SANDS Lab presented research on tracking malware modified by generative artificial intelligence (AI) at the international security conference Virus Bulletin (VB) 2026, held in Seville, Spain, on Oct. 14 local time.

Senior researchers Jeon Chan-bin and Lim Seung-beom delivered a joint presentation during a Green Room session titled "Tracing the Lineage of Large Language Model (LLM)-Based Malware Variants: Does GHOST Leave Traces?" The research was selected for the conference's official presentation program following a review by the VB 2026 selection committee.

The research addresses concerns that generative AI could be misused to automatically modify malware and produce large numbers of variants. Conventional analysis identifies malware variants based on similarities in code patterns and other characteristics. However, such connections may be difficult to detect when LLMs alter malware structures and coding styles while preserving their functionality.

To investigate the problem, SANDS Lab's research team developed Generative Heuristic Obfuscation and Semantic Transformation (GHOST), a research tool that uses LLMs to automatically modify malware structures and representations. The team conducted 50 experiments involving five malware families and two LLMs.

The researchers found that even when code was modified, recurring characteristics remained in function structures and data processing methods, depending on the model used. Based on these findings, they proposed a method for tracing relationships between malware variants and narrowing down the samples and functions requiring further analysis.

"We will continue validating and advancing technologies needed for real-world threat analysis, building on the exchanges we have maintained through VB," said Jeon Chan-bin, senior researcher at SANDS Lab.

Lim Seung-beom, also a senior researcher at SANDS Lab, said, "We hope the technology we developed will help counter emerging threats involving the misuse of AI and provide a foundation for advancing security technologies in the AI era."

SANDS Lab also participated in VB in 2023 and 2025, sharing its research findings. Established in 1991, VB is an international security conference recognized for its authority in malware analysis and cyber threat intelligence (CTI).