Release Notes
Back to All

October 29, 2026 — GTI Mail Hub, Agentic Updates, Process Trees, and Detection Highlights

October 29th, 2026

📬 Introducing GTI Mail Hub

We are thrilled to announce the GTI Mail Hub, designed to deliver proactive GTI Alerts and centralized email management straight to your inbox. By eliminating the need to monitor multiple environments or maintain custom scripts, the Mail Hub automatically pushes high-fidelity, context-rich alerts to security teams, accelerating threat triage and incident response.

For this initial release, our focus is exclusively on delivering a robust and highly reliable email notification experience. Key Capabilities include:

  • Unified "Mail Hub" Settings Tab: Consolidates your notification preferences into a dedicated Mail Hub tab within your settings. From this single interface, you can effortlessly manage your Threat Intelligence Digests, alerts from My Landscape, and general communication subscriptions.

  • Scheduled Digests: Configure daily or weekly email summaries for the latest Intelligence Reports, Vulnerability updates, and personalized Threat Profiles.

  • Real-Time Alert Notifications: While GTI automatically monitors your infrastructure for threats, you control which My Landscape alerts reach your inbox. Unlike scheduled digests, these emails are sent immediately when an alert matches your custom rules for Threat Scenario, Severity, and Relevance Score.

Configure your alert notifications today at virustotal.com/gui/settings/mail-hub and learn more in the Mail Hub Documentation.

🤖 Google TI Agentic Updates

We continue to expand the automation capabilities of Google TI Agentic:

  • Multi-Step Agentic Flows: We have introduced a zero-code orchestration engine that allows you to chain together multi-step prompts, saved searches, and email actions. This enables security teams to automate daily threat hunts and turn them into autonomous background routines. For example, a flow could be scheduled to trigger every Monday to fetch new IoCs for a specific threat actor, prompt the AI agent to analyze them, and automatically email the generated summary to your security team as a Weekly Executive Threat Digest.
  • Internet Scanning in GTI Agentic: Agentic can now analyze open ports and exposed services on IP addresses with GTI Internet Scanning data. It can show port history and activity timelines, find changes in software, banners, SSH keys and certificates, and correlate hosts that share infrastructure fingerprints (see an example).

📘 Process Trees in Livehunt: YARA Rules That Know Who Launched What

Our latest blog post details how to write behavior-based Livehunt and Retrohunt YARA rules using flattened sandbox process trees. By leveraging the new parent_name and ancestor_names fields in vt.behaviour.processes_list, you can now trace full execution chains—such as an Office document launching PowerShell—and attribute specific file operations directly to the individual processes that performed them. The post includes five real-world hunting scenarios complete with tested YARA rules and sample hashes to try directly in the Livehunt editor.

Read the full walkthrough and rule examples in Process trees in Livehunt: YARA rules that know who launched what.

💪 Detection Highlights

The Google Threat Intelligence Group and FLARE team consistently update Google TI's YARA rules. In the last two weeks, we have released YARA rules covering 14 newly tracked malware families and expanded our configuration extraction platform to cover 14 new malware families.

Notable examples from these newly tracked malware families include:

  • BLUESHIFT: A modular dropper written in C designed for reuse across campaigns and supporting multiple payload types.
  • TARNKEEL.NET: A .NET-based backdoor that leverages Discord for C2 over WebSocket, HTTPS, and UDP alongside a custom binary TCP protocol. It supports mouse/keyboard control, shell execution, file transfer, audio/video/screenshot capture, browser and IM credential theft, AV disabling, and a user-mode rootkit for process masquerading and termination protection.
  • BRINEHASP: A dropper written in C that writes an embedded payload to disk, loads it into the current process memory, and immediately deletes the payload file from disk.
  • ZINCCASK: A 64-bit Rust infostealer compiled as a Windows DLL that harvests browser credentials, cookies, autofill, and extension data, extracts Steam/Roblox/Discord session tokens, hijacks clipboard crypto wallet addresses, and bypasses Chromium App-Bound Encryption by launching a hidden-desktop browser instance and hijacking a remote thread to decrypt the v20 master key in-process.
  • FROSTVALVE: A C++ downloader that retrieves encrypted payloads over HTTPS using WinHTTP, decrypts the stream with a 256-bit stream cipher, and reflectively maps and executes the staged PE image directly in memory without touching disk.

In addition to providing detection rules for new and emerging threats, we continue to update our detection and configuration extraction systems for established threats, including QUASARRAT, AGENTTESLA, and MIRAI. These updates ensure you have the latest indicators extracted by our configuration extraction systems.