The researchers say they tested the malware against an industry-leading EDR solution, which they were kind not to name, and it repeatedly failed to detect the threat.Īlso read: Latest MITRE Endpoint Security Results Show Some Familiar Names on Top A New Breed of Threat The keylogger collects sensitive information, including usernames, passwords and credit card numbers, then uses Microsoft Teams to exfiltrate the data, sending it to an attacker-controlled Teams channel. “Every time BlackMamba executes, it re-synthesizes its keylogging capability, making the malicious component of this malware truly polymorphic.” “It then executes the dynamically generated code within the context of the benign program using Python’s exec() function, with the malicious polymorphic portion remaining totally in-memory,” Sims added. “BlackMamba utilizes a benign executable that reaches out to a high-reputation API (OpenAI) at runtime, so it can return synthesized, malicious code needed to steal an infected user’s keystrokes,” HYAS principal security engineer Jeff Sims wrote in a blog post detailing the threat. The BlackMamba PoC will likely heighten concerns that AI tools can be used by cybercriminals to create new exploits. See the top EDR and antivirus products Leveraging OpenAI In December, SafeBreach Labs researcher Or Yair discovered zero-day vulnerabilities in several EDR and antivirus tools, while in October, the BlackByte ransomware group was found to be actively exploiting a known driver vulnerability to bypass EDR protections. The malware has functionality to steal user credentials, provide shell access, and persist through firmware upgrades.” While the HYAS researchers may have been wearing white hats, Mandiant researchers this week reported on a “suspected Chinese campaign that involves maintaining long term persistence by running malware on an unpatched SonicWall Secure Mobile Access (SMA) appliance. The malware, dubbed “BlackMamba,” is the latest example of exploits that can evade even the most sophisticated cybersecurity products. HYAS researchers recently developed proof-of-concept (PoC) malware that leverages AI both to eliminate the need for command and control (C2) infrastructure and to generate new malware on the fly in order to evade detection algorithms.

Eset dynamic endpoint protection