Emerald Sleet used ChatGPT for research, scripting and phishing content

Confirmed

OpenAI and Microsoft both state the accounts were tied to this actor; activity was limited, non-novel assistance.

The North Korea-affiliated group used ChatGPT to find defense experts in the Asia-Pacific, understand public vulnerabilities, script, and draft phishing content.

“Emerald Sleet used our services to identify experts and organizations focused on defense issues in the Asia-Pacific region, understand publicly available vulnerabilities, help with basic scripting tasks, and draft content that could be used in phishing campaigns.”OpenAI

Sources

Disrupting malicious uses of AI by state-affiliated threat actorsOpenAI · 14 Feb 2024 · primary source
Staying ahead of threat actors in the age of AIMicrosoft Security Blog · 14 Feb 2024 · primary source

Date: Feb 2024
Disclosed: 14 Feb 2024
Actor: Emerald Sleet (nation state), as attributed by OpenAI
Nexus: North Korea
Targets: Government and defense-related targets (per source)
What the AI did: Recon, Vuln research, Phishing content
Model: ChatGPT (OpenAI services)
Model family: OpenAI
Model basis: stated by vendor
Autonomy: assist
Outcome: OpenAI accounts disabled in coordination with Microsoft.