Ledger / 29 Jan 2025
Russian APT actors used Gemini to port and encrypt malware code
Confirmed
Google states it observed this use; volume was limited.
Russian APT actors used Gemini for coding tasks such as converting public malware into another language and adding encryption functions.
“Their Gemini use focused on coding tasks, including converting publicly available malware into another coding language and adding encryption functions to existing code”Google Threat Intelligence Group
Sources
- Adversarial Misuse of Generative AIGoogle Threat Intelligence Group · 29 Jan 2025 · primary source
- Disclosed
- 29 Jan 2025
- Activity
- 2024
- Actor
- Russian government-backed APT actors (nation state), as attributed by Google Threat Intelligence Group
- Nexus
- Russia
- Targets
- Unspecified
- What the AI did
- Malware dev
- Model
- Gemini
- Model family
- Model basis
- stated by vendor
- Autonomy
- assist
- Outcome
- Limited use observed.