State-Backed Hackers from Four Nations Weaponize Google Gemini for Cyberattack Operations (2025)

Incident Summary

Google’s Threat Intelligence Group (GTIG) documented state-backed hacking groups from North Korea, Iran, China, and Russia using Google Gemini across multiple stages of cyberattack operations, publishing an initial report in January 2025 and a follow-up in February 2026 detailing escalation from productivity use to AI-integrated malware.^[1][2] North Korea’s UNC2970, which targets defense industry organizations by impersonating corporate recruiters, used Gemini to synthesize open-source intelligence and profile high-value targets by searching for information on cybersecurity and defense companies and mapping specific technical job roles and salary information.^[3] Iran’s APT42 used Gemini to search for official email addresses, conduct reconnaissance on potential business partners for phishing pretexts, and accelerate malware development and exploitation techniques.^[1] The February 2026 follow-up identified HONESTCUE, a malware framework that sends prompts via Gemini’s API to outsource code generation, receiving C# source code as responses to function as a downloader and launcher.^[2] Threat actors commonly circumvented safety guardrails by reframing prompts as security research or capture-the-flag exercises.^[4]

Key Facts

• Threat actors: UNC2970 (North Korea), APT42 (Iran), plus unnamed Chinese and Russian state-backed groups^[1]
• UNC2970 activities: Target profiling of defense and cybersecurity companies; mapping job roles and salary information for impersonation campaigns^[3]
• APT42 activities: Email address discovery for phishing; business partner reconnaissance for social engineering pretexts; malware development acceleration^[1]
• HONESTCUE malware: A downloader/launcher framework that uses Gemini’s API to dynamically generate C# source code payloads^[2]
• Guardrail bypass method: Threat actors reframed malicious prompts as security research or CTF exercises to circumvent safety filters^[4]
• Source: Google Threat Intelligence Group reports, January 2025 and February 2026^[1][2]

Threat Patterns Involved

Primary: Social Engineering via AI — The dominant use of Gemini by state-backed groups was reconnaissance, target profiling, and phishing pretext development. UNC2970 used Gemini to map defense industry targets for impersonation campaigns, while APT42 used it to identify email addresses and develop contextually appropriate social engineering pretexts. These activities represent AI-augmented social engineering at the nation-state level.

Secondary: AI-Morphed Malware — The HONESTCUE malware framework represents a further evolution where AI integration moves from pre-attack preparation into the malware itself, with the Gemini API serving as a dynamic code generation engine during execution. This creates malware whose capabilities can evolve with each execution without requiring human developer intervention.

Significance

1. AI-integrated malware — HONESTCUE represents an evolution from using AI to prepare attacks to embedding AI API calls within malware itself, creating a new class of threats where the malware’s capabilities are dynamically generated and can evolve with each execution
2. Multi-nation convergence — Four nation-state programs independently adopting the same AI platform for attack operations indicates that AI-assisted offensive cyber capabilities are becoming a standard component of state-sponsored threat actor tradecraft
3. Guardrail bypass as tradecraft — The systematic reframing of malicious prompts as security research demonstrates that current safety guardrails are insufficient against motivated, persistent adversaries with expertise in prompt crafting