State-Sponsored Hackers Leveraging Google's Gemini AI Model for Cyber Attacks: Threat Landscape and Mitigation Strategies

State-Sponsored Hackers Leveraging Google's Gemini AI Model for Cyber Attacks: Threat Landscape and Mitigation Strategies

State-sponsored hackers are utilizing Google's Gemini AI model to facilitate various stages of cyber attacks, including reconnaissance and post-compromise actions. Threat actors from China, Iran, North Korea, and Russia have leveraged Gemini for target profiling, open-source intelligence, phishing lures, coding, vulnerability testing, and troubleshooting. Cybercriminals are increasingly interested in AI tools for illegal activities like social engineering campaigns.

The Google Threat Intelligence Group (GTIG) reports that APT adversaries use Gemini for reconnaissance, phishing lure creation, command and control development, and data exfiltration. Chinese threat actors requested Gemini to automate vulnerability analysis and testing plans against specific US-based targets. Iranian adversaries used Google's LLM for social engineering campaigns and to speed up the creation of tailored malicious tools.

GTIG observed threat actors integrating new capabilities into existing malware families using AI, such as the CoinBait phishing kit and the HonestCue malware downloader. The HonestCue malware framework uses the Gemini API to generate C# code for second-stage malware, while CoinBait is a phishing kit disguised as a cryptocurrency exchange. Cybercriminals have also used generative AI services in ClickFix campaigns to deliver the AMOS info-stealing malware for macOS.

Gemini has faced attempts of AI model extraction and distillation, posing a significant commercial and intellectual property problem for the creators of these models. Google has disabled accounts and infrastructure linked to abuse and enhanced Gemini's classifiers to deter misuse. The company emphasizes robust security measures and safety guardrails in designing AI systems.

Google is exploring the integration of Gemini AI into various products and services, including Personal Intelligence linking Gmail, Photos, and Search to Gemini, testing a new image AI model, and developing Gemini-powered AI "Skills" for Google Chrome on Android. The company remains vigilant in addressing potential threats and ensuring the security and safety of its AI models.