State-sponsored hackers from Iran and China misuse Google Gemini for cyber attacks
Google reported that state-sponsored hacker groups from Iran, China, and North Korea are misusing its Gemini AI chatbot to increase the efficiency of cyber attacks. Iranian hackers use it for phishing and reconnaissance, while Chinese groups target US government and military networks. The hackers use Gemini for code generation, vulnerability research, and reconnaissance, though Google states no fundamentally new attack capabilities have emerged.
What happened
According to Google's Threat Intelligence Group, state-sponsored hacker groups from Iran, China, and North Korea have been using Google's Gemini AI chatbot to enhance their cyber attack capabilities. Iranian hackers use Gemini primarily for reconnaissance and phishing campaigns targeting defense experts and organizations. Chinese hacker groups employ Gemini to research vulnerabilities and develop scripts for lateral movement and privilege escalation, focusing on US military and government organizations.
Chinese and North Korean actors also use Gemini to generate code for hacking tools and scripts, research known security vulnerabilities, and gather information about target organizations. North Korean groups use Gemini to draft forged correspondence and research job openings as part of efforts to place agents with false or stolen identities into positions at US firms.
Reported impact
Google reported that threat actors are experimenting with Gemini to increase their productivity and operational efficiency, though they have not developed fundamentally new attack capabilities with the technology. The generative AI tool allows threat actors to operate faster and at greater scale without enabling breakthrough changes to their methods.
Index analysis
The misuse demonstrates that current large language models are being repurposed to optimize existing hacking processes rather than enable novel attack techniques. Google noted that the AI landscape is in constant change with new models and agent systems emerging daily, suggesting ongoing potential for threat actors to discover new uses for AI tools.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.