Google's Threat Intelligence Group (GTIG) reported that the North Korea-affiliated hacking group known as UNC2970 has been utilizing its generative AI model, Gemini, for reconnaissance activities. This development highlights a troubling trend as various hacking collectives exploit AI to enhance their cyber attack strategies, including information operations and model extraction.
UNC2970, linked to the notorious Lazarus Group, has focused on high-value targets within the cybersecurity and defense sectors. Their activities involved gathering data on technical job roles and salary information, which aids in crafting tailored phishing schemes. GTIG emphasized that this practice blurs the line between professional research and malicious intent.
Additionally, other threat actors have similarly adopted Gemini to refine their tactics. For instance, UNC6418 has employed the tool for targeted intelligence collection, while Temp.HEX has used it to create profiles on individuals in Pakistan. Meanwhile, APT31 has automated vulnerability analysis and developed targeted testing plans.