Pre-Lab

Learning Objectives

After completing this learning module, you will be able to:

• Explain how Generative AI lowers the technical barrier for creating malware (e.g., Keyloggers, Reverse Shells, Ransomware).

• Define Polymorphic Malware and how AI contributes to code mutation to evade antivirus detection.

• Identify the mechanics of the "Cyber-AI Arms Race" where AI is used for both offense and defense.

• Demonstrate how to use LLMs to generate defensive scripts (Blue Teaming) to counter specific AI-generated threats

Prerequisites

• Python 3 (via Google Colab).

• Basic understanding of networking (ports, IPs) and system processes.

• Familiarity with the Hugging Face API (used in the Lab).

Key Terms

• Malware Generation: The use of LLMs to write functional malicious code, such as spyware, viruses, or encryption scripts, often by bypassing safety filters.

• Reverse Shell: A type of cyberattack where a target machine communicates back to the attacking machine, granting the attacker remote control over the system.

• Polymorphic Malware: Malicious software that uses AI to alter its code structure with every execution (mutation) while keeping its original functionality, making it difficult for traditional antivirus to detect.

• Lowered Barrier to Entry: The phenomenon where GenAI allows individuals with limited coding skills ("Script Kiddies") to experiment with and execute sophisticated cyberattack techniques.

• Cyber-AI Arms Race: The escalating cycle where malicious AI is used to create attacks, and defensive AI is required to detect and counter them.

• Blue Teaming: The defensive side of cybersecurity; in this module, it refers to using AI to write scripts that monitor and protect systems.

Background

Gen AI has strong implications for the threat landscape. While most commercial LLMs (Copilot, Gemini, Claude, etc.) have safety protections, attackers can sometimes use "Jailbreaks" or open-source models to bypass these restrictions. This module explores the "Double-Edged Sword" of AI in scripting: it can build tools to destroy systems, but it can also build tools to protect them.

The Offensive capability (Red Team)

Historically, writing effective malware required deep technical knowledge. You need knowledge of both operating systems and memory management to take advantage and exploit the system. GenAI changes this dynamic by acting as an "amplifier" for cybersecurity risks.

1. Lowering the Barrier: GenAI assists less technically capable users in experimenting with attack techniques (similar to script kiddies). A user who does not know how to write Python can simply ask an AI to "Write a script that records keystrokes" (Keylogger) or "Encrypt all files in this directory" (Ransomware logic). While current LLMs may struggle to autonomously create complex, operational malware from scratch without human help, they do excel at generating certain specific malicious snippets and payloads.

2. Polymorphic Code: Traditional antivirus software detects malware by looking for specific "signatures" (or byte sequences). Recently, AI threatens to render this practice obsolete through Polymorphic Malware Generation. An attacker can ask an LLM to rewrite the malware's code structure every time it runs—changing variable names, loops, and logic flow—while the malicious action remains the same. This makes signature-based detection ineffective.

3. Specific Attack Vectors:

• Reconnaissance: AI can write scripts to scan networks for open ports and vulnerabilities.

• Ransomware: Researchers have demonstrated that jailbroken LLMs can generate code that encrypts files across a network, mimicking notorious attacks like WannaCry or Ryuk.

• Spyware/Trojans: LLMs can generate code to capture screens, log keystrokes, or record audio.

The Defensive Capability (Blue Team)

To counteract the threats GenAI brings offensively, defenders must use AI to automate their security. Effectively bringing about a "Cyber-AI Arms Race" 

1. Automated Defense Scripts: Just as AI can create a script to open a reverse shell, it also can write a script to detect one. Defenders can use LLMs to generate code that:

• Monitors ongoing network connections for any suspicious IPs.

• Scans system processes for anomalies (like the previously mentioned keylogger, running in the background).

• Parses server logs to identify things like SQL injection attempts.

2. Vulnerability Detection: LLMs have shown a strong ability to detect vulnerable functions in code. By using techniques like "self-reflection," AI can analyze code and suggest patches for security flaws before attackers can exploit them. This was shown partially in Lab 5, where comparing the two codes gave reasons why one was more secure.

In this lab, you will act as both the Attacker (generating malicious scripts) and the Defender (generating monitoring scripts to catch them), using the DeepSeek-R1 model hosted on Hugging Face.