Info-Stealer Campaign's Script Suspected to Be AI-Written

Proofpoint researchers have unveiled a sophisticated phishing campaign orchestrated by the notorious hacking group TA547, which uses a malicious PowerShell script that seems to be AI-written. The campaign, which specifically targeted German organizations, attempted to deliver Rhadamanthys malware, an information stealer.

Proofpoint's analysis highlighted that the PowerShell script contained a pound sign, as well as grammatically correct and hyper-specific comments above each component. Proofpoint stated “this is typical output of LLM-generated coding content.”

TA547, known in the cyber underworld as Scully Spider, has been active since at least 2017, and typically works as an Initial Access Broker (IAB). This is the first time Rhadamanthys has been used in TA547’s operations. The relevant campaign mimicked Germany’s Metro cash-and-carry brand.

As of late, TA547 mostly targets businesses in Germany, Austria, Switzerland, Spain, and the United States. It’s possible future phishing campaigns containing Rhadamanthys could hit organizations in any of these countries.

Further scrutiny revealed that TA547's use of AI might have streamlined the attack process but didn’t necessarily heighten the script’s complexity or its impact. While AI-generated scripts can streamline malicious activity, they don't inherently make the resulting cyber threats more difficult to detect, as noted by CSO Online. In some cases, the unique traits of AI-generated content could even aid cybersecurity defenses in identifying and neutralizing threats more efficiently.

This incident aligns with a growing trend where cybercriminals are harnessing AI to assist their attacks; one example is using AI to quickly and easily generate convincing phishing emails. Despite the evolving threat landscape, the core principles of cybersecurity defense currently remain potent against such AI-assisted attacks.