Skip to content
NewA calmer, faster ZeroHour
StoryAI researchinfo

Intezer uses AI agents to rebuild Slack, Finder, and TinyTurla-NG

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Intezer says AI agents reconstructed working source for Slack, Finder, and TinyTurla-NG from binaries, and even extended Slack.

Intezer researchers said AI agents reconstructed working source for Slack, Apple’s Finder, and a TinyTurla-NG sample from shipped binaries and vendor documentation. Codex using GPT-5.6-sol-high made engineering decisions while Kimi K3 filled three roles; Nicole Fishbein said each target needed a different harness, and Claude reconstructed source in some cases and refused in others. The rebuilt Slack ran well enough for the team to add local-model text autocomplete, and agents built a Slack-compatible server on SQLite because Slack’s server is not downloadable. Finder still lacks some online-file, sync, and macOS-service behavior. Dark Reading reports Turla was the hardest target and recreating the proprietary apps was only moderately challenging; researchers avoided executing the malware. Intezer advises encryptors and obfuscators to raise the bar.

Key facts
  • Agents produced about 3,100 lines of TinyTurla-NG source in two files.
  • Rebuilt DLL is 296,960 bytes versus the original 291,840.
  • BinDiff matched 1,034 functions at 92.8% similarity and 98.7% confidence.
  • Slack’s client contains more than 500,000 functions, mostly third-party libraries.
  • Finder is a 25.8 MB executable; Intezer did not publish time or cost.
  • For the malware test, researchers avoided executing anything.
Explain this AI news with Vani AIWhat was announced, what is new and why it matters, in a new chat

What each outlet adds

beyond the shared facts
  • Dark ReadingTurla was hardest; Claude sometimes refused; different harnesses per target.
  • Help Net SecurityBinDiff scores, line counts, Slack autocomplete, SQLite server, model roles.
Vendors
SlackAppleSalesforce
Products
FinderSlack
Threat actors
Turla
Malware
TinyTurla-NGTurla
Organizations
IntezerCisco Talos
AI models
GPT-5.6-sol-highKimi K3Claude

Coverage

oldest first · one row per article · UTC
  1. · 12h ago Dark ReadingFirst report

    Intezer says AI eased reverse engineering of Slack, Finder, and Turla

    Each target needed a different harness, and Turla was harder to reconstruct than the proprietary apps.

  2. · 10h ago Help Net Security

    Intezer agents rebuild Slack, Finder and TinyTurla-NG from binaries

    The TinyTurla-NG rebuild scored 92.8% BinDiff similarity, and the Slack copy gained local AI autocomplete.