Ledger / 8 Sep 2026
BASIN CASTLE used LLMs for recon, lures and obfuscated malware
Confirmed
Google observed the activity.
The group used LLMs to profile targets, draft localized lures, write obfuscated custom malware and fix post-exploitation commands.
“has integrated generative AI across successive phases of the attack lifecycle”Google Threat Intelligence Group
Sources
- GTIG AI Threat Tracker: From Prompting to AutonomyGoogle Threat Intelligence Group · 8 Sep 2026 · primary source
- Disclosed
- 8 Sep 2026
- Activity
- 2026
- Actor
- BASIN CASTLE (BASIN, TEMP.Hex) (nation state), as attributed by Google Threat Intelligence Group
- Nexus
- China
- Targets
- High-value targets
- What the AI did
- Recon, Phishing content, Malware dev
- Model
- Gemini
- Model family
- Model basis
- stated by vendor
- Autonomy
- assist
- Outcome
- Google reports.