An unidentified company in Hangzhou, China recently fell victim to a ransomware attack perpetrated using ChatGPT, leading to the first arrests in the country involving the AI chatbot.
Chinese authorities revealed that four cybercriminals were detained late last month – two in Beijing and two in Inner Mongolia. The suspects confessed to utilizing ChatGPT to optimize ransomware code, conduct network scans, infiltrate systems, deploy malware, and extort funds.
The attack itself saw the company’s networks blocked by ransomware, with the criminals demanding a payment of 20,000 Tether cryptocurrency to restore access.
Ransomware usage on the rise
Ransomware has fast become one of the most severe cyberthreats facing governments, businesses, and individuals worldwide. The malicious software encrypts files and systems, rendering them inaccessible until a ransom demand is met.
Damages from ransomware topped an estimated $20 billion globally in 2021. Attacks increased by 13% that year in China alone, where cybercriminals made off with over $1.6 billion in extorted payments.
The arrests mark the first time ChatGPT has been implicated in a Chinese ransomware case. However, the chatbot itself likely did not directly participate in the attack.
Instead, the accused admitted to using ChatGPT’s natural language capabilities to optimize their malware code. The AI’s conversational nature makes it straightforward to refine ransomware programs by providing feedback and suggestions.
Access to ChatGPT limited in China
While immensely popular worldwide, ChatGPT faces restrictions in China. OpenAI, its developer, has blocked mainland Chinese IP addresses from accessing the chatbot.
Some users bypass the limitations using VPNs registered outside of China. However, the legal risks for companies providing such services are unclear.
Authorities have warned that ChatGPT could potentially “commit crimes and spread rumors” if access becomes widespread. But interest in the AI remains high, with tech firms racing to develop rivals to OpenAI’s breakout product.
Generative AI also enables convincing deepfakes, which Chinese police confronted this summer in a loan scam crackdown. With the technology’s hazards evident, regulators globally are assessing how best to respond.
Concerns around AI-written malware
ChatGPT garnered fame for its conversational tone and eloquent, human-like responses on most topics. But its advanced language skills also make it dangerously effective for malicious uses like optimizing malware.
Cybersecurity researchers exposed how straightforward it was for ChatGPT to generate fake phishing pages, malicious computer code, and other threats. With simple prompts, the AI produces sophisticated ransomware tailored to evade detection.
And chatbots like ChatGPT never forget what they have learned. The accumulated knowledge further enhances their skills in coding malware, hacking systems, and deceiving targets.
AI’s generative nature poses wider risks
Beyond software vulnerabilities, AI chatbots also create risks around misinformation. Their convincing human-like writing can flood social networks and websites with false material that appears credible.
Generative AI likewise enables creation of deepfake audio/video media and cloned voices for fraud purposes. Impersonation scams and fake celebrity media pose major threats as the technology advances.
Plus, legal and ethical issues persist around AI training datasets and ownership. Systems like ChatGPT ingest vast troves of copyrighted books, articles, songs, images, and other content without consent.
As generative AI’s capabilities grow exponentially, its potential for harm in the wrong hands continues rising too. But careful regulation and cybersecurity vigilance can help mitigate emerging threats.
