• Enhanced intelligent threat detection and analysis based on generative AI and LLM 
  
  
• Expansion of AI-driven operations across various products and services 
  
  
• Provision of advanced AI services and security assurance through learning systems based on self-collected data.
  

Quote:What Is Mark Of The Web?

Mark of the Web (MoTW) is a security feature of the Microsoft Windows operating system that adds an NTFS Alternate Data Stream (ADS) called “Zone.Identifier” to files downloaded from the Internet, indicating the file’s source. This feature displays a security warning or restricts the file from being executed when a user tries to run a file downloaded from the Internet.

Files with Mark of the Web (MoTW) have the following characteristics:
 

• Microsoft Office document: Opened in Protected View mode
  
• Executable file (.exe, .dll): Windows SmartScreen warning
  
• Script file (.js, .vbs, .ps1): Warning or block message when executed
  

Quote:The main characteristic of ViperSoftX is that it operates as a PowerShell script. During the C&C communication process, parameters such as “/api/”, “/api/v1”, “/api/v2”, “/api/v3/” are always included in the URI path. After the C&C communication process, additional malware is downloaded. In this particular campaign, while the initial distribution method of ViperSoftX remains unclear, the PowerShell and VBS code used for C&C communication contains Arabic comments, suggesting that the attacker is an Arabic speaker.

According to the AhnLab Smart Defense (ASD) infrastructure, the additional malware such as VBS downloader, malicious powershell script, PureCrypter (a downloader), and Quasar RAT are downloaded from ViperSoftX. The following information is identified during ViperSoftX C&C communication process....

Quote:This report will introduce the types of threats generated by AI, cases of AI misuse, and AhnLab's strategies for enhancing security using AI.

1. The Potential Risks of Generative AI
Cyber threats stemming from AI manifest in various forms, many of which have already materialized and are causing significant damage. There are four major potential risks arising from generative AI.
 

First, hallucination refers to errors that occur during the process of generating information based on the data the AI has been trained on. AI may sometimes produce information that is either nonexistent or inaccurate, potentially leading users to make poor decisions and raising concerns about reliability.

Bias emerges when the inherent biases in training data cause problems. AI learns patterns and makes predictions based on training data, but if this data contains stereotypes or discriminatory elements related to gender, race, or religion, it increases the likelihood of generating biased outputs.

Copyright issues arise when AI incorporates copyrighted materials without authorization during large-scale data training, potentially infringing on the rights of content creators. The legal status of AI-generated content in relation to copyright remains unresolved and is a critical issue that must be addressed in the era of widespread AI adoption.

Finally, data privacy breaches are another significant concern. If the data used for AI training contains personal or sensitive information, its exposure or misuse can lead to serious consequences. This could result in the unauthorized use of personal information and severe violations of privacy rights.



2. Attacks on Generative AI
Threat actors are abusing the widespread commercialization of generative AI and the various ways it's being adopted by businesses and individuals to attack generative AI in multiple ways. In a broad sense, attacks on generative AI include adversarial prompting, data poisoning, and model reversing.

First, adversarial prompting can be divided into jailbreaking and prompt leaking. Jailbreaking involves disabling or bypassing the ethical constraints of AI by exploiting vulnerabilities through carefully crafted prompts designed to circumvent its built-in rules. As a result, AI can operate in dangerous or illegal ways.

Prompt leaking, on the other hand, refers to the theft of prompts used in generative AI. Prompts are instructions or commands that guide the AI to perform tasks accurately. If system prompts are leaked through code-sharing platforms like GitHub, threat actors could exploit them to distort AI or undermine its reliability. This is particularly concerning for large language models like GPT models, as leaked prompts could significantly undermine data security.

The second attack type, data poisoning, involves deliberately injecting malicious or distorted data into the AI training process to manipulate its outputs. A well-known example is Microsoft's AI chatbot "Tay". Released in 2016, Tay learned and interacted based on user-provided data. However, some users fed Tay inappropriate content, including profanity, racism, and sexism, causing the chatbot to adopt and spew highly offensive and hateful remarks. As a result, Microsoft was forced to shut Tay down just 16 hours after its launch. This incident highlights the critical importance of high-quality training data and how attackers can abuse AI systems.

The third type, model reversing, is a technique where attackers perform repeated queries on an AI model to analyze its functioning and extract its training data. By studying the model's responses, threat actors can infer its internal structure and training data, potentially exposing confidential or sensitive information, including personal data. This attack method exploits security vulnerabilities in AI models, posing significant threats to data protection and model security.



