Adversaries may obtain access to generative artificial intelligence (AI) tools, such as large language models (LLMs), to aid various techniques during targeting. These tools may be used to inform, bolster, and enable a variety of malicious tasks, including creating scripts, assisting social engineering, developing payloads, and to Query Public AI Services in support of Reconnaissance.1 For example, by utilizing a publicly available LLM an adversary is essentially outsourcing or automating certain tasks to the tool. Using AI, the adversary may draft and Generate Content in a variety of written languages to be used in Phishing/Phishing for Information campaigns. The same publicly available tool may further enable vulnerability or other offensive research supporting Develop Capabilities. AI tools may also automate technical tasks by generating, refining, or otherwise enhancing (e.g., Obfuscated Files or Information) malicious scripts and payloads.2 Finally, AI-generated text, images, audio, and video may be used for fraud, Impersonation, and other malicious activities.345
- MSFT-AI
- OpenAI-CTI
- Google-Vishing24
- IC3-AI24
- WSJ-Vishing-AI24
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g1057 | ShinyHunters | — |
| grp_g1052 | Contagious Interview | — |
| grp_g1059 | NIMBUS MANTICORE | — |
| grp_g0007 | APT28 | Russia |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.