Google identifies the first zero-day vulnerability developed with the help of an AI

Although this vulnerability presents “many signs of the use of AI”, GTIG researchers rule out the use of Gemini and Mythos in its development. They also report that they shared their discoveries with the company responsible for the affected service, which was able to distribute a patch and correct it.

Widespread use of the cybercrime industry

On the other hand, the report includes the use of artificial intelligence to drive attacks and exploit large-scale vulnerabilities, as identified in the case of the North Korean cybercriminal group APT45.

Agent artificial intelligence has also become a tool for cybercriminals. The GTIG report includes experimentation with agents such as OpenClaw and OneClaw in test environments, with the aim of perfecting their capabilities by orchestrating attacks.

Specifically, its use is cited to refine AI-generated payloads within controlled configurations to increase the reliability of the exploit before deployment.

To mitigate this use, the person responsible for OpenClaw has partnered with the Spanish company Virus Total to detect malicious programs in its marketplace by scanning the skills that are published there.

Additionally, cybercriminals use AI to create more advanced infrastructure and malware with better obfuscation and evasion capabilities. In this case, the China-linked cyber threat group APT27 is highlighted, which turned to Gemini to accelerate the development of a fleet management application to support the management of a network of operational relay boxes (ORBs) using multi-hop configurations.

For their part, the UNC6201 and UNC5673 threat groups have directed their activity to the violation of LLM with the aim of circumventing the safeguards that prevent their malicious use and payment methods to access the most advanced capabilities and take advantage of them in their campaigns.

The report highlights other uses of AI, for example, to create deepfakes for use in disinformation campaigns, to refine malicious software, and to persistently and autonomously probe for business vulnerabilities.

“Cybercriminals are using AI to increase the speed, scale and sophistication of their attacks” as this technology “allows them to test their operations, maintain persistence against their targets, create better malware and achieve many other improvements”, as explained by GTIG chief analyst, John Hultquist.