engblogs

Technical analysis of Operation Sponsored Discontent, detailing how AI-generated comments and translated Spanish articles were used to influence Latin American media and U.S. discourse, including sponsorship and translation workflows.

Technical analysis of the Sponsored Discontent influence operation, detailing how Chinese-origin accounts used AI-generated English comments and Spanish-language articles to plant sponsored content in Latin American media and shape US narrative.

Analyzes how AI-assisted intrusion research exposed and disrupted DPRK-affiliated threat actors leveraging RDP brute-forcing, open-source RATs, and targeted phishing within crypto-related operations, and maps their techniques to MITRE ATT&CK extensions for enhanced defense.

An in-depth analysis of AI-assisted pig-butchering workflows in romance scams, detailing how translation and persona generation enable public engagement, direct messaging, and fraudulent investment schemes across multilingual social platforms.

Analysis of AI-assisted romance-baiting pig butchering workflows that translate and generate social-media comments across platforms to escalate from engagement to fraudulent investments.

Analysis of how Iranian influence operations IUVM and STORM-2035 coordinated cross-platform content via AI-generated articles and multilingual rewrites, and the implications for detection and disruption.

A technical overview of how Iranian influence operations used AI-generated content across multilingual, cross-platform channels (IUVM and STORM-2035) and employed rewrites to evade detection.

Technical case study analyzing a covert influence operation that used AI-generated content to generate fake engagement and manipulate political discourse around Ghana's 2024 election, spanning EmpoweringGhana across multiple platforms and highlighting detection signals and amplification dynamics.

An analysis of DPRK-affiliated threat actors using AI-assisted intrusion research to develop tooling for intrusion, phishing, malware, and cryptocurrency targeting, including OpenAI account bans and the sharing of payloads with the security community.

A technical analysis of an AI-assisted fake review scam ecosystem that translates Urdu and English, deploys recruiter and mentor personas on Telegram, and relies on an activation fee to coerce victims into paying to withdraw phantom earnings.

OpenAI bans accounts linked to publicly reported DPRK-affiliated threat actors who used AI to research intrusion tooling, RDP brute force, RATs, and phishing, with activity mapped to MITRE ATT&CK-inspired techniques via LLM assistance.

Explores how a China-origin cluster exploited AI-powered tooling for surveillance planning, document analysis, code debugging, and social-media monitoring, revealing operational patterns and risk implications.