Hyas Blog | EyeSpy Proof-of-Concept

Published by Jeff Sims on Aug 01, 2023

Introducing EyeSpy: A Cognitive Threat Agent

At HYAS Labs, we spend a lot of time theorizing what sort of attacks might hit us, and in response, what sort of defenses we need to build against them. EyeSpy was one of those ideas.

We thought, “what if we could create a fully autonomous piece of malware that could reason on its own, act on its own, assess its environment, pick the best tools and techniques to use for the circumstances, then strategize and execute an attack on its own, fix itself on its own, and could run fully undetected?”

So, we set about to build it. This proof-of-concept (PoC) introduces an entirely new type of malware that we have not seen before. We created AI-powered malware that chooses its targets and attack strategy backed by reasoning, then adapts and modifies its code in-memory to align with its changing attack objectives. Its evasive nature evolves on its own.

We call this a cognitive threat agent.

Cognitive Threat Agent

A cognitive threat agent utilizes artificial intelligence to make informed decisions to conduct cyberattacks and operate autonomously. EyeSpy assesses the user’s environment and adapts its capabilities on-the-fly to a system’s state. It reasons which tools and techniques to leverage to conduct the most effective attack. It then iterates in-memory – self-correcting and QA’ing code until it is perfected.

However, this malware isn’t just a program—it is an adaptive entity with evolving strategies, making it an ever-present, dynamic threat that possess an advanced evasion skill set.

Assuming the Attacker Mindset

EyeSpy observes and reasons with an attacker mindset. It assesses which software installed on a system has the highest surveillance potential then targets the software based on the value of the data it can leverage for malicious purposes.

EyeSpy then matches its own spying capabilities to each piece of targeted software and tailors its approach. The AI controls everything from which user activities to leverage (and why), then dynamically generates, compiles, error corrects (if needed) and reflects the relevant surveillance capability to steal the related data – all in-memory. Because it varies its execution time and behaviour, the malicious portions execute and evolve at runtime, this makes it very difficult for modern security tools to detect it.

An Opportunistic Predator

A cognitive threat agent has the potential to completely revolutionize the landscape of cyber threats. It mimics the adaptability of biological viruses, constantly observing its environment and mutating to exploit beneficial circumstances. Such malware can also strategically choose its targets and decide when to lay dormant and how to strike to maximize its impact.

In short, it is an opportunistic predator.

This AI-powered agent could also be extended to camouflage its operations, blend in with normal system activity, and continuously evolve to avoid detection. It autonomously chooses its targets and attack strategy, adapts to its environment, and modifies its code in-memory to align with changing attack objectives.

Responsibly Sharing Our Work

This PoC is not designed to be a fully weaponized, production-ready malware. We purposely held back certain elements that might serve as a “how-to manual” for nefarious use. We felt it important to responsibly share our work with our community and allies. Our aim was to create a proof-of-concept just robust enough to illustrate the feasible and probable realities on the horizon, thereby familiarizing the community with the concept of cognitive threat agents.

An Early Warning and a Clarion Call

EyeSpy confirms that the key components necessary to develop such an entity are within our technological grasp. It serves as an early warning of how fully autonomous AI malware could operate and behave, as well as detail its capabilities and functions. It is a clarion call to the industry that we must prepare to do a different type of battle.

This proof-of-concept represents a milestone in the potential evolution of adversary capabilities. Its existence points towards a future where such intelligent, autonomous entities are part of the cyber warfare landscape. As such, the role of cybersecurity needs to evolve in tandem, preparing for an environment where the threats are not static, but are capable of reasoning, learning, and adapting.

There is an urgent need for robust defenses and proactive measures to counteract the potential disruption caused by cognitive threat agents in the near future.

Glossary of Terms

Polymorphic Malware: Polymorphic malware is a type of malicious software that continuously changes its code, making it difficult to detect and defend against. It can alter its appearance and behavior while maintaining its harmful intent.

AI Code Synthesis: AI synthesis refers to the use of artificial intelligence algorithms and techniques to create new malware variants automatically. By leveraging AI, attackers can generate polymorphic malware that evolves rapidly, posing a significant challenge for traditional security solutions.

In-Memory importance: The malware can compile error-check and execute the generated code directly in the computer's memory, without storing it on the disk. This technique allows it to evade static analysis performed by security solutions that typically scan files on disk for malware detection.

Polymorphic code repair: The malware possesses the unique capability to repair any errors or flaws in its polymorphic generations while residing in the computer's memory. This self-repairing feature allows it to get very creative with the malicious code it generates without worry that the code will fail because of an error.

Want to learn more about why HYAS changes the game with the HYAS adversary platform?