GTIG — Iranian APT42 used Gemini extensively across attack lifecycle
Date: 2025-01
Affected: Google Gemini; Western think-tanks, journalists, defense
Attack vector: tool-abuse
Category: threat-report
Severity: High

Google's Threat Intelligence Group reported Iranian APT42 (CALANQUE / Charming Kitten) as the heaviest Iranian Gemini user, leveraging the model for reconnaissance on defense organisations, drafting phishing campaigns targeting Western think-tanks and journalists, translating English/Persian, and assistance with vulnerability research.


Mitigations:

Architectural layers (MAESTRO):