cyber.hendryadrian.com
Security Report · cloud.google.com

GTIG Details Adversaries’ Expanding Use of AI Across Cyber Operations

· Original article ↗

Summary

Google's GTIG report documents adversaries using generative AI for vulnerability research, malware development, reconnaissance and influence operations, while detailing attacks on AI software supply chains and defensive actions.

Key points

  • GTIG assesses that adversaries are moving from AI experimentation to scaled use across vulnerability research, malware development, reconnaissance, and other operational tasks.
  • GTIG found a zero-day 2FA-bypass exploit for an open-source administration tool and assesses with high confidence that an actor likely used AI to help develop it. The exploit required valid credentials; GTIG worked with the vendor, and its intervention may have prevented planned mass exploitation.
  • PROMPTSPY, an Android backdoor, uses Gemini to interpret device interfaces and generate actions; it can also capture authentication gestures and obstruct uninstallation. Google says it disabled associated assets and that Play Protect protects against known versions.
  • GTIG found AI-generated decoy code in CANFAIL and LONGSTREAM, and describes AI-assisted malware obfuscation and operational tooling.
  • TeamPCP (UNC6780) claimed multiple software supply-chain compromises. Mandiant responded to related incidents; GTIG says stolen credentials included cloud keys and GitHub tokens.
  • Malicious OpenClaw skill packages could execute commands or expose local data. OpenClaw partnered with VirusTotal to scan skills published to its marketplace.
  • GTIG describes suspected AI voice cloning in the pro-Russia Operation Overload campaign, while noting it has not identified AI-generated content from some other observed information-operation attempts in the wild.

Article Details

Publisher
Google Threat Intelligence Group (GTIG)
Report Period
Since February 2026; examples span early February through late March 2026.
Scope
GTIG observations of generative AI use in cyber operations, information operations, and attacks on AI software supply chains.
Key Statistics
  • The wooyun-legacy repository contains more than 85,000 vulnerability cases collected by WooYun between 2010 and 2016.
  • APT45 sent thousands of repetitive prompts to analyze CVEs and validate proof-of-concept exploits; the article gives no exact count.
  • LONGSTREAM queried the system's daylight-saving status 32 times, which GTIG describes as repetitive decoy logic.
Recommendations
  • LLM providers can analyze network-infrastructure data associated with AI-related API aggregators to support disruption efforts.
  • Use automated security scanning for AI-agent skills to identify unauthorized network operations, malicious payloads, and unsafe embedded instructions, and warn users or block risky packages.
  • Continuously test AI models and red-team them for vulnerabilities, including indirect prompt injection.

MITRE ATT&CK

T1027.014 · Polymorphic CodePROMPTFLUX used automated code modification to vary file signatures and evade legacy security controls.T1027.016 · Junk Code InsertionCANFAIL and LONGSTREAM used decoy code to disguise malicious functionality.T1090.003 · Multi-hop ProxyAPT27 used AI to support development of fleet-management software for an operational relay box network with multi-hop configurations.T1566 · PhishingThreat actors used LLMs to research targets and craft higher-fidelity phishing lures.T1587.001 · MalwareGTIG reports AI-augmented research and development of malware such as CANFAIL and LONGSTREAM.T1587.004 · ExploitsGTIG assesses that AI-assisted research was used to develop an exploit for a two-factor-authentication bypass zero-day.T1588.002 · ToolThreat actors downloaded community-developed tools to support their operations.T1588.005 · ExploitsThreat actors used AI to obtain known exploits for vulnerabilities affecting targeted systems.T1588.006 · VulnerabilitiesThreat actors used AI to research vulnerabilities in targeted systems.T1588.007 · Artificial IntelligenceThreat actors used automated pipelines to exploit provider registration flows and create LLM accounts.T1591.002 · Business RelationshipsThreat actors prompted AI models to generate third-party business relationships for large enterprises.T1591.004 · Identify RolesThreat actors used LLMs to generate organizational hierarchies, including roles in finance, internal security, and human resources.T1592.001 · HardwareA threat actor used an LLM to identify a high-value target's computer make and model and seek photos showing the target using it.

