Loading story…
A technical write-up demonstrated a compact decoder-only transformer for malware analysis that learns the byte-level structure of legitimate ELF binaries and uses perplexity to flag anomalous regions associated with packing or encryption. The approach trains a roughly 600K-parameter model in PyTorch on binaries from /usr/bin, applying transformer concepts introduced in Attention Is All You Need to binary analysis rather than natural language tasks.
The author reported that the model trained in about 25 seconds on an NVIDIA L20, reduced validation perplexity to roughly 14, and achieved a ROC-AUC of 0.994 when separating normal binaries from simulated packed samples across 80 held-out files. The article said the method outperformed simple Shannon entropy because it captures byte order and code structure, while cautioning that legitimate compressed resources can still trigger false positives and that the signal should be combined with section context and YARA rules for practical detection.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A blog post described an educational malware-analysis method using a small byte-level GPT model in PyTorch to detect packed or encrypted binaries via perplexity. The post reported a roughly 600K-parameter decoder-only transformer trained on legitimate ELF binaries and evaluated against simulated packed variants.
The foundational transformer paper 'Attention Is All You Need' was published on arXiv, introducing the architecture referenced by later GPT-style binary-analysis work.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecocomelonc.github.io
Open sourcepytorch.org
Open sourcearxiv.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Darktrace published a technical walkthrough of unpacking and analyzing **SnappyBee** (aka **Deed RAT**), a modular backdoor previously reported in China-linked espionage activity attributed to **Salt Typhoon** (aka *Earth Estries*). The write-up describes SnappyBee as typically deployed **post-compromise** to establish persistence and enable follow-on tooling (including **Cobalt Strike** and the **Demodex** rootkit), and highlights its use of a **custom packing routine** intended to obscure the payload and hinder static analysis. Zscaler ThreatLabz detailed **GuLoader**’s evolving **obfuscation** methods designed to evade detection and frustrate reverse engineering. Techniques described include **polymorphic “dynamic constant construction”** (building constants at runtime via instruction sequences like `mov`, `xor`, `add`, `sub`) and **exception-based control-flow redirection** that replaces normal `jmp` logic with deliberately triggered CPU exceptions handled by custom exception handlers (e.g., `0x80000003` `STATUS_BREAKPOINT`, `0x80000004` `STATUS_SINGLE_STEP`, `0xC0000005` `STATUS_ACCESS_VIOLATION`), complicating automated tracing and signature-based detection.
Jun 29, 2026
Researchers reported a new **PDFly** malware variant that uses a **custom-modified PyInstaller** executable to break common unpacking workflows and force manual reverse engineering. The sample alters PyInstaller identifiers (including a non-standard “magic cookie”) and corrupts strings so tools like *PyInstxtractor* fail to recognize the archive structure; even after adapting extraction scripts to accept the custom cookie and bypass validation checks, the recovered Python components remained **multi-layer encrypted**, with decryption logic implemented in separate bootstrap files that handle runtime extraction. Separately, an educational malware-analysis write-up detailed how to unpack **SnappyBee (Deed RAT)**, a modular backdoor previously reported in China-linked espionage activity and associated in public reporting with **Salt Typhoon / Earth Estries**. The post describes SnappyBee’s **custom packing routine** used to obscure its payload and evade static analysis, and positions the unpacking methodology as a repeatable approach for triaging similarly packed malware (including post-compromise tooling used for persistence and follow-on deployment such as **Cobalt Strike** and the **Demodex** rootkit).
Jun 29, 2026
SentinelLabs introduced a multi-stage benchmark to test whether frontier AI models can autonomously sustain a full malware reverse-engineering investigation, using the 2005 **Fast16** Windows sabotage toolkit as the case study. Fast16 was designed to interfere with **LS-DYNA** engineering software and has been compared to **Stuxnet** because of its apparent link to efforts affecting Iran’s nuclear weapons development. The benchmark recreated an eight-stage investigation with staged evidence release, **IDA Pro**-based artifact generation, and verification tied to specific addresses and recovered components, including Fast16’s **Lua** framework and its 101-rule patching engine. In the reported results, **GPT-5.6 Sol** was the only publicly available model tested that completed all eight stages, while **GPT-5.5**, **GLM-5.2**, and **Opus 4.7/4.8** demonstrated useful point-in-time analysis but failed to maintain project-wide coherence. SentinelLabs said the decisive capability was **project-scale recovery**: retracting invalidated conclusions, tracing dependencies, and repairing the broader investigative narrative as new evidence emerged. The researchers concluded that current leading models can materially assist malware analysts and, in the strongest cases, operate as supervised investigative agents, but human reverse engineers remain necessary because the models still make semantic, technical, and quality-control errors and can declare completion prematurely.
Jul 23, 2026