Case gtig-canfail-longstream-decoyAI-assisted malwareUkraine
Russia-nexus CANFAIL and LONGSTREAM malware pad code with LLM filler to fool analysts
GTIG found two Russia-nexus families aimed at Ukraine whose LLM-generated decoy logic, including comments labelling blocks as filler and 32 daylight-saving checks, is designed to make scripts look benign to reviewers.
MediumAttack using AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- May 11, 2026
- Location
- Ukraine
- Target
- Ukrainian organisations
- Severity
- Medium
- Triggered by
- Suspected Russia-nexus actors
- Actor type
- State-sponsored
- Reported loss
- None reported
- CVE
- None
What happened
GTIG found two Russia-nexus families aimed at Ukraine whose LLM-generated decoy logic, including comments labelling blocks as filler and 32 daylight-saving checks, is designed to make scripts look benign to reviewers.
Impact: Harder detection of malware in active campaigns against Ukraine; victim details not published.
Who triggered it
Actor: Suspected Russia-nexus actors
Attribution: GTIG assesses a Russia nexus from targeting and tooling; group not named.
Motive: Espionage against Ukraine
How it happened
Attack vector: AI-generated inert code inserted into malware for junk-code evasion
Root cause: LLMs make bulk generation of plausible decoy code trivial
Timeline
- Samples with LLM-written filler code observed in campaigns against Ukraine
- GTIG publishes the families in its AI Threat Tracker
Response
Google documented indicators and updated detection guidance.
Current status: Ongoing
Sources (open in a new tab)
- GTIG AI Threat Tracker May 2026 cloud.google.com
- Secure Blink coverage secureblink.com
Cite this case
Russia-nexus CANFAIL and LONGSTREAM malware pad code with LLM filler to fool analysts. AI Threat Watch, case gtig-canfail-longstream-decoy, May 11, 2026. https://aithreat.io/cases/gtig-canfail-longstream-decoy/
Permanent link: https://aithreat.io/cases/gtig-canfail-longstream-decoy/