Threat detection is an arms race. As threat actors evolve their tactics—deploying new evasion techniques, building sophisticated multi-stage attack chains, and abusing legitimate tools for initial access—detection teams must keep pace by identifying new behavioral patterns and threat signatures before they cause harm. VMRay Labs responded to this challenge in August 2026 by releasing 10 new threat identifiers, 50+ new YARA rules, and 4 new configuration extractors designed to detect emerging threats across the attack surface.
This webinar brings together VMRay threat researchers Julian Wolf and Tucker to walk through the latest detection innovations—from blockchain-based dead-drop resolvers to P2P botnet communications to sophisticated phishing kit fingerprinting. They also previewed VMRay's H1 2026 threat landscape report, revealing how ransomware, identity attacks, and AI-driven operations are reshaping the threat landscape organizations face today.
10 New VMray Thread Identifiers: Threat Detection Coverage Expansion
VMRay's threat identifier (VTI) system assigns behavioral and indicator-based scores to samples based on observed malware capabilities. In August 2026, VMRay Labs released 10 new VTIs targeting emerging attack behaviors that weren't previously tracked by the platform. These identifiers span multiple attack vectors: web3 infrastructure abuse, network communication patterns, phishing infrastructure, and evasion techniques.
The new VTIs address specific gaps in threat detection. For example, traditional malware analysis tools struggle to detect dead-drop resolvers that use blockchain smart contracts instead of DNS or HTTP. They miss the significance of P2P botnet communications because these fall outside centralized C2 monitoring. They overlook multi-step redirect chains that obscure phishing landing pages. And they rely too heavily on static signature matching to detect sophisticated phishing kits. The new VTIs close these gaps by recognizing behavioral patterns that correlate with emerging threats.
Key insight: Detection isn't just about identifying known malware signatures—it's about recognizing new behavioral patterns that indicate emerging threats. VMRay's new VTIs shift detection from signature-focused to behavior-focused, enabling faster identification of novel attack techniques.
New Detection Behaviors: From Blockchain Dead-Drops to Network Communication Patterns
Among the 10 new VTIs released, several stand out for targeting previously under-monitored threat behaviors. Understanding these new detections helps organizations recognize when malware is attempting tactics that traditional defenses often miss.
Web3 Dead-Drop Resolution
Detects malware using blockchain smart contracts as C2 dead-drop resolvers. Threat actors encode C2 server addresses or backup communication channels in smart contract return values, allowing malware to retrieve updated C2 information from immutable blockchain infrastructure rather than standard C2 servers.
Multi-Step Redirect Chains
Identifies suspicious redirect chains that obscure link destinations. Multiple redirects make it difficult for users and security tools to follow the navigation path, often using legitimate services in the first step to add false legitimacy before directing to malicious content.
UDP Peer-to-Peer Communication
Detects P2P botnet communications using UDP instead of centralized C2. Bots communicate directly with each other, complicating detection by eliminating the traditional C2 server bottleneck and distributing communication across the network.
Bulk SMTP Server Contacts
Flags malware contacting numerous SMTP servers in a single session. Single SMTP connections are common, but mass SMTP targeting indicates email-spam or mass-mailing botnet activity, signaling intent to abuse email infrastructure.
Three additional VTIs focus specifically on phishing email detection: pressure/urgency keywords, brand logo impersonation via public image hosting, and brand name masquerading in sender fields. These help anti-phishing teams identify suspicious email campaigns without relying solely on URL analysis of embedded links.
4 New Configuration Extractors: Tracking Malware & Abused Legitimate Tools
Configuration extractors automatically recover C2 addresses, encryption keys, and other operational parameters embedded in malware samples. In August 2026, VMRay Labs added extractors for four new threats: Forpix botnet, NetSupport Manager, ScreenConnect, and Valerian Red trojan. These extractors are significant because they go beyond traditional malware—some target legitimate remote management tools frequently abused for initial access in targeted campaigns.
