AI is speeding up existing attacks
Although AI is yet to displace traditional attack methods, a range of security vendors report that attackers are using AI to make existing techniques faster and more convincing, while also allowing them to operate at greater scale.
“It [AI] can help write phishing messages and automate reconnaissance, while also supporting faster vulnerability discovery and more realistic impersonation attempts,” says Patricia Leppert, team manager of customer trust and security at TeamViewer.
But attackers are also using AI to build malware and related tooling.
eSentire Threat Research Unit reports logging signs of AI-assisted development by attackers ranging from ransomware affiliates to a North Korean cyberespionage group.
“Attackers use large language models (LLMs) such as ChatGPT, Claude, and DeepSeek to write loaders, droppers, admin panels and scripts, to convert code between languages, and to write social-engineering text,” says Spence Hutchinson, senior manager of intelligence research at eSentire. “They get past the models’ safeguards through jailbreaking, or through stolen and resold accounts.”
Attackers adopting modern development techniques
Malware developers are also using modern software development practices. For example, security vendor Barracuda reports a growing use of modern programming languages such as Rust and Go in malware, especially ransomware binaries.
“These languages allow developers to build malware that is more portable and easier to adapt across operating systems,” explains Christine Barry, senior chief cybersecurity storyteller and content manager for the office of the CTO at Barracuda. “Rather than maintaining separate malware families for Windows, Linux, and virtualization environments, threat actors can support multiple platforms from a common code base.”
Agentic AI enters the fray
Attackers are already using generative AI to create phishing emails, write malicious code, and accelerate social-engineering attacks. But agentic AI will push their capabilities further by combining LLMs with tools, memory, and decision-making capabilities that enable a malicious system to plan actions, adapt to obstacles, and pursue objectives autonomously.
JadePuffer offers a recent example of such an agentic AI attack.
“This attack conducted reconnaissance, adapted to changing conditions, harvested credentials, moved through the target environment, and carried out destructive actions with limited evidence of human interaction or control,” Barracuda’s Barry says. “Researchers also observed JadePuffer modifying its behavior when it encountered problems, allowing the attack to adapt to conditions that might interrupt a scripted attack.”
Depreciated malware techniques
Some noticeable trends reflect a “downturn” for malware and hacking techniques that have fallen out of fashion, mainly because their effectiveness has decreased due to advances in security defenses.
For example, threat actors rely more on legitimate admin tools — such as Sysinternals Suite and living-off-the-land binaries (LOLBins) — for evasion and persistence, and less on malicious executables.
“On the hacking tool front, we observed a decrease in the use of more comprehensive tool suites like Cobalt Strike and Sliver,” says O’Donnell-Welch of Huntress. “However, threat actors continue to use specialized tools like Mimikatz and CrackMapExec for functionalities like password sniffing, memory dumping, privilege escalation, and lateral movement.”
Other once popular techniques that have fallen out of favor include:
- Network worms, such as Conficker, because modern networks now feature segmentation, automated patching, and strong endpoint defenses, all of which limit worm propagation
- Traditional botnets
- Exploit kits, which were once a prevalent method for delivering malware through web-based attacks by scanning users’ systems for known vulnerabilities in software such as Adobe Flash, Java, or Internet Explorer, and then exploiting those weaknesses to install malware
- Office macros
- USB-based malware
