VirusTotal Poisoning
- Occurred
- Jan 1, 2020
- Published
- Unknown
- Source
- MITRE ATLAS
- Sector
- incident
Summary
McAfee Advanced Threat Research noticed an increase in reports of a certain ransomware family that was out of the ordinary. Case investigation revealed that many samples of that particular ransomware family were submitted through a popular virus-sharing platform within a short amount of time. Further investigation revealed that based on string similarity the samples were all equivalent, and based on code similarity they were between 98 and 74 percent similar. Interestingly enough, the compile time was the same for all the samples. After more digging, researchers discovered that someone used 'metame' a metamorphic code manipulating tool to manipulate the original file towards mutant variants. The variants would not always be executable, but are still classified as the same ransomware family. Target: VirusTotal Actor: Unknown Reporter: McAfee Advanced Threat Research Procedure: 1. The actor obtained [metame](https://github.com/a0rtega/metame), a simple metamorphic code engine for arbitrary executables. 2. The actor used a malware sample from a prevalent ransomware family as a start to create "mutant" variants. 3. The actor uploaded "mutant" samples to the platform. 4. Several vendors started to classify the files as the ransomware family even though most of them won't run. The "mutant" samples poisoned the dataset the ML model(s) use to identify and classify this ransomware family.
Deployers
- VirusTotal
Tags
- MITRE ATLAS
- AML.CS0002
Classification
Rationale: Malware poisoning of ML-based security platform, but not a direct LLM failure; fits LLM category as ML model manipulation.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8