OPSWAT research: Malware complexity surges 127% in six months

OPSWAT has released its first-ever Threat Landscape Report, revealing key insights from over 890,000 sandbox scans in the last 12 months.

This report offers a unique lens into the evolving nature of cyberthreats. The findings are clear: traditional detection methods are being outpaced, with a 127% rise in malware complexity and a staggering 1 in 14 files—initially deemed ‘safe’ by legacy systems—proven to be malicious. This report is a call to action for industries relying on outdated defences and the importance of multi-layered solutions.

Key Findings:

127% increase in malware complexity

Behavioral telemetry revealed a 127% rise in multi-stage malware complexity over the past year. OPSWAT’s sandbox uncovered layered threats designed to evade analysis, including obfuscated loaders such as NetReactor and evasive behaviors missed by traditional tools. These results show that modern malware intends to confuse, not flood, which is why OPSWAT’s pipeline is purpose-built to unpack that complexity.

Proactive threat detection

OPSWAT analysis reclassified 7.3% of files that were silent across open-source intelligence (OSINT) feeds as malicious, on average 24 hours earlier than public data sources. These were confirmed executions, not speculative flags, highlighting how adaptive analysis can close dangerous gaps left by static and reputation-based systems.

Campaign-level threat correlation

With 890,000+ sandbox scans, OPSWAT connects the dots across threats. It identifies shared TTPs, reused C2 infrastructure, and behavioral patterns across campaigns. This provides defenders with context-rich, actionable intelligence instead of noisy indicators.

99.97% detection accuracy

OPSWAT’s behavioral and machine learning pipeline delivers results. Aided by a newly enhanced PE emulator, the platform identified sophisticated threats such as:

• Clipboard hijacking via ClickFix
• Steganography-wrapped loaders
• C2 channels embedded in Google services
• .NET Bitmap malware loaders delivering Snake Keylogger payloads

“Our strength lies in precision, behavioral depth, and early visibility into emerging attacks,” said Jan Miller, Chief Technology Officer of Threat Analysis at OPSWAT. “That’s what sets OPSWAT apart in delivering high-fidelity, context-aware threat intelligence.”

Why It Matters

As critical infrastructure, government systems, and enterprise networks face growing targeting from increasingly modular and evasive malware, the findings of this report spotlight the evolving adversary playbook and the need for integrated, multilayered solutions.

Cybersecurity leaders must now prioritise adaptability, shared intelligence, reassessing technology, and fast behavioral detection pipelines to protect systems from known threats, but also to keep pace with a rapidly evolving threat landscape and whatever is on the horizon.

Filescan.io, part of the OPSWAT MetaDefender Platform, powers advanced threat detection and file analysis across critical environments. Download the full report and learn more about OPSWAT’s integrated pipeline at Filescan.io.