The Forpix extractor is particularly noteworthy because Forpix is a worm that's been in circulation since 2010, evolving over 16 years of continuous development. Modern Forpix samples use P2P communication alongside traditional C2, requiring multi-layered configuration extraction. The extractor automatically identifies both centralized C2 addresses and P2P communication nodes.
NetSupport Manager and ScreenConnect are both legitimate remote management tools frequently abused for initial access operations. Unlike traditional malware, these tools aren't inherently malicious—they're often deployed by IT teams for legitimate remote work scenarios. However, threat actors frequently abuse them as first-stage payloads in phishing campaigns, sometimes with zero malware payload in between. Being able to extract their configuration is critical for identifying attacker-controlled instances and understanding how they're being weaponized.
Valerian Red is a C++ trojan with information-stealing, keylogging, persistence, and remote control capabilities. The new extractor enables rapid identification of Valerian Red's operational parameters across variants.
Console Demonstrations: Real-World Detection Examples in Action
During the webinar, Julian Wolf demonstrated the new VTIs and config extractors using real samples submitted to VMRay. These examples illustrate how the detection innovations translate into actionable intelligence for threat analysts.
AirTraffic: Blockchain-Based Dead-Drop Resolver
AirTraffic uses Ethereum smart contracts on the Polygon network as a dead-drop resolver. Rather than connecting to a C2 server, the malware queries a specific contract address and receives an encoded C2 server address in the return value. The encoding is simple (not encrypted), allowing easy decoding into the actual C2 address. VMRay's new web3 dead-drop VTI identifies this behavior automatically, and the config extractor recovers both the smart contract address and the decoded C2 address—all without manual analyst work.
Forpix: UDP P2P Botnet with Backup C2 Configuration
A modern Forpix sample demonstrated the UDP P2P communication VTI and backup C2 configuration VTI. The sample attempted UDP connections to numerous IP addresses on port 40,500 (the P2P port), most unsuccessful. More importantly, the sample attempted to retrieve backup C2 configuration from a URL labeled "backup domains"—exactly the pattern the new backup C2 configuration VTI is designed to flag. The config extractor recovered this URL and documented that the backup C2 list was empty in this instance, but the behavioral signature is consistent across Forpix variants.
ClickFix: Social Engineering & Code Execution
ClickFix is a social engineering attack that uses a browser popup to trick users into executing code via keyboard shortcuts. A notable variant requests Windows + X followed by I to open PowerShell—a slight variation from the typical Windows + R shortcut. This demonstrates how threat actors continuously refine attack chains to evade both user awareness and automated detection. VMRay's multi-step execution tracking identifies this pattern.
ScreenConnect: Legitimate Tool Weaponized for Initial Access
A phishing URL directly distributes a ScreenConnect installer without intermediate malware. The URL uses a lure (gift card/birthday card) to convince users to click and execute the installer. When analyzed, VMRay's config extractor automatically recovers the encryption key and C2 server ScreenConnect is configured to contact. This example is significant because there's no traditional malware involved—the threat is the abuse of a legitimate remote management tool. Defenders need to identify and block such deployments, and the new ScreenConnect config extractor enables automated identification.
50+ New YARA Rules: Expanding Threat Signature Coverage
While Julian didn't walk through individual YARA rules in detail (the list is extensive), the 50+ new rules released in August 2026 focus on expanding coverage for emerging malware families and variants. YARA rules enable custom threat detection by matching specific byte patterns, strings, or structural characteristics in binaries or memory dumps. The new rules target recent malware families, phishing kit implementations, and evasion techniques.
YARA rules are particularly valuable for threat intelligence teams because they can be deployed across SOCs, threat feeds, and sandboxes to automatically identify related samples. When combined with VMRay's config extractors and VTIs, YARA rules provide multi-layered detection: signature-based matching for rapid identification, behavioral analysis for pattern recognition, and configuration extraction for intelligence gathering.
