Full Report
Huntress outlines 2025 AI attack speed with automated scripts, but adversaries use familiar tradecraft. Detection and hygiene remain decisive.
Analysis Summary
# Tool/Technique: AI-Augmented Scripting (Vibe-Coded Malware)
## Overview
This technique involves the use of Large Language Models (LLMs) and generative AI systems (e.g., ChatGPT, DeepSeek, Gemini) to rapidly author, automate, and assemble traditional attack scripts. Rather than creating novel exploits, adversaries use AI as a productivity multiplier to convert intent into executable code, often resulting in "noisy" but high-velocity commodity attacks.
## Technical Details
- **Type:** Technique / Attack Framework Supplement
- **Platform:** Windows (primarily PowerShell and Batch environments)
- **Capabilities:** Rapid script generation, automated credential dumping, network enumeration, and templated exfiltration.
- **First Seen:** Increased prevalence noted throughout 2025.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1133 - External Remote Services] (e.g., RDP Brute Forcing)
- [T1190 - Exploit Public-Facing Application] (e.g., ScreenConnect CVE-2024-1709)
- **[TA0002 - Execution]**
- [T1059.001 - PowerShell]
- [T1059.003 - Windows Command Shell]
- **[TA0006 - Credential Access]**
- [T1003 - OS Credential Dumping]
- [T1555 - Credentials from Web Browsers]
- **[TA0007 - Discovery]**
- [T1018 - Remote System Discovery]
- [T1087 - Account Discovery]
## Functionality
### Core Capabilities
- **Rapid Authoring:** Converting natural language prompts into functional PowerShell/Batch scripts for immediate deployment.
- **Credential Harvesting:** Automated extraction of Veeam credentials and browser-stored passwords.
- **Lateral Movement Automation:** Scripting WinRM commands to pivot through networks.
- **Network Enumeration:** AI-generated scripts for Active Directory discovery.
### Advanced Features
- **Naive Obfuscation:** Using AI to lightly wrap or hide script logic, though often remains detectable by modern telemetry.
- **C2 Integration:** Templated exfiltration paths to commodity channels like Telegram.
- **Vibe-Coding:** Use of machine-generated code logic that allows low-skilled operators to perform tasks previously requiring intermediate scripting knowledge.
## Indicators of Compromise
- **File Names:** `v.ps1` (commonly used in temp directories).
- **Behavioral Indicators:**
- Unusual RMM activity (e.g., ScreenConnect, WinRM).
- PowerShell execution from `C:\temp\`.
- Script execution containing non-native language strings (e.g., Cyrillic comments in an English-speaking environment).
- High-frequency process behavior following initial RDP access.
## Associated Threat Actors
- **Commodity Actors:** General low-to-mid-tier cybercriminals leveraging AI to bridge skill gaps.
- **KongTuke:** Linked to related "CrashFix" and ModeloRAT campaigns.
- **General Opportunistic Actors:** Utilizing ScreenConnect vulnerabilities (CVE-2024-1709).
## Detection Methods
- **Signature-based detection:** Identifying machine-produced code artifacts (non-native strings, inconsistent variable naming, odd comments).
- **Behavioral detection:** Monitoring for suspicious PowerShell execution, unauthorized WinRM lateral movement, and RMM tool abuse.
- **AI-Verification Tooling:** Using machine-learning models to flag code that was likely generated by another AI.
## Mitigation Strategies
- **Prevention measures:** Disable or restrict RDP and WinRM from public-facing exposure. Implement MFA on all remote access points.
- **Hardening recommendations:** Enforce PowerShell Constrained Language Mode and Script Block Logging. Patch known vulnerabilities in RMM software (e.g., ScreenConnect).
- **Hygiene:** Maintain robust telemetry and rapid forensic response capabilities to validate the "blast radius" of noisy, AI-driven attacks.
## Related Tools/Techniques
- **ScreenConnect Exploitation:** (CVE-2024-1709 & 1708).
- **Havoc C2:** Often deployed via AI-assisted delivery mechanisms.
- **Evilginx:** Researched by attackers using AI to automate adversary-in-the-middle workflows.