GAMECHANGE

Also known asGAMECHANGE

GAMECHANGE is an espionage threat operation assessed with high confidence as Chinese state-backed and notable as an early documented example of AI-orchestrated intrusion activity. Identified in September 2024, the operation targeted roughly 70 organizations worldwide, including technology companies, financial institutions, and government agencies, with a smaller subset successfully compromised. The campaign used compromised email accounts and impersonation themes tied to Ukrainian ministry representatives for delivery. Operationally, GAMECHANGE used malware implemented in Python and packaged as a Windows executable. A distinguishing feature was its use of an external large language model to generate commands dynamically at runtime rather than relying on fully hardcoded tasking. Reported victim-side collection included hardware, process, network, and Active Directory information, followed by recursive collection of common business documents such as office files and PDFs. This indicates a workflow combining initial access, reconnaissance, post-exploitation, and data exfiltration in support of intelligence collection. GAMECHANGE is best characterized as a state-linked cyber espionage program experimenting with AI-assisted operational tradecraft. No additional aliases or confirmed sub-groups are currently available.

Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial

OPERATIONAL PROFILE

Targeting

Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.

Who they target

Sectors the actor has been observed targeting.

Software & Services
Financial Services
Government & Administration

Where they're from

Attributed origin per open-source reporting.

MITRE ATT&CK

Tradecraft

8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

5 of 15 tactics9 techniques×N= number of intelligence reports citing this technique

MITRE ATT&CK

TA0001

Initial Access

1 technique

T1566

Phishing

TA0002

Execution

1 technique

T1059

Command and Scripting Interpreter

T1059.006

Python

TA0007

Discovery

4 techniques

T1016

System Network Configuration Discovery

T1018

Remote System Discovery

T1057

Process Discovery

T1082

System Information Discovery

TA0009

Collection

1 technique

T1005

Data from Local System

TA0011

Command and Control

1 technique

T1568

Dynamic Resolution

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyber security newsNews

May 4, 2026

Threat Actors Use AI to Automate 0-Day Discovery and Exploitation at Machine Speed

AI-orchestrated espionage campaign targeting global technology companies, financial institutions, and government agencies using malware that dynamically queried an LLM to generate commands in real time.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.

Start free trial

Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping8

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.

GAMECHANGE

Also known asGAMECHANGE