ReversingLabs: AI malware rebuilds still fail behavior-based detection

ReversingLabs flagged Midnight Blizzard's Go backdoor on Aug. 1, weeks before Anthropic's Sept. 10 report, and tracked five versions of the same stager over 25 days. Hashes changed each time, but behavior stayed identical, leaving every iteration detectable.

• ReversingLabs spotted the backdoor Aug. 1; Anthropic reported Sept. 10
• Five stager versions with different hashes seen in 25 days
• All versions behaved the same and were caught by behavior analysis
• AI speeds up code rewrites but does not change the payload's core