Researchers Uncover Emerging Cyber Threats Leveraging AI and Advanced Malware
HP and ThreatFabric Report Escalating Cybersecurity Concerns in Europe
19 October 2024 - In a significant development for cybersecurity, researchers from HP and ThreatFabric have revealed alarming findings indicating an increasing utilisation of Generative Artificial Intelligence (GenAI) tools and advanced malware to execute sophisticated cyberattacks. These discoveries have underscored the evolving landscape of cyber threats, particularly targeting European regions.
GenAI-Powered Malware: Lowering Barriers for Cybercriminals
Researchers at HP's Arctic Wolf unit have identified a concerning trend where GenAI tools, such as ChatGPT and Gemini, are being exploited to generate malicious code. While the application of GenAI in creating realistic phishing emails and deceptive landing pages has been acknowledged previously, this new discovery marks a significant milestone. HP researchers found evidence of GenAI-aided scripts, including VBScript and JavaScript, targeting the French-speaking community. This discovery was highlighted by Patrick Schläpfer, Principal Threat Researcher at HP Security Lab, who emphasized the gravity of this finding: "Speculation about AI being used by attackers is rife, but evidence has been scarce, so this finding is significant."
The identified malware campaign deploys AsyncRAT, an info-stealer capable of screen and keystroke recording. According to HP, the presence of structured scripts, explanatory comments, and native language elements are telling signs of GenAI's involvement. Despite still requiring significant technical proficiency to execute such attacks, GenAI substantially reduces entry barriers for novice threat actors.
Octo2: A Sophisticated Android Malware Targeting Europe
Simultaneously, ThreatFabric researchers have detected a new Android malware variant, Octo2, spreading across Europe. Octo2, believed to be the successor to the notorious Octo trojan, disguises itself as popular applications like NordVPN and Google Chrome. This advanced malware tricks users into downloading it from fake websites and risky third-party app repositories. Once installed, Octo2 exhibits capabilities like remote access, screen recording with invisibility, keylogging, SMS and notification manipulation, among others.
Compared to its predecessor, Octo2 presents several improvements, including enhanced stability and more advanced anti-detection mechanisms. It also features a Domain Generation Algorithm (DGA) system, providing resilience in its communication channels and making it harder to disrupt.
Malware Distribution and Impact
The distribution of Octo2 does not occur through the official Google Play store, complicating efforts to gauge the exact number of infections. However, ThreatFabric indicates that the majority of impacted devices are found in Italy, Poland, Moldova, and Hungary. Experts suggest that Octo2 is likely a strategic response to the earlier leak of Octo’s source code, which had led to widespread and unauthorised use of the malware’s capabilities. By introducing Octo2, the developers are possibly aiming to regain market traction, reportedly offering discounts to existing Octo users.
Regional and Global Implications
The findings of both HP and ThreatFabric signify a notable escalation in cyber threats within Europe. The use of GenAI tools to craft sophisticated malware scripts and the appearance of advanced malware variants like Octo2 emphasize the dynamic and evolving nature of cyber threats. While currently concentrated in Europe, the potential for these threats to spread globally remains high, necessitating heightened vigilance and advanced defensive measures in the cybersecurity landscape.
As these trends continue to unfold, the cybersecurity community remains on alert, with ongoing efforts to understand and mitigate these advanced threats in an increasingly digital world.
Source: Noah Wire Services