Google ’s cybersecurity intelligence group has found experimental malware that rewrites itself every hour using its artificial intelligence tool , Gemini, to make it more difficult to detect.
This mechanism allows the software to avoid detection by anti-malware applications, as it relies on known and previously discovered patterns to track and stop malware, making it similar to trying to track a constantly moving target.
The software comes in several different versions, including one that requires Gemini to rewrite all the code in it every hour while preserving the code necessary to perform its task, and another version where artificial intelligence changes parts of the code without rewriting it completely.
Promptflox is not the only software that uses this method to avoid detection by security applications, as various software groups that follow the same method have recently emerged.
The indicated that the hacker group APT28, which is allegedly linked to the Russian government, used one of these programs in its attacks against multiple targets in Ukraine, but instead of relying on the Gemini model.
But does that mean that antivirus and anti-malware security applications have become ineffective in the age of artificial intelligence?
A different detection mechanism
the emergence of malware that automatically improves itself during an attack does not mean the end of the era of security applications. Although this mechanism makes malware detection more difficult, it does not mean it cannot be detected.
This is because malware has something like a fingerprint, and artificial intelligence tools cannot rewrite the software in a way that completely hides this fingerprint and prevents its detection and tracking.
Security applications, such as Windows Defender which comes pre-installed on Windows systems, also rely on artificial intelligence and machine learning to detect and review malware on an ongoing basis.
Antivirus applications primarily rely on detecting suspicious activities occurring within the system and then alerting the user to them. Therefore, if the application finds suspicious activity, it will automatically classify it as belonging to malware, even if it does not recognize the malware itself.
This software increases the importance of using up-to-date antivirus and anti-malware applications that have a direct internet connection.
Tags:
technology