3. Cyber Threats Advanced by the Application of AI
Threat actors are not only targeting AI systems but also rapidly incorporating AI into their attack campaigns. AI-powered attacks include malware creation, phishing attacks, deepfakes, and vulnerability analysis and hacking. These attacks have reached unprecedented levels of sophistication and scale, making them significantly more dangerous than traditional methods.
 

First, AI is being actively utilized to write malware and scripts. Attackers leverage AI to generate large volumes of obfuscated code designed to evade detection, enabling them to bypass existing security systems. Notably, AI significantly enhances the efficiency and speed of creating ransomware or malware aimed at stealing personal information. Recently, there has been an increase in cases where AI is used to search for images containing sensitive information, such as passwords or cryptocurrency wallet addresses, which are then abused for malicious purposes.

In addition, AI allows attackers to execute phishing attacks with greater precision. AI-generated phishing email content appears highly natural, as if written by a person. While traditional phishing emails could often be identified through specific words or awkward sentence structures, AI-powered phishing creates messages that are virtually indistinguishable from legitimate business emails or notifications since they are based on large language models. The advancement of AI has caused a more than 40-fold increase in phishing emails compared to the past, significantly enhancing their realism and impact, which underscores AI's profound influence on cyberattacks.

Deepfake technology allows for the creation of realistic fake videos using just a few images and voice samples. The quality of deepfakes continues to improve, and they are increasingly being abused for crimes such as spreading fake news, causing social unrest, producing fraudulent video content, and conducting voice phishing. For example, attackers can now fabricate videos of celebrities making false statements or use a person's voice to commit financial fraud, creating significant risks of social and financial disruption.

Quote:4. AhnLab's Security Enhancement Strategy Using AI
Given the sophistication and complexity of AI-driven attacks, traditional security approaches are insufficient for effective defense. Consequently, AI holds immense importance not only in countering AI-enabled attacks but also in addressing emerging threats.
 

AhnLab is actively applying AI technology to enhance its solutions and platforms. The company's AI capabilities are rooted in filing technology, which classifies malicious and legitimate files. Additionally, AhnLab trains its learning models using a wide range of data, including behavior-based analysis, URL information, and event logs. This technology is integrated into all major products, such as V3, V3 Mobile, EDR, MDS, TIP, and XDR, significantly improving overall threat detection, analysis, and response capabilities. Furthermore, AhnLab is advancing its security technology in multiple areas, including malware and phishing email detection and response, prediction of potential threats, and comprehensive risk management.

• Dynamic Multi-Layered Security
  
  Today’s cyber threats are armed with various sophisticated techniques, making them difficult to prevent with a point-product. AhnLab ENDPOINT PLUS, an array of endpoint security controls, dominates modern cyber-attacks with its multi-layered approach by pulling together the best-in-class anti-malware, sandbox, and endpoint detection & response.
  
  
  
• Flexible Integration and Central Management
  
  AhnLab ENDPOINT PLUS smoothly consolidates extensive security tools to deliver complete coverage of endpoint protection with central monitoring and management. Its broader integration with network security products and threat intelligence platform drives AhnLab Endpoint PLUS to make stride toward a truly limitless security.
  
  
  
• Cutting-Edge Technologies
  
  AhnLab ENDPOINT PLUS sets itself apart with its granular threat detection, robust analysis, and optimal response powered by the proprietary engine AhnLab Smart Defense (ASD), which represents our industry-leading technology and expertise compiled over the last thirty years.
  

• Top-Tier Detection Rate
  
  AhnLab V3 products achieved top-tier detection rates in global evaluations like AV-TEST. CC certification and other global testing bodies have further validated its excellence. Our anti-malware suite dynamically detects endpoint threats by harnessing the multidimensional analysis platform equipped with behavioral detection, cloud-based machine learning detection, process memory detection and more.
  
  
  
• Extensive Coverage
  
  Organizations can use AhnLab V3 products as standalone or together with our endpoint protection platform (AhnLab EPP) and cloud protection platform (AhnLab CPP) in line with their security requirements. Users will enjoy the benefits of extensive OS coverage across physical/virtual desktops, laptops and servers along with powerful features, including file detection, network protection and device control (Windows only).
  
  
  
• Time-Honored Expertise
  
  Leveraging cyber threat data and analytical expertise accumulated over 30 years, our anti-malware products effectively tackle emerging threats and ensure business continuity. The threat intelligence delivered by our industry-leading researchers is reflected in the engine in real-time to prevent novel malware and variants.
  

