Ledger / 29 Jan 2025
North Korean APTs used Gemini across attack phases and IT-worker fakery
Confirmed
Google states it observed these groups using Gemini.
North Korean actors used Gemini for infrastructure research, target recon, payload development and evasion scripting, and to draft cover letters and research jobs for the clandestine IT worker scheme.
“North Korean APT actors used Gemini to support several phases of the attack lifecycle, including researching potential infrastructure and free hosting providers, reconnaissance on target organizations, payload development, and assistance with malicious scripting and evasion techniques.”Google Threat Intelligence Group
Sources
- Adversarial Misuse of Generative AIGoogle Threat Intelligence Group · 29 Jan 2025 · primary source
- Disclosed
- 29 Jan 2025
- Activity
- 2024
- Actor
- Nine North Korea-backed groups (nation state), as attributed by Google Threat Intelligence Group
- Nexus
- North Korea
- Targets
- South Korea and US organizations; Western employers
- What the AI did
- Recon, Malware dev, Evasion, Fraud
- Model
- Gemini
- Model family
- Model basis
- stated by vendor
- Autonomy
- assist
- Outcome
- Google reports usage and account action.