactics to outmaneuver every new security innovation brought to market, especially in the era of AI.Fortunately, the ball is in our court. We have the means to adapt, but little time to respond. If we lack urgency or respond with the wrong strategies and solutions, we will see billions in new ransomware costs, more insidious nation-state attacks, further encroachment on our personal data, and the potential expansion of physical-space attacks. We need to get it right.<h5>The Acceleration of Zero-Day Attacks</h5>Today’s fight is against zero-day attacks and unknown malware, which have proliferated with the widespread use of <a href="https://www.deepinstinct.com/blog/beyond-flesh-and-code-building-an-llm-based-attack-lifecycle-with-a-self-guided-agent">generative AI tools </a><a href="https://www.deepinstinct.com/blog/beyond-flesh-and-code-building-an-llm-based-attack-lifecycle-with-a-self-guided-agent">in the hands of cybercriminals</a>. Bad actors can now generate and modify new attacks with tools easily found on the dark web, allowing them to launch attacks with alarming speed and regularity. It’s adding overwhelming pressure to defenders who must be continually vigilant against new tactics and behaviors.Since 2018, the number of zero-day attacks has been on the rise. Recent research from IBM, Cisco, and Google document the alarming increase: more zero-day attacks were reported in 2021 than in the prior three years combined; in 2023, 97 zero-day attacks were reported, beating the high of 2021. In May 2024, Rapid7 published the following in their Threat Intelligence Report:“A consistently high level of zero-day exploitation over the last three years. Since 2020, our vulnerability research team has tracked both scale and speed of exploitation. For two of the last three years, more mass compromise events have arisen from zero-day exploits than from n-day exploits. 53% of widely exploited CVEs in 2023 and early 2024 started as zero-day attacks.” What makes these attacks particularly concerning is that they target undefended, unknown vulnerabilities. Their effects are wide-reaching and catastrophic, leaving organizations to defend against breaches that have already happened, rather than proactively preventing them from happening in the first place.In 2024, the average cost of ransomware rose across industries, reaching $5.2 million by mid-year. The price of remediation grew alongside the price of ransom. In addition to the dollar cost of these attacks, organizations face reputation damage, and SOC teams face yet another escalation in pressure, <a href="https://www.deepinstinct.com/voice-of-secops-reports">contributing to growing levels of burnout</a>.Traditional “detect and respond” cybersecurity tools and strategies are no longer effective. A solution that can not only detect never-before-seen malware, but prevent it, is not only necessary—it’s the only path forward. AI-powered <a href="https://www.deepinstinct.com/dsx/zero-day-data-security" target="_self">zero-day data security (ZDDS)</a> is the answer.<h5>The Abrupt Decline of Legacy Solutions</h5>The accelerating scale and sophistication of modern cyberattacks, particularly zero-day exploits, have rendered reactive methods ineffective. Attacks happen so quickly today that by the time a breach is detected, attackers have already encrypted or exfiltrated sensitive data. This speed makes reactive approaches not only futile but also costly in terms of recovery and damage control.Even with tools boasting high detection rates, a small miss rate—say, 5%—can result in catastrophic breaches when facing thousands of daily threats. And most tools aren’t anywhere near that efficient.The reality is that organizations can no longer afford to rely on outdated detection methods or wait for an attack to happen before acting. Unfortunately, much of the cybersecurity market isn’t positioned to deal with these threats.Zero-day threats are particularly difficult to defend against using <a href="https://www.deepinstinct.com/deep-instinct-vs-competitors" target="_self">legacy security measures</a>. Malware slips past defenses, unrecognized and undetected, landing in storage or on user machines. Popular signature-based tools are now a liability because:<ul><li>The updates necessary to try and keep pace are unsustainable</li><li>They typically only catch known threats</li><li>The underlying technology is outdated</li><li>Management costs have ballooned</li><li>The LLM weapons used by criminals, so-called DarkAI, are more advanced than the ML used by legacy tools</li></ul>The only way to combat this surge of attacks without completely closing an environment off from the outside world is by using a solution specifically designed to combat zero-day attacks.