Today, attackers have transitioned from using traditional fixed payloads in cyber campaigns (ransomware attacks, espionage, infostealer operations, and phishing chains) to using real-time or victim-specific adaptive payloads to evade detection and bypass endpoint controls, as well as to increase their success rates.
Dynamic adaptation of how a malware or loader or initial access payload will behave, along with how it will obfuscate itself, what command-line arguments it will use, how its C2 configurations will look like, and what core logic will govern its operation, is now based on real-time feedback from the attacker's environment through data collected through EDR telemetry or by determining what phase of their campaign they are in.
The transition to the use of these dynamic adaptations has evolved since 2024-2026 due to improvements in both EDRs and behavioral analytics. As a result of this evolution, the use of static indicators (i.e. known hashes, static strings, and consistent command-line arguments) has become one of the main reasons that threat actors prioritize the use of runtime polymorphism, environmental awareness, and fallback mechanisms.
Script Adaptation Techniques
1. Check OS version, EDR presence, username, domain membership, CPU architecture and installed AV/EDR processes to determine which payload to run or how the script will behave.
2. Use on-the-fly decryption to encrypt strings at runtime and rename variables, insert junk code, and rewrite your code (e.g., PowerShell → C# reflective → native shellcode). Use different C2 domains/ports for each run or victim.
3. Randomize command-line flags, the order and encoding of parameters (base64, hex or gzip), and use environment variables to obscure patterns.
4. If the original payload isn't functioning, the alternate payload will execute.
5. If a command schedule is taking excessive time, I've used a "sleep timer" with randomness so that EDR can't use time to determine that something is incorrect.
6. Initially use an HTTPS C2 and then switch to DNS, ICMP or WebSocket if HTTPS is being blocked.
Practical Examples from 2025–2026 Campaigns
Example 1: Lumma Stealer - Dynamic PowerShell cradle.
1. First stage: Using phishing ZIP → LNK → PowerShell
2. The script looks for common EDR processes (CSI, S1, MD) on launch.
3. If found → wait for a random interval of 5-15 minutes and switch to an alternate injection method via process hollowing.
4. If no EDR is detected → download encrypted configuration data from different pastebin-like domains each time the script is executed.
5. Obfuscation is performed every few hours via a builder (string/variable randomization).
Example 2: RansomHub/LockBit Affiliation - Malevolent Adaptive LOLBin Chains
1. Via Stolen RDP Credentials, Obtain Initial Access Through PowerShell One-Liner
2. Script will Check Registry for Defender File Exclusion, If None Found Then Add Self-Exclusion via GPO Registry Keys
3. Script to Check for a Sysmon Process (If Present, Use Schtasks Command-Line Handler Bypass NOT Directly Executing Payload)
4. Many Randomized Methods for Delivering the Payload: BITSAdmin -> CertUtil -> Rundll32 -> Native PE File Drops
Example 3: GhostPairing and HackOnChat chains - JavaScript polymorphism.
1. A phishing portal delivers a different JavaScript payload based on the User-Agent, geolocation of IP address, and browser version.
2. If an EDR browser add-on is detected, then fall back to pure HTML form with manual input of One Time Password (OTP).
3. QR code session tokens are encrypted differently for each campaign wave (the AES key is changed daily).
Example 4: Multi-Stage Adaptive Behavior of the ClayRat Android Malware
1. The victim has granted the APK permission to send SMS messages (Not always applicable) the malware will send out premium-rate SMS messages using this capability.
2. If SMS permissions are denied, the malware will use the accessibility service to abuse it by reading and sending SMS messages.
3. The C2 domain (command and control) list is being collected dynamically via a GitHub gist and is updated every 24 hours.
Example 5: Self-Propagating Adaptive Waterspider/Sorvepotel Worm.
1. The victim will receive a compressed ZIP file through a compromised account from WhatsApp.
2. The extractor will check what version of WhatsApp is currently loaded on the complete device before selecting either WPPConnect or Selenium to inject the waterspider onto each installation of the victim's WhatsApp application.
3. If the loader detects that the victim is in a group chat, it will give priority to sending messages to all members of that group for a faster distribution method.
Adaptive Dynamic Change Detection and Response for Defenders:
1. Establish a Behavior Baseline for Alerts in Instances of Deviation from Normal PowerShell/Command Line Behavior – Type of Rare Flags Utilized and/or High Entropy of Arguments.
2. Implement Script Block Logging and AMSI with Strict GPO Policies; Look for IEX, DownloadString and Reflection Calls.
3. Process Ancestry Monitoring → Flag suspected parent-child relationships (explorer → powershell → regsvr32).
4. Network Telemetry → Identify algorithmically generated domain names, fast-flux, and/or protocol-switching.
5. Memory Forensics → Search for in-memory payloads (e.g., Process Hacker, Volatility).
6. Threat Hunting Queries → Search through absent expected events (e.g., periods of silence among critical systems).
Dynamic changes in adaptation are now a requirement for actors who are serious about their intent, these changes are established baseline.
The typical use of static signatures to identify threat actors have diminished due to the capacity of these threat actors to change quickly; thus, defenders must begin using behavior, contextual information, and anomaly based methods of detection for continued success.
