Nation State Hackers Deploy AI

Cyber security is undergoing a massive transformation with Artificial intelligence (AI) is at the forefront of this change, posing both a threat and an opportunity.  AI has the potential to empower organisations to defeat cyberattacks at machine speed and drive innovation and efficiency in threat detection, hunting, and incident response.

However, adversaries can use AI as part of their exploits. It’s never been more critical for us to design, deploy, and use AI securely.

Now, Microsoft says it has detected threats from foreign countries that used or attempted to exploit generative AI it had developed. State-backed hackers from Russia, China, and Iran have been using tools from Microsoft-backed OpenAI to improve their skills, according to a recent Microsoft Report.

While computer users of all stripes have been experimenting with large language models to help with programming tasks, translate phishing emails and assemble attack plans, the new report is the first to associate top-tier government hacking teams with specific uses of the Large Language Model training technology used to create Generative AI. .

It’s also the first report on countermeasures and comes amid a continuing debate about the risks of the rapidly developing technology and efforts by many countries to put some limits on its use.

US adversaries, chiefly Iran and N. Korea, and to a lesser extent Russia and China, are beginning to use Generative Artificial Intelligence to mount or organise offensive cyber operations, Microsoft has recently said.

Microsoft said it detected and disrupted, in collaboration with business partner OpenAI, many threats that used or attempted to exploit AI technology they had developed.

In a blogpost the company said the techniques were “early-stage” and neither “particularly novel or unique” but that it was important to expose them publicly as US rivals leveraging large-language models to expand their ability to breach networks and conduct influence operations.

Cyber security firms have long used machine-learning on defence, principally to detect anomalous behaviour in networks. But criminals and offensive hackers use it as well, and the introduction of large-language models led by OpenAI’s ChatGPT upped that game of cat-and-mouse.

Microsoft has invested billions of dollars in OpenAI, and it’s announcement coincided with its release of a report noting that generative AI is expected to enhance malicious social engineering, leading to more sophisticated deepfakes and voice cloning.

This is a threat to democracy in a year where over 50 countries will conduct elections, magnifying disinformation and already occurring.

Microsoft has provided some examples. In each case it said all generative AI accounts and assets of the named groups were disabled.

  • The North Korean cyber-espionage group known as Kimsuky has used the models to research foreign thinktanks that study the country, and to generate content likely to be used in spear-phishing hacking campaigns.
  • Iran’s Revolutionary Guard has used large-language models to assist in social engineering, in trouble-shooting software errors and even in studying how intruders might evade detection in a compromised network.

That includes generating phishing emails “including one pretending to come from an international development agency and another attempting to lure prominent feminists to an attacker-built website on feminism”. The AI helps accelerate and boost the email production.

  • The Russian GRU military intelligence unit known as Fancy Bear has used the models to research satellite and radar technologies that may relate to the war in Ukraine.
  • The Chinese cyber-espionage group known as Aquatic Panda – which targets a broad range of industries, higher education and governments from France to Malaysia – has interacted with the models “in ways that suggest a limited exploration of how LLMs can augment their technical operations”.

The Chinese group Maverick Panda, which has targeted US defence contractors amongst other sectors for more than a decade, had interactions with large-language models suggesting it was evaluating their effectiveness as a source of information “on potentially sensitive topics, high profile individuals, regional geopolitics, US influence, and internal affairs”.

In another blog OpenAI said its current GPT-4 model chatbot offers “only limited, incremental capabilities for malicious cybersecurity tasks beyond what is already achievable with publicly available, non-AI powered tools”.

Cyber Security Researchers Expect This To Change

Last April, the director of the US Cybersecurity and Infrastructure Security Agency, Jen Easterly, told Congress that “there are two epoch-defining threats and challenges. One is China, and the other is artificial intelligence.” Easterly said at the time that the US needed to ensure AI is built with security in mind.

Critics of the public release of ChatGPT in November 2022  argue it was irresponsibly hasty, considering security was largely an afterthought in their development. “Of course bad actors are using large-language models – that decision was made when Pandora’s Box was opened,” said Amit Yoran, chief executive of the cyber security firm Tenable.

Some cybersecurity professionals complain about Microsoft’s creation and marketing of tools to address vulnerabilities in large-language models when it might more responsibly focus on making them more secure.

Former AT&T chief security officer Edward Amoroso has observed that while the use of AI and large-language models may not pose an immediately obvious threat, they “will eventually become one of the most powerful weapons in every nation-state military’s offense”.

The Guardian   |   Microsoft     |   Open AI    |   Reuters     |   Washington Post   |  Microsoft     |    Microsoft

Image: Unsplash 

You Might Also Read: 

The Data Privacy Risks Of Generative AI:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible

« US Navy Will Use Data Analytics For Maritime Security
Data Breach - Bank of America Warns Clients & Customers »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

BTWorks

BTWorks

BTWorks provides identity management and anti-phishing / smishing solutions for web and mobile apps.

SentryBay

SentryBay

SentryBay is a real-time data security company developing technology for PC, mobile, the cloud and IoT.

Modux

Modux

Modux focus on a number of core competencies across cyber security including; cyber intelligence & analytics, penetration testing and training.

Caveonix

Caveonix

Caveonix’s RiskForesight TM solution is an automated, proactive risk and compliance platform designed for hybrid and multi-cloud.

Guardara

Guardara

Guardara's mission is to help our customers to continuously improve in every aspect of software development.

Pelion

Pelion

Pelion Connected Device Services are the easiest way to securely connect and manage your devices, allowing you to focus on forging your future.

3B Data Security

3B Data Security

3B Data Security offer a range of Penetration Testing, Digital Forensics, Incident Response and Data Breach Management Services.

IntelliDyne

IntelliDyne

IntelliDyne is a leading information technology consulting firm enabling better mission performance through innovative technology solutions.

Nine23

Nine23

Nine23 are a highly focused cyber security solutions company that defines, builds and manages innovative services, enabling end-users to use technology securely in today’s workplace.

eCapital

eCapital

eCAPITAL is a leading venture capital firm that provides early to growth stage funding to technology companies in fields including software & information technology, cybersecurity and industry 4.0.

Obsidian Security

Obsidian Security

Protect your business-critical applications by mitigating threats and reducing risk with Obsidian, the first truly comprehensive security solution for SaaS.

NETAND

NETAND

NETAND privileged access and identity management solutions will secure your business from cyber threats.

Cyber Defense International (CDI)

Cyber Defense International (CDI)

At CDI, we utilize decades of experience in designing and building large-scale cybersecurity programs, creating tailored solutions and services that protect businesses from cyber threats.

TraitWare

TraitWare

The TraitWare mission is to increase user and company security while simplifying access to digital and physical resources through the elimination of the need for usernames and passwords.

Genix Cyber

Genix Cyber

Genix Cyber provides world-class cybersecurity services that protect systems, cloud applications, infrastructure, critical data, and networks from evolving cyber threats.

RKON

RKON

RKON Technologies provides managed IT and cybersecurity services to organizations across various industries, helping businesses mitigate risks and secure their digital infrastructures.