A recent cyber threat originating from China has targeted artificial intelligence (AI) experts in the United States through the deployment of a variant of the well-known Gh0st RAT malware. Identified by security researchers at Proofpoint as “UNK_SweetSpecter,” the threat actor behind this campaign has set its sights on stealing valuable information from individuals in US companies, government agencies, and academia who specialize in AI.

This targeted attack was first noticed earlier this month by Proofpoint, who have been closely monitoring the activities of the UNK_SweetSpecter group. According to a report released on May 16, the attackers employed an AI-themed phishing lure to distribute the remote access trojan (RAT) known as SugarGh0st to a select group of AI experts. The campaign specifically honed in on less than 10 individuals with direct connections to a prominent US-based AI organization, as revealed by open source research.

Despite the absence of concrete evidence linking the malicious activities to any known nation-state actor, the specific characteristics of this campaign have raised concerns among cybersecurity experts. The lure theme referencing AI tools, the precise targeting of experts in the field, and the overall highly focused nature of the attack indicate a clear objective: obtaining confidential information related to generative AI technologies.

Further investigation into the SugarGh0st malware revealed that it is a customized variant of the original Gh0st RAT, with enhanced capabilities tailored towards reconnaissance and targeted attacks. Cisco Talos researchers, who initially identified the malware last November in a cyberespionage campaign targeting government officials in Uzbekistan and South Korea, highlighted the advanced features of SugarGh0st. These include the ability to search for specific registry keys, execute malicious code, and issue custom commands through a command-and-control interface.

In the recent UNK_SweetSpecter campaign, Proofpoint observed the threat actor sending AI-themed emails to targets, disguised as requests for assistance with an AI tool-related problem. The malicious attachments contained decoy documents and encrypted binaries, ultimately leading to the deployment of SugarGh0st on compromised systems. The goal of this elaborate attack appears to be the theft of generative AI technology secrets, possibly in response to US government efforts to restrict Chinese access to such technologies.

The broader implications of this targeted campaign suggest a strategic effort by China-affiliated actors to acquire valuable AI knowledge through illicit means. Recent reports of US government actions to limit Chinese access to AI technologies have likely motivated such attacks, as seen in previous cases of intellectual property theft within the industry. As tensions continue to escalate in the realm of technological competition, cybersecurity experts warn of the potential risks posed by sophisticated threat actors aiming to exploit vulnerabilities in AI research and development.

Link na izvor