SugarGh0st RAT variant, targeted AI attacks – Source: www.cybertalk.org

EXECUTIVE SUMMARY:

Cyber security experts have recently uncovered a sophisticated cyber attack campaign targeting U.S-based organizations that are involved in artificial intelligence (AI) projects. Targets have included organizations in academia, private industry and government service.

Known as UNK_SweetSpecter, this campaign utilizes the SugarGh0st remote access trojan (RAT) to infiltrate networks. In the past, SugarGh0st RAT has been used to target individuals in Central and East Asia and prior to this point, it has not been widely deployed elsewhere.

The specifics of the attack remain under investigation. However, it appears that attackers deployed phishing emails in order to send AI-themed lures to targets; with the objective of persuading them to open an attached ZIP archive.

Risks to AI sector

Although the attack methodology is not particularly sophisticated, telemetry data supports the notion that the campaign primarily targeted a select group of individuals, all of whom had the commonality of maintaining direct connections to a single, leading U.S.-based AI-oriented organization.

Cyber security professionals believe that the attackers are geo-politically motivated, and interested in either espionage or intellectual property theft. The campaign’s timing coincides with a Reuters report noting that the U.S. government intends to restrict foreign access to generative artificial intelligence.

Proactive takeaways for CxOs

The attacks highlight the growing risk to the U.S. AI sector. They emphasize the need for continued cyber security vigilance. Organizations that own or are developing proprietary AI tools or resources are advised to pursue a multi-layered approach to cyber security.

Cyber security leaders may wish to reevaluate security measures for AI-related projects. CISOs should prioritize use of comprehensive, advanced threat prevention systems. Such systems can analyze patterns and user behavior within AI environments, isolating anomalies that are indicative of malicious activity.

Leaders may also want to upgrade organizational email security. Consider the implementation of advanced email filtering solutions that can identify and quarantine emails containing malicious links and attachments.

Beyond that, cyber security leaders can elevate threat prevention by connecting and collaborating with the larger cyber security community. Consider participating in information-sharing forums and leveraging threat intelligence feeds.

AI-powered cyber security tools, like Check Point’s Infinity Platform, can effectively mitigate AI-based threats. AI-powered cyber security technologies can detect novel attacks, analyze attachments in real-time and can flag phishing emails, among numerous other advanced capabilities.

Get more information about AI-powered cyber security solutions here. To receive robust cyber insights, groundbreaking research and emerging threat analyses each week, subscribe to the CyberTalk.org newsletter.