MCYSEKA-Maritime Cyber Security Knowledge Archive

OK so, be prepared for the ranting thoughts of a layman here. Anyway:

It seems like the downfall of almost every malware is that its purpose eventually has to reveal its existence, either by directly communicating with the target (eg ransomeware) or achieving some goal whose consequences will inevitably be felt and eventually attributed to an attack and therefore investigated (data exfil eg keyloggers, stealing compute power eg cryptominers and botnets, or physically disabling hardware eg stuxnet). The assumption is that it doesn’t matter if the malware is detected as long its job gets done and it doesn’t give away the identity of the people or organisations that deployed it.

In the past there have been programs like iloveyou that did in fact only intend to spread as much as possible, but by being too greedy made themselves obvious and conspicuous (iirc iloveyou infected like a fifth of the internet at the time, or some crazy number like that).

But what about a more sneaky malware that used only the minimal resources required to spread to enough machines in enough different environments, could be just like, 100 machines at a time. What if it didn’t even need to phone home, but rather could just communicate with other instances of itself in a decentralized manner? And heck, while I’m dreaming, what if it used metamorphic code and followed CVE lists and was able to learn and update itself, was able to survive, entirely without the aid of, and outside the control of, its original creator?

That seems like a really cool project to me. Basically the idea of malware that acts more like a living creature, whose goals are 100% survival based. Instead of profit based or politically motivated, decided by some silly little human somewhere.

An “advanced persistent threat” that has no particular endgame.