H1 2026 Threat Landscape: Ransomware Dominance & Identity-Centric Attacks
Julian provided a sneak preview of VMRay's H1 2026 threat landscape report (to be published in full shortly). The report aggregates threat data from multiple security vendors and organizations, revealing macro-level threat trends. Key findings from the first half of 2026:
Ransomware Remains Dominant: More organizations were listed on ransomware leak sites than ever before. Ransomware isn't declining—it's evolving. Fewer dominant operators now control larger shares of total impact, suggesting consolidation among threat groups. Extortion demands increasingly rely on data theft threats rather than encryption alone, pushing total ransom demands higher.
Identity & Access Attacks Accelerate: Unit 42's assessment found that many incident response cases begin with identity compromise. Crowdstrike reports that a growing percentage of detections are "malware-free"—involving identity compromise instead of traditional malware delivery. This pattern includes ClickFix social engineering, phishing for credentials, adversary-in-the-middle attacks, and multi-factor authentication (MFA) bypass techniques. Even traditional MFA methods are increasingly vulnerable to advanced attacks.
Faster Exploitation Cycles: Newly disclosed vulnerabilities are weaponized faster than ever. Mandiant reports exploits leading 32% of breach activity, with edge devices (routers, network appliances) heavily targeted. This puts pressure on DevOps and network security teams to patch aggressively and monitor for exploitation attempts.
AI Becomes Operational: Organizations are increasingly using AI to automate attack chain components—reconnaissance, social engineering automation, and payload generation. While some vendor assessments claim high percentages of AI-driven operations, Julian's assessment is more nuanced: AI is more often used as a social engineering lure than as a true autonomous agent. The reality is probably somewhere in between, but AI-enhanced attacks are undeniably a growing trend.
Supply Chain & Cloud Risk: Compromised cloud environments and poisoned package repositories create cascading risk. A single compromised package can propagate to thousands of downstream users if trusted.
Key Takeaways: Detecting Emerging Threats in a Rapidly Evolving Landscape
The August 2026 detection innovations and H1 threat landscape trends reveal several critical lessons for defense teams:
Monitor Non-Traditional C2 Channels
Threat actors are moving beyond standard C2 infrastructure to blockchain smart contracts, P2P networks, and legitimate services. Detection teams must expand monitoring to cover these emerging channels, not just HTTP/HTTPS and DNS.
Watch for Legitimate Tool Abuse
ScreenConnect, NetSupport Manager, and similar legitimate remote management tools are increasingly weaponized for initial access. Defenders need configuration-level visibility into how these tools are deployed, not just binary signatures.
Prioritize Identity & Access Controls
As identity compromise becomes the entry point for more breaches, advanced MFA, conditional access policies, and identity monitoring become critical. The malware-free breach is the new normal for many threat actors.
Implement Multi-Layer Detection
Single-layer detection (signature-based YARA, behavior-based VTIs, or config extraction alone) isn't sufficient. Combining signature matching, behavioral analysis, and configuration intelligence creates redundancy and catch more threats.
Frequently Asked Questions
What is a VMRay Thread Identifier (VTI)?
A Thread Identifier (VTI) is VMRay's behavioral scoring system that assigns threat scores to malware samples based on observed capabilities and behaviors. Each VTI represents a specific threat pattern—such as C2 communication, information stealing, or evasion techniques. VTIs enable rapid threat identification without relying solely on signature matching, making them effective for detecting emerging and variant malware.
How do config extractors work?
Configuration extractors are automated tools that recover operational parameters embedded in malware samples and legitimate tools. They extract C2 server addresses, encryption keys, API endpoints, backup communication channels, and other configuration data. This enables security teams to rapidly identify attacker infrastructure, correlate related samples, and generate actionable threat intelligence without manual reverse engineering.
What are YARA rules and how do they differ from VTIs?
