Ledger / 5 Nov 2025
TEMP.Zagros used Gemini to research custom malware
Confirmed
Google observed the Gemini use directly.
The group used Gemini to support development of custom malware including web shells and a Python C2 server.
“used Gemini to conduct research to support the development of custom malware”Google Threat Intelligence Group
Sources
- GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI ToolsGoogle Threat Intelligence Group · 5 Nov 2025 · primary source
- Disclosed
- 5 Nov 2025
- Activity
- 2025
- Actor
- TEMP.Zagros (MuddyWater) (nation state), as attributed by Google Threat Intelligence Group
- Nexus
- Iran
- Targets
- Phishing victims
- What the AI did
- Malware dev
- Model
- Gemini
- Model family
- Model basis
- stated by vendor
- Autonomy
- assist
- Outcome
- Google reports; no breach detail.