https://lnkd.in/dfN8pgpk
PDF https://lnkd.in/dbPcQ-FC
"A new report from #OpenAI has been released about the misuse of its AI services by malicious actors . In previous reports, OpenAI shared how it blocked accounts linked to state-sponsored hacker groups and identified information-psychological campaigns utilizing AI-generated content.
This time, the report presents examples of AI being used in both cyber operations and information-psychological operations.
Report highlights activities of three hacker groups: presumably pro-China SweetSpecter, and two pro-Iranian groups, CyberAv3ngers and STORM-0817. These groups used OpenAI services for various tasks: gathering vulnerability information, aiding in the development of malware, code obfuscation assistance, providing advice on post-compromise commands, social engineering, and more. Notably, OpenAI shows how the malicious actors’ activities align with tactics, techniques, and procedures (TTPs) related to the use of large language models (LLMs). However, OpenAI uses categories developed with Microsoft, instead of the more detailed MITRE ATLAS matrix (https://lnkd.in/dw--6AvX), which adapts the ATT&CK matrix for AI/ML attacks. Nonetheless, the differences are not substantial. See the image for an example of TTPs used by the SweetSpecter group.
On the information-psychological front, the report includes several examples of using AI-generated content, ranging from short comments or posts on Twitter to long articles and even images. According to the report, this content was used for promoting politically charged messages, and in one case, for luring users to gambling websites. Interestingly, the geography of blocked accounts includes Russia, Rwanda, Israel, and even the USA — someone from America was allegedly conducting a pro-Azerbaijani information campaign.
In broader terms, this report, like some others (https://lnkd.in/dwAtUUSi), shows that LLMs can significantly simplify hackers’ work and lower the entry barrier. However, they currently rely on advanced services from leading companies like OpenAI. As a result, malicious actors potentially expose their operations to the security teams of these services. While not all companies may handle this well, OpenAI, supported by Microsoft and others in the industry, is paying increasing attention to security. Therefore, APTs and advanced groups will likely recognize this risk and might avoid ChatGPT or use it only in limited situations.
For regular users and companies, it’s worth remembering that their conversations with chatbots are likely stored somewhere, and both service employees and outsiders might gain access to them."
Tags: #OpenAI #CyberOperations #AIAbuse #SweetSpecter #CyberAv3ngers #STORM0817 #InformationPsychologicalOperations #LLM #Microsoft #TTP #CyberSecurity #APT #MITREATLAS #AI
