Reflecting on AI in 2025: Faster Attacks, Same Old Tradecraft

What it is

A Huntress retrospective on four 2025 incident-response cases where adversaries used general-purpose LLMs (ChatGPT, DeepSeek, Gemini, and similar) as authoring aids for otherwise commodity tradecraft. The engineering value beyond the summary is the set of authorship "tells," delivery vectors, and file artifacts that make these payloads detectable.

How it works

AI was used to draft PowerShell/batch scripts, not to plan or execute autonomously. The resulting artifacts carry recognizable signatures the reader can hunt on:

• Cyrillic strings appeared in every case (case 1 dumper, case 3 browser stealers) — either lazy leftover or a deliberate Russian-speaking false flag; Huntress does not attribute.
• Odd/misplaced comments, inconsistent variable naming, copy-paste errors, and overly organized formatting with comprehensive comments (the RAT).
• A distinctive failure mode: claimed vs. actual behavior mismatch. qb_check.ps1 claimed Telegram exfil but contained none; coinbase_check.ps1 swapped URL strings to Coinbase while the underlying regex still searched QuickBooks data. Only the third iteration, secure.chase.ps1, worked. Reused regex that doesn't match the advertised target is a strong AI-authorship signal.

Preconditions / Affected

Delivery relied on ordinary access, not novel exploits: RDP brute force (case 1), WinRM lateral movement (case 2), and a rogue ScreenConnect session spawning PowerShell (case 3). Detection hinged on anomalous RMM-to-PowerShell process lineage.

What to do

Hunt on the concrete artifacts the page names:

• File paths / names: C:\temp\v.ps1 (Veeam cred theft), secure.chase.ps1, qb_check.ps1, coinbase_check.ps1.
• Scripts scanning Chrome/Edge history for banking URLs (Chase) and exfiltrating to Telegram endpoints.
• The Chrome extension RAT titled "Telegram Agent + Cookies" (no real Telegram link) that beacons to C2 at 172.86.105[.]237:5000 every five seconds, with a pop-up UI for C2 config and manual cookie export.
• Alert on ScreenConnect (or other RMM) spawning PowerShell with anomalous lineage.
• Huntress notes AI-verification tooling flagged the case-2 script as machine-produced — you can triage suspect scripts by checking for the tells above.

The stated thesis for prioritization: none of this required new detections. Sound basics — telemetry, RDP/WinRM exposure control, RMM monitoring, rapid forensics to validate blast radius — caught all four.

Caveats

Two of the four payloads failed outright (case 1 contained, case 2 didn't execute), and two of three browser stealers were non-functional. Attribution is explicitly not self-evident; the shared Cyrillic characters may be a false flag. The RAT command list is truncated in the source ("inclu…"), so the full capability set is not enumerated here.