when

Security

Malware developers are now using generative AI to speed up the process of writing code, accelerating the number of attacks while essentially letting anyone tech-savvy develop malware.
In a September report from HP’s Wolf Security team, HP detailed how they <a data-ct-non-breakable="null" href="https://threatresearch.ext.hp.com/hp-wolf-security-threat-insights-report-september-2024/" rel="null" target="null" text="null" title="null">discovered</a> a variation of the asynchronous remote access trojan (AsyncRAT) — a type of software that can be used to remotely control a victim’s computer — while investigating a suspicious email sent to a client.
However, while AsyncRAT itself was developed by humans, this new version contained an injection method that appeared to have been developed using generative AI.
In the past, researchers have found generative AI “phishing lures” or deceptive websites used to lure in victims and scam them. But according to the report, “there has been limited evidence of attackers using this technology to write malicious code in the wild” prior to this discovery.
The program had several characteristics that provided strong evidence it was developed by an AI program. First, nearly every function in it was accompanied by a comment explaining what it did.&nbsp;
Cybercriminals rarely take such care in providing notes for readers, as they generally do not want the public to understand how their code works. The researchers also believed that the structure of the code and “choice of function names and variables” gave strong evidence that the code was developed using AI.
<figure>
 <img alt="Hackers have started using AI to churn out malware" src="https://s3.cointelegraph.com/uploads/2024-10/0192553a-829d-7419-8052-bb4e398383bc" title="">
 <figcaption style="text-align: center;">
 Code excerpt containing alleged AI-generated statements. Source: HP Wolf Security
 </figcaption>
</figure>
The team first discovered the email when it was sent to a subscriber of HP’s Sure Click threat containment software. It posed as an invoice written in French, which indicated that it was likely a malicious file targeting French speakers.
However, they could not initially determine what the file did, as the relevant code was stored inside a script that could only be decrypted with a password. Despite this roadblock, the researchers eventually succeeded at cracking the password and decrypting the file, which revealed the malware hidden within it.&nbsp;
Inside the file was a Visual Basic Script (VBScript) that wrote variables onto the user’s PC registry, installed a JavaScript file onto one of the user’s directories, and then ran the JavaScript file. This second file loaded the variable from the registry and injected it into a Powershell process. Two more scripts were then run, causing AsyncRAT malware to be installed on the device.
<figure>
 <img alt="Hackers have started using AI to churn out malware" src="https://s3.cointelegraph.com/uploads/2024-10/0192553b-1539-719f-91c4-572f47150ae9" title="">
 <figcaption style="text-align: center;">
 Infection chain leading to AsynRAT. Source: HP Wolf Security
 </figcaption>
</figure>
According to cybersecurity software developer Blackberry, AsyncRAT is software released through GitHub in 2019. Its developers <a data-ct-non-breakable="null" href="https://www.blackberry.com/us/en/solutions/endpoint-security/ransomware-protection/asyncrat#:~:text=AsyncRAT%20is%20a%20remote%20access%20trojan%20(RAT)" rel="null" target="null" text="null" title="null">claim</a> it to be “a legitimate open-source remote administration tool.” However, it “is used almost exclusively by cybercriminal threat actors.”&nbsp;
The software allows its users to “control infected hosts remotely” by providing them with a user interface that can perform tasks on the victim’s computer. Because it allows an attacker to take control of a victim’s computer, AsyncRAT can be used to steal a crypto user’s private key or seed words, potentially leading to the loss of funds.
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/new-overlay-attacks-growing-threat-crypto-users-security-ceo" rel="null" target="null" text="null" title="null">New ‘overlay attacks’ are a growing threat to crypto users — security CEO</a>
Although AsyncRAT itself is not new, this particular variation uses a novel injection method, and the researchers found telltale signs of AI-generated code in this injection method, indicating that this new technology is making it easier than ever for malware developers to carry out attacks.
“The activity shows how GenAI [generative AI] is accelerating attacks and lowering the bar for cybercriminals to infect endpoints,” the HP report stated.
Cybersecurity researchers are still grappling with the effects of AI advancement on security. In December, some ChatGPT users discovered that it <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/this-ai-chatbot-is-either-an-exploiter-s-dream-or-their-nightmare" rel="null" target="null" text="null" title="null">could be used to discover vulnerabilities</a> in smart contracts.&nbsp;
As many in the crypto community noted at the time, this could make the AI program a useful tool for white hat hackers, but it could also allow black hats to find vulnerabilities for them to exploit.
In May 2023, Meta’s security department released a report warning that some malware operators were <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/chatgpt-and-ai-the-newest-vector-for-malware-meta-security-team" rel="null" target="null" text="null" title="null">creating fake versions</a> of popular generative AI programs and using them as lures to attract victims.
<a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/advanced-ai-system-already-self-aware-asi-alliance-founder-agi/" rel="null" target="null" text="null" title="null">Magazine: Advanced AI system is already ‘self-aware’ — ASI Alliance founder</a>

Hackers have started using AI to churn out malware

Cointelegraph

Other articles published on Oct 4, 2024

Top Altcoins SUI, KAS, and SEI Rebound from Key Support— What To Expect Next?

Is Satoshi Nakamoto About to Be Exposed? HBO Documentary Claims to Reveal Bitcoin Creator’s Identity

CZ: Continuing Investments in Blockchain, Decentralized Technologies, AI, and Biotechnology

Curve Finance Considers Removing TUSD from crvUSD Collateral Amid SEC Accusations

Experts Foresee PEPE Outshining SOL and XRP in 2025

Bitcoin miner CleanSpark mines a total of 493 BTC in September

Join our free newsletter for daily crypto updates!