Why can uploading a suspected implant to a public multi-scanner service burn your investigation?

## What actually happens when you press upload A public multi-scanner platform is not a private laboratory. Submitted files are shared with the antivirus and security vendors that partner with it, and paid subscribers can search, download and set standing rules over new submissions. Anyone can buy that access, and adversaries do. The practical consequence is simple: **an upload is publication**. ## Signal one: the adversary learns he is discovered Operators monitor for their own artefacts. A standing content-matching rule over new submissions, or a periodic search for the hashes of their loaders, tells them the moment a sample lands. What they learn is not a technical detail - it is a *status change*: this campaign is now known. The usual responses are all bad for you. Infrastructure rotates, so the addresses and domains you were tracking stop being useful. Backup persistence you have not found gets used. In a campaign heading toward extortion or theft, the operator stops being patient and moves to his objective on a clock he now controls. ## Signal two: the sample often names the victim This is the part candidates miss. Targeted files are rarely generic: - The filename itself is frequently the lure: an invoice number, a project name, an employee's name. - Documents carry metadata - authors, template paths, internal server names in a linked template. - A phishing link inside the document often carries a **per-recipient token** so the operator can track exactly whose click produced a session. - Real business content may be embedded: contract text, personal data of employees, credentials in a decoy spreadsheet. So the upload can simultaneously tell the operator that he is discovered *and* which of his targets discovered him, while spilling your own or your employees' data into a corpus that is redistributed. Some organisations have found their own confidential documents in a public sample repository because a well-meaning employee submitted a lure that contained a real attachment. ## Hash search versus upload versus URL submission These are three different exposures and you should be able to separate them. | Action | Reaches the adversary? | Discloses content? | | --- | --- | --- | | Computing the hash locally | No | No | | Searching that hash on the platform | Not directly | No - the bytes stay with you | | Uploading the file | Indirectly, via subscribers watching new submissions | Yes, fully | | Submitting a URL for scanning | Yes - the service fetches his server | Reveals the link, and any token in it | A hash search is the workhorse of careful triage: if the sample is already publicly known, you gain the community's analysis without adding anything. If it is *not* known, that itself is information - a file nobody has ever seen is more likely to be targeted, and is exactly the file you must not be the first to publish. Note that the platform still logs your query, so a hash search is low-exposure rather than zero-exposure; it is not a place to look up something you would not want the provider to associate with you. URL submission deserves its own warning because it feels passive. It is not: you are asking a third party to make an HTTP request to the adversary's server. He sees a fetch from a scanner range, timed to your discovery, and if the link was uniquely generated for one recipient, he sees precisely which mailbox reported it. ## What to do instead Keep the sample internal. Compute hashes locally and search those. Extract what you need from the file in your own environment. Share the sample through channels with controlled distribution - a trusted sharing community, your incident response retainer, or the vendor whose product missed it - rather than by publishing it. If your team genuinely has no internal capability and the answer cannot wait, then submitting may still be the right call: make it a *decision*, taken by a named person, with the burn accepted and the incident timeline shortened accordingly. ## And when submitting is right Once the adversary already knows he is discovered - after containment, after a public disclosure, or when the operation is over - publishing the sample is often actively good. It buys industry-wide detection coverage for the next victim. The rule is not *never upload*; the rule is *never upload by reflex, and never before you have decided that the observation is worth less than the coverage*.