Red Team AI Malware Simulator: Dual-Phase AI-Driven Polymorphic Malware Testing Framework

Abstract

With the rise of artificial intelligence, the cyber security landscape is witnessing a paradigm shift where traditional penetration testing tools that rely on static attack patterns and obfuscation are increasingly ineffective against modern AI- driven security defenses. This work presents the RED TEAM AI MALWARE SIMULATOR, a dual-phase AI-driven polymorphic malware testing framework with comprehensive C2 orchestration and intelligent decision making. The framework uses a simple two-phase approach consisting of reconnaissance and attack, driven by custom-trained Recon Prioritization and Attack Decision AI models integrated with a bespoke Django-based C2 server deployed on a VPS. The system simulates sophisticated, real- world malware behavior in a controlled and legal environment, including full kill chain simulation from reconnaissance to C2 communication, while ensuring that all executed actions are safe, non-destructive, and sand boxed. Experimental evaluation consists of five comprehensive tests coverings can submission, recon prioritization, attack decision, report generation, and LLM mitigation, with all five tests passing (100% success rate), demonstrating that modern systems are vulnerable to AI-powered malware and highlighting the need for AI-aware security measures in organizations.