Wednesday 14 October 14:00 - 14:30, Green room
Chanbin Jeon, SeungBeom Lim & SuhMahn Hur (SANDS Lab)
Traditional malware tracking relies on code similarity to cluster variants and infer actor lineage. However, the rise of accessible local LLMs introduces a critical blind spot: malware can now be autonomously rewritten to systematically evade these assumptions.
To quantify this threat, we developed GHOST (Generative Heuristic Obfuscation & Semantic Transformation), an end-to-end autonomous mutation pipeline that performs source rewriting, rebuilding, and functional verification. We evaluated GHOST on rebuildable Mirai-family IoT botnets and statically linked binaries, where static triage remains essential. Moving beyond basic API substitution, GHOST leverages LLMs to rewrite algorithms, restructure functions, and modify build strategies. This approach achieved a 95% success rate in generating functional variants and bypassed 22 of 46 capability-based detection rules in a single run. As a result, variants from the same campaign lose their structural resemblance, defeating standard heuristics such as function reuse.
Despite this effective obfuscation, LLM-driven transformations are not random. They introduce consistent, model-specific structural artifacts that persist through compilation. Beyond superficial indicators like dead code insertion or debug-string contamination, we identify deeper patterns in function decomposition and semantic inconsistencies. These persistent artifacts can be captured and clustered using function-level code embeddings, enabling the recovery of relationships between seemingly unrelated samples.
Our findings demonstrate that LLM-based obfuscation simultaneously disrupts human-centric lineage analysis and introduces model-centric fingerprints. In constrained environments such as IoT, where dynamic analysis is limited, these artifacts provide a new foundation for static clustering. This shifts attribution from "who wrote the malware" to "which model generated it."
 |
Chanbin Jeon Chanbin Jeon is a research engineer on the Threat Analysis Team at SANDSLab, specializing in malware analysis and cyber threat intelligence. He began his career in intrusion response and network security at AhnLab's Computer Emergency Response Team (CERT), and has since expanded his expertise into behavioural malware analysis and intelligence generation. His current research focuses on malware analysis and threat intelligence development, with a strong interest in attacker attribution and threat profiling based on real-world incident cases.
|
 |
SeungBeom Lim SeungBeom Lim is a research engineer on the AI Tech & Development Team at SANDS Lab. He holds an M.Sc. in AI / machine learning and information security from Hoseo University in South Korea. His current research focuses on solving cybersecurity challenges through AI technologies, utilizing both large language models (LLMs) and deep learning architectures. He primarily investigates threats in areas such as network security, botnet detection, and ransomware analysis, aiming to apply advanced AI techniques to real-world security problems and make impactful contributions to the field.
|
|
SuhMahn Hur SuhMahn Hur is the Team Lead of the Threat Analysis Team at SANDS Lab. He has a strong interest in cyber threat intelligence, malware analysis, and URL analysis. Leveraging his extensive analytical experience, he has developed numerous detection solutions and is also deeply interested in applying artificial intelligence to security technologies. He has worked for several years as an incident response analyst and has developed a platform that significantly reduces incident analysis time by creating artifact collection tools and malware detection agents. |
Back to VB2026 conference page
Register your interest for VB2026