Google Detects State-Sponsored Hackers Using AI in Cyberattacks

State-sponsored hackers are exploiting highly-advanced tooling to accelerate their particular flavours of cyberattacks, with threat actors from Iran, North Korea, China, and Russia using models like Google's Gemini to further their campaigns. They are able to craft sophisticated phishing campaigns and develop malware, according to a new report from Google's Threat Intelligence Group (GTIG).

The quarterly AI Threat Tracker report, released today, reveals how government-backed attackers have begun to use artificial intelligence in the attack lifecycle – reconnaissance, social engineering, and eventually, malware development. This activity has become apparent thanks to the GTIG's work during the final quarter of 2025.

"For government-backed threat actors, large language models have become essential tools for technical research, targeting, and the rapid generation of nuanced phishing lures," GTIG researchers stated in their report.

🎯 Reconnaissance by State-Sponsored Hackers Targets the Defence Sector

Iranian threat actor APT42 is reported as having used Gemini to augment its reconnaissance and targeted social engineering operations. The group used an AI to create official-seeming email addresses for specific entities and then conducted research to establish credible pretexts for approaching targets.

APT42 crafted personas and scenarios designed to better elicit engagement by their targets, translating between languages and deploying natural, native phrases that helped it get round traditional phishing red flags, such as poor grammar or awkward syntax.

North Korean government-backed actor UNC2970, which focuses on defence targeting and impersonating corporate recruiters, used Gemini to help it profile high-value targets. The group's reconnaissance included searching for information on major cybersecurity and defence companies, mapping specific technical job roles, and gathering salary information.

"This activity blurs the distinction between routine professional research and malicious reconnaissance, as the actor gathers the necessary components to create tailored, high-fidelity phishing personas," GTIG noted.

⚠️ Model Extraction Attacks Surge

The latest intelligence reveals a significant increase in model extraction attacks, where adversaries attempt to replicate or steal AI model capabilities. These sophisticated operations represent an evolving threat landscape where state-sponsored actors continuously adapt their techniques to exploit cutting-edge technologies for malicious purposes.

Security experts warn that organizations must remain vigilant and implement robust AI security measures to protect against these advanced persistent threats that leverage artificial intelligence for reconnaissance, social engineering, and malware development activities.