Full Report
Cybercriminals are selling access to the malicious GenAI chatbot via Telegram, providing rapid assistance for a range of nefarious activities, according to Abnormal Security
Analysis Summary
# Tool/Technique: GhostGPT AI Chatbot
## Overview
GhostGPT is a malicious generative AI chatbot being sold to cybercriminals on Telegram, designed to assist with various illicit activities, primarily malware creation and generating convincing phishing/Business Email Compromise (BEC) content.
## Technical Details
- Type: Tool (Malicious AI Chatbot)
- Platform: Accessible via Telegram bot interface. Underlying model is likely a wrapper around a jailbroken ChatGPT or an open-source Large Language Model (LLM).
- Capabilities: Malware creation, exploit development assistance, efficient generation of phishing/BEC emails, uncensored responses.
- First Seen: Observed being sold on Telegram from the end of 2024.
## MITRE ATT&CK Mapping
Given the described functionality, the primary focus is on initial access and execution support:
- **Tactic: Initial Access**
- T1566 - Phishing
- T1566.001 - Spearphishing Attachment / T1566.002 - Spearphishing Link (Facilitates rapid creation of deceptive emails)
- **Tactic: Execution**
- T1059 - Command and Scripting Interpreter (Assisting with generating malicious code/exploits)
## Functionality
### Core Capabilities
- **Malware Creation:** Assists users in coding and developing malware.
- **Phishing/BEC Generation:** Quickly produces convincing email templates for phishing or BEC scams (e.g., producing a DocuSign phishing email template).
- **Ease of Access:** Available as a paid Telegram bot, removing the need for users to jailbreak core models or set up local LLMs.
### Advanced Features
- **Uncensored Responses:** Uses a wrapper for jailbroken or open-source LLMs to bypass safety filters typical of standard AI models.
- **Activity Concealment:** Creators claim that user activity within the bot is not recorded, aiming to help customers conceal illegal activities.
- **Exploit Development:** Advertised assistance with writing and developing software exploits.
## Indicators of Compromise
No specific digital IOCs (hashes, IPs, domains) related to the *tool itself* were provided in the context, only its delivery mechanism and target outputs (emails/code).
- File Hashes: [Not provided]
- File Names: [Not provided]
- Registry Keys: [Not Applicable/Not provided]
- Network Indicators: Accessible via the Telegram messaging service. (No malicious C2 infrastructure provided in context)
- Behavioral Indicators: Generation of text for phishing, BEC, or malicious code snippets; user interaction via a Telegram bot interface.
## Associated Threat Actors
- Cybercriminals looking to leverage AI for low-skilled attacks or increased efficiency in existing campaigns.
- Users interested in malware development and sophisticated social engineering.
## Detection Methods
Detection focuses on the output and utilization rather than the tool itself, which is primarily accessed via a third-party service (Telegram).
- Signature-based detection: N/A for the tool itself; generalized signatures for AI-generated content might be theoretical.
- Behavioral detection: Monitoring for unusually rapid output generation matching common phishing vector templates or the introduction of unique, complex malicious code patterns into systems.
- YARA rules: [Not provided]
## Mitigation Strategies
Mitigation focuses on user education and security controls against the derived threats (phishing and malware).
- Prevention measures: Enhanced multi-factor authentication (MFA), robust email filtering capable of detecting sophisticated social engineering, and endpoint detection and response (EDR).
- Hardening recommendations: Continuous security awareness training emphasizing identifying sophisticated, AI-generated phishing content; strict controls over code execution from unknown sources.
## Related Tools/Techniques
- WormGPT (Similar LLM focused on BEC)
- WolfGPT
- EscapeGPT