Kaspersky details how cybercriminals can use AI for APT attacks

There have been several reports on how humans can trick ChatGPT to write malware, but the possible applications of Artificial Intelligence (AI) in cyberattacks go beyond scripting malicious software.

Kaspersky, a global cybersecurity company, disclosed that this network of smart machines can be utilized by cybercriminals in each stage of a sophisticated attack.

Noushin Shabab, Senior Security Researcher for Global Research and Analysis Team (GReAT) Asia Pacific at Kaspersky, revealed how AI can assist even in Advanced Persistent Threat (APT), a more targeted and sophisticated type of online assault.

“Beyond malware development, AI can be used in various stages of a sophisticated cyberattack. Nowadays, APT actors combine sophisticated techniques to evade detection and stealthy methods to maintain persistence. New AI developments can be of assistance to cybercriminals from reconnaissance stage to data exfiltration,” warns Shabab.

As the name “advanced” suggests, an APT uses continuous, clandestine, and sophisticated hacking techniques to gain access to a system and remain inside for a prolonged period of time, with potentially destructive consequences.

One of the main characteristics of an APT attack is to gain ongoing access to the system. Hackers achieve this in a series of attack stages including reconnaissance (collecting information about the target, its systems, and potential vulnerabilities), resource development, execution, and data exfiltration.

Reconnaissance

Shabab shared that at present, there are at least 14 active APT groups operating in APAC.

One of which is Origami Elephant, known to acquire domains and virtual private server during its resource development stage. This threat actor (aka DoNot team, APT-C-35, SECTOR02) has been targeting the South Asia region with special interest in government and military entities mainly in Pakistan, Bangladesh, Nepal and Sri Lanka since the beginning of 2020.

The infamous cyberespionage and cybersabotage APT, Lazarus, utilizes social media platforms and messaging apps such as LinkedIn, WhatsApp, and Telegram to reach its targets. The adversary is also known for compromising web services like vulnerable WordPress websites to upload its malicious scripts.

“During reconnaissance, AI can help actors find and understand potential targets by automating the analysis of data from various sources such as online databases and social media platforms and by collecting information about the target’s personnel, systems and applications used in a company’s environment. Smart machines can even spot the weak entry points by assessing the company’s employee details, third-party relationships, and network architecture,” she explained.

As widely known, AI can also play a role in malware development, but Shabab also shared that AI can assist in automating tasks related to building attack infrastructure including purchase of network infrastructure, creation of accounts, and compromising network infrastructure and accounts.

Initial access

Shabab also revealed that spear phishing is still the preferred initial access technique for APT actors in APAC. Among the 14 active cybercriminal groups in the region, 10 use this tactic to break into their target’s network.

Spear phishing is an email or electronic communications scam targeted towards a specific individual, organization or business. Although often intended to steal data for malicious purposes, cybercriminals may also intend to install malware on a targeted user’s computer.

In this initial access stage, AI can help cybercriminals craft highly convincing and personalized phishing messages. These smart machines can also be trained to find the best entry point into a target network and know the best timing to launch an attack.

“AI can analyze patterns in network and system activity and launch attacks during periods of low security vigilance or high noise. Thus, machines can assist cybercriminals to find the best timing for a phishing campaign to get initial access into the victim’s networks,” Shabab explained.

This technology can also enhance traditional brute-force attacks by intelligently selecting likely passwords based on patterns, dictionaries, and previous breaches. By analyzing patterns in user behavior, social media activity, and personal information, AI algorithms can make educated guesses about passwords, increasing the chances of successful access.

Execution

During the execution stage, AI has the capability to adapt the behavior of its malware in response to security measures, increasing the chance of a successful attack. AI-based obfuscation can also create polymorphic malware that changes its code structure to evade detection.

AI-chosen command and scripting interpreter can also analyze the target environment, understand system characteristics, and select the most suitable options for running malicious scripts or commands. AI-driven social engineering tactics could also increase the likelihood of users interacting with malicious files, enhancing the success of the execution phase.

Persistence

APT groups are known for the sophisticated technique to remain inside a network without being caught. Shabab shared that the most common techniques among APT actors in APAC to achieve persistence are:

• Scheduled Task/Job: Scheduled Task
• Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

For this stage, AI can create the most suitable script to execute the malware based on user behavior analysis. Threats actors can also develop AI-powered malware that can dynamically adapt its persistence mechanisms based on changes in the target environment.

AI-driven monitoring mechanisms can also track system changes and adjust persistence tactics accordingly and AI-guided techniques can also manipulate Windows Registry entries to update persistence registry keys and evade detection.

Data exfiltration and Impact

Shabab also explained how AI can help exfiltrate stolen data in a more stealthy and efficient way.

“AI can analyze network traffic patterns in order to better blend in with the regular network behaviors and determine the most suitable communication channel to exfiltrate data for each victim. It can even optimize obfuscation, compression, and encryption of the stolen data to avoid abnormal traffic detection,” she added.

She also warned that AI can assist in maximizing the attack impact by enhancing the effectiveness and efficiency of attackers’ actions.

To boost enterprises’ and organizations’ defenses against AI-assisted APT attacks, Shabab suggests the following:

• Advanced security solutions: Implement security solutions that use advanced methods to monitor user and system behaviors. This can help identify deviations from normal patterns, potentially signaling malicious activities.
• Regular Software Updates: Keep all software, applications, and operating systems up to date to mitigate vulnerabilities that attackers might exploit.
• User Training and Awareness: Provide employees with training on cybersecurity best practices, including recognising and avoiding social engineering attacks and phishing attempts.
• Multi-Factor Authentication (MFA): Enforce MFA for accessing critical systems and applications, reducing the risk of unauthorized access even if credentials are compromised.

To know more about Kaspersky’s advanced security solutions, interested customers can visit: https://www.kaspersky.com/enterprise-security.

Kaspersky will continue the discussion about the future of cybersecurity at the Kaspersky Security Analyst Summit (SAS) 2023 happening in Phuket, Thailand, from 25^th to 28^th October.

This event welcomes high-caliber anti-malware researchers, global law enforcement agencies, Computer Emergency Response Teams, and senior executives from financial services, technology, healthcare, academia, and government agencies from around the globe.

Interested participants can know more here: https://thesascon.com/#participation-opportunities.