<h5>The Path Forward: Zero-Day Data Security</h5>Preventative ZDDS, powered by deep learning (DL)—the most advanced form of AI—is the future of cybersecurity. Deep Instinct is at the forefront of this effort. We use our <a href="https://www.deepinstinct.com/dsx-brain" target="_self">purpose-built DL cybersecurity framework</a> to prevent and explain unknown threats in real time. We fight AI with better AI and help organizations dramatically reduce their exposure to malware, ransomware, and zero-day attacks.The ability to stop an attack in its tracks—before it’s even identified by a “signature”—is the key to staying ahead in a rapidly evolving threat landscape. Moving from a reactive approach to a proactive strategy is necessary as cyberattacks increase in volume and sophistication.Organizations must invest in technologies focused on fighting the future of cybercrime. This means being bolder in taking on new contracts, integrating new solutions more swiftly, and putting less effort towards trying to make existing tools do something they were not designed to do.Waiting for an attack to happen—and then reacting—is simply too risky. The costs, both financially and reputationally, are too high. The price of an effective cybersecurity solution is a fraction of the cost of a breach.<h5>Conclusion</h5>With AI-driven threats, zero-day vulnerabilities, and the overwhelming scale of cyberattacks, you can’t afford to innovate slowly. Your enemies aren’t. They’re harnessing every possible AI tool to achieve their goals and finding it easier than ever to break through underperforming and overwhelmed defenses. Beleaguered security teams can no longer hope that their detection systems will catch everything, because they won’t.Deep Instinct is the leading ZDDS vendor on the market. <a href="https://www.deepinstinct.com/dsx">Deep Instinct Data Security X (DSX)</a>, is the first and only purpose-built ZDDS product built from the ground up on the world’s only DL cybersecurity framework to prevent and explain unknown threats no one else can find. It provides unparalleled protection against zero-day threats across your entire data ecosystem with <a href="https://www.deepinstinct.com/dsx-brain">unmatched prevention capabilities</a>, real-time malicious verdicts, and <a href="https://www.deepinstinct.com/dsx-companion">detailed explainability</a>, solving the growing problems of cybersecurity.To learn more about how to proactively protect your organization and its data, no matter where it resides, read about our approach to ZDDS <a href="https://www.deepinstinct.com/dsx">here</a>. Then request your <a href="https://info.deepinstinct.com/request-a-demo?_ga=2.78054167.2026569605.1737992833-777567433.1721843012">free scan</a>.

“Detect and Respond” is Not the Answer: The Need for Proactive Zero-Day Data Security

Explore how Deep Instinct’s GenAI-powered malware analysis tool, DIANNA, the DSX Companion, leverages Amazon Bedrock to revolutionize cybersecurity explainability by providing rapid, in-depth analysis of known and unknown threats in minutes, enhancing the capabilities of SOC teams and addressing key challenges in the evolving threat landscape.

Meta_Dianna-930x400.png

DIANNA: Deep Instinct's Artificial Neural Network Assistant - Powered By Amazon Bedrock

Follow along with Security and Threat Research Team Leader Mark Vaitzman as he gives a brief history of LLMs and describes step-by-step how LLMs can empower attack lifecycles, making cyberthreats more dangerous.

Robot_1200x627.png

Large Language Models (LLMs) are rapidly evolving, and their capabilities are attracting the attention of threat actors. This blog explores how malicious actors are utilizing LLMs to enhance their cyber operations and then delves into LLM-based tools and an advanced stealer managed by artificial intelligence (AI).While LLMs hold immense potential for improving cybersecurity through threat detection and analysis, their power can also be wielded for malicious purposes. Recent reports suggest that cybercriminals and nation-state actors are actively exploring LLMs for different tasks such as code generation, phishing emails, scripts, and more. We’ll elaborate on just a few examples in this blog.The last times we saw such significant technological changes influencing everyday life were the four industrial revolutions (1765 – Oil, 1870 – Gas, 1969 – Electronics and Nuclear, and 2000 – Internet and Renewable Energy). Many believe that AI—and LLMs, which are part of AI—is the next industrial revolution, capable of reshaping industries, including crime, as new cyber threats emerge.Cybersecurity is a very dynamic field, but there are still a few basic aspects that haven’t changed – one of which is the attack lifecycle. The cyber attack lifecycle, often referred to as the Cyber Kill Chain, includes the following stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control (C2), and actions on objectives.First, I’ll give a brief history of AI and then, using LLMs, I will provide a full attack lifecycle and demonstrate how threat actors could employ them, the risk they pose, and their potential future uses. LLM-based tools can play a significant role in various stages of the cyber attack lifecycle, including fully managing the final stage of the Payload and C2 – and that’s the most interesting part of this blog. The bottom line is that AI as a whole, and LLMs in particular, are very powerful and will get better with time. In the wrong hands, they will cause significant damage. The only way to fight the abuse of LLMs is with AI and advanced Deep Learning prevention alogorithms.