Ledger / 8 Sep 2026
MIDNIGHT NEPTUNE used LLMs for RATs, lures and lateral movement
Confirmed
Google observed the activity and tool use.
The group used AI for personas and lures, Python RATs and Bash lateral-movement scripts.
“Used AI coding assistants such as DeepSeek-Coder to develop Python-based Remote Access Trojans”Google Threat Intelligence Group
Sources
- GTIG AI Threat Tracker: From Prompting to AutonomyGoogle Threat Intelligence Group · 8 Sep 2026 · primary source
- Disclosed
- 8 Sep 2026
- Activity
- 2026
- Actor
- MIDNIGHT NEPTUNE (formerly UNC1069) (nation state), as attributed by Google Threat Intelligence Group
- Nexus
- North Korea
- Targets
- Cryptocurrency organizations
- What the AI did
- Malware dev, Social engineering, Ops automation
- Model
- Gemini, DeepSeek-Coder, unspecified commercial LLMs
- Model family
- Google, DeepSeek, Unspecified
- Model basis
- stated by vendor
- Autonomy
- assist
- Outcome
- Backdoor SOMBERMEME deployed; Google reports.