Key takeaways
- Leverage AI has transformed aspiring hackers into more sophisticated and capable threats.
- Utilize AI tools to streamline malware creation and enhance the efficiency of cyberattacks.
- Recognize the growing risk of complex attacks that exploit social engineering and deepfake technology.
- Understand that traditional security measures may struggle against advanced AI-driven hacking techniques.
- Stay vigilant against insider threats that may enable hackers to execute their plans more effectively.
Advancements in AI have proven to be a double-edged sword. While they have provided security teams with much-needed relief from an overwhelming volume of reports, they have also enabled hackers to expand their scale of attacks more efficiently.
Before the rise of AI, anyone who wanted to be a hacker—especially those with malicious intent—relied heavily on the scripts available on the Internet, often with little understanding of how they actually worked.
Now, with AI in the picture, aspiring hackers can easily craft sophisticated tools and materials needed for successful attacks.
But what exactly are these hackers doing, and how are they using AI to support malicious activities?
The Use of Hacking Assistants and Deepfakes
Dean Teffer, vice president of AI at Arctic Wolf, told AIM that there can be hacking assistants just like there are coding assistants. “So you can use AI to find attacks, help write malware, and do that faster,” he added.
While Teffer acknowledged the existence of systems capable of detecting new malware, he suggested this may be a smaller concern. The greater threat lies in more complex attacks, particularly involving social engineering.
He shared an example of a series of casino attacks in the US from a year or two ago, where hackers managed to steal the credentials of an IT staff member in the casino. Using SIM swapping, the hacker turned their phone into the administrator’s, granting them access and control.
The hacker was able to perform SIM swapping because of social engineering.
He pointed out that the malicious actor may have had insider help, but with AI-driven deepfakes now in play, social engineering has become even easier. For example, a hacker could make it appear as though someone’s boss is speaking to them on a Zoom call, when in reality, it’s a deepfake.
Teffer expressed concern that even individuals with limited tech expertise can now use AI to generate convincing deepfakes and extract credentials, making these attacks much harder to detect. In such scenarios, cybersecurity firms like Arctic Wolf must offer comprehensive service solutions that go beyond traditional defences.
Addressing these concerns, Teffer told AIM, “Cybersecurity is kind of fun. It's fun because it's adversarial, but it's also hard because of that. There are always new attacks hackers are doing.”
Credible Phishing Attempts and Low Bar for Coding
Jeff Green, senior vice president of engineering at Arctic Wolf, mentioned business email compromises and told AIM, “It is now a lot easier to create phishing-type attacks and make them more credible, especially if they're in a non-native language.”
He pointed out that hackers in China or Russia, who may not be proficient in the English language, can still make a convincing phishing attempt using emails because of AI.
Green emphasised that the use of AI in such malpractices has made it difficult for the average user to spot the phishing attempts.
He also drew a comparison to malicious groups from a decade ago that focused on building toolkits to help build malware easily. Now, however, AI can perform many of those things, effectively lowering the coding bar for such activities.
Not to forget, the existence of AI coding tools has also helped hackers launch a new form of attack.
AI is Reshaping Online Crimes
A recent research report from the Centre for Emerging Technology and Security (CETaS) has shed light on how AI is being increasingly used by criminals.
The report mentioned use cases in areas such as financial crime, phishing, distributed denial of service (DDoS) attacks and romance scams. It further stated that AI has accelerated the process of automating and rapidly scaling the volume of criminal activity.
Tinkerers on the internet have also demonstrated AI agents capable of cybercrime, where Claude helped design a ransomware. Tools like WormGPT have been known to help cybercriminals in business email compromise attacks.
Fortunately, cybersecurity companies like Arctic Wolf are also harnessing AI to combat emerging threats. The ongoing war between cybersecurity protectors and hackers may well have been amplified by the advent of AI.
