{"id":7464,"date":"2025-03-20T15:18:00","date_gmt":"2025-03-20T20:18:00","guid":{"rendered":"https:\/\/blogs.infoblox.com\/?p=11220"},"modified":"2025-03-20T15:18:00","modified_gmt":"2025-03-20T20:18:00","slug":"as-actors-adopt-genai-threat-intel-needs-to-modernize","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2025\/03\/20\/as-actors-adopt-genai-threat-intel-needs-to-modernize\/","title":{"rendered":"As actors adopt GenAI, threat intel needs to modernize"},"content":{"rendered":"

Authors: Krupa Srivatsan and Bart Lenaerts<\/h3>\n

How adversaries evade detections and the case for predictive intelligence<\/p>\n

INTRO<\/h3>\n

Generative AI, particularly Large Language Models (LLM), is transforming cybersecurity. Adversaries are attracted to GenAI as it lowers entry barriers to create deceiving content. Actors do this to enhance the efficacy of their malicious techniques like social engineering and detection evasion<\/p>\n

This blog provides examples of malicious GenAI usage like deepfakes, chatbot automation and obfuscation. More importantly, it also makes a case for new levels of telemetry and the case for predictive threat intelligence capable of disrupting actors before they execute their attacks.<\/p>\n

Example 1: Deepfakes for Crypto Scams<\/h3>\n

At the end of 2024, the FBI warned1<\/sup> that criminals were using generative AI to commit fraud on a larger scale, making their schemes more believable. GenAI reduces the time and effort needed to deceive targets by creating new trustworthy content. These tools can correct human errors that might otherwise signal fraud, and while creating synthetic content isn\u2019t illegal, it can facilitate crimes, like fraud and extortion. Criminals use AI-generated text, images, audio and videos to enhance social engineering, phishing and financial fraud schemes. <\/p>\n

In September 2024, Infoblox Threat Intel discovered deep fake videos some with over 180,000 viewers as cybercriminals jumped at the opportunity to use the U.S. presidential debate as fodder for a new cryptocurrency scam. Victims were lured by deep fake videos claiming to show Elon Musk presenting the theme of cryptocurrency and telling viewers that they could win big by investing in cryptocurrency during the streamed event.<\/p>\n

\"Picture<\/p>\n

Picture 1: Example of a deepfake cryptocurrency scam video discovered by Infoblox2<\/sup><\/p>\n

The videos contained QR codes linked to domains made to look like the candidates or cryptocurrency platforms, adding further deception. All of this demonstrates how criminals take advantage of high-profile current events, social media, and GenAI to make money. While YouTube took down account after account, some videos were available for over 12 hours, tricking an untold number of users. But by blocking access to suspicious domains, users can be protected from these clever scams.<\/p>\n

Example 2: AI-Powered Chatboxes<\/h3>\n

Actors often pick their victims carefully by gathering insights on their interests. Their initial research is used to craft the smishing message and trigger the victim into a conversation with them. Personal notes like \u201cHow can we bring you a happy mood today?\u201d or \u201cI read your last social post and wanted to become friends\u201d are some examples our intel team discovered (step 1 in picture 2). While some of these messages may be extended with AI-modified pictures, what matters is that actors invite their victims to the next step, which is a conversation on Telegram or another actor controlled medium, far away from security controls (step 2 in picture 2).<\/p>\n

\"Picture<\/p>\n

Picture 2: Sample AI-driven conversation<\/p>\n

Once the victim is on the new medium, the actor uses several tactics to continue the conversation, such as invites to local golf tournaments, Instagram following or AI-generated images. These AI bot-driven conversations go on for weeks and include additional steps, like asking for a thumbs-up on YouTube or even a social media repost. At this moment, the actor is trying to assess their victims and see how they respond. Sooner or later, the actor will show some goodwill and create a fake account. Each time the victim reacts positively to the actor\u2019s request, the amount of currency on the fake account will increase. Later, the actor may even request small amounts of investment money, promising an ROI of more than 25 percent. When the victim asks to collect their gains (step 3 in picture 2), the actor starts the real play by requesting access to the victim\u2019s crypto account. At this moment, the pig butchering comes to an end and the actor steals all the crypto money in the account.<\/p>\n\n\n\n
\nObserved characteristics of GenAI usage in chatboxes<\/p>\n