ไทย
English
AI is transforming the cybersecurity landscape as cyberattacks continue to become more severe and increasingly sophisticated. AI is often regarded as a double-edged sword because organizations can use it to enhance threat detection and cybersecurity defense, while cybercriminals use AI to launch attacks more quickly, scale them across a wider range