<h5>The Long Way to the Present Day LLM</h5>Let's start with an introduction to AI and LLMs before they became mainstream. I started working with AI when I built my first Prolog app, which is a declarative programming language designed for developing logic-based AI applications.Prolog is based on four main elements: Facts, Rules, Variables, and Queries. The original version is 52 years old and even the most current version is 24 years old. At the time of its creation there was not enough data for the facts, and the queries had to be pre-defined and barely customized during usage. Despite that, it was used for building chatbots like Zamia AI.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt4cacfae68c0a2bc8" width="583" alt="Figure 1: Zamia AI" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt4cacfae68c0a2bc8/67855a294ac08c6dd62a053f/fig1-Zamia-AI-main.png" height="789" /><figcaption style="text-align: center;" style="text-align: center;">Figure 1: Zamia AI</figcaption></div></figure><figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt8f3c53a01e1f6b06" width="548" alt="fig2-Zamia-AI-Chat.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8f3c53a01e1f6b06/67855a29b33932b1322143ac/fig2-Zamia-AI-Chat.png" height="298" /><figcaption style="text-align: center;" style="text-align: center;">Figure 2: Zamia AI Chat</figcaption></div></figure>When we think about AI today, we envision complex systems and advanced chatbots like ChatGPT equipped with complicated infrastructure and powerful problem-solving skills. However, AI was not always so advanced. Early examples of AI often took the form of chatbots. They seem simple now, but they were groundbreaking innovations that ushered new concepts and tools into the world.Let’s look at some of them:Eliza (1966) - This first-ever chatbot was developed by MIT professor Joseph Weizenbaum in the 1960s. Eliza was programmed to act as a psychotherapist to users.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt39109eebae6dd559" width="674" alt="fig3-Eliza-chatbot.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt39109eebae6dd559/67855a299c8312d204b48ed5/fig3-Eliza-chatbot.png" height="350" /><figcaption style="text-align: center;" style="text-align: center;">Figure 3: Eliza Chatbot 1966</figcaption></div></figure>Parry (1972) - A natural language program that simulated the thinking of a paranoid individual. Parry was constructed by American psychiatrist Kenneth Colby in 1972.ChatterBot (1988) - British programmer&nbsp;<a href="https://en.wikipedia.org/wiki/Rollo_Carpenter">Rollo Carpenter</a> created the Chatterbot in 1988. It evolved into Cleverbot in 1997.&nbsp;Fun fact– ChatterBot was active until 2023. <a href="https://www.cleverbot.com/">Cleverbot</a> is still operating and accessible today.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="bltb6ebe6bd89db5d9f" width="368" alt="fig4-CleverBot-Chatbot.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb6ebe6bd89db5d9f/67855a29a840ac66f7d5161e/fig4-CleverBot-Chatbot.png" height="298" /><figcaption style="text-align: center;" style="text-align: center;">Figure 4: CleverBot Chatbot</figcaption></div></figure>DR SBAITSO (1992) - This chatbot was created by Creative Labs for MS-DOS in 1992. It is one of the earliest chatbots to incorporate a full voice-operated chat program. You may try it out with an <a href="https://classicreload.com/dr-sbaitso.html">MS-DOS emulator</a>.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt75aad27671c9d80c" width="778" alt="fig5-DR-Sbaitso-Chatbot.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt75aad27671c9d80c/67855a2926c6b42b6a3efe55/fig5-DR-Sbaitso-Chatbot.png" height="326" /><figcaption style="text-align: center;" style="text-align: center;">Figure 5: DR SBAITSO Chatbot</figcaption></div></figure>&nbsp;A.L.I.C.E. (1995) – A universal language processing chatbot that uses heuristic pattern matching to carry conversations. Richard Wallace pioneered the construction of ALICE in 1995.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="bltc341c7a55fbb99f1" width="1378" alt="fig6-ALICE-Chatbot.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc341c7a55fbb99f1/67855a297854593beb60b083/fig6-ALICE-Chatbot.png" height="460" /><figcaption style="text-align: center;" style="text-align: center;">Figure 6: ALICE Chatbot</figcaption></div></figure>The evolution of AI and its applications is ongoing. Despite the popularity AI now has, researchers have been studying and experimenting with it for decades. Natural Language Processing, Machine Learning, and Deep Learning technologies have all existed for years. And, as shown by the timeline above, assistant-like chatbots were already popular –&nbsp; by combining the idea of an AI assistant with actual AI technology, chatbots with voice recognition burst onto the scene. Later, refining and evolving what we created, we developed the almighty LLMs:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt2099abc03b83a316" width="822" alt="fig7-Chatbots-evolution.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2099abc03b83a316/67855a2a5dc3c373fb1dff58/fig7-Chatbots-evolution.png" height="260" /><figcaption style="text-align: center;" style="text-align: center;">Figure 7: Chatbots and recent LLMs</figcaption></div></figure>Now that you have a better understanding of the timeline of AI, chatbots, and LLMs, let’s get into how the unique capabilities of LLMs can help facilitate a cyber attack.