OrcaRouter's OrcaCyber Nano 1.0 Lets Security Teams Analyze Malware Locally
OrcaRouter dropped a 27B vision-language model tuned for reverse engineering, vuln analysis, and secure code review, packaged as GGUF to run fully offline.
- OrcaCyber Nano 1.0 is a 27B vision-language model tuned for defensive security, shipped as GGUF for local use
- Targets reverse engineering, vulnerability analysis, secure code review, triage, and screenshot-based RE workflows
- Qwen3_5 VL hybrid, 64 layers, 262K context, with built-in MTP head and separate DFlash2 speculative drafter
- Reported 93.29% HumanEval+, 78.4% SWE-bench, 92.23% LiveCodeBench, weaker 49.82% on BigCodeBench
- Runs in stock llama.cpp, Ollama, vLLM, LM Studio; fits 16 GB cards with the Mix-13G build
- Positioned as local counterpart to hosted OrcaCyber Zero 1.5 on the OrcaRouter gateway
OrcaRouter has released OrcaCyber Nano 1.0, a 27-billion-parameter vision-language model tuned for defensive security work. Its GGUF weights run through llama.cpp, allowing teams to analyze source code, logs, binaries, and screenshots without sending those artifacts to a hosted model endpoint.
Local inference addresses a recurring constraint in security work: proprietary binaries, customer logs, internal source code, and unreleased vulnerabilities often cannot leave a controlled network. An air-gapped deployment remains possible after the required model files and runtime have been imported, provided operators also disable network access and external integrations.
From disassembly to packet captures
OrcaRouter trained the model around five defensive workflows:
- Reverse engineering: Explain control flow, infer the purpose of stripped functions, suggest variable names, and analyze pasted disassembly or decompiler output.
- Vulnerability analysis: Trace unsafe execution paths, assess exploitability, and propose remediations.
- Secure code review: Inspect files and diffs for injection flaws, memory-safety defects, and logic errors.
- Incident triage: Correlate logs, alerts, and packet-capture data.
- Visual analysis: Process screenshots from Ghidra, IDA, and other tools, along with network diagrams.
Vision support extends the model beyond text-only code assistants. A separate multimodal projector maps image input into the model, enabling analysis of screenshots when a clean text export is unavailable. Textual disassembly remains easier to search, diff, and reproduce, so teams should compare both input modes on representative cases.
What sits inside the model
This story is for Pro members
You've reached the end of the free preview. Upgrade to AlphaSignal Pro to read the full article - and everything else behind the paywall.
Comments
