Ledger / 11 May 2026
APT27 uses Gemini to build relay-network management tool
Confirmed
Google observed the activity in its own Gemini service.
GTIG saw APT27 use Gemini to speed development of a fleet-management app for an ORB network using mobile and router devices. It supports hiding intrusion origin rather than attacking a victim directly.
“APT27, which has leveraged Gemini to accelerate the development of a fleet management application”Google Threat Intelligence Group
Sources
- GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial AccessGoogle Threat Intelligence Group · 11 May 2026 · primary source
- Disclosed
- 11 May 2026
- Activity
- 2026
- Actor
- APT27 (nation state), as attributed by Google Threat Intelligence Group
- Nexus
- China
- Targets
- Own operational relay box (ORB) infrastructure
- What the AI did
- Malware dev, Evasion
- Model
- Google Gemini
- Model family
- Model basis
- stated by vendor
- Autonomy
- assist
- Outcome
- Tooling to manage a 3-hop ORB anonymization network supporting intrusion activity.