State-backed hackers abuse Google's Gemini AI for cyberattacks
Google's Threat Intelligence Group reported that government-backed hackers from Iran, China, North Korea, and Russia have been using Gemini AI to enhance cyberattack operations including phishing, code generation, and reconnaissance. While the tool has improved hacker productivity, Google stated that no significant new capabilities have yet been developed and Gemini's safeguards prevented more sophisticated attacks.
What happened
According to a report from Google's Threat Intelligence Group released on January 31, 2025, government-backed hackers from Iran, China, North Korea, and Russia have been using Google's Gemini chatbot for cyberattack operations.
The report states that hackers used Gemini for tasks including generating code and scripting, gathering information about potential targets, researching publicly known vulnerabilities, and enabling post-compromise activities such as defense evasion in target environments. Iranian hackers were identified as the most active users, followed by Chinese and North Korean hackers, while Russian hackers were less involved.
Reported impact
Google reported that while the AI tool has boosted hacker productivity, it has not yet led to significant advancements in their capabilities. The report notes that Gemini's safeguards prevented hackers from using it for more sophisticated attacks, such as accessing information to manipulate Google's own products.
Index analysis
Iranian hackers employed Gemini to craft phishing campaigns and conduct reconnaissance on defense experts and organizations. Chinese hackers focused on code troubleshooting and obtaining deeper access to target networks, researching topics such as lateral movement, privilege escalation, data exfiltration, and detection evasion. North Korean actors used the technology to craft fake cover letters and research jobs as part of a plan to secretly place agents into remote IT jobs in Western companies.
Governance controls
Google stated that threat actors were experimenting with Gemini to enable their operations, finding productivity gains but not yet developing novel capabilities. The report noted that generative AI allows threat actors to move faster and at higher volume rather than enabling disruptive change.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.