OpenAI Disrupts CyberAv3ngers Iran-linked Cyber Research Activity

OpenAI has banned accounts associated with CyberAv3ngers, a threat actor affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC), after discovering the group used AI models to assist in cyber research and reconnaissance. This action highlights the ongoing use of LLMs by state-sponsored actors to streamline existing cyberattack workflows rather than to create novel capabilities.

Threat Actor Profile: CyberAv3ngers

CyberAv3ngers is a disruptive threat actor known for targeting industrial control systems (ICS) and programmable logic controllers (PLCs) within the water, manufacturing, and energy sectors. Their primary targets typically include infrastructure in the United States, Israel, and Ireland.

Recent documented attacks by the group include:

  • Municipal Water Authority of Aliquippa (Pennsylvania): PLCs were compromised in November 2023.
  • County Mayo (Ireland): Water services suffered a two-day disruption in December 2023.

These campaigns typically exploit default or weak passwords and well-documented vulnerabilities in PLCs, often utilizing open-source scanning and exploitation tools.

LLM Usage and Malicious Behavior

CyberAv3ngers used ChatGPT for reconnaissance and technical assistance that would traditionally be performed via search engines. The activity primarily fell into four categories of the LLM ATT&CK Framework:

LLM-Informed Reconnaissance

The actor sought information to identify targets and access points, including:

  • Listing commonly used industrial routers and electricity companies, contractors, and common PLCs in Jordan.
  • Identifying industrial protocols and ports capable of connecting to the internet.
  • Requesting default usernames and passwords for specific hardware, such as Tridium Niagara devices and Hirschmann RS Series Industrial Routers.
  • Researching recently disclosed vulnerabilities in CrushFTP and Cisco Integrated Management Controller, as well as older vulnerabilities in Asterisk Voice over IP software.

LLM-Enhanced Scripting Techniques

The group used the model to refine their toolkit, specifically by:

  • Debugging bash code snippets that returned errors.
  • Requesting the creation of a Modbus TCP/IP client.

LLM-Assisted Vulnerability Research

The actor attempted to use the model to find and exploit weaknesses, including:

  • Asking how to scan networks and zip files for exploitable vulnerabilities.
  • Requesting C source code examples for process hollowing.

LLM-Enhanced Evasion and Post-Compromise Activity

The group sought to maintain access and escalate privileges through:

  • Asking for methods to obfuscate VBA scripts in Excel and general code obfuscation.
  • Requesting instructions on how to copy a SAM file, how to use pwdump to export passwords, and how to access user passwords in MacOS.
  • Seeking alternatives to the tool mimikatz.

Technical Impact Assessment

OpenAI concludes that the interactions with their models did not provide CyberAv3ngers with any novel capabilities, resources, or information. The assistance provided by the LLM offered only limited, incremental improvements to capabilities that are already achievable using publicly available, non-AI powered tools.

Sources