Intezer agents rebuild Slack, Finder and TinyTurla-NG from binaries
Original title: AI reverse engineering let researchers add a new feature to Slack
The TinyTurla-NG rebuild scored 92.8% BinDiff similarity, and the Slack copy gained local AI autocomplete.
Intezer says AI agents reconstructed working source for Slack, Apple’s Finder, and a TinyTurla-NG sample from shipped binaries and vendor documentation. Codex using GPT-5.6-sol-high made engineering decisions while Kimi K3 filled three roles. The rebuilt Slack ran well enough for the team to add local-model text autocomplete, and agents also built a Slack-compatible server on SQLite because Slack’s server is not downloadable. Finder still lacks some online-file, sync, and macOS-service behavior. Intezer advises encryptors and obfuscators as a way to raise the bar.
Unconfirmed: Behavioral equivalence rests on Intezer’s own harness; time and cost of the rebuilds were not published.
- Agents produced about 3,100 lines of TinyTurla-NG source in two files.
- The rebuilt DLL is 296,960 bytes versus the original 291,840.
- BinDiff matched 1,034 functions at 92.8% similarity and 98.7% confidence.
- Slack’s client contains more than 500,000 functions, mostly third-party libraries.
- Finder is a 25.8 MB executable; Intezer did not publish time or cost.
- Products
- Finder
- Threat actors
- Turla
- Malware
- TinyTurla-NG
- Organizations
- IntezerCisco Talos
- AI models
- GPT-5.6-sol-highKimi K3
From the original article
2 min read at helpnetsecurity.com
Intezer researchers used AI agents to rebuild source code for Slack, Apple’s Finder and a TinyTurla-NG sample, from a backdoor family Cisco Talos attributes to the Turla group. They worked from the shipped programs and vendor documentation. The rebuilt Slack ran well enough that the team added a new feature to it: AI text autocomplete, powered by a small local model.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.