APT Meets GPT: Targeted Operations with Untamed LLMs
Summary: Volexity tracked a China-aligned actor it calls UTA0388 running spear phishing campaigns against customers in North America, Asia, and Europe from June 2025, using fabricated researcher identities and links to remotely hosted ZIP or RAR archives that loaded the GOVERSHELL backdoor via search order hijacking. Volexity assesses with high confidence that UTA0388 used LLMs in its operations, citing fabricated personas with sequential phone numbers and PGP key identifiers, non-existent signature domains, campaign tempo, and five distinct GOVERSHELL variants that each rewrote the network stack rather than iterating on it.
What's compelling: The actor's tell is fabrication at scale: fake institutions, dead signature domains, and pattern-built credentials that a careful recipient could catch, but only if someone is actually reading the sender's identity rather than the display name. Five rewrites of the malware's network stack in roughly three months is a development pace that signature-based detection on GOVERSHELL variants will struggle to keep up with.
Read the original at Volexity Blog ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026