Loading story…
Researchers disclosed a sandbox evasion technique that abuses the Intel x86 trap flag (TF) to help malware distinguish physical systems from virtual machines used for analysis. By enabling TF before instructions such as RDTSC, malware can observe whether a debug exception is raised at a different instruction boundary than it would be on real hardware, exposing incorrect hypervisor emulation during a VM exit and allowing the sample to terminate or change behavior before deeper inspection.
The technique was observed in the Lampion malware family, which has targeted users in Portugal, showing that the method is not purely theoretical. Palo Alto Networks said it identified the hypervisor emulation issue in its own environment and deployed a fix so the evasion approach no longer succeeds against WildFire, underscoring the need for defenders to validate sandbox fidelity against low-level CPU and virtualization edge cases.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks identified that incorrect hypervisor emulation of the Intel trap flag could enable this sandbox evasion method and said its hypervisor team tested and deployed a fix. The company stated the specific evasion issue was resolved for malware samples using this technique in WildFire.
The Lampion malware family, which targeted users in Portugal, used an Intel x86 trap-flag single-step check with instructions such as RDTSC and NOP to distinguish virtualized sandboxes from physical machines and terminate when a VM was detected.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple public research reports detailed how attackers can evade Windows security monitoring by abusing native APIs, loader behavior, and application logging. White Knight Labs and XPN documented techniques to suppress or bypass **Event Tracing for Windows (ETW)** visibility in .NET and Windows processes, while separate research showed that access-mask-based detections can be defeated with `DuplicateHandle` by first requesting only `PROCESS_DUP_HANDLE` and then cloning a more privileged handle to targets such as **LSASS** or **winlogon**. Microsoft documentation for `CreateProcessA` also appeared in the reference set because process creation remains central to many payload chains, including shellcode that ultimately launches command shells or follow-on tooling. Additional reports showed how attackers can blend execution into legitimate Windows behavior and trusted software. iPurple described **EntryPoint Hijacking**, in which a loaded DLL's entry point is overwritten so malicious code runs during normal thread creation or loader activity, reducing obvious injection signals and complicating EDR detection. NVISO separately analyzed Metasploit reverse-shell shellcode that walks the **PEB** and resolves APIs such as `LoadLibraryA`, networking functions, and `CreateProcessA`, while Hunt & Hackett showed that **ConnectWise Control/ScreenConnect** can be used for intrusion activity and that its own event logging can be disabled by patching `ScreenConnect.Core.dll`. Together, the reports underscore that defenders must validate loader integrity, monitor low-visibility handle requests and memory writes, and avoid relying on a single telemetry source such as ETW or application-generated event logs.
Aug 15, 2026
Researchers analyzing a **SystemBC** malware sample found it was protected by **VMProtect 3.6+**, which used layered anti-analysis techniques to frustrate debugging and unpacking. The protection chain reportedly included multiple debugger-detection methods, direct system calls, Windows build-number validation through structures such as `KUSER_SHARED_DATA`, fresh `NTDLL` remapping, and syscall-number extraction designed to evade user-mode hooks. The sample also appeared to rely on well-known anti-debugging and evasion patterns documented in public research, including low-level checks associated with segment handling and other debugger-detection tricks. The analysts said VMProtect also performed anti-virtualization checks using **CPUID**, trap-flag behavior, and firmware-table inspection, exposing artifacts left by some older **VirtualBox** environments. To bypass those defenses, they modified **ScyllaHide** to spoof additional version fields, hook more APIs, change section-mapping behavior, and suppress firmware-table results. Those countermeasures allowed them to debug and unpack the malware, revealing that the **SystemBC** payload had been packed a second time beneath the VMProtect layer.
Aug 15, 2026
SentinelOne published a technical walkthrough showing how analysts can reverse the macOS malware **EvilQuest** and defeat its anti-analysis behavior with **radare2**. The guide demonstrates how to prepare a malware sample in a controlled macOS virtual machine, attach the debugger with elevated privileges, inspect functions and cross-references, and rename imported library calls to clarify the sample’s execution flow. The tutorial focuses on dynamically bypassing EvilQuest checks without patching the binary, including skipping function execution and altering register return values during debugging. SentinelOne highlights routines such as `_is_virtual_mchn` and `user_info`, and notes that one of the checks appears closer to sleep-based sandbox evasion than true virtual-machine detection. The malware, first seen in 2020 and initially described as ransomware, is characterized in the report as ineffective in the wild and possibly a proof of concept or early-stage project.
Aug 14, 2026