YARA rules are signature-based detection methods that match specific byte patterns, strings, or structural characteristics in files or memory. VTIs are behavioral scoring systems that identify threat patterns based on runtime behavior. YARA rules excel at rapid identification of known malware signatures, while VTIs detect behavioral patterns that may indicate emerging or variant threats. Together, they provide complementary detection coverage: signatures for known threats and behavior patterns for novel variants.
Why are legitimate tools like ScreenConnect being used in attacks?
Legitimate remote management tools like ScreenConnect are attractive to threat actors because they don't trigger traditional malware alerts—they're trusted applications. Threat actors use them for initial access, often delivering them through phishing campaigns. Once installed, they provide remote access without requiring malware payloads. This "living off the land" technique bypasses many endpoint detection systems, making legitimate tool abuse a critical threat vector.
What is AirTraffic and how does blockchain-based C2 work?
AirTraffic is malware that uses blockchain smart contracts (specifically Ethereum contracts on the Polygon network) as dead-drop resolvers for C2 server addresses. Instead of contacting a C2 server directly, the malware queries a smart contract and receives an encoded C2 address in the response. This approach distributes C2 infrastructure across immutable blockchain networks, making takedowns significantly more difficult and enabling rapid C2 address rotation through contract updates.
How can organizations detect phishing kits like Sneaky 2FA and Tycoon 2FA?
Phishing kits are detected through "meta-VTIs" that correlate multiple behavioral patterns rather than relying on single signatures. Sneaky 2FA detection combines fake CAPTCHA challenges, credential capture patterns, and specific visual resources. Tycoon 2FA detection correlates fake code inputs, visual obfuscation patterns, and communication endpoints. By correlating these patterns, meta-VTIs identify phishing kits with high confidence even when individual components appear legitimate.
What does the H1 2026 threat landscape report reveal about ransomware trends?
The H1 2026 threat landscape report shows that ransomware activity remains strong with consolidation around fewer, more impactful threat groups. Rather than decline, ransomware is evolving toward higher-value targets and larger ransom demands. Extortion now increasingly relies on data theft threats rather than encryption alone, driving demands higher. This indicates a shift from volume-based ransomware campaigns to targeted, high-impact operations against critical infrastructure and large enterprises.
Why are identity-based attacks becoming the dominant threat vector?
Identity attacks are becoming dominant because they bypass many traditional defenses (malware-free breaches), work across multiple platforms, and often succeed even with multi-factor authentication deployed. Techniques include phishing for credentials, ClickFix social engineering, adversary-in-the-middle attacks, and MFA bypass techniques. Once an identity is compromised, threat actors gain legitimate access, making detection extremely difficult. Organizations must prioritize advanced MFA, conditional access policies, and identity monitoring to defend against this threat vector.
How do I implement the detection recommendations from this webinar?
Implement the detection recommendations through a multi-layered approach: (1) Deploy VTI-based behavioral detection using VMRay for incoming samples; (2) Implement YARA rules across your detection infrastructure (SIEM, EDR, threat feeds); (3) Enable configuration extraction for malware analysis to identify attacker infrastructure; (4) Monitor non-traditional C2 channels (blockchain, P2P networks); (5) Watch for legitimate tool abuse (ScreenConnect, NetSupport); (6) Prioritize identity & access controls to prevent identity compromise. VMRay automates steps 1–4, enabling rapid threat identification and response.
Meet the Experts
Julian Wolf
PhD in Binary Program Analysis | Threat Researcher at VMRay Labs specializing in malware analysis, threat detection innovation, and detection research.
Focus areas: Threat Detection, Malware Analysis, Configuration Extraction
Tucker Aldinger
VMRay Events & Community Manager | Coordinates webinar series and community engagement to deliver the latest detection innovations and threat research to security professionals.
Focus areas: Threat Intelligence, Detection Innovation, Community Engagement
Stay Ahead of Emerging Threats with Automated Detection
VMRay's latest detection innovations give security teams the visibility to identify new threats before they impact your organization. Access advanced VTIs, YARA rules, and config extractors to enhance your detection capabilities.
Start Your Free Trial Watch More Webinars