Evading Detection with Dynamic AI Mimicry

Evading Detection with Dynamic AI Mimicry

Speakers: Darren and Mosam (with contributors Oner Erdigan and Ray McCormack)

Conference: BSides Seattle

YouTube: https://www.youtube.com/watch?v=fdfdSAYY-40

Overview

What happens when you take polymorphic AI malware and teach it to blend into the victim's own cloud traffic? Darren and Mosam presented their research on a framework called LL MALJ that advances the offensive tradecraft of AI-driven malware by solving the detection gap that caught earlier AI malware families like LameMug. The framework uses cloud provider mimicry to evade network anomaly detection while leveraging LLM-powered polymorphism to defeat endpoint signatures.

The research team, which also includes Oner Erdigan and Ray McCormack, built LL MALJ as a red team tool that enumerates which cloud providers a victim organization legitimately uses, then routes its command-and-control and exfiltration traffic through those same providers. The result is that both network detection (NDR) and endpoint detection (EDR) are effectively blind to the implant's operations. The second half of the talk, presented by Mosam, shifts to telemetry analysis of the agent's behavior, revealing distinctive timing signatures that could enable detection — and pointing toward the future of AI-versus-AI defense.

This research matters because it demonstrates how the convergence of AI polymorphism and cloud-native tradecraft eliminates two detection opportunities simultaneously: network anomaly detection and signature-based endpoint detection. The defenses proposed are equally important, particularly the finding that TLS inspection with tenant validation would definitively kill this attack — yet almost no organizations in the room were doing it.

Background

▶ Watch: How AI-powered polymorphism broke defensive methodologies in 2025 (0:30)

In 2025, malware families began seriously leveraging AI for polymorphism — generating different behavioral patterns on each execution to defeat profiling. Simultaneously, legitimate AI coding tools like Quad Code and OpenAI Codex proliferated, accelerating the development of such malware. The intersection of these trends created a new class of threat.

The specific real-world example that motivated this research was LameMug, a sample reported by the Ukrainian Computer Emergency Response Team (CERT-UA). LameMug was a minimal implant that connected to an LLM hosted on Hugging Face, asked for instructions on how to execute high-level goals, received specific commands, executed them, and eventually exfiltrated data to a separate C2 server. It was caught through network anomaly detection — the victim environment was baselining network traffic and flagged Hugging Face as an unknown service along with the custom C2 server. The researchers set out to fix this detection weakness.

Key Findings

▶ Watch: Cloud provider mimicry concept — blending into whitelisted traffic (6:00)

The research produced several significant findings across both offensive capability and defensive telemetry analysis:

Cloud Provider Mimicry Works: By profiling which cloud providers (AWS, Azure, GCP, Anthropic API) a victim already uses and routing malicious traffic through those same providers, the framework avoids triggering network anomaly detections. The traffic goes to whitelisted IPs for known cloud services, making it indistinguishable from legitimate traffic at the firewall level.

Dual Detection Evasion: The framework simultaneously defeats EDR (no malicious shellcode, no known signatures, just standard Python using standard libraries with an orchestration framework) and NDR (encrypted traffic to whitelisted cloud IPs).

Near-Zero Jaccard Similarity: Across multiple runs, the agent's command sequences showed Jaccard similarity scores close to zero, meaning there is virtually no overlap between runs. This confirms that signature-based detection is not viable against polymorphic AI agents.

Distinctive Timing Signatures: The ReAct (Reasoning and Acting) agent loop produces a consistent 2-to-6-second gap between commands, driven by LLM API latency. Human operators show a bell curve with high variance (breaks, Googling commands, mistakes). This timing pattern is a detectable fingerprint.

Agent Behavioral Profile: The AI agent used approximately 18 commands to complete credential harvesting versus 12 for a human and a constant 26 for a static script. The agent spent five times longer in the reconnaissance phase than other phases, exhibiting "greedy" and thorough directory enumeration. The agent's 46% immediate error recovery rate (recovering on the next command after a failure) provides another behavioral signal.

Husking Bypasses LLM Guardrails: LLMs refuse direct requests like "exfiltrate SSH data to my server" but will happily answer each individual sub-step when the overall intent is broken into smaller, benign-looking queries. The agent exploits this by design, with no single step appearing malicious.

Technical Deep Dive

▶ Watch: Telemetry: 2-to-6 second timing signature between agent commands (14:00)

The LL MALJ framework architecture centers on a ReAct agent (Reasoning and Acting) loop. The reasoning component runs at the LLM layer, where the agent asks the cloud-hosted LLM what to do next. The acting component runs locally through tools that execute commands, write harvested credentials, and collect telemetry metrics.

