Story perspectives

State-Sponsored Hackers Exploit Google’s Gemini for Cyber Attacks

2/13/2026

Summary

Story summary

Google's Gemini is increasingly used by state-sponsored hackers from North Korea, Iran, China, and Russia across reconnaissance, phishing, and malware development.
The North Korean group UNC2970 has used Gemini to profile targets in defense sectors, boosting their phishing.
HONESTCUE uses Gemini's API to generate malicious code dynamically, complicating detection.
There has been a surge in model extraction since attackers have sent over 100,000 prompts to replicate Gemini.

History

Historical Context

In 2016, the U.S. Department of Justice indicted Russian hackers for cyber espionage, revealing they targeted over 500 million Yahoo accounts. This incident marked a significant escalation in state-sponsored cyberattacks, a trend that has evolved with groups like North Korea's UNC2970 employing advanced tools for reconnaissance and phishing, highlighting the urgent need for enhanced cybersecurity measures in an increasingly hostile digital landscape.

1 of 2

Story summary

Google's Gemini is increasingly used by state-sponsored hackers from North Korea, Iran, China, and Russia across reconnaissance, phishing, and malware development.
The North Korean group UNC2970 has used Gemini to profile targets in defense sectors, boosting their phishing.
HONESTCUE uses Gemini's API to generate malicious code dynamically, complicating detection.
There has been a surge in model extraction since attackers have sent over 100,000 prompts to replicate Gemini.

1 / 2