Google's Threat Intelligence Group (GTIG) reports that over ten Iranian state-backed groups are actively using the Gemini AI model for cyberattacks. These actors represent the largest nation-state demographic currently exploiting the platform.
Data indicates that Iranian operations account for approximately 75% of all AI-assisted disinformation efforts observed by Google. The most active group, APT42, which is linked to the Islamic Revolutionary Guard Corps, is responsible for over 30% of this activity.
The groups utilize Gemini for reconnaissance, phishing, code development, and creating photorealistic fake identities. Google notes that these tools serve as productivity multipliers for existing tactics rather than creating new attack methods.
Google first identified this trend in a January 2025 report. Recent observations show APT42 using the model for research shortly before conflict escalations in late February 2026, aligning AI usage with geopolitical events.
