APT groups from China, North Korea, and Iran use Google Gemini for reconnaissance, malware coding, and phishing campaigns, Google GTIG reveals.