{"id":59808,"date":"2025-12-08T00:00:00","date_gmt":"2025-12-08T00:00:00","guid":{"rendered":"urn:uuid:5886d7f9-4d21-6eef-6093-8c0699ec2eb3"},"modified":"2025-12-08T00:00:00","modified_gmt":"2025-12-08T00:00:00","slug":"ai-automated-threat-hunting-brings-ghostpenguin-out-of-the-shadows","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/ai-automated-threat-hunting-brings-ghostpenguin-out-of-the-shadows\/","title":{"rendered":"AI-Automated Threat Hunting Brings GhostPenguin Out of the Shadows"},"content":{"rendered":"

<\/p>\n

<\/div>\n

Threat hunting approach<\/span><\/h2>\n

Our approach focused on collecting, processing, and analyzing a large number of malware samples from known and reported attacks. The goal was to extract useful artifacts that help hunt for new, undetected threats.<\/p>\n

Hunting workflow<\/b><\/p>\n

1. Collect and extract artifacts<\/b>
We gather many malware samples from known and reported attacks and extract key information from them such as strings, API calls, behaviors, function names, variable names, and constants. All collected data is stored in a structured database. Afterwards, we tag and categorize the samples so they are easier to search and compare.<\/p>\n

2. Build VirusTotal hunting queries<\/b>
Using the extracted artifacts, we create VirusTotal hunting rules and run them against samples with zero detections. When we find potential candidates, pass the samples to the profiling stage.<\/p>\n

3. Profiling and analysis<\/b>
Binary files are sent to IDA Pro (Hex-Rays) for decompilation and further artifact extraction. CAPA also utilized to identify specific capabilities (A custom rule has been generated based on the artifacts collected during Stage 1). Non-binary files like scripts or code are passed directly to the profiler for feature extraction. The profiler subsequently generates a unified profile in JSON format for each file, which is then forwarded to the next stage of analysis.<\/p>\n

The AI agent Quick Inspect reviews the JSON profile created during the profiling stage. It analyzes the artifact, scores it, and determines if the file is malicious or not. Files below the threshold go into a monitoring list for later review, while files above the threshold tagged as malicious and move to the next stage.<\/p>\n

The Deep Inspector agent performs a deeper analysis on files that pass the threshold and are tagged as malicious. It generates a detailed analysis report for the file based on the decompiled code and the metadata created during the profiling stage. The agent reviews the file profile and produces a code-analysis report that includes:<\/p>\n