Ledger / Apr 2024
TA547 delivers Rhadamanthys stealer with likely LLM-written PowerShell
Strong
Proofpoint researchers inferred LLM authorship from the script's style; no model is named.
Proofpoint observed TA547 using a PowerShell script that its researchers suspect was generated by an LLM. The script ran in a chain that ended with the Rhadamanthys stealer. This is one of the earliest vendor-reported cases of an LLM-written loader from a tracked criminal actor.
“the actor appeared to use a PowerShell script that researchers suspect was generated by large language model (LLM) such as ChatGPT, Gemini, CoPilot, etc.”Proofpoint
Sources
- Security Brief: TA547 Targets German Organizations with Rhadamanthys StealerProofpoint · 10 Apr 2024 · primary source
- Date
- Apr 2024
- Disclosed
- 10 Apr 2024
- Actor
- TA547 (criminal), as attributed by Proofpoint
- Targets
- German organizations, invoice lure impersonating retailer Metro
- What the AI did
- Malware dev
- Model
- unspecified LLM
- Model family
- Unspecified
- Model basis
- inferred
- Autonomy
- assist
- Outcome
- Campaign delivered Rhadamanthys information stealer via a PowerShell loader.