<h5>Not all Chatbots are LLMs</h5>LLM is an evolution of Natural Language Processing (NLP), but there are some key differences, as shown in the following graphic:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img width="1052" alt="Screenshot_2025-01-14_at_2.32.10_PM.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt127f601c1983a0c4/6786bbcbbd2b7423333152ef/Screenshot_2025-01-14_at_2.32.10_PM.png" height="551" style="max-width: 1052px;width: 1052px;height: 551px;" max-width="1052" /><figcaption style="text-align: center;" style="text-align: center;">Figure 8: NLP vs LLM</figcaption></div></figure>There are multiple capabilities unique to LLMs that enable the attack flow POC I’m about to describe.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blta1391ffcefcf764f" width="849" alt="fig9-LLM-capabilities.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blta1391ffcefcf764f/67855a2a66c78759deba45d0/fig9-LLM-capabilities.png" height="396" /><figcaption style="text-align: center;" style="text-align: center;">Figure 9: LLM Capabilities for the Attack Flow POC</figcaption></div></figure><h2>Building an LLM Attack Lifecycle</h2><h5>Understanding the Attack Lifecycle</h5>In order to begin, we have to understand why the attack lifecycle is the perfect methodology to prove that LLMs can perform a full multistage attack on their own. The term “Attack lifecycle” represents the stages in a cyber attack flow, also known as the Attack Kill Chain. These stages, when executed correctly, can lead to a successful attack. Therefore, there are multiple security products that are expected to stop the attack in each stage and kill the chain, disrupting the attack.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt9478e1de7b400c6d" width="1200" alt="fig10-Attack-lifeCycle.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9478e1de7b400c6d/67855a2a9f3ffe210a1d7029/fig10-Attack-lifeCycle.png" height="413.63" /><figcaption style="text-align: center;" style="text-align: center;">Figure 10: Attack Lifecycle</figcaption></div></figure>The Attack Lifecycle follows these steps:<ul><li>Recon: Gathering information about the target (e.g., network topology, employees, vulnerabilities) to identify weaknesses or valuable entry points.</li><li>Weaponization: Creating a malicious payload (such as a virus, malware, or exploit) and preparing it to be delivered to the target system.</li><li>Delivery: Transmitting the weaponized payload to the target, typically through methods like email attachments, malicious links, or infected websites.</li><li>Exploitation: Triggering the payload to exploit a vulnerability in the target system (e.g., executing a malicious code or exploiting a software flaw).</li><li>Installation: Installing the malware or exploit onto the target system, often establishing persistence so the attacker can maintain access over time.</li><li>Command and Control (C2): Establishing a remote connection between the compromised system and the attacker’s infrastructure to control and issue commands to the infected system.</li><li>Actions on Objective: Carrying out the attacker’s primary goals, such as stealing data, spreading malware, disrupting operations, or further exploiting the network.</li></ul><h5>Initial Reconnaissance</h5>LLMs can automate the process of gathering information from publicly available sources such as social media and technical forums about target systems and individuals.After choosing the victim or the sector, one of the most important stages begins: Initial Reconnaissance. This phase is where information gathering and identification of potential entry points happens.Even though this stage is already fairly simple due to powerful search engines like Google and scanning services like Shodan and Censys, LLMs have made it even easier and faster.For our POC, we’ll start by identifying a possible pool of initial vectors and their victims – a chatbot can help with that.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt60e639ae21c4bfc7" width="525" alt="fig11-vulnerabilities-chatGPT.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt60e639ae21c4bfc7/67855a49baaf228ec928af43/fig11-vulnerabilities-chatGPT.png" height="535" /><figcaption style="text-align: center;" style="text-align: center;">Figure 11: ChatGPT Query and Vulnerability Explanation</figcaption></div></figure>Censys, a well-known worldwide internet scanning platform, helps information security practitioners discover, monitor, and analyze devices. When integrated with an LLM chat it makes the search even easier and provides an actual pool of potential victims.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt481611daa29e50c3" width="434" alt="fig12-Censys-search-GPT-results.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt481611daa29e50c3/67855a49532fd65fdc5a29ba/fig12-Censys-search-GPT-results.png" height="446" /><figcaption style="text-align: center;" style="text-align: center;">Figure 12: Censys search results</figcaption></div></figure>Additionally, there are tools made specifically for OSINT that can automate the reconnaissance and scanning process. In fact, there are several LLMs built and trained specifically for that purpose, such as PentestGPT (originally known as HackerGPT).

