Hackers are using AI to dissect threat intelligence reports and 'vibe code' malware

"According to research from Trend Micro, hackers are now using AI to analyze these reports and use them to refine their tactics. The study showed large language models (LLMs) can translate technical blogs into "partial malicious code" in a dark twist on the "vibe coding" trend. This not only allows threat actors to speed up attacks or reverse engineer malware strains, it also helps them mimic other group's TTPs, creating challenges with the attribution of attacks."

"McArdle told ITPro the company decided to test this by using AI tools to dissect its own blog posts, which showed some initial promise. "What came back was quite good," he said. "It wasn't the final product. It did need a little bit of tweaking to get it to work, but it certainly took a lot of work out of the way.""

Threat intelligence blog posts document TTPs and malware analysis used by security teams. Trend Micro research found attackers are using AI and large language models to analyze those blogs and generate partial malicious code or re-implement malware. LLM-assisted analysis can speed up attacks, enable reverse engineering of strains, and allow criminals to mimic other groups' TTPs, complicating attribution. Cybercriminals are adopting vibe coding techniques to reduce development effort and lower the barrier to entry. Security teams face increased risk as public technical disclosures become usable vectors for automated malicious tool creation.

Read at IT Pro