Intezer says AI eased reverse engineering of Slack, Finder, and Turla
Each target needed a different harness, and Turla was harder to reconstruct than the proprietary apps.
Stories per day · 30 days
2 RSS
Relatedsandbox5threat-intelligence4ai-agents3joesecurity3reverse-engineering3any.run2virustotal2yara2ai-generated-malware1attck1autocad1autolisp1conference-recap1cybersecurity1daybreak1detection1didier-stevens1dwg1
32 stories, newest first · one card per story
Stories tagged #malware-analysis
MEvince Knowledge-Constrained Framework Identifies Malware ATT&CK Techniques
MEvince uses shared behavioral representations and evidence-aligned retrieval to improve exact-ID F1 by 17.4% on 610 malware reports.
Joe Security Launches Adaptive Detonation for Malware Analysis
Adaptive Detonation uses AI agents to identify sandbox obstacles and apply targeted interventions, revealing concealed malicious behavior in evasive samples.
1
Joe Security Launches Adaptive Detonation
AI agents enable targeted interventions to reveal hidden malware in Joe Sandbox.
AI-generated malware shows uniform code patterns and emojis
Threat intelligence expert notes AI-generated malware includes function comments and emojis, speeding fraud campaigns.
ANY.RUN Recaps it-sa 2026: Trends in Security Operations
ANY.RUN showcased malware analysis tools and threat intelligence at it-sa 2026 to help SOC teams reduce triage time and improve incident response.
1
OneNote .one file extraction tool adds JSON output
Didier Stevens updated onedump.py to produce JSON data for embedded files inside OneNote .one files and support batch processing of many files at once.
SANS diary explains a local Ghidra Server for malware labs
A shared Ghidra repository keeps analysis projects outside disposable VMs and supports versioning and multiple clients.
YARA-X 1.22.0 adds built-in 64-bit integer read functions
The release ships 11 improvements and 9 bugfixes, including int64, int64be, uint64, and uint64be.
Buyer’s guide ranks 12 malware analysis tools for 2026
The guide scores sandboxes and reputation services on depth, privacy and pricing, without new vulnerability findings.
2
SEMPRE infers protocol layouts with LLM search and traces
Semantic-field inference scored 0.72, against 0.13 for BinPRE, on a corpus of mainstream protocols.
Top 10 Best Malware Analysis Tools in 2026 [Ranked & Scored]
A 2026 roundup ranks malware sandboxes and file-intelligence tools, led by context, interactive, and evasion-resistant analysis.
9
SentinelOne cuts malware analysis from weeks to hours
SentinelOne says OpenAI Daybreak produces human-level malware reverse engineering in about eight hours.
1
Orphaned VBA Projects Inside DWG Files, (Wed, Oct 14th)
SANS finds AutoCAD DWG files with orphaned VBA projects that AutoCAD cannot execute.
Cisco Talos Launches CAIRN Tool to Hunt and Track AI-Integrated Malware
Cisco Talos released CAIRN, an open-source toolkit to identify AI-integrated malware by analyzing metadata for 'cognitive artifacts' from LLMs.
4
[object Object]
The DarkMe malware is now being delivered via simple phishing emails, abandoning the zero-days previously used to deliver the payload.
3
Vidar Adds Virtual Machine and Custom Stream Ciphers For String Obfuscation
ThreatLabz shows Vidar 2.x and 3.x hide strings with a bytecode virtual machine and custom stream cipher.
4
TerminalFix: PNG Steganography, (Mon, Sep 21st)
SANS analyzes the TerminalFix malware campaign, which hides a malicious DLL inside PNG pixel data via steganography and DLL side-loading.
2
ALIBI: Adversarial Legitimacy Injection in Binary Input against LLM Malware Analyzers
ALIBI embeds fake benign-narrative sections into binaries, flipping 30 of 35 malware samples to benign verdicts on Gemini 2.5 Pro.
German Manufacturer Shrinks Security Alert Response While Protecting 10,000 Endpoints
Vendor case study: a German manufacturer's five-person SOC cut alert triage time using ANY.RUN's cloud sandbox across 10,000 endpoints.
2
Echo: Learning-based Matching Decompilation using Trusted Back Translation
Researchers introduce Echo, a matching decompiler using trusted back-translation that roughly doubles exact-match rates and outperforms GPT-5.6 and Codex on Mirai.
ANY.RUN Secures Leader Status in G2’s Malware Analysis Rankings
ANY.RUN announced G2 Fall 2026 Grid Leader and Momentum Leader recognition in the malware analysis category, citing 700,000+ users.
Threats Making WAVs - Incident Response to a Cryptomining Attack
Guardicore researchers dissect a cryptomining attack that hid a cryptominer inside WAV files, mapping the full infection chain and response steps.
1
Advanced WildFire Archives
Palo Alto Networks describes Advanced WildFire as its cloud malware analysis engine using machine learning and crowdsourced intelligence.