Figure 46: Full flow agent idea demonstration We’re almost done! Next, I wanted to see what my LLM-guided malware can do with unrestricted LLMs. What would happen if I left the agent to run for a bit while I had some coffee?It tried to download and execute several tools but failed to do so since I tested the malware on an empty and new Linux VM. The agent tried to fix the errors by installing the missing common libraries.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt5de6dbc9602d702c" width="1161" alt="fig47-llm-guided-attempts-to-fix-missing-libraries.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5de6dbc9602d702c/67855aa538abf9e29d1f08df/fig47-llm-guided-attempts-to-fix-missing-libraries.png" height="738" /><figcaption style="text-align: center;" style="text-align: center;">Figure 47: LLM-Guided Malware Attempts to Install Additional Libraries to Avoid Failures</figcaption></div></figure><h5>Takeaways and Follow Ups</h5>Today, LLMs are already capable of making attacks faster and much more frequent.<ul><li>We could add the following to the POC to make it even more effective:<ul><li>Rewrite into a more efficient and less common language – Rust / GO</li><li>Build a packer for better and longer evasion</li><li>Try with local Tiny LLMs to work without the need of an external LLM server&nbsp;</li><li>Make the agent perform the request for the malware to be generated and compiled on request during the initial LLM communication using a polymorphic algorithm</li><li>Hunt for LLM-based malware – which can be tricky (keep an eye out for another blog on this topic)</li><li>Research and move the idea into BLM (Behavior Large Models – often developed for future robots) – DO NOT TRY AT HOME</li></ul></li></ul>Underestimated research – Recently, Claude announced that their latest version of <a href="https://www.anthropic.com/news/3-5-models-and-computer-use">Claude 3.5 “Sonnet”</a> will be able to follow user’s commands to move a cursor, click on relevant locations, and input information via a virtual keyboard to emulate the way people interact with their own computer. This capability is exactly what I was missing to make my LLM-guided malware even more efficient. Just after that, OpenAI announced “<a href="https://www.bloomberg.com/news/articles/2024-11-13/openai-nears-launch-of-ai-agents-to-automate-tasks-for-users">Operator</a>” with similar abilities. Finally, information was leaked that Google’s <a href="https://www.theverge.com/2024/10/26/24280431/google-project-jarvis-ai-system-computer-using-agent">Jarvis AI</a> can use a computer to take actions on a person's behalf.<h5>Conclusion</h5>My view of how LLMs will affect cyber attacks has evolved throughout my research; the cyber threats posed by LLMs are not a revolution, but an evolution. There’s nothing new there, LLMs are just making cyber threats better, faster, and more accurate on a larger scale. As demonstrated in this blog, LLMs can be successfully integrated into every phase of the attack lifecycle with the guidance of an experienced driver. These abilities are likely to grow in autonomy as the underlying technology advances.&nbsp;Defending against this evolution requires a corresponding evolution in the prevention methods. In order to break down the attack, defenders are only required to break down two of the stages (on average). It can be done. But defenders need the right tools to do it.We'll update this blog soon with video from the DeepSec Conference where this research was presented.If you are a cybersecurity professional who wants to fight AI with the best AI, then <a href="https://info.deepinstinct.com/request-a-demo">request your free scan</a> to see the power of cybersecurity’s only deep learning framework for yourself.Referenceshttps://github.com/MythicAgents/Medusastopwatch.iohttps://github.com/GreyDGL/PentestGPTCensys.comChatGPT.comGemini.comhttps://github.com/PhonePe/mantishttps://github.com/fin3ss3g0d/evilgophishhttps://github.com/kingridda/voice-cloning-AIhttps://github.com/nomic-ai/gpt4allhttps://github.com/kgretzky/evilginx3huggingface.comOllama.comWhiteRabbitNeo.comhttps://github.com/jasonacox/TinyLLMhttps://github.com/katanaml/sparrow