Operation Synthetic Siege

AI · LINUX · difficulty 3 · ~22 min · 12 steps

Every infected host has a different malware hash. Signatures are useless. Adapt.

Briefing

A phishing wave hit 300 staff — each email uniquely written, no two alike, clearly LLM-generated at scale. The loader they drop is polymorphic: it mutates per host, so every infected machine has a different file hash. Your signature tooling sees 300 unrelated 'unknown' files. You cannot block your way out one hash at a time. Pivot from what the malware IS to what it DOES — the behaviour is identical even when the bytes are not — and hunt the fleet with osquery.

Objectives

• Confirm hashes and signatures are a dead end here
• Find the invariant behaviour across mutated samples
• Hunt on behaviour, contain, and sinkhole the C2 pattern
• Attribute the campaign honestly

Return to the range lobby