ShinyHuntersG1057 ↗
Has used Bland AI to create conversational pathways tailored to specific scenarios during voice phishing attacks.1
tfMITRE ATT&CK sub-technique
Artificial Intelligence T1588.007
sub-technique of T1588 Obtain Capabilities
- Tactic
- Resource Development
- Platform
- PRE
- Version
- 1.1
- Created
- 11 March 2024
- Last modified
- 12 May 2026
- Contributor
- Menachem Goldstein
Adversaries may obtain access to generative artificial intelligence tools, such as large language models (LLMs), to aid various techniques during targeting. These tools may be used to inform, bolster, and enable a variety of malicious tasks, including conducting Reconnaissance, creating basic scripts, assisting social engineering, and even developing payloads.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
3
Threat groups64th pct
Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.2
CampaignsTop 17%
Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Artificial Intelligence MITRE reference T1588.007
64th pctamong all ATT&CK techniques for number of groups
3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Contagious InterviewG1052 ↗
Has appeared to have used AI to generate images and content to facilitate their campaigns.1
APT28G0007 ↗
Has deployed LAMEHUG which can can query an LLM to generate and return commands for post compromise activity on targeted systems.1
All 3 groups for this technique
2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Anthropic AI-orchestrated CampaignC0062 ↗
During the Anthropic AI-orchestrated Campaign, the adversary obtained access to Claude Code to support cyber intrusion operations.1
2025 Poland Wiper AttacksC0063 ↗
During the 2025 Poland Wiper Attacks, the adversaries generated custom script with an LLM.1
All 2 campaigns for this technique
1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
LazyWiperS9039 ↗
Is believed to have been generated by a large language model (LLM) due to the non-sensical comments in the code.1
All 1 software entries for this technique
Offense vs defense T1588.007
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Artificial Intelligence detection strategy DET0842
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Artificial Intelligence
1 platform
AN1974 · PRE
Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on behaviors relating to the potential use of generative artificial intelligence (i.e. Phishing, Phishing for Information).
Pre-compromiseM1056
This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.