Modern Incident Response: Tackling Malicious ML Artifacts

May 21, 2025, 7:59 p.m.

Description

This analysis explores the emerging threat of machine learning model-based breaches, detailing their anatomy, detection methods, and real-world examples. It highlights the risks associated with sharing ML models, particularly through platforms like Hugging Face, and the potential for malicious actors to exploit serialization formats like pickle files. The report outlines various techniques for detecting and analyzing suspicious models, including static scanning, disassembly, memory forensics, and sandboxing. It also presents case studies of actual incidents involving malicious models, demonstrating the urgency of developing specialized incident response capabilities for AI-related threats.

Date

  • Created: May 14, 2025, 1:56 p.m.
  • Published: May 14, 2025, 1:56 p.m.
  • Modified: May 21, 2025, 7:59 p.m.

Indicators

  • 391f5d0cefba81be3e59e7b029649dfb32ea50f72c4d51663117fdd4d5d1e176
  • 121.199.68.210

Attack Patterns

  • TSPY_TRICKLOAD
  • Mythic
  • Metasploit
  • Totbrick
  • TrickBot - S0266
  • Cobalt Strike - S0154