• Threat Detection and Prevention
  
  AhnLab V3 products accurately detect, prevent and remediate cyber threats in real-time by utilizing our integrated engine and the cloud network. They prevent fileless attacks through a full-scale memory inspection in conjunction with AMSI detection and proactively defend against unknown threats through ML-powered detection technologies.
  
  
• Anti-Ransomware
  
  The V3 products harness decoy detection and application quarantine inspection to prevent ransomware or execution of suspicious processes. Also, the security folder feature safeguards organizations from their business-critical files being encrypted.
  
  
• Network Security and Firewall
  
  AhnLab V3 products deliver web security features such as malicious website blocking by leveraging a database of over 2.5 billion IPs and URLs. It further offers network security controls spanning abnormal packet flow monitoring and firewall features, allowing users to configure program-specific network rules for desktops.
  
  
• Device Control
  
  AhnLab V3 Endpoint Security offers control over external devices like Bluetooth and USB, allowing or blocking access as needed. It provides write permission/blocking and logging for USBs, along with exception settings for controlled devices.
  
  
• Central Management and Integration
  
  The V3 products represent our platform-centric approach by seamlessly interacting with AhnLab EPP and AhnLab CPP to enable central monitoring and policy configuration. The anti-malware products can also be deployed by AhnLab EPP Patch Management (EPM), our patch management solution.
  

• Frictionless Integration
  
  AhnLab EPP represents our platform-centric approach by pulling together various security controls ranging from anti-malware to EDR. It drives our customers’ proactive approach toward security monitoring, policy enforcement, and threat response.
  
  
  
• Next-Level Efficiency
  
  AhnLab EPP supercharges our customers with next-level operational efficiency and business productivity by delivering centralized management of industry-leading security tools within a single console and agent.
  
  
  
• Unmatched Scalability
  
  AhnLab EPP supports various deployment methods and server scaling techniques to address diverse security requirements. It ensures operational stability by harnessing load balancers and expands threat response coverage by smoothly interacting with third-party products.
  

• Holistic Security Toolset
  
  AhnLab EPP pulls together full-scale endpoint security controls to actualize an ultimate single-pane-of-glass experience. It empowers users with unrivaled malware prevention, patch management, security assessment, data protection, and EDR to harden security posture and take down sophisticated cyber threats.
  
  
  
• Integrated Rules and Policies
  
  Integrated management is at the heart of our endpoint protection platform. A centralized rule and policy enforcement drive security tools of AhnLab EPP to run at the peak level and flexibly interact with each other.
  
  
  
• User-Defined Dashboard
  
  User-defined dashboard and report of AhnLab EPP customizable with customers’ requirements bolster operational efficiency and flexibility. The central view of abundant security insights from multiple security controls accelerate organization’s security decision making process.
  
  
  
• Centralized Data Ingestion
  
  AhnLab EPP garners extensive data from endpoint devices across the organization by leveraging its agent. Then, it performs comprehensive inspection and analysis into risky or suspicious devices to safeguard business assets from advanced malicious campaigns.
  
  
  
• Zero Trust Implementation
  
  AhnLab EPP plays a significant part in realizing the zero trust initiative. It executes rigorous endpoint security assessment and allows network connection only for secure devices by interacting with our next-generation firewall, AhnLab TrusGuard.
  

• Advanced Threat Detection
  
  The multi-engine of AhnLab MDS is the backbone of its unrivaled file analysis technology, applying the most suitable analysis technique aligned with the characteristics of each file. It runs files in an isolated environment (sandbox) and performs a comprehensive analysis of behavior, file/process creation, network traffic, and URL access to determine the maliciousness of files.
  
  
  
• No Execution Until Validated
  
  AhnLab MDS never lets suspicious files executed in the end-user system. Once unanalyzed files are detected, it instantly holds execution, triggers analysis, and performs response measures, including file removal and system quarantine if a file is convicted of being malicious.
  
  
  
• AI-Powered Email Security
  
  AhnLab MDS determines the maliciousness of email by extracting the email data and implementing AI-assisted analysis. This results in laser-accurate detection of phishing emails that might evade policy-based detection.
  

• Cutting-Edge Analysis
  
  In the sandbox constructed within the high-performance appliance, AhnLab MDS analyzes every executable and non-executable files as well as covert techniques hidden behind files. It accelerates users to outpace modern cyber threats without compromising end-user systems.
  
