Virus Bulletin 2026

I was (speaking) at Virus Bulletin this year, and it was an excellent edition with lots of very interesting, highly technical talks. Conferences are a cool place to learn about new fields you haven’t looked into yet. It’s rarer to learn things in your own field - especially when you’ve 18+ years of experience in that field… That’s what unique at VB in my mind: I get an opportunity to learn in multiple fields including mine.

What was my talk about? Nothing concerning Android or IoT malware this time. It was a “simple” bank fraud case operated on a 80+ year old man, demonstrating the skills of social engineering and to which extent our security measures, 2FA included, rely on a weak chain: trust. Give your trust to the wrong person, and it’s often game over…

• VB programme link 🔗

The following is not a summary of talks, but my personal notes or takeaways on the paper/talk. It does not summarize what the papers says, but why it was interesting to me.

Disclaimer: this blog post is personal. It hasn’t been reviewed by my employer and does not represent my employer in any way.

Hunting malicious packages at scale (C. Tafani-Dereeper, J. Doutre)

In Sept 2025, the first known npm worm “Shai-Hulud” was discovered. The malware infects the developer’s machine and injects its payload into npm packages the developer creates.

The malware was followed by a new version, and then in August 2026 by ChainDrop, which infected “only” 400 npm packages, but some with high download rates (150M weekly+).

I know the basics of npm/pypi supply chain attacks, but didn’t know about any supporting malware, so this was new to me.

Open source maintainers were also targeted by various phishing campaigns. On compromised accounts, this led to publishing backdoored version of previously legitimate packages. The attackers also typically generated pull requests that contained hidden malicious code.

Gorbag: orcs at the border (D. Schaeffer)

In 2026, VBA is still a thing 🫢

The compromise chain is the following:

1. Spear-phishing email, with .XLSM attachment. Targeting Ukraine government officials.
2. The XLS document is partly unreadable, on purpose. The idea is to have the user click on “fix the document” and run a macro.
3. Run VBA code and dump the payload, BeautyStealer.

In another campaign, the email contained a RAR archive containing a PowerShell reverse shell + BeautyStealer. Some of these powershells sometimes included a comment to trick AI into believing the file was genuine.

The Invisible Warzone: competing botnets fighting over your smart TV (A. Davila, C. Navarrete, D. Santos)

Android TV boxes are often sold with insecure settings, like ADB port 5555 open 😮.

Millions of units of TV boxes are compromised with botnets such as TuxBot, Kimwolf and Lorikazz.

• Both Kimwolf and Lorikazz use Ethereum Name Service (ENS) at a given point to distribute the IP address of their C2s.
• TuxBot source code was recovered and shows clear use of LLMs for development: left in reasoning comments, alleged Argon2id password hashing etc.

Free games costly consequences - unravelling PiviGames’ hidden treasure (J. R. Dador)

PiviGames is a popular Spanish gaming platform. It hosts links to pirates games 🏴‍☠️ etc, but also malware ☠️

I know malware authors are smart, but I can’t emphasize enough to what sophistication extent they sometimes go. This is a typical attack chain for the ACRStealer malware:

1. Fake Cloudflare challenges and redirect to malicious sites.
2. Download a clean game launcher (Setup.exe), but which executes a malicious DLL, Conduit.Broker.dll, by sideloading (see also talk How real-world malware disables EDR systems).

DLL Sideloading 101. Attacker bundles a legitimate executable with a malicious DLL. The malicious DLL is loaded, overriding a potentially existing legitimate DLL with the same name.

3. Module stomping. A shellcode is injected into the legitimate evr.dll

Module stomping 101. This is a process injection technique where malicious code is executed inside a legitimate Windows process, by overwriting the memory of an existing executable module. NB. injection of the shellcode occurs in memory. The file on disk is not modified.

4. Decrypt a main configuration file.
5. Run a second stage shellcode which will enable Anti-VM modules, persistance, interprocess communication etc.
6. Inject a 32-bit rshell shellcode into MicrosoftEdgeUpdate.exe and run it.
7. Use Heaven’s Gate technique to switch to 64 bit mode.
8. Use Doppelganging to make a malicious process appear from a legitimate executable, and in the end, drop an ACRStealer payload.

Wow. I don’t know why the author made it that complicated! 🤯

How real-world malware disables EDR systems (H. Unterbrink)

This is the analysis of an EDR killer binary from the Qilin ransomware ecosystem.

The core of the attack relies on one point: at some point, the victim executes a malicious msimg32.dll.

On Windows, msimg32.dll is a genuine DLL responsible for Windows graphics. Typically, the victim receives a legitimate app bundled with the malicious DLL. When running the legitimate app, Windows will typically run the DLL from the current directory, therefore running the infected version.

That’s DLL sideloading again.

The rest is game over, even if in reality, the binary goes through multiple further tricks. For example, at some point, the binary goes in single step mode, generating exceptions which are caught by an exception handler of the malicious DLL.

