Stairwell launches Backstory to trace malware variants

Stairwell has launched Backstory, a platform for investigating malware incidents. It is designed to trace related malware variants and identify affected systems.

The launch is accompanied by Stairwell research that highlights gaps in how security teams assess the extent of malware incidents. In an analysis of 1,085 public threat reports, each published malware hash was linked on average to 2.4 additional malicious variants, producing more than 46,000 related files not included in the original reporting.

The finding suggests security teams may often investigate only part of an attack. Public threat reports commonly highlight a single malware sample, but related variants can differ enough to evade detection methods based on hashes and signatures, leaving other malicious files in a company's systems.

Backstory is intended to address that problem. Rather than centring an investigation on alerts, it starts with files collected from customer endpoints and looks for related malware, where it appeared and how long it has been present.

Investigation focus

Stairwell describes the platform as agentic, reflecting its use of artificial intelligence to conduct parts of an investigation. The system traces related malware variants, identifies affected machines and maps the spread of an incident in seconds.

The backdrop is a rise in malware variation that security companies increasingly link to generative AI tools. As attackers produce more altered versions of malicious software, security teams face a growing volume of files that may be tied to one campaign but do not exactly match a known sample.

Many tools used by security operations centres are built to reduce the number of alerts analysts must review or to speed up triage once an alert is triggered. Stairwell is positioning Backstory differently, arguing that the central question is whether a threat has actually been contained across the environment.

"Closing tickets faster does not mean you contained the threat," said Mike Wiacek, founder and CTO of Stairwell. "When a team finds something malicious, the real question is not just, 'Can I close this alert?' It's, 'What else looks like it, where did it land, how long has it been here, and what do I need to do to contain it?' Backstory gives every team that level of investigation, regardless of headcount."

File corpus

At the centre of the product is Stairwell's file collection model. It continuously gathers executable files from customer endpoints and stores them in a private customer corpus, which can be reviewed again as new intelligence or detection rules emerge.

This approach differs from systems that work mainly from alerts generated by endpoint detection products or other monitoring tools. Instead, Backstory reasons over the files that have touched an environment and keeps that historical record available for later analysis.

The foundation for Backstory includes a preserved corpus of more than 1.5 billion executable files, AI trained on more than 110,000 detection rules, intelligence from more than 20 public threat sources and more than 8.7 billion historical rule matches.

Those figures point to the scale of data Stairwell is using to search for links between known malware samples and related files that may sit outside conventional detection paths. The premise is that preserving files over time gives security teams a better chance of uncovering a broader malware family after the first indicator is discovered.

The research tied to the launch also underscores a long-running issue in cybersecurity reporting. Public disclosures often serve as a starting point for defenders, but they are typically constrained by what researchers observed at the time and by the indicators they chose to publish. If malware families are materially larger than those reports show, defenders using only published hashes may be working from a partial picture.

That has practical implications for security operations teams under pressure to move quickly. If related variants are missed because they do not match a named sample, companies may declare an incident contained while some of the malware remains active.

Jeff Moore, chief security officer at H&M Group, pointed to that distinction between external indicators and internal evidence. "Attackers can test against global threat intel, EDR, and every common Yara rule on the internet," he said. "What they can't test against is your environment because they've never seen it. That's the whole game. Stop asking 'what's bad out there?' an infinite question you will always lose and start asking 'what changed in here?' It's not a new idea. It's just the honest one."