Ledger / 11 May 2026
Russia-nexus malware with LLM-generated decoy code targets Ukraine
Strong
GTIG found leftover developer (LLM) comments in the code but names no model.
GTIG confirms the use of CANFAIL and LONGSTREAM, whose decoy code is LLM generated. The decoy code pads the malware with benign-looking activity. Date shown is the report month.
“Analysis confirms the use of CANFAIL and LONGSTREAM, which utilize LLM-generated decoy code to obfuscate their malicious functionality.”Google Threat Intelligence Group
Sources
- GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial AccessGoogle Threat Intelligence Group · 11 May 2026 · primary source
- Disclosed
- 11 May 2026
- Activity
- 2026
- Actor
- Suspected Russia-nexus actors (nation state), as attributed by Google Threat Intelligence Group
- Nexus
- Russia
- Targets
- Ukrainian organizations
- What the AI did
- Malware dev, Evasion
- Model
- unspecified LLM
- Model family
- Unspecified
- Model basis
- inferred
- Autonomy
- assist
- Outcome
- CANFAIL and LONGSTREAM delivered with AI-generated decoy logic to hamper analysis.