Volexity put out a report about likely GenAI being used in cyber attacks by China... and it contains IOCs! It's a good report.

It has all the low hanging fruit classics defenders have been aware of forever, e.g. .rar files with .exe files inside, all of the "GenAI malware" was detected out of the box across all leading vendors etc etc.

Also the payloads contain unique phrases (and Wav files, lol) which made them easy to detect.

https://www.volexity.com/blog/2025/10/08/apt-meets-gpt-targeted-operations-with-untamed-llms/