Ledger / 29 Jan 2025
PRC-backed APT groups used Gemini for recon, scripting and post-compromise research
Confirmed
Google states it observed these groups using Gemini.
Chinese APT actors used Gemini for reconnaissance, scripting and troubleshooting, and for research on lateral movement, privilege escalation, data exfiltration and detection evasion.
“Chinese APT actors used Gemini to conduct reconnaissance, for scripting and development, to troubleshoot code, and to research how to obtain deeper access to target networks.”Google Threat Intelligence Group
Sources
- Adversarial Misuse of Generative AIGoogle Threat Intelligence Group · 29 Jan 2025 · primary source
- Disclosed
- 29 Jan 2025
- Activity
- 2024
- Actor
- Over 20 China-backed groups (nation state), as attributed by Google Threat Intelligence Group
- Nexus
- China
- Targets
- Unspecified targets
- What the AI did
- Recon, Malware dev, Vuln research, Evasion
- Model
- Gemini
- Model family
- Model basis
- stated by vendor
- Autonomy
- assist
- Outcome
- Google reports usage; no specific breach tied to Gemini use.