BlackMamba: Evading through AI polymorphic malware

The proof-of-concept attack BlackMamba is on the verge of using AI technology as its drive. The researchers from HYAS Labs demonstrated the proof-of-concept attack, which they call BlackMamba, which exploits a large language model (LLM). 

This model is the same as in ChatGPT. Although ChatGPT will not direct you to malware-installing techniques and bugs, intruders have found their way out.

BlackMamba uses the same techniques. It executes and synthesizes its keylogging capability every time.

“Traditional security solutions like endpoint detection and response (EDR) leverage multi-layer, data intelligence systems to combat some of today’s most sophisticated threats, and most automated controls claim to prevent novel or irregular behavior patterns,” the HYAS Labs researchers wrote. “But in practice, this is very rarely the case.”

BlackMamba: Systematic approach

According to HYAS Labs:

• BlackMamba has a built-in keylogger designed to collect sensitive information from targeted devices. This includes usernames, passwords, and credit card numbers. 
• Once collected, it sends the data to a malicious channel on Microsoft Teams.
• From there, it can be transmitted to the dark web or other locations via secure encrypted channels while bypassing common firewalls and intrusion detection systems.

Proving Black Mamba’s credibility to disaster

The malware is said to be a silent disrupter. It was tested against the EDR systems, and there was no detection.

I think it's time to get to the bottom of each EDR's telemetry. This is one way to push them to improve their products based on what security teams need!

Watch this space; this is happening…👇🔜 https://t.co/mL3tbwFfyW

— Kostas (@Kostastsale) March 9, 2023

• In the first, a malware sample had intelligent automation in a way that required no C2 communication. The stolen data was made to reach a designated server via a legitimate communication channel such as Microsoft Teams.
• Secondly, researchers used AI code generative techniques (OpenAI APIs) to dynamically synthesize new malware code during each run, making this malware polymorphic. 
• Furthermore, it uses the open-source Python package Auto-py-to-exe, allowing developers to convert the code into standalone executable files with Windows, Linux, and macOS support. 

Ending note

BlackMamba is proof of technological advancement and masterminds who incorporated AI into cyber crimes. AI malware is proven disastrous as it can not be detected and changes codes every time they are deployed. 

The time is now to change the outdated security procedures; instead, installing deep, in-depth security procedures for everyone with an online presence has become crucial.