“We held both files from July 6 and July 10, before either report,” says Lasic.
Persistent limitations
Still, ReversingLabs’ recent report may reflect only the current state of the art of AI-assisted malware rebuilding, as some of the limitations that characterized the Midnight Blizzard instance could be something more advanced models might overcome, Lasic concedes.
“Today a model rewrites the file for free but cannot cheaply rewrite the server code that parses the beacon, re-register domains or re-phish victims, so the indicators that survived were the ones that had to change in two places at once,” Lasic explains. “A more capable agent with access to the whole operation could coordinate those changes, and I expect infrastructure indicators to age faster over the next few years, the way hashes already have.”
