Attackers are using malware kits and generative artificial intelligence to improve cyberattacks

HP Inc. has issued its latest Threat Insights Report, highlighting how threat actors are using malware kits and generative artificial intelligence (GenAI) to improve the efficiency of their attacks. Such tools are reducing the time and skill needed to create attack components, enabling attackers to focus on experimenting with techniques to bypass detection and trick victims into infecting their endpoints, such as embedding malicious code inside images.

The report provides an analysis of real-world cyberattacks, helping organizations to keep up with the latest techniques that cybercriminals are using. 

Based on data from millions of endpoints running HP Wolf Security, notable campaigns identified by HP threat researchers include: 

• Malware-by-numbers kits: HP threat researchers observed large campaigns spreading VIP Keylogger and 0bj3ctivityStealer malware that leverage the same techniques and loaders, suggesting the use of malware kits to deliver different payloads. In both campaigns, attackers hid the same malicious code in images on file hosting websites, as well as using the same loader to install the final payload. Such techniques help attackers circumvent detection, as image files appear benign when downloaded from well-known websites, bypassing network security like web proxies that rely on reputation.

• GenAI is helping to create malicious HTML documents: researchers identified an XWorm remote access trojan (RAT) campaign initiated by HTML smuggling, which contained malicious code that downloads and runs the malware. Notably, similar to an AsyncRAT campaign analyzed in the previous quarter, the loader bore hallmarks that indicate that it may have been written with the help of GenAI, for example, including a line-by-line description and the design of the HTML page.