  
  
• Reversing Anti-VM
  
  Some modern malware is equipped with anti-VM features, which freezes its operation once sandbox environments are detected. AhnLab MDS, always a few steps ahead of the latest cyber threats, reverses the anti-VM feature by disabling malware to scan the sandbox and evade detection.
  
  
  
• Network Inspection
  
  When analyzing files, AhnLab MDS granularly detects and blocks malicious network traffic based on extensive signatures and YARA rules to tackle techniques of advanced persistent threats (APTs) such as C2 server connections.
  
  
  
• Third-Party Integration
  
  AhnLab MDS is compatible with a variety of third-party products spanning SSL/TLS decryption and spam filtering solutions. This extends its range of file aggregation, detection, and analysis to deliver reinforced threat response capabilities.
  
  
  
• Intelligence-Driven Defense
  
  AhnLab MDS actualizes “intelligence-driven defense” by deeply integrating with our native products and services. Our threat intelligence platform, AhnLab TIP, feeds additional insights on files, URLs, and Ips to AhnLab MDS, and industry-leading experts of ASEC step in to deliver the full-scale file analysis service.
  
  
  
• Central Monitoring and Log Management
  
  The intuitive AhnLab MDS dashboard offers exceptional visibility into the threat detection and analysis status and central management of logs and events generated by products deployed across the organization.
  

• Detection and Analysis with Precision
  
  AhnLab EDR, powered by our EDR-dedicated proprietary engine, fuels users to achieve a greater understanding of full attack stories by delivering laser-accurate detection and graphical visualization of the result. It enables us to fully deconstruct malicious operations and provide contextualized response measures.
  
  
  
• Expert-led Analytics and Response
  
  Our managed detection and response (MDR) complements AhnLab EDR by offering full coverage of expert-led threat investigation and response. It accelerates users to streamline the entire detection & response process and make context-aware security decisions with confidence.
  
  
  
• Dedicated Console for Proactive Security
  
  AhnLab EDR Analyzer, the dedicated console of AhnLab EDR, empowers users to perform instant detection, in-depth analysis, and powerful response to active and potential cyber threats. It underpins users to take a proactive security approach without laboriously chasing alerts.
  

• State-of-the-Art Visualization
  
  AhnLab EDR intuitively visualizes the full picture of cyber threats, including types, paths, behaviors, correlations, severities, and further details aligned with MITRE ATT&CK Framework via diagram, timeline, and other graphics to ensure users stay context-aware and response-ready.
  
  
  
• Behavioral Analytics
  
  AhnLab EDR cross-examines behaviors across endpoint vectors and provides extensive information on the type, severity, and detail of each behavior with mapping to the standardized MITRE ATT&CK knowledge base.
  
  
  
• User-defined Behavior Rule Sets
  
  AhnLab EDR lets users deploy pre-defined static and dynamic rules on endpoint behaviors to sharpen threat detection and automate the response process. It plays a pivotal role in preventing adversaries from slipping through the cracks with nuanced techniques.
  
  
  
• Proactive Threat Response
  
  AhnLab EDR offers optimal response features spanning artifact and file aggregation, network quarantine, rollback, process killing, and more to help users achieve successful threat response with a proactive approach.
  
  
  
• Seamless Integration
  
  AhnLab EDR amplifies its threat detection and response capabilities by seamlessly integrating with diverse security controls of our endpoint protection platform (AhnLab EPP), threat intelligence platform (AhnLab TIP), and sandbox solution (AhnLab MDS).
  

• Cost-Effective
  
  Customers can enjoy the benefit of central management from the “AhnLab Security Center” included in the deal at no additional charge. Also, our comprehensive all-in-one service relieves the stress of managing multiple contracts.
  
  
  
• Easy-To-Use
  
  Customers can effortlessly access management anytime, anywhere, with just an online connection. They can conduct monitoring, immediate threat response, and policy configuration from the single dashboard while receiving email reports on security status and license management.
  
  
  
• Centrally Managed
  
  SaaS-delivered unified management ensures convenient security operations, consolidated visibility, and central policy enforcement across multiple endpoint devices in the organization. Also, its extensive set of security controls can easily be executed by non-experts.
  

• V3 Endpoint Security
  
  V3 Endpoint Security ensures secure protection against malware across Windows, macOS, Linux, and Android environments through real-time scanning, vulnerability assessment, and malware remediation.
  
  
  
• V3 Server Security
  
  V3 Server Security delivers advanced protection for Windows and Linux servers, including ransomware-specific response features, multi-level detection of suspicious processes and programs, malicious website blocking, and network intrusion prevention.
  
