Nation-State Hackers Are Vibe Coding Malware, and Your Detection Stack Isn't Ready

THE STORY

Bitdefender published research this week disclosing a fundamental shift in how APT36 (Transparent Tribe) develops and deploys malware. Instead of investing in a small number of carefully engineered tools, the Pakistan-aligned state-sponsored group has pivoted to what Bitdefender calls "vibeware": AI-assisted, rapidly produced malware that trades sophistication for scale.

The concept is deceptively simple. Using large language models, APT36 operators are generating functional malware in programming languages they likely don't know well, including Nim, Zig, Crystal, Rust, and Go, at a pace of roughly one new variant per day. The code is not elegant. Researchers found tools with placeholder C2 addresses that would never actually exfiltrate data. They found backdoors that reset their own tracking timestamps. They found logic errors that would make a junior developer cringe. Some of the code even contained emojis, which is a telltale sign of LLM-assisted generation.

But the quality doesn't matter. The strategy does.

Bitdefender has named the approach "Distributed Denial of Detection," or DDoD. The logic mirrors a DDoS attack: instead of overwhelming a server with traffic, you overwhelm a detection engine with variants. If five malware samples hit a target simultaneously, one in Nim, one in Crystal, one in Rust, one in Go, one in .NET, and even one gets through because the AV engine hasn't seen Crystal malware before, the attacker wins. The other four were expendable.

The campaign targets the Indian government, its embassies across multiple countries, and entities in Afghanistan and the broader South Asian region. APT36 uses LinkedIn to identify high-value targets and delivers initial access through fake resume PDFs and modified browser shortcuts. Once on a system, the malware fleet communicates through Slack, Discord, Google Sheets, Supabase, and Firebase. All of these are trusted cloud services that most organizations cannot block without disrupting business.

The specific tools identified include CreepDropper (a .NET loader), SHEETCREEP (a Go-based infostealer using Microsoft Graph API for C2), MAILCREEP (a C# backdoor using Google Sheets), SupaServ (a Rust backdoor using Supabase with Firebase fallback), LuminousStealer (a Rust-based file exfiltrator using Firebase and Google Drive), CrystalShell (a cross-platform backdoor in Crystal using Discord for C2), and LuminousCookies (a credential stealer that bypasses Chrome's App-Bound Encryption by injecting directly into the browser's memory).

THE ADVERSARY PERSPECTIVE

The Economics of Malware Just Changed

From an offensive security standpoint, vibeware represents a structural shift in the attacker-defender cost equation. For decades, building effective malware required real skill. You had to understand target architectures, write reliable shellcode, engineer persistence mechanisms, and test against AV engines. The cost of production was high, which meant attackers were selective and defenders could focus on detecting known tool families.

AI collapses that cost to near zero. APT36 can now produce a functional implant in a new language in minutes, not weeks. The tool doesn't need to be perfect. It needs to work once, on one machine, for long enough to establish a foothold. If it gets burned, they generate another one tomorrow in a different language.

This fundamentally breaks signature-based detection. Every new language, every new binary, every slight variation in how the same logic gets expressed resets the detection baseline. And by using niche languages that most security engines have limited visibility into, the attacker gets a bonus advantage: the AV has never seen a Crystal binary before, so it has no behavioral models for what "normal" Crystal execution looks like.

The cloud C2 layer compounds the problem. Blocking Slack, Discord, or Google Sheets is impractical in most enterprises. The attacker's command traffic looks identical to an employee checking a shared spreadsheet. Defenders are forced to do behavioral analysis on API-level telemetry from trusted services, and that is a capability most SOCs simply do not have.

Here's what most security teams are missing: this is not just an APT36 story. Bitdefender's telemetry shows AI-generated malware samples increasing across multiple nation-state groups. Russia, China, North Korea, and Iran have all been observed using LLMs for code generation. The vibeware model is going to spread because it works, it's cheap, and the AI tools that enable it are getting better every quarter.

DEFENSIVE TAKEAWAYS