“Keep going, bro. You’ve got this!” A data-driven look at how adversaries are weaponizing AI

MITRE Techniques

• [T1498 ] Network Denial of Service – AI was used to develop tooling for DDoS-style stress testing and later clarified targeting of bots and Android TVs (‘remove the auth part, I don’t want the auth stuff’; ‘I already control nearly 2,000 Android TVs’).
• [T1036 ] Masquerading – Actors hid malicious intent by using neutral verbs, CTF/bug bounty framing, or claims of legitimate testing to get models to comply (‘I’m allowed to do this’; ‘bug bounty’; ‘stress testing’).
• [T1059 ] Command and Scripting Interpreter – AI-built tooling executed shell commands, background jobs, and scripted workflows during exploitation, mining, and credential harvesting (‘passed the remaining text to the system shell’; ‘launched it in the background’).
• [T1021 ] Remote Services – Operators used SSH and other remote administration paths to control servers, modify code, and troubleshoot systems (‘connect over SSH, inspect services, modify code’).
• [T1589 ] Gather Victim Identity Information – Bulk-mail validation and credential pipelines collected and enriched recipient, credential, and target data (‘collect timing, IP address, and user-agent data’; ‘extracts tokens from exposed .git/config files’).
• [T1071 ] Application Layer Protocol – Deluge plugin abuse and streaming workflows used legitimate application channels and web/media protocols for command, control, and retrieval (‘move_completed_path’; ‘HLS, FLV, and RTMP’).
• [T1190 ] Exploit Public-Facing Application – AI-assisted React2Shell and ZLMediaKit-related workflows targeted exposed services and vulnerable web applications (‘public React Server Components exploitation’; ‘SSRF flaw’).
• [T1195 ] Supply Chain Compromise – The React2Shell pipeline and public-code-based tooling aimed to harvest secrets and source material from exposed software systems (‘conversion → validation → dump pipeline’).
• [T1005 ] Data from Local System – The exploitation stage dumped runtime variables, configs, source code, and secret-bearing files from compromised hosts (‘retrieving complete process environments, application configuration’).
• [T1114 ] Email Collection – The bulk-mail platform used old and third-party email datasets, delivery testing, and open tracking to validate address activity (‘sent real messages to old or potentially third-party addresses’).
• [T1566 ] Phishing – Subject lines and transactional-style messages were crafted to induce engagement and mimic legitimate account updates (‘cold outreach dressed as transactional mail’; ‘Important update for your Tubely account’).
• [T1053 ] Scheduled Task/Job – The mining operation used cron-based persistence and periodic checks to maintain miner execution (‘cron-based persistence attempt checked for the miner every 15 minutes’).
• [T1219 ] Remote Access Software – AI helped build multi-agent and orchestrated control workflows for unattended operations (‘Telegram-controlled, multi-agent system’; ‘orchestrator bot, dubbed Moxy’).
• [T1133 ] External Remote Services – Actors leveraged internet-facing torrent clients, cloud services, and hosted platforms as entry points for operations (‘internet-facing Deluge and qBittorrent clients’; ‘cloud-based AI models’).