Chinese State-Sponsored Hackers Use AI on Compromised Networks, Google Reports

Google's Mandiant security division has identified a Chinese state-sponsored hacking group, designated APT40, that employs artificial intelligence on networks it has already infiltrated. The group uses machine learning to evade detection and enhance its operations, according to a report Mandiant published on Wednesday.

Mandiant investigators detailed the group's methods, stating that APT40 uses AI tools to develop defenses against network security measures. They also observed the group deploying AI to study network traffic and identify anomalies, which allows them to adapt their activities.

The report specifies that APT40 targets academic institutions, medical research facilities, and military organizations involved in AI development. Mandiant analysts believe these targets provide the group with valuable insights into AI technologies and research, which they then integrate into their own hacking infrastructure.

Sandra Joyce, Vice President of Mandiant Intelligence, discussed the evolving nature of cyber threats. Joyce stated, "Adversaries constantly adapt their techniques, and the use of AI represents a significant shift." She added that security professionals must also adapt their defenses to counter these new methods.

Mandiant's analysis indicates that APT40 has developed methods to train its AI models within the compromised networks. This allows the group to analyze network defenses from an internal perspective, aiding in the development of more effective evasion tactics. The group focuses on gathering intelligence related to AI research and development, according to the report.