Surprising: State-Sponsored APT Groups Utilize Gen AI LLMs

Microsoft and OpenAI have identified five Advanced Persistent Threat (APT) groups that are actively using large language models (LLMs) for malicious purposes. These threat groups, originating from North Korea, China, Iran, and Russia, are using LLMs to automate malicious operations, generate believable phishing content, and gain vulnerability knowledge. While the APT groups were not directly using LLMs to create malware, the discovery highlights the use of generative AI by both white hat and black hat actors for operational efficiency. Microsoft has also identified nine LLM-themed techniques and procedures being used by these threat groups. Experts advise organizations to remain vigilant and adopt application-specific models tailored for specific tasks to defend against generative AI or LLM-based attacks.