Researchers recently released a report highlighting that nation-state hackers from China, North Korea, and Iran are leveraging Google’s Gemini AI tool to enhance their cyberattacks, refine malware, and conduct target reconnaissance. Google’s Threat Intelligence Group (GTIG) reports that these groups use Gemini for coding tasks, gathering intelligence on potential targets, and automating reconnaissance processes. The researchers also emphasized how the Chinese groups have utilized Gemini to compile information on individuals in Pakistan and analyze separatist organizations, while Iranian group APT42 uses it to craft phishing personas and translate emails for better engagement. North Korean hackers on the other hand focus on the defense sector, using Gemini to profile targets and gather intelligence. Gemini enables these advanced persistent threat (APT) groups to bypass manual labor in profiling and targeting, accelerating their activities. Chinese groups employ Gemini for analyzing vulnerabilities and testing bypass techniques against U.S.-based targets. Additionally, GTIG notes that HONESTCUE malware samples integrate Gemini’s API for functionality generation, indicating a sophisticated approach to obfuscation and evasion. While GTIG has not linked HONESTCUE to specific threat clusters, they suspect a small group or singular actor is involved, evidenced by iterative sample changes and testing against antivirus systems. CTIX Analysts will continue to provide relevant findings related to the use of AI by Threat Actors and improvements to their attack capabilities.