CuraSec

tag: Adversarial-Ai · 2 items

Plan archived GTIG: Threat Actors Shift to Agentic AI for Supply Chain and Credential Attacks
2026-09-08 · Google Threat Intelligence · source ↗ #adversarial-ai#supply-chain#threat-intelligence
  • Engineer — Plan: UNC6780 is actively exploiting AI coding assistants and LLM security scanners to slip supply chain compromises past tooling you likely run; audit which AI coding tools have access to your repositories and artifact pipelines, and validate that LLM-assisted code review is not your only security gate.
  • SOC/IR — Learn: The GTIG report documents AI-enabled automation compressing attack timelines to under six hours from initial cloud compromise to mass credential harvesting — no specific IOCs or ATT&CK mappings are provided in the summary, but the compressed defender response window should inform how you threshold alerting latency for cloud privilege escalation events.
  • Leader — Plan: Google’s Q2 2026 findings establish enterprise AI assets — model weights, API keys, and cloud compute quotas — as high-value espionage and extortion targets; update your risk register to reflect this and task your team with inventorying AI workload access controls before Q4 budget planning.
Plan archived UAC-0099 embeds LLM-disrupting prompts in malware to blind AI analysis
2026-09-01 · The Hacker News · source ↗ #adversarial-ai#malware-analysis#uac-0099
  • Engineer — Learn: GuardBreaker shows that AI-assisted malware scanning can be manipulated at the artifact level; no patch or config change is needed today, but engineers building AI-augmented security pipelines should understand this evasion class.
  • SOC/IR — Plan: Review any AI/LLM-assisted triage or malware-analysis workflows and add a mandatory human-review layer for suspected APT samples — do not treat LLM output as authoritative when analyzing artifacts from sophisticated actors.
  • Leader — Learn: Adversaries are now actively engineering around AI-assisted defenses; file this as context for future AI-tool procurement and policy decisions around over-reliance on LLM-based analysis in SOC operations.