  
  
• Endpoint Security Assessment
  
  The security control performs a periodic assessment on over fifty criteria to make sure that systems are well-performing, not vulnerable, properly patched, and safely configured.
  
  
  
• Security Center
  
  The “Security Center” offers a central web-based management that allows users to easily monitor, operate, and manage the security status of PCs and mobile devices. It also supports convenient policy configurations, remote inspections, updates, and report production.
  

• Globally Verified Capabilities
  
  AhnLab V3 Mobile products have proven their best-in-industry mobile protection by being certified in all rounds of AV-TEST, where they have presented outstanding performance, usability, and detection rates.
  
  
  
• Flexible Implementation
  
  Our mobile security products accelerate flexible deployment and optimization conforming with each corporate environment. They feature an intuitive user interface for a convenient and efficient mobile security experience.
  
  
  
• Integrated Operation
  
  AhnLab V3 Mobile products drive a platform-centric approach with the “Transaction Security Center” at its heart. As such, we establish a mobile security ecosystem where users can perform security monitoring and policy configuration in an integrated manner.
  

• ML-Powered Text Scanning
  
  Leveraging our cutting-edge machine learning technology, AhnLab V3 Mobile products prevent mobile scams from materializing. They precisely detect phishing content in text messages, including those related to overseas shopping, financial services, and family impersonation, even without the presence of malicious URLs.
  
  
  
• Web Filtering
  
  Our mobile security products proactively examine the safety of URLs accessed through Chrome and Samsung Internet browsers on mobile devices, preventing security risks in advance.
  
  
  
• Anti-Malware
  
  Built upon AhnLab V3’s globally top-tier anti-malware capabilities, the AhnLab V3 Mobile suite ensures a robust and convenient security experience with an intuitive interface and user-friendly scanning options.
  
  
  
• Device Threat Detection
  
  The security controls of AhnLab V3 Mobile safeguard against attacks by detecting voice phishing apps that pose a threat to mobile devices. They also ensure customer usability by offering an application selection feature in conjunction with exception management.
  
  
  
• Integrated Management
  
  By utilizing the “Transaction Security Center”, customers can seamlessly manage threat detection logs and take response action by piecing together V3 Mobile Plus, Mobile Engine SDK, and Mobile Device Threat Information.
  

• Ransomware Protection
  
  Threat actors use various techniques until they finally drop ransomware. AhnLab effectively tackles ransomware by redesigning organization’s security system that goes beyond malware prevention.
  
  AhnLab Ransomware Protection
  
  
  
• Threat Detection and Response
  
  The latest cyber threats traverse security layers to perform malicious activities. Our purpose-built products detect, analyze and respond to advanced threats across multiple security domains, together with security services by the experts.
  
  AhnLab Threat Detection Response
  
  
  
• OT Security
  
  The OT/IT convergence is urging organizations for a new security strategy to bridge the gap between two environments. With AhnLab's “Unified OT Security Framework”, AhnLab delivers OT and IT-integrated security for a successful industrial digital bridging. 
  

  Quote:Our Unified OT Security Framework: Definition and Benefits In July 2021, AhnLab acquired NAONWORKS, a company specializing in OT security and industrial protocol analysis, in response to the expanding demand for unified OT security. Starting with the gateway solutions for OT protocol standardization in 2017, NAONWORKS has provided the “CEREBRO” series, security solutions customized for OT and ICS, powered by OT protocol identification and analysis technology and open architecture-based edge computing platforms. AhnLab's excellent IT security capabilities were further enhanced with the acquisition of NAONWORKS, allowing AhnLab's security threat detection, response, and analysis technologies to be integrated with NAONWORKS' industrial protocol analysis technology to establish a unified OT security framework. The following is a summary of our unified OT security framework architecture for each OT layer.

   
  
  
  
  More Info below:
  
  AhnLab OT Security
  
  Additional Info HERE
  
  About NAONWORKS
  
  
  
   
  
  AhnLab ENDPOINT PLUS
  
  AhnLab Home Page HERE
  
  Products Page HERE
  
  AhnLab Services HERE
  
  AhnLab Solutions HERE
  
  AhnLab Support HERE
  
  AhnLab Downloads HERE
  
  About AhnLab
  
  AhnLab Press Releases
  
  AhnLab CertificatesHERE
  
  AhnLab in LinkedIn
  
  AhnLab at Twitter (X)
  
  AhnLab at YouTube
  
  
  Data and info derived / lifted from AhnLab with permission