OpenAI threat analysts also found that the North Korean actors revealed staging URLs for malicious binaries unknown to security vendors at the time while debugging auto-start extensibility point (ASEP) locations and macOS attack techniques. Since October 2024, when it published its previous report, OpenAI has also detected and disrupted two campaigns originating from China, "Peer Review" and "Sponsored Discontent." These campaigns used the ChatGPT models to research and develop tools linked to a surveillance operation and generate anti-American, Spanish-language articles. In addition to researching what tools to use during cyberattacks, the threat actors used ChatGPT to find information on cryptocurrency-related topics, which are common interests linked to North Korean state-sponsored threat groups. The malicious actors also used ChatGPT for coding assistance, including help on how to use open-source Remote Administration Tools (RAT), as well as debugging, researching, and development assistance for open-source and publicly available security tools and code that could be used in Remote Desktop Protocol (RDP) brute force attacks. In the October report, OpenAI revealed that since the beginning of 2024, it disrupted over twenty campaigns linked to cyber operations and covert influence operations associated with Iranian and Chinese state-sponsored hackers. The company also banned accounts linked to a potential North Korean IT worker scheme, described as having all the characteristics of efforts to obtain income for the Pyongyang regime by tricking Western companies into hiring North Koreans. OpenAI says it blocked several North Korean hacking groups from using its ChatGPT platform to research future targets and find ways to hack into their networks. "We banned accounts demonstrating activity potentially associated with publicly reported Democratic People's Republic of Korea (DPRK)-affiliated threat actors," the company said in its February 2025 threat intelligence report.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Mon, 24 Feb 2025 21:35:19 +0000