GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI

MITRE Techniques

• [T1195.001] Supply Chain Compromise – UNC6780 trojanized legitimate developer assets and published compromised packages and MCP tools (‘published trojanized forks of legitimate MCP servers’ / ‘inject malicious code directly into official organizational GitHub repositories’).
• [T1552.001] Credentials In Files – ACRSTEALER targeted AI assistant configuration files that can store plaintext API keys (‘secrets.json file of Cline’ and ‘config.yaml file of Continue AI’).
• [T1555] Credentials from Password Stores – Actors harvested developer and platform credentials from compromised environments and AI tools (‘collects credentials to AI tools alongside other credentials’).
• [T1078] Valid Accounts – Threat actors used stolen developer credentials and hijacked accounts to access AI platforms and cloud resources (‘stealing developer credentials’ / ‘purchasing compromised AI platform accounts’).
• [T1059.001] PowerShell – BASIN CASTLE used PowerShell for post-exploitation troubleshooting (‘Troubleshoot PowerShell errors for Active Directory domain discovery post-exploitation’).
• [T1059.004] Unix Shell – SANDWORM RELIC and others used scripts and shell automation for credential spraying and lateral movement (‘write and refine asynchronous Python scripts’ / ‘draft Bash scripts’).
• [T1059.006] Python – Attackers used Python to automate exploitation, credential harvesting, and post-exploitation tasks (‘asynchronous Python scripts designed to perform automated password spraying’).
• [T1059.007] JavaScript – DUSTMAKER used JavaScript loader scripts with embedded prompt injection (‘prompts embedded as comments at the top of the malware’s JavaScript loader scripts’).
• [T1027] Obfuscated Files or Information – Threat actors used obfuscation in malware, code, and AI-generated content (‘author obfuscated custom malware’ / ‘extreme adversarial text’).
• [T1036] Masquerading – DUSTMAKER disguised malicious pipeline tasks as legitimate AI utilities (‘disguised under AI-themed names such as “Copilot Setup”’).
• [T1204] User Execution – Malicious prompts and workspace hooks relied on developer interaction to trigger execution (‘whenever the assets were downloaded or cloned’ / ‘during routine developer interactions’).
• [T1053.005] Scheduled Task/Job: Container and CI/CD Automation – DUSTMAKER created automated build/startup commands and CI/CD tasks to persist and execute (‘automated build or startup commands’ / ‘compromised CI/CD environments’).
• [T1566] Phishing – Several groups used AI to craft spear-phishing lures and social engineering content (‘generate convincing spear-phishing lures’ / ‘craft localized pretext lures’).
• [T1110.003] Password Spraying – SANDWORM RELIC wrote scripts for automated password spraying (‘write and refine asynchronous Python scripts designed to perform automated password spraying’).
• [T1595] Active Scanning – Actors deployed agentic frameworks to scan targets and identify services (‘perform discovery tasks such as port scanning and service parsing’).
• [T1580] Cloud Infrastructure Discovery – Adversaries queried cloud environments and quotas to identify resources (‘Executed targeted BigQuery queries’ / ‘request quota increases’).
• [T1090] Proxy – Attackers used proxies and IP rotation to obscure origin and route traffic (‘route traffic through the proxies’ / ‘implement obfuscation tactics including automated routing through proxies’).
• [T1219] Remote Access Software – UNC6240 used Claude code and MCP tools to parse exfiltrated directories and support extortion operations (‘Integrating Claude code configured with custom Model Context Protocol (MCP) tools’).
• [T1041] Exfiltration Over C2 Channel – Several operations involved exfiltrating AI repositories, data, or secrets for extortion (‘exfiltrated a copy of this AI repository’ / ‘stole corporate data and drug research’).
• [T1021] Remote Services – Threat actors leveraged cloud services and GitHub Actions runners for remote execution and access (‘GitHub Actions runners’ / ‘Cloud Run services’).