Something shifted in the past few months. Russia, Iran, and North Korea - three separate programs, no…
Lara B. — Building Cyberr
Something shifted in the past few months. Russia, Iran, and North Korea - three separate programs, no coordination - all moved to AI-assisted malware development at roughly the same time. In live attacks, against real targets.
Russian hackers deployed malware that connects to a live AI model mid-attack, generating its commands on the fly. Every execution looks different. No signature to write, no pattern to catch.
Iran's MuddyWater used Google Gemini to write a backdoor from scratch. Analysts confirmed it by the fingerprints the AI left behind. They deployed it without cleaning up the code.
North Korea went after people instead of systems. AI-generated developer identities, convincing enough to get hired at real companies across the US and Europe, salaries routing straight to Pyongyang.
Three adversaries, three different applications, same window.
The implications for defenders are structural, not incremental. Signature-based detection assumes you've seen the threat before. Malware that rewrites its own behaviour at runtime breaks that assumption entirely.
This isn't a new variant to add to the database - it's a different problem category.
What makes it worse is that none of this required classified research or state-level resources. These programs used tools anyone can access.
5 reactions · 0 comments