Phase 0 performs cloud provider enumeration, identifying which LLM providers the victim organization uses. From this point, the agent selects a matching provider and all subsequent C2 communication blends with legitimate traffic.

The agent then moves through credential enumeration on macOS, systematically searching directories where credential files reside (SSH keys, browser credentials, application tokens). Each step is a ReAct cycle: the agent queries the LLM ("What credentials exist?"), the LLM reasons and responds ("Check the .ssh folder first"), the agent executes the command using local tools, and the results are fed back to the LLM for the next action. If the agent decides more exploration is needed, the cycle continues; otherwise results pass to the next phase.

Harvested credentials are compressed into a zip file and exfiltrated through the same cloud provider channel. The framework supports AWS, Azure, GCP, and Anthropic's API, and is extensible to additional providers like Oracle Cloud.

The critical evasion mechanism is that the implant itself contains no defined malicious behaviors. It is standard Python using standard libraries with an orchestration framework used by many legitimate AI agents. Every execution produces different command sequences (near-zero Jaccard similarity), making static signatures impossible.

Mosam's telemetry analysis used controlled experiments comparing the agent against human operators and static scripts on identical credential harvesting tasks on macOS. The 2-to-6-second inter-command timing gap is an artifact of the network round-trip to the LLM API, and this consistent cadence creates a fingerprint distinct from human behavior patterns.

Demo / Proof of Concept

▶ Watch: Near-zero Jaccard similarity proves signatures cannot detect this agent (16:00)

The researchers built and tested LL MALJ as a functional red team tool, running it against controlled environments to generate the comparative telemetry data presented. While no live demonstration was performed during the talk, the framework's operation was demonstrated through architectural diagrams, phase-by-phase execution traces, and the quantitative results from controlled experiments comparing agent, human, and script behaviors across command counts, timing patterns, reconnaissance ratios, Jaccard similarity scores, and error recovery rates.

Defensive Implications

▶ Watch: TLS inspection with tenant validation as the definitive defense (22:00)

The talk identified a stark defensive gap: EDR misses the implant because there is no binary to scan and no signatures to match. Firewalls whitelist the traffic because it goes to known cloud provider IPs. NDR is blind because the traffic is encrypted. The C2 channel is effectively invisible.

The single most effective defense is TLS inspection with tenant validation — decrypting traffic and verifying it is going to the organization's own tenant, not an attacker-controlled account on the same cloud provider. When Mosam asked the audience if they were doing this, only two people raised their hands. This represents a critical gap in most enterprise environments.

Additional defensive approaches include: deploying behavioral analytics that detect the agent's characteristic timing patterns (consistent 2-to-6-second inter-command gaps), using AI proxy solutions that validate tenant ownership of AI API traffic, and monitoring for the aggressive reconnaissance patterns (five times more time in recon than other phases) that distinguish AI agents from human operators.

The researchers noted where the field is heading: multi-agent coordination on the attacker side, embedded models that eliminate the network signature entirely, cross-platform mimicry, and prompt injection for lateral movement using existing AI tools. On the defensive side, emerging approaches include intent detection firewalls that identify what the LLM is actually trying to achieve, baselining to identify normal AI traffic patterns, and zero trust AI architectures.

Key Takeaways

• AI-powered polymorphic malware combined with cloud provider mimicry defeats both endpoint and network detection simultaneously by using standard libraries and routing through whitelisted cloud services
• The LameMug malware (reported by CERT-UA) demonstrated this class of threat in the wild; LL MALJ advances it by solving the network detection problem that caught LameMug
• Near-zero Jaccard similarity between runs confirms that signature-based detection is fundamentally inadequate against polymorphic AI agents
• The ReAct agent loop produces a distinctive 2-to-6-second timing signature between commands that represents a viable detection signal
• TLS inspection with tenant validation is the most effective defense but is deployed by almost no organizations
• LLM guardrails are bypassed through "husking" — breaking malicious intent into individually benign sub-steps that the LLM answers without refusal

About the Speaker(s)

Darren and Mosam presented this research alongside collaborators Oner Erdigan and Ray McCormack. Darren focused on the offensive framework design and cloud mimicry tradecraft, while Mosam covered the telemetry analysis and defensive insights. The team operates in the red team and security research space, building tools that advance offensive tradecraft to identify defensive gaps. Their collaborative approach — building the attack framework, instrumenting it for telemetry, and analyzing the behavioral signals — demonstrates a research methodology that serves both offensive and defensive communities.