A Russian-speaking threat actor has been identified as operating a large Telegram channel that served as a hub for fraud, credential theft, and cryptocurrency harvesting, according to Trend Micro. The actor used AI to impersonate an American military veteran to attract members from the QAnon and MAGA communities, according to a recent report by Tech Radar.
The threat actor created the public Telegram channel, @americanpatriotus, shortly after the Capitol riot in 2021. The channel targeted members of the MAGA and QAnon communities who had been excluded from mainstream social media. The actor used a jailbroken version of Google Gemini, bypassing ethical safeguards by issuing prompts in Russian, to ingest news articles and automatically populate the channel with content. This AI was also used to assist in credential theft and fraud campaigns.
The actor claimed to be an "authorised pentester" and used the AI to find "hidden angles" related to control and financial manipulation. The campaign likely cost the threat actor near-zero due to the use of 73 stolen API keys. The actor distributed a remote-access trojan (RAT) and employed AI-assisted password brute-forcing, compromising 29 WordPress admin credentials, infiltrating a company, and stealing cryptocurrency.
Source: Tech Radar