After the wipe: runtime root-secret recovery from jadepuffer/encforge on Windows (W. Gao)

ENCFORGE is a Linux ransomware with the particularity to attack AI-development environments. For example, it searches for .parquet files (LLM training datasets).

This is quite new! Actually, I wasn’t even aware of the parquet format.

Each file is encrypted with its own key using AES-256, which is derived from a root secret using Argon2id.

Argon2id is a key derivation function. It resists to some side-channel attacks.

The malware author(s) fortunately does not wipe the root secret correctly: it is recoverable, and hence files can be decrypted 😉

Mac & Cheese: Cooking Up the Digistealer recipe (K. Yamburh, J. Garcia)

The separation between criminal malware and nation-state campaigns is blurring.

DigiStealer is a criminal campaign, but its authors obviously studied nation-state attacks from DPRK and re-used successful techniques.

The malware was distributed through a social engineering campaign targeting Web3 job seekers:

1. Many AI-generated job offers on LinkedIn, all themed around crypto-currencies, blockchain, NFT etc.
2. Victims apply to a job application platform (controlled by malware authors).
3. Victims are approached via email to evaluate their profile.
4. Finally, victims are conned into a fake webex interview… which served the malware.

Kimwolf’s claws loom over 1.8 million firewalled android devices worldwide (A. Turing)

Similar in topic to “The Invisible Warzone: competing botnets fighting over your smart TV”, but focusing on Kimwolf.

Kimwolf is a 1.8 million size botnet. With that amount of bots, it poses a significant DDoS threat and several peak attacks were attributed to it and its parent, Aisuru.

Actually, Kimwolf’s first activity isn’t DDoS but residential proxies. Other cybercriminals or individuals involved in shaddy activities purchase compromised IP addresses, and re-use them to route shaddy business (ad fraud, spam, data scraping…). Reselling those IP address apparently generates 17,500 $ monthly revenue for the botnet.

The author behind Kimwolf was arrested in April 2026.

Practical ransomware detection on macOS (P. Wardle)

The speaker explains how to detect encrypted files at runtime using entropy and pi. His tool is open source: RansomWhere. The tool is tested quite thoroughly, it has design limits but works quite well.

As an example, the speaker discussed the HeartBreaker ransomware, which is successfully detected by his tool.

HeartBreaker is interesting for 2 points: (1) it is implemented in Rust, and (2) it uses metamorphism.

The concept behind metamorphism is to change some part of its code at each run. In the image below, we see the code refers to its own embedded source code, attempts to change it and recompile it.

Polymorphism vs Metamorphism. With polymorphism, the malware changes how its code is encoded/encrypted with each variants. With metamorphism its the code itself that changes.

Otter encyclopedia: deep analysis of Otter family (R. Koike, Y. Sawabe, M. Motoda)

The Otter malware family is attributed to WaterPlum, a threat group linked to North Korea. They affect Linux, Mac and Windows platforms. All malware of the family share a Node.js implementation, a C2 communicating through Socket.IO and the goal of stealing cryptocurrency related information.

In some cases, the malware gets a downloader from a URL hosted on Vercel. Vercel is a legitimate cloud platform to deploy web applications.

OtterCandy was developed using a LLM service. The malware authors provided a spec, and got the code written by the LLM. Note: this does not mean the code worked immediately in a single go, the malware author probably developed through several steps, but it is proof of LLM-assisted development.

When malware talks back - real-time interaction with a threat actor during the analysis of Kiss Loader.pdf (M. Castillo, A. J. Bandong)

Kiss Loader execution chain:

1. Windows shortcut file that connects to a remote WebDAV resource. The resource is hosted by TryCloudflare which allows the creation of temporary public tunnels to a local host, without requiring domain registration.

See TryCloudflare. Initiates a tunnel with a local host on a given port, and provides a *.trycloudflare.com URL. This is a legitimate free service.

2. The WebDAV contains a PDF, which actually executes a Windows Script Host (WSH) script and then a JScript component.
3. Display a decoy PDF

Ah ha! Like Linux/GoGra. It’s common to mimick a given file, then get your payload executed, but also display a decoy file for the victim not to become too suspicious.

4. Run a batch script, retrieve a Python-based loader and decrypt payloads.

The malware uses shellcode generated by Donut. This open source tool generates position independant shellcode for .NET assemblies.

5. Inject the decrypted shellcode into a legitimate Windows process using “Early Bird Asynchronous Procedure Call”.

Early Bird APC consists in queuing an APC with the payload to a thread in a newly created process. When the thread starts, it executes the APC before security tools have had time to inspect the process…

The unique part in this talk is the “encounter” with the malware author. As the malware analysts were working dynamically on the sample (in a controlled environment), the malware author took control of the session and closed the analysis tools.

My take on this is always the same: dynamic analysis is dangerous. It was fortunately limited because operating in a controlled environment - but you never know what are the skills of the cybercriminals at the other end and if they can evade your environment…