cyber.hendryadrian.com
Interesting Stuff · darkreading.com

AI Use Is Making Some Threat Campaigns Sloppier, Researchers Say

· Original article ↗

Summary

Researchers describe AI-generated phishing and malware from several threat groups as error-prone and noisy, exposing infrastructure and weakening campaigns. They say sophisticated espionage groups remain cautious about adopting AI broadly.

Key points

  • Proofpoint says TA4903 has used AI across its phishing chain since March, but exposed control panels, infrastructure, and other operational details.
  • TA4903’s lures reportedly include QR codes that fail to render, empty emails with elaborate PDFs, and messages containing unedited AI-generated text.
  • A Genians report attributed a campaign against Ukraine to North Korea’s Kimsuky; its AI-generated lures and code reportedly contained inconsistencies and errors.
  • Bitdefender reported APT36’s use of AI-generated malware, including a stealer that could not exfiltrate data and a bot-management system that did not work as intended.
  • Researchers interviewed for the article say AI can increase noise and lower sophistication, while sophisticated espionage groups are cautious because noisier operations risk discovery.
  • The article notes that AI can still support limited tasks, citing Bitdefender’s report on China-linked SilkParasite using it to assist malware development.

Article Details

Topic
AI-generated attack campaigns and tooling are degrading the effectiveness and operational security of several cybercrime and state-sponsored threat groups.

People

Martin ZugecBitdefender technical solutions director who discussed AI use in cyber operations.Selena LarsonProofpoint principal threat researcher who discussed the effects of AI-generated attack chains.

Threat Actors

APT36Pakistan-associated group, also identified in the source as Transparent Tribe, reported to have transitioned to AI-generated disposable malware.KimsukyNorth Korean group reported to have used AI agents and LLM infrastructure for spear-phishing content and code generation in a campaign against Ukraine.TA2725Group described as a former participant in the Brazilian banking Trojan space whose activity has degraded into low-quality AI-generated output.TA4903Cybercrime actor focused on credential phishing and business email compromise; Proofpoint reported that its AI-generated phishing activity exposed infrastructure and degraded lure quality.Transparent TribeThe source explicitly identifies Transparent Tribe as another name for APT36.

Malware

SilkParasitecampaigns, so long as its application is limited. In August, Bitdefender published a blog post about SilkParasite, a China-Nexus group that used AI to very narrowly support malware development. Still, overall, the

Vendors

BitdefenderSimilarly, back in March, Bitdefender wrote about a major change within Pakistan's APT36, aka Transparent Tribe. APT36 was transitioning from using off-the-shelf malware to "vibeware" — disposable polyglot files itGeniansThis week, for instance, researchers at Genians published a report about a campaign it attributed to North Korea's Kimsuky group, against Ukraine. Kimsuky is employing AI agents and large language model (LLM)Proofpointor fashion. At a glance, it seemed frightening. But in a briefing shared with Dark Reading this week, Proofpoint highlighted TA4903, a once-sophisticated cybercrime actor that's been suffering from conspicuous AI rot.

Products

Google Meetformal and informal, and male and female grammar. Content didn't match associated decoy documents. Google Meet invites contained Zoom links. Kimsuky's malware came with logical errors, sloppy code obfuscation, andZoommale and female grammar. Content didn't match associated decoy documents. Google Meet invites contained Zoom links. Kimsuky's malware came with logical errors, sloppy code obfuscation, and missing pieces.

Countries

Chinaso long as its application is limited. In August, Bitdefender published a blog post about SilkParasite, a China-Nexus group that used AI to very narrowly support malware development. Still, overall, the data justNorth KoreaThis week, for instance, researchers at Genians published a report about a campaign it attributed to North Korea's Kimsuky group, against Ukraine. Kimsuky is employing AI agents and large language model (LLM)PakistanSimilarly, back in March, Bitdefender wrote about a major change within Pakistan's APT36, aka Transparent Tribe. APT36 was transitioning from using off-the-shelf malware to "vibeware" — disposable polyglot files itUkraineat Genians published a report about a campaign it attributed to North Korea's Kimsuky group, against Ukraine. Kimsuky is employing AI agents and large language model (LLM) infrastructure to automate spear-phishing

Related Articles