Ledger / 5 Nov 2025
UNC4899 used Gemini for exploit research and tooling
Confirmed
Google observed the Gemini use directly.
The supply-chain-focused group used Gemini to write code, research exploits and improve tooling.
“used Gemini for a variety of purposes including developing code, researching exploits, and improving their tooling”Google Threat Intelligence Group
Sources
- GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI ToolsGoogle Threat Intelligence Group · 5 Nov 2025 · primary source
- Disclosed
- 5 Nov 2025
- Activity
- 2025
- Actor
- UNC4899 (PUKCHONG) (nation state), as attributed by Google Threat Intelligence Group
- Nexus
- North Korea
- Targets
- Edge devices and browsers (likely)
- What the AI did
- Exploit dev, Vuln research, Malware dev
- Model
- Gemini
- Model family
- Model basis
- stated by vendor
- Autonomy
- assist
- Outcome
- Accounts disabled.