In recent years, ChatGPT models have made significant advancements in natural language processing and machine learning. However, these advancements have introduced the potential for a dangerous new cyber threat. Malware creators can now leverage ChatGPT models to create deadly polymorphic malware that can evade traditional endpoint detection and response (EDR) security solutions. In this article, we will delve into the inadequacies of traditional security solutions, the worsening cybersecurity situation with advanced AI-generated malware, and the proof of concept of BlackMamba – a polymorphic malware that successfully evades EDRs.
Ineffectiveness of Traditional Security Solutions
Traditional security solutions, such as EDRs, are typically designed to detect and prevent irregular or novel behavior patterns. However, these solutions rarely align with their claims. A rapidly evolving threat landscape and the increasing sophistication of malware creators mean that EDRs must be constantly updated to remain effective. Unfortunately, this is not always the case, resulting in security gaps that cybercriminals can exploit.
The Worsening Cybersecurity Situation
The availability of AI-generated polymorphic malware in the hands of malicious threat actors will worsen the cybersecurity situation. The flexibility of modern machine learning technology, such as ChatGPT models, allows malware creators to generate sophisticated, constantly changing code that can evade detection. Moreover, this advanced polymorphic malware can establish undetectable command-and-control infrastructure without leaving any signs of malicious activity.
As proof of the severity of polymorphic malware, cybersecurity analysts at Hyas developed a proof of concept that uses a powerful language model to generate polymorphic keylogger functionality in real-time. This PoC eliminates the need for command-and-control infrastructure to deploy and verify the capabilities of the malicious keylogger. The name given to this PoC is “BlackMamba,” inspired by a venomous snake that highlights the threat it represents.
Command-and-Control Infrastructure Elimination
ChatGPT is used to generate the code required to ensure that the malware adapts and changes. Therefore, BlackMamba operates without the need for command-and-control infrastructure. This is significant because command-and-control infrastructure is usually a weak point in the malware’s arsenal, and security solutions are traditionally designed to detect it. With BlackMamba, eliminating the command-and-control infrastructure makes it even more difficult for EDRs and other security solutions to detect and prevent the malware’s execution.
“BlackMamba” is the chosen name for the proof of concept (PoC) malware. The name has venomous implications, as it is capable of causing damage beyond simple data theft. One of the key characteristics of the BlackMamba malware is its adaptability, allowing it to evade detection through various methods. For instance, it can change the code it uses after each deployment, making it harder to detect its signature. It can also change port numbers and domain names to evade detection.
During runtime, BlackMamba establishes communication with an API from OpenAI, allowing it to retrieve the necessary synthesized malicious code. This integration enables BlackMamba to learn and improve as it gathers more data, making it an even greater threat over time.
Evasion of Detection
EDR solutions are designed to detect and prevent malware before it can do harm. Unfortunately, BlackMamba is capable of evading detection. In numerous assessments conducted against a highly regarded EDR, BlackMamba managed to evade detection. This evasion is particularly significant as it indicates that the malware can potentially go unnoticed, causing significant damage to an ostensibly secured system.
Platform for Data Exfiltration
Experts have identified MS Teams as a platform that threat actors could manipulate to serve as a channel for data exfiltration. Once deployed, BlackMamba collects sensitive information such as usernames and passwords from the infected system. This information is then transmitted through MS Teams to the threat actors, which can be used to cause even more havoc.
With the continued innovation in AI and machine learning, cybersecurity analysts must remain vigilant. The creation of polymorphic malware such as BlackMamba is a clear indication of the potential harm cybercriminals can cause through such advancements. EDRs and other security solutions must stay up-to-date with the latest advances in technology to be able to detect and respond to these threats. Organizations must have a comprehensive and layered security strategy that includes proactive threat hunting, security information and event management (SIEM) solutions, and integration with other security platforms. Only by being proactive and staying aware of these threats can we hope to remain protected in an increasingly sophisticated and malicious threat landscape.