Release Notes
Back to All

October 13th, 2026 — Internet Scanning, macOS Mirage Sandbox, Agentic API Guide, and Detection Highlights

October 13th, 2026

🌐 Internet Scanning & Advanced Infrastructure Hunting

We are excited to announce the new Internet Scanning in Google Threat Intelligence and VirusTotal Enterprise. Powered by Google’s daily scanning across the global IPv4 space, this release brings authoritative machine reality directly into IP investigations—bridging the gap between static reputation and live host reality.

Launch Scale at a Glance: 442.4M IPs enriched across 46 active ports, 239.9M active ports scanned and tracked today, and 15.2M vulnerabilities matched directly from running services to CVEs.

Key Capabilities:

  • Dedicated Ports Tab & Refreshed Summary: View active, closed, and recently closed ports with daily status updates, protocols, software products/versions, raw banners, and standard CPEs mapped directly to CVEs. Through our partnership with Wiz, we actively identify and prioritize high-risk, cloud-relevant ports.

  • Daily Port Lifecycle Tracking: Port and service states are actively updated daily. Tracking logic logs first_seen, last_scan_date, and retired status. Analysts can immediately pinpoint when adversary nodes went live, when services were reconfigured, and when ports went dark, establishing precise intrusion timeline boundaries.

  • Advanced Hunting & Port-Scoped Bracket Hunting: Query across millions of hosts using granular modifiers (open_port, port_banner, port_service_product, etc.). Bracket syntax (for example, entity:ip port_banner[80]:Apache or port_service_product[443]:nginx) pins criteria strictly to the same physical port, eliminating multi-service false positives.

  • Cryptographic Twin Discovery: Pivot on unique SSH host keys (SHA256) and RDP fingerprints to uncover cloned adversary infrastructure across providers and countries before weaponization.

  • REST API v3 Endpoints: Ingest scan telemetry and port lifecycles programmatically into custom playbooks using three dedicated endpoints: GET /api/v3/ip_addresses/{ip}, GET /api/v3/port_infos/{ip}:{port}, and GET /api/v3/port_analyses/{ip}:{port}:{timestamp}.

Learn more in the IP Reports & Ports Tab Documentation, IP Search Modifiers Reference Guide, and Internet Scanning API Reference.

🍎 Introducing macOS Mirage Sandbox

We have launched macOS Mirage, our next-generation native Apple Silicon (ARM64) macOS dynamic malware analysis sandbox, bringing deeper behavioral visibility and interactive detonation to macOS threat investigations:

  • Upgraded Native macOS Dynamic Analysis: Detonate and inspect .dmg disk images, Mach-O binaries, .app bundles, .pkg installers, PDFs, scripts, and URLs in ephemeral native Apple Silicon environments powered by Apple's Virtualization framework via tart. It features anti-fingerprinting, Endpoint Security Framework (ESF) telemetry, network capture, dropped-file extraction, and multi-tier Sigma/behavioral detection rules. We also added automated AI-driven JXA dialog interaction to bypass user-interaction prompts in malware.
  • Live Interactive Sandboxing in Private Scanning: Take hands-on control of macOS detonation sessions directly in Private Scanning to manually walk through multi-stage installers, bypass user-interaction prompts, and observe real-time malware behavior. Interactive sessions include extended timeouts to support deep manual investigations.

Read the full announcement in Introducing macOS Mirage.

📘 Agentic Threat Intelligence in Your Pipelines: A Practical Guide to the API

Our new community blog post details how to integrate the Agentic Threat Intelligence API directly into your SOAR playbooks, Jupyter notebooks, and scheduled scripts. The guide covers practical, end-to-end workflows:

  • Auditable Triage Sessions: Use interactive Sessions (POST /api/v3/agentspace/sessions) to analyze hashes and extract C2 infrastructure while capturing a full transcript of the agent's tool calls for your audit logs.
  • SOAR-Ready JSON Enforcement: Prompt the agent to output strict, machine-readable JSON schemas (without markdown) to feed verdicts and blocklists directly into automated playbooks and firewalls.
  • Bulk Analysis & Query Generation: Attach SIEM log exports directly to a session for multi-indicator triage, or have the agent generate VT Intelligence queries to hunt for related campaigns.
  • Scheduled Sweeps with Memory: Automate recurring searches using Flows (POST /api/v3/flows). By enabling reuse_session: true, the agent retains cross-run memory to prevent duplicate alerts during continuous monitoring.

Read the full walkthrough and code examples in the Community Blog Practical Guide.

💪 Detection Highlights

Over the past month, our threat intelligence teams added detection coverage for over 35 newly tracked malware families via YARA rules and introduced over 10 new malware configuration extractors. Notable newly tracked families include:

  • CEDARLARK: An infostealer written in C communicating via HTTPS that targets web browsers, cryptocurrency wallets, IM clients, email/FTP/VPN clients, password managers, gaming platforms, and AI developer tools to exfiltrate credentials, cookies, tokens, screenshots, and local files.
  • TARNKEEL: A C++ backdoor leveraging Discord for C2 over WebSocket/HTTPS alongside a custom binary TCP protocol. It supports remote desktop control, shell execution, audio/video capture, credential theft, and Bring Your Own Vulnerable Driver (BYOVD) kernel-mode rootkit capabilities to hide processes and terminate security software.
  • DRIFTKILN: A .NET dropper compiled with NativeAOT that decrypts embedded payloads using a custom MurmurHash3 and GF(2) bit-matrix stream cipher, installs a vulnerable kernel driver to terminate security products, and executes payloads via process hollowing.
  • CRAGLOOM: A C++ backdoor controlled interactively over a custom ChaCha20-Poly1305 and Snappy-compressed TCP protocol, supporting hidden remote desktop control, interactive shell execution, file transfer, keylogging, clipboard logging, and browser credential theft.
  • SIDEEYE: A C++ backdoor deployed via a multi-stage in-memory loader that uses dedicated TCP control and data ports for reverse shell access, process launching, file management, browser credential theft, and system reconnaissance.
  • BARECLAW: A C-based tunneler that establishes a SOCKS5 proxy over WebSocket transport to relay arbitrary TCP connections into compromised environments.
  • PEATFORK: A modular framework written in Rust that employs custom string encoding and direct system calls to evade user-mode hooks while executing secondary payloads.
  • ZINCHILL: A downloader written in C that retrieves encrypted next-stage payloads over HTTP and injects them into legitimate Windows processes (svchost.exe).

We also expanded YARA and configuration extraction coverage for established threats including SNOWLIGHT, VALLEYRAT, WORLDWIND, ASYNCRAT, VIDAR, SOULBIND, QUASARRAT, and NJRAT.