How Rubrik Zero Labs Uses LLMs to Analyze Malware at Machine Speed

AI is changing how malware is built—and how it’s caught. In this episode, Caleb Tolin is joined by Amit Malik, Staff Security Researcher at Rubrik Zero Labs, to unpack how large language models are transforming malware analysis, enabling defenders to sift through thousands of samples and surface truly novel threats. From Chameleon malware abusing WSL to AI-generated attack code, this conversation explores what real data resilience looks like in an AI-driven threat landscape. What You’ll Learn How LLMs help analysts move from syntax-level review to intent-based malware analysis Why processing thousands of samples daily requires AI-assisted triage and clustering How attackers are abusing WSL and cloud-native environments to evade detection What AI-generated, dynamically delivered malware code means for traditional defenses Where LLMs excel—and where human validation remains essential Why resilience matters more than speed in AI-driven security operations Episode Highlights [00:00] AI-generated malware and shrinking attacker footprints [03:30] Why Rubrik Zero Labs built an LLM-driven malware analysis system [05:45] Scaling from 6,000 samples to 20 worth investigating[07:40] Extracting malware “business logic” before sending code to LLMs [10:05] Chameleon malware abusing Windows Subsystem for Linux [13:00] APT-linked Linux RATs and what sophistication signals intent [15:00] LLM hallucinations and the need for human verification Episode Resources Rubrik Zero Labs Research Reports