From Text to MITRE Techniques: Exploring the Malicious Use of Large Language Models for Generating Cyber Attack Payloads
Open accessAbstract
This research article critically examines the potential risks and implications arising from the malicious utilization of large language models(LLM), focusing specifically on ChatGPT and Google's Bard. Although these large language models have numerous beneficial applications, the misuse of this technology by cybercriminals for creating offensive payloads and tools is a significant concern. In this study, we systematically generated implementable code for the top-10 MITRE Techniques prevalent in 2022, utilizing ChatGPT, and conduct a comparative analysis of its performance with Google's Bard. Our experimentation reveals that ChatGPT has the potential to enable attackers to accelerate the operation of more targeted and sophisticated attacks. Additionally, the technology provides amateur attackers with more capabilities to perform a wide range of attacks and empowers script kiddies to develop customized tools that contribute to the acceleration of cybercrime. Furthermore, LLMs significantly benefits malware authors, particularly ransomware gangs, in generating sophisticated variants of wiper and ransomware attacks with ease. On a positive note, our study also highlights how offensive security researchers and pentesters can make use of LLMs to simulate realistic attack scenarios, identify potential vulnerabilities, and better protect organizations. Overall, we conclude by emphasizing the need for increased vigilance in mitigating the risks associated with LLMs. This includes implementing robust security measures, increasing awareness and education around the potential risks of this technology, and collaborating with security experts to stay ahead of emerging threats.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Charan et al. (2023) shows high efficiency of LLMs by generating executable code for the top 10 MITRE weaknesses observed in 2022 using ChatGPT and Bard.
“This study shows the high efficiency of LLMs by generating executable code for the top 10 MITRE weaknesses observed in 2022 using ChatGPT and Bard respectively.”
From When LLMs meet cybersecurity: a systematic literature review (2025) · cites this paper as Charan et al. (2023)
The Our Approach section says the authors generated and executed code for the top 10 prevalent MITRE *techniques* observed in 2022 using ChatGPT and Bard. But the Discussion reports that Bard produced incomplete or inconsistent code for some techniques and was less effective than ChatGPT, so the claim of high efficiency for both models overstates the findings. The paper calls these techniques, not weaknesses. (LLM, conf=0.86)
Experimental — accuracy not yet measuredLLM-generated payloads tend to be more complex and targeted than manually crafted payloads.
“In addition, LLM-generated payloads tend to be more complex and targeted than manually crafted payloads.”
From When LLMs meet cybersecurity: a systematic literature review (2025) · cites this paper as Charan et al. (2023)
The Abstract and §1.1 say LLMs can enable more sophisticated, targeted attacks. They do not compare LLM-generated payloads with manually crafted payloads, and they frame the effect as a potential rather than an observed tendency. (LLM, conf=0.86)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
The citation lists haven’t been fetched yet
Cited by 25
Research works printed but not linked: 10
- Zhuo, Terry Yue, et al. "Exploring ai ethics of chatgpt: A diagnostic analysis." arXiv preprint arXiv:2301.12867 (2023). · arXiv
- Haleem, Abid, Mohd Javaid, and Ravi Pratap Singh. "An era of ChatGPT as a significant futuristic support tool: A study on features, abilities, and challenges." BenchCouncil transactions on benchmarks, standards and evaluations 2.4 (2022): 100089.
- THE RED REPORT 2023: https://www.picussecurity.com/resource/blog/ the-red-report-2023-top-ten-attack-techniques 14. Mijwil, Maad, and Mohammad Aljanabi. "Towards Artificial Intelligence-Based Cybersecurity: The Practices and ChatGPT Generated Ways to Combat Cyber- crime." Iraqi Journal For Computer Science and Mathematics 4.1 (2023): 65-70.
- Putrevu, Mohan Anand, Venkata Sai Charan Putrevu, and Sandeep Kumar Shukla. "Early Detection of Ransomware Activity based on Hardware Performance Coun- ters." Proceedings of the 2023 Australasian Computer Science Week. 2023. 10-17.
- Budzianowski, Pawe l, and Ivan Vulić. "Hello, it's GPT-2-how can I help you? towards the use of pretrained language models for task-oriented dialogue systems." arXiv preprint arXiv:1907.05774 (2019). · arXiv
- Charan, PV Sai, et al. "DOTMUG: a threat model for target specific APT at- tacks-misusing google teachable machine." 2022 10th International Symposium on Digital Forensics and Security (ISDFS). IEEE, 2022.
- Shi, Jiawen, et al. "BadGPT: Exploring Security Vulnerabilities of ChatGPT via Backdoor Attacks to InstructGPT." arXiv preprint arXiv:2304.12298 (2023). · arXiv
- chatGPT confirms data breach: https://securityintelligence.com/articles/ chatgpt-confirms-data-breach/ 26. chatGPT poses cyber security conerns: https://hbr.org/2023/04/ the-new-risks-chatgpt-poses-to-cybersecurity 27. Derner, Erik, and Kristina Batistič. "Beyond the Safeguards: Exploring the Secu- rity Risks of ChatGPT." arXiv preprint arXiv:2305.08005 (2023). · arXiv
- Anand, P. Mohan, PV Sai Charan, and Sandeep K. Shukla. "A comprehensive API call analysis for detecting Windows-based ransomware." 2022 IEEE International Conference on Cyber Security and Resilience (CSR). IEEE, 2022.
- Sebastian, Glorin. "Do ChatGPT and Other AI Chatbots Pose a Cybersecurity Risk?: An Exploratory Study." International Journal of Security and Privacy in Pervasive Computing (IJSPPC) 15.1 (2023): 1-11.
- Authors
- Charan, P. V. S., Chunduri, H., Anand, P. M., & Shukla, S. K.
- Affiliations
- Indian Institute of Technology Kanpur (IN)
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2023
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2305.15336
- OpenAlex
- W4378474356
- Cited by
- 25
- References
- 0
- Citations by year
- 2025: 5 · 2024: 12 · 2023: 8
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- arXiv (Cornell University) (submittedVersion, cc-by)
- arXiv (Cornell University) (cc-by)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Signal Processing › Advanced Malware Detection Techniques
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Keywords
- large language models, malicious use of AI, ChatGPT, Google Bard, code generation, ransomware, offensive security, penetration testing, cybercrime, AI-generated malware
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
