Artificial Intelligence & Machine Learning
,
Next-Generation Technologies & Secure Development
Google Says Iranian and Chinese Threat Group the Most Active

Iranian and Chinese threat actors are using Google’s artificial intelligence application Gemini for vulnerability scanning and reconnaissance activities, with some attempting to bypass security guardrails of the application, the computing giant disclosed.
See Also: OnDemand | AI in the Spotlight: Exploring the Future of AppSec Evolution
Advanced persistent groups from over 20 countries over the past two years experimented with Gemini for information on payload development, malicious scripting and evasion techniques, the company said Wednesday. The highest volume of usage came from Iran and China.
More than 10 Iranian threat groups used Gemini, with APT42 the most prolific. It prompted the application for information on crafting phishing emails and reconnaissance activities targeting policy and defense experts. The threat group, also known as Mint Sandstorm and Cobalt Illusion, is linked to the Islamic Revolutionary Guard Corps intelligence organization.
The hacking group also sought information on vulnerabilities in products such as Mikrotik routers, Apereo identity solutions and Atlassian, researching on exploitation techniques, proof-of-concept code, as well as on server-side request forgery.
“APT42 appeared to be researching how to use generative AI tools for offensive purposes, asking Gemini for help preparing training content for a red team focused on how offensive teams can use AI tools in their operations,” the report said.
Chinese nation-state activities on the platform largely focused on reconnaissance, with one group unsuccessfully attempting to reverse engineer Carbon Black endpoint detection and response server components.
Another actor sought help from the AI assistant to figure out how to sign a plugin for Microsoft Outlook and discreetly deploy it. In another case, the Chinese threat group APT41 used the application to learn about Gemini’s underlying infrastructure and systems.
“Gemini responded but did not disclose sensitive information,” the report said
APT41, also tracked as Brass Typhoon and Earth Baku, was one among the Chinese nation-state groups behind a years-long campaign that compromised Sophos firewalls. The group’s activity aligns with the broader Chinese tactics of compromising edge devices for stealth espionage campaigns (see: Sophos Discloses Half Decade of Sustained Chinese Attack).
North Korean and Russian state hacking groups were also among Gemini users.
North Korean hackers largely focused on activities such as LinkedIn job searches and drafting cover letters to support the Pyongyang government’s IT worker scam ( US Sanctions North Korean Remote IT Worker Front Companies).
Russian prompts indicated likely interest in developing domestic tech capabilities and creating AI chatbots for interacting with large language models.
In addition to using the platform for malicious research, hackers also attempted to bypass Gemini guardrails to compromise Google products and to create malicious scripts. Since they used publicly available prompts rather than custom ones, these attempts were largely mitigated, Google said.