InfoSecBulletin Cybersecurity for mankind
Google detects for the first time a zero-day exploit which is thought to be developed using artificial intelligence. The company shared a new report on Monday. It gives a summary of its findings on how AI is used in cyber threats. This information comes from recent data collected by Gemini, Google Threat Intelligence Group (GTIG), and Mandiant.
A key finding is that a well-known cybercrime group used AI to develop a zero-day exploit. This exploit was made to get around two-factor authentication (2FA) on an open-source web tool for system management. The exploit was in a Python script.
Contract and server dispute brought down Bangladesh’s digital payment
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
The hacker group and the tool they tried to use are not named, but Google said it helped the affected company stop a large attack, which seemed to be what the hackers wanted.
“Although we do not believe Gemini was used, based on the structure and content of these exploits, we have high confidence that the actor likely leveraged an AI model to support the discovery and weaponization of this vulnerability,” Google explained.
It added, “For example, the script contains an abundance of educational docstrings, including a hallucinated CVSS score, and uses a structured, textbook Pythonic format highly characteristic of LLMs training data (e.g., detailed help menus and the clean _C ANSI color class).”
Google pointed out that Chinese and North Korean state-sponsored hackers are very keen on using AI to find vulnerabilities. A group likely connected to China was seen using tools like Strix and Hexstrike to attack a Japanese tech company and a big cybersecurity firm in East Asia.
UNC2814 is a Chinese group that attacks telecom and government groups. They used a fake identity jailbreak where the AI pretends to be a top security auditor. This helped them research flaws in embedded devices, like TP-Link firmware with OFTP features.
Google says that the North Korean group known as APT45 sent out many repeated messages to look closely at CVEs and check PoC exploits.
“This results in a more robust arsenal of exploit capabilities that would be impractical to manage without AI assistance,” Google said in its report.
The complete report talks about self-running malware, AI helping to avoid defenses, attacks on supply chains, and bad actors seeking top access to LLMs.
