AI Now Integral to Every Stage of Cyberattacks
In a significant shift within the cyber threat landscape, artificial intelligence has transitioned from being a supplementary tool for hackers to a core element in every stage of cyberattacks. According to a report released by cybersecurity firm Check Point, AI is now involved in identifying targets, exploiting vulnerabilities, and stealing data, marking a notable evolution in the capabilities of cybercriminals.
Previously, AI was primarily used for specific tasks such as probing targets and troubleshooting malicious code. However, recent observations indicate that AI systems are now generating commands and testing vulnerabilities autonomously, allowing hackers to execute thousands of commands with less oversight than before. This development suggests that AI is becoming an integral part of the intrusion process, rather than merely an occasional aid.
Check Point's findings reveal that criminal groups have begun to utilize AI as a primary operator in their operations, breaching government agencies and other targets at scale. The report notes that the role of AI in these attacks is often uncovered through the attackers' mistakes or monitoring by AI providers, rather than through the defenses of the victim organizations.
Hackers are leveraging both open-source models and specialized malicious AI tools available on the dark web, although major commercial AI providers remain their preferred choice. For instance, the Gentlemen ransomware group has incorporated AI into their operations, selecting models based on the fewest restrictions and using AI to develop internal tools quickly. One notable example is the VoidLink toolkit, which was initially thought to require a team of developers months to create, but was actually produced by a single developer in under a week using a commercial AI coding tool.
While hackers often prefer U.S.-based AI models like ChatGPT for their superior output quality, they face challenges due to the stronger safeguards designed to prevent misuse. When these attempts fail, they tend to turn to Chinese AI platforms, which have fewer restrictions. The report highlights that Chinese AI models are becoming increasingly capable and popular among cybercriminals, particularly as Beijing considers limiting access to advanced models for national security reasons.
The report also discusses the implications of these developments for U.S. government and critical infrastructure targets, noting an increase in exploitation attempts driven by AI's speed and geopolitical tensions. The Cybersecurity and Infrastructure Security Agency (CISA) has responded by updating its remediation timelines for security flaws, aiming to address vulnerabilities more swiftly in light of the evolving threat landscape.
As AI continues to advance, the pace at which vulnerabilities are exploited has accelerated dramatically. The report emphasizes that a vulnerability can now become a working exploit within hours of its disclosure, and phishing campaigns can be executed at a scale and quality beyond human capabilities. This rapid evolution poses significant challenges for security teams, who struggle to keep pace with AI-driven threats.
In response to these challenges, the Trump administration has tasked federal agencies, including the National Security Agency and CISA, with developing a classified process to benchmark the advanced cyber capabilities of frontier AI models and identify systems requiring additional scrutiny. The ongoing developments in AI technology underscore the urgent need for enhanced cybersecurity measures to counteract the growing sophistication of cyberattacks.
