Microsoft and OpenAI are revealing today that hackers are already using large language models like ChatGPT to refine and improve their existing cyberattacks. In newly published research, Microsoft and OpenAI have detected attempts by Russian, North Korean, Iranian, and Chinese-backed groups using tools like ChatGPT for research into targets, to improve scripts, and to help build social engineering techniques.<\/p>\n<\/div>\n
\u201cCybercrime groups, nation-state threat actors, and other adversaries are exploring and testing different AI technologies as they emerge, in an attempt to understand potential value to their operations and the security controls they may need to circumvent,\u201d says Microsoft in a blog post today<\/a>. <\/p>\n<\/div>\n The Strontium group, linked to Russian military intelligence, has been found to be using LLMs \u201cto understand satellite communication protocols, radar imaging technologies, and specific technical parameters.\u201d The hacking group, known also as APT28 or Fancy Bear, has been active during Russia\u2019s war in Ukraine<\/a> and was previously involved<\/a> in targeting Hillary Clinton\u2019s presidential campaign in 2016.<\/p>\n<\/div>\n The group has also been using LLMs to help with \u201cbasic scripting tasks, including file manipulation, data selection, regular expressions, and multiprocessing, to potentially automate or optimize technical operations,\u201d according to Microsoft.<\/p>\n<\/div>\n A North Korean hacking group, known as Thallium, has been using LLMs to research publicly reported vulnerabilities and target organizations, to aid in basic scripting tasks, and to draft content for phishing campaigns. Microsoft says the Iranian group known as Curium has also been using LLMs to generate phishing emails and even code for avoiding detection by antivirus applications. Chinese state-affiliated hackers are also using LLMs for research, scripting, translations, and to refine their existing tools.<\/p>\n<\/div>\n There have been fears around the use of AI in cyberattacks, particularly as AI tools like WormGPT and FraudGPT have emerged<\/a> to assist in the creation of malicious emails and cracking tools. A senior official at the National Security Agency also warned last month<\/a> that hackers are using AI to make their phishing emails look more convincing.<\/p>\n<\/div>\n Microsoft and OpenAI haven\u2019t detected any \u201csignificant attacks\u201d using LLMs yet, but the companies have been shutting down all accounts and assets associated with these hacking groups. \u201cAt the same time, we feel this is important research to publish to expose early-stage, incremental moves that we observe well-known threat actors attempting, and share information on how we are blocking and countering them with the defender community,\u201d says Microsoft.<\/p>\n<\/div>\n While the use of AI in cyberattacks appears to be limited right now, Microsoft does warn of future uses cases like voice impersonation. \u201cAI-powered fraud is another critical concern. Voice synthesis is an example of this, where a three-second voice sample can train a model to sound like anyone,\u201d says Microsoft. \u201cEven something as innocuous as your voicemail greeting can be used to get a sufficient sampling.\u201d<\/p>\n<\/div>\n Naturally, Microsoft\u2019s solution is using AI to respond to AI attacks. \u201cAI can help attackers bring more sophistication to their attacks, and they have resources to throw at it,\u201d says Homa Hayatyfar, principal detection analytics manager at Microsoft. \u201cWe\u2019ve seen this with the 300+ threat actors Microsoft tracks, and we use AI to protect, detect, and respond.\u201d<\/p>\n<\/div>\n Microsoft is building a Security Copilot<\/a>, a new AI assistant that\u2019s designed for cybersecurity professionals to identify breaches and better understand the huge amounts of signals and data that\u2019s generated through cybersecurity tools daily. The software giant is also overhauling its software security<\/a> following major Azure cloud attacks and even Russian hackers spying on Microsoft executives<\/a>.<\/p>\n<\/div>\n<\/div>\n