As businesses race to incorporate AI into their workflows, hackers have also found the technology useful for understanding their targets and bypassing the social and technical barriers that stymied their past attacks.<\/p>\n
The Iran-linked hacking team Charming Kitten, for example, \u201clikely\u201d used AI to generate messages as part of a 2024 phishing campaign against U.S. and European organizations, CrowdStrike said. Another group, which CrowdStrike called \u201cReconnaissance Spider,\u201d almost certainly used AI to translate one of its phishing lures into Ukrainian when it reused old messages after their initial deployment. The attackers forgot to remove the AI model\u2019s boilerplate prompt-response sentence from the text they copied.<\/p>\n
AI is also helping the North Korea-linked hacker team \u201cFamous Chollima\u201d (also tracked as UNC5267) sustain \u201can exceptionally high operational tempo\u201d of more than 320 intrusions in a year, the report said. The group is known for masterminding North Korea\u2019s remote IT-worker fraud schemes, which funnel stolen money to Pyongyang and sometimes lead to the theft of victim businesses\u2019 confidential data.<\/p>\n
The hackers have been able to \u201csustain this pace by interweaving GenAI-powered tools that automate and optimize workflows at every stage of the hiring and employment process,\u201d CrowdStrike said. AI has helped the hackers draft r\u00e9sum\u00e9s, manage job applications and conceal their identities during video interviews, researchers found.<\/p>\n
AI is also a top target for hackers as companies scramble to adopt the technology and often forget to secure it. \u201cThreat actors are using organizations\u2019 AI tools as initial access vectors to execute diverse post-exploitation operations,\u201d CrowdStrike said, citing the exploitation in April of a vulnerability in Langflow\u2019s AI workflow development tool, which helped hackers burrow into networks, commandeer user accounts and deploy malware.<\/p>\n