AI-Powered Malware on the Rise: Nation-State Goons and Cybercrime Rings Experiment with Gemini

In a disturbing trend, nation-state goons and cybercrime rings are experimenting with Gemini to develop a 'Thinking Robot' malware module.

TL;DR
• Nation-state goons and cybercrime rings are experimenting with Gemini to develop a 'Thinking Robot' malware module.
• The malware uses LLMs during execution to generate malicious scripts.
• Attackers are using Gemini to build a data processing agent that converts natural language requests into SQL queries.

Summary
Nation-state actors and cybercrime groups are experimenting with AI tools like Google's Gemini to develop advanced malware and data processing agents. These actors are using Gemini for various malicious purposes, including developing a 'Thinking Robot' malware module that can rewrite its own code to avoid detection. The 'Thinking Robot' malware interacts with Gemini's API to request obfuscation and evasion techniques.

Key findings include:
• APT42, linked to Iran's Islamic Revolutionary Guard Corps, used Gemini to build a data processing agent that analyzes personally identifiable information.
• A novel code family, PromptFlux, uses LLMs during execution to generate malicious scripts on the fly and obfuscate itself.
• Russia's APT28 used a new data-mining malware, PromptSteal, which queries LLMs during attacks to generate commands.

Google's threat hunters have identified these activities and disabled the associated accounts. The company emphasizes the importance of monitoring these evolving threats and developing effective countermeasures.

The use of AI in malicious activities is a growing concern, with threat actors leveraging AI tools to enhance their operations and evade detection.

Google continues to track these threats and collaborate with security researchers to mitigate the risks associated with AI-powered malware.

As AI-powered malware continues to evolve, it's essential to stay vigilant and adapt our security measures to counter these emerging threats.