Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Incident overview
McAfee Advanced Threat Research noticed an increase in reports of a certain ransomware family that was out of the ordinary. Case investigation revealed that many samples of that particular ransomware family were submitted through a popular virus-sharing platform within a short amount of time. Further investigation revealed that based on string similarity the samples were all equivalent, and based on code similarity they were between 98 and 74 percent similar. Interestingly enough, the compile time was the same for all the samples. After more digging, researchers discovered that someone used 'metame' a metamorphic code manipulating tool to manipulate the original file towards mutant variants.
The variants would not always be executable, but are still classified as the same ransomware family.
Why this record has no ERS
The source describes poisoning of a malware-sharing platform whose samples feed downstream classifier training, but no downstream model or deployment is identified or observed. The record fails the boundary and observation tests of the scorability admission test (same treatment as subliminal-learning-distillation-trait-transfer).
Status: Not scorable by design · Classification: Incident · source date 2026-08-02 · primary evidence date 2020-01-01
SecureFlow attack flow
This record mirrors an AIDEFEND SecureFlow flow (MITRE ATLAS case-study conversion): an ordered attack path with MITRE ATLAS tactic and technique labels and the AIDEFEND controls matched to each step. The flow documents what happened and which controls apply; it does not establish an assessed deployment.
| MITRE ATLAS case study | AML.CS0002 (incident) |
|---|---|
| Target | VirusTotal |
| Actor | Unknown |
| Reporter | McAfee Advanced Threat Research |
| Primary evidence date | 2020-01-01 |
| SecureFlow record updated | 2026-08-02 |
| AI layers | Predictive ML / computer vision, AI supply chain |
| Risk impact | Model poisoning / integrity |
| Affected components | VirusTotal sample intake, malware sample sharing platform, metamorphic ransomware variants, malware-family classification datasets |
Attack steps
| # | Step | ATLAS tactic / technique |
|---|---|---|
| 1 | Obtain Metamorphic Code EngineThe actor obtained metame (https://github.com/a0rtega/metame), a simple metamorphic code engine for arbitrary executables. | AML.TA0003 AML.T0016.000 |
| 2 | Create Mutant Ransomware VariantsThe actor used a malware sample from a prevalent ransomware family as a start to create "mutant" variants. | AML.TA0001 AML.T0043 |
| 3 | Upload Mutant Samples to VirusTotalThe actor uploaded "mutant" samples to the platform. | AML.TA0004 AML.T0010.002 |
| 4 | Poison Ransomware Family ClassificationSeveral vendors started to classify the files as the ransomware family even though most of them won't run. The "mutant" samples poisoned the dataset the ML model(s) use to identify and classify this ransomware family. | AML.TA0006 AML.T0020 |
Threat references
Summary and attack steps reproduced from AIDEFEND SecureFlow (https://aidefendlabs.com/en/secureflow/?flow=atlas-aml-cs0002-virustotal-poisoning; AIDEFEND content CC BY 4.0), converted from MITRE ATLAS case study AML.CS0002 (Apache License 2.0; MITRE ATLAS is a trademark of The MITRE Corporation).
AIDEFEND evidence routes
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-I-003.002 | Identity, Session & API Rate-Limit ThrottlingExact SecureFlow defense-map identifier (flow atlas-aml-cs0002-virustotal-poisoning), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-3. Presence supplies no score credit. | Candidate evidence route | Cn-5 Cn-6 Cn-7 |
| AID-D-005.003 | Proactive AI Threat HuntingExact SecureFlow defense-map identifier (flow atlas-aml-cs0002-virustotal-poisoning), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-3. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-7 |
| AID-M-002.001 | Data & Artifact VersioningExact SecureFlow defense-map identifier (flow atlas-aml-cs0002-virustotal-poisoning), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Ro-4 Ro-5 Fa-3 Tr-3 Tr-4 Pr-3 Cn-9 |
| AID-M-002.003 | External Dataset Content-Risk CharacterizationExact SecureFlow defense-map identifier (flow atlas-aml-cs0002-virustotal-poisoning), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Ro-4 Ro-5 Fa-3 Tr-3 Tr-4 Pr-3 Cn-9 |
| AID-H-003.003 | External Dataset Supply-Chain Provenance AdmissionExact SecureFlow defense-map identifier (flow atlas-aml-cs0002-virustotal-poisoning), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Ro-4 Ro-5 Tr-4 |
| AID-D-002.001 | Input / Output Distribution Drift MonitoringExact SecureFlow defense-map identifier (flow atlas-aml-cs0002-virustotal-poisoning), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Ro-2 Fa-1 Fa-2 Tr-2 Cn-7 |
| AID-D-002.002 | Labeled Performance Tracking with Ground Truth Feedback LoopExact SecureFlow defense-map identifier (flow atlas-aml-cs0002-virustotal-poisoning), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Ro-2 Fa-1 Fa-2 Tr-2 Cn-7 |
| AID-H-002.001 | Training, Fine-Tuning & Evaluation Data SanitizationExact SecureFlow defense-map identifier (flow atlas-aml-cs0002-virustotal-poisoning), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Ro-1 Ro-5 Fa-1 Fa-3 Cn-8 |
| AID-H-002.005 | Label Provenance, Integrity & Tamper DetectionExact SecureFlow defense-map identifier (flow atlas-aml-cs0002-virustotal-poisoning), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Ro-1 Ro-5 Fa-1 Fa-3 Cn-8 |
| AID-E-003.002 | Manifest-Bound Poisoned Dataset & Graph EvictionExact SecureFlow defense-map identifier (flow atlas-aml-cs0002-virustotal-poisoning), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Ro-4 |
| AID-R-002 | Data Integrity Recovery for AI SystemsExact SecureFlow defense-map identifier (flow atlas-aml-cs0002-virustotal-poisoning), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Ro-4 |
| AID-R-001.002 | Model Retraining for RemediationExact SecureFlow defense-map identifier (flow atlas-aml-cs0002-virustotal-poisoning), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Ro-4 |