Generative Pre-trained Transformers (GPTs) like OpenAI's ChatGPT are revolutionising industries across the board. From writing emails to creating educational content, they're powerful tools built to understand and generate human-like text. But the same tech that makes GPTs useful also makes them risky, particularly for cybersecurity.

In February 2024, Microsoft and OpenAI spotted several state-backed hacking groups from Russia, North Korea, Iran, and China using GPTs to improve their exploitation tactics. The Strontium group, linked to Russian military intelligence, has been found using large language models (LLM’s) to understand satellite communication protocols, radar imaging technologies, and other sensitive miliatry information.

But GPTs can also be misused in everyday cybercrime and by employees or contractors who have access to sensitive data.

‍

How GPTs can be weaponised in everyday cybercrime

• Phishing: GPTs can generate convincing phishing emails that mimic real writing styles, making it more difficult to spot and harder for filters to block.
• Social engineering: these models can be used in live chats, like customer support, to trick people into giving up sensitive information. Connected to text-to-speech tools, they could also be used in voice scams.
• Malware code generation: even with filters in place, attackers can trick GPTs into writing malicious code.
• Data leakage: when employees input sensitive company information into these models, that data gets stored and could be leaked back to others.
• Misinformation: GPT’s can 'hallucinate', which means they present false information portrayed as fact. When spread, this can lead to real-world consequences such as political confusion or interference during a crisis.

_{How DPG overcame last-minute delays to get online in 3 weeks}

Anyone who’s managed an office move understands how much coordination it takes: logistics, tight deadlines, suppliers to manage, all while keeping the day job going. But when your internet provider, a well-known legacy player, lets you down just weeks before your move, things can get really stressful.

Three months to get connected – but the provider stalled

DPG is a specialist social justice law firm. With a team of 80, they rely on secure, fast connectivity to manage sensitive legal work.

They gave their internet provider three months’ notice to install a leased line at their new office. But as the move-in date approached, the provider asked for a further 60-day extension.

With just six weeks left to go before staff were due to move in, DPG had no choice but to cancel their contract and find a new supplier.