Threat Actors

APT45GTIG observed APT45 sending thousands of repetitive prompts to analyze CVEs and validate proof-of-concept exploits.SHORE CASTLEGTIG observed APT27 using Gemini to accelerate development of fleet-management software likely intended to support an operational relay box network.TeamPCPTeamPCP claimed responsibility for supply-chain compromises involving GitHub repositories and associated GitHub Actions. The article identifies UNC6780 as an aka for TeamPCP.TEMP.HexGTIG reports notable overlaps between TEMP.Hex and UNC5673; the article does not state that the names are aliases.UNC2814GTIG observed UNC2814 using expert-persona prompts to support vulnerability research into embedded-device targets, including TP-Link firmware and OFTP implementations.UNC5673GTIG describes UNC5673 as a PRC-nexus threat cluster that used tools for account pooling and scalable LLM access, and notes overlaps with TEMP.Hex.UNC6201GTIG observed activity associated with UNC6201 involving attempted use of a script to automate registration and cancellation of premium LLM accounts.

Malware

CANFAIL[T1587.001 ] Develop Capabilities: Malware – AI-assisted research was used to develop malware families including CANFAIL and LONGSTREAM (‘develop malware, such as CANFAIL and LONGSTREAM’).Honestcue[Malware / tool names ] AI-enabled malware and tooling discussed in the report – PROMPTSPY, CANFAIL, LONGSTREAM, HONESTCUE, PROMPTFLUX, OpenClaw, OneClaw, Hexstrike, StrixLONGSTREAM[T1587.001 ] Develop Capabilities: Malware – AI-assisted research was used to develop malware families including CANFAIL and LONGSTREAM (‘develop malware, such as CANFAIL and LONGSTREAM’).PROMPTFLUX[T1027.014 ] Obfuscated Files or Information: Polymorphic Code – PROMPTFLUX used automated code modification to vary signatures (‘vary file signatures and bypass legacy security controls’).PromptSpyThe report highlights PROMPTSPY, Operation Overload, TeamPCP/UNC6780, APT27, UNC6201, and other clusters as examples of AI-enabled abuse, while also describing Google’s defensive actions such as disabling maliciousSANDCLOCK[File / package names ] Compromised packages and credential-stealing components – SANDCLOCK, malicious OpenClaw skill packages, ChatGPT Account Auto-Registration Tool

Vendors

GoogleGoogle Threat Intelligence Group reports that threat actors are increasingly using generative AI across the full attack lifecycle, from vulnerability discovery and malware development to reconnaissance, informationMandiantThis report, based on insights derived from Mandiant incident response engagements, Gemini, and GTIG’s proactive research, highlights the dual nature of the current threat environment where AI serves as both aVirusTotalThese risks became more apparent in early February 2026, when VirusTotal researchers reported on security risks associated with the OpenClaw AI agent ecosystem, including AI software supply chain risks and

Products

AndroidPROMPTSPY is a notable Android backdoor that uses Gemini for autonomous device interaction, persistence, and command generation.GeminiPROMPTSPY is a notable Android backdoor that uses Gemini for autonomous device interaction, persistence, and command generation.Google Play ProtectAndroid users are automatically protected against known versions of this malware by Google Play Protect, which is on by default on Android devices with Google Play Services.LiteLLMSupply-chain attacks against AI ecosystems, including OpenClaw skills and GitHub repositories such as LiteLLM, show that AI platforms themselves are becoming targets.OpenClawSupply-chain attacks against AI ecosystems, including OpenClaw skills and GitHub repositories such as LiteLLM, show that AI platforms themselves are becoming targets.Trivy[Software / repository names ] Targeted or abused software packages and repos – LiteLLM, BerriAI, Trivy, Checkmarx, wooyun-legacy

Tools

Big SleepFurthermore, we leverage AI agents like Big Sleep to identify software vulnerabilities and use Gemini’s reasoning capabilities via the likes of CodeMender to automatically fix them, proving that AI can also be aClaude-Relay-ServiceFor example, they employ “Claude-Relay-Service” to aggregate multiple Gemini, Claude, and OpenAI accounts, enabling account pooling and cost-sharing.CLIProxyAPI[T1588.002 ] Obtain Capabilities: Tools – Actors downloaded community tools like CLIProxyAPI for API key aggregation and proxying (‘downloaded specialized, community-developed middleware projects’).CodeMenderBig Sleep to identify software vulnerabilities and use Gemini’s reasoning capabilities via the likes of CodeMender to automatically fix them, proving that AI can also be a powerful tool for defenders.GraphitiHexstrike was utilized alongside the Graphiti memory system, a temporal knowledge graph, to maintain a persistent state of the attack surface, allowing the agent to autonomously pivot between tools like subfinder andHexstrike[Malware / tool names ] AI-enabled malware and tooling discussed in the report – PROMPTSPY, CANFAIL, LONGSTREAM, HONESTCUE, PROMPTFLUX, OpenClaw, OneClaw, Hexstrike, Strixhttpxstate of the attack surface, allowing the agent to autonomously pivot between tools like subfinder and httpx based on its internal reasoning.OneClaw[Malware / tool names ] AI-enabled malware and tooling discussed in the report – PROMPTSPY, CANFAIL, LONGSTREAM, HONESTCUE, PROMPTFLUX, OpenClaw, OneClaw, Hexstrike, StrixStrix[Malware / tool names ] AI-enabled malware and tooling discussed in the report – PROMPTSPY, CANFAIL, LONGSTREAM, HONESTCUE, PROMPTFLUX, OpenClaw, OneClaw, Hexstrike, Strixsubfindera persistent state of the attack surface, allowing the agent to autonomously pivot between tools like subfinder and httpx based on its internal reasoning.

Countries

ChinaThreat actors associated with the People’s Republic of China (PRC) and the Democratic People’s Republic of Korea (DPRK) have also demonstrated significant interest in capitalizing on AI for vulnerability discovery.Democratic People’s Republic of Korea (DPRK)Threat actors associated with the People’s Republic of China (PRC) and the Democratic People’s Republic of Korea (DPRK) have also demonstrated significant interest in capitalizing on AI for vulnerability discovery.IranActors from Russia, Iran, China, and Saudi Arabia are producing political satire and materials to advance specific narratives across both digital platforms and physical media, such as printed posters.People’s Republic of China (PRC)Threat actors associated with the People’s Republic of China (PRC) and the Democratic People’s Republic of Korea (DPRK) have also demonstrated significant interest in capitalizing on AI for vulnerability discovery.Russianetworks and the integration of AI-generated decoy logic in malware that we have linked to suspected Russia-nexus threat actors.Saudi ArabiaActors from Russia, Iran, China, and Saudi Arabia are producing political satire and materials to advance specific narratives across both digital platforms and physical media, such as printed posters.

Industries

Artificial intelligence[T1588.007 ] Obtain Capabilities: Artificial Intelligence – Automated pipelines were used to register premium LLM accounts across providers (‘programmatically exploit the registration flows’).CybersecurityAs we highlighted in prior blog posts, threat actors often leverage expert cybersecurity personas as a structured approach to prompt Gemini.GovernmentWe have observed similar activity from UNC5673, a PRC-nexus threat cluster that has notable overlaps with TEMP.Hex and that has targeted government sectors primarily in South and Southeast Asia.TechnologyFor example, we recently analyzed a suspected PRC-nexus threat actor deploying agentic tools like Hexstrike and Strix against a Japanese technology firm and a prominent East Asian cybersecurity platform.

Related Articles