How government hackers are trying to exploit Google Gemini AI | Computer Weekly
Summary
These actors attempted to use Gemini to support multiple phases of their attack chains, from procuring infrastructure and so-called bulletproof hosting services, reconnoitering targets, researching vulnerabilities, development payloads, and assisting with malicious scripting and post-compromise evasion techniques. The Iranians, who appear to be the heaviest “users” of Gemini, tend to use it for research on defence organisations, vulnerabilities and creating content for phishing campaigns, often cyber security themes. Chinese APTs, on the other hand, favour the tool for recon, scripting and development, code troubleshooting, and researching topics such as lateral movement, privilege escalation, and data exfiltration and intellectual property (IP) theft. • CIISec’s annual report on the security profession finds evidence of growing concern that artificial intelligence will ultimately prove more useful to threat actors than defenders. GTIG said it had, however, observed a “handful” of cases in which threat actors conducted low-effort experimentation using publicly known jailbreak prompts to try to hop Gemini’s on-board guardrails – for example, asking for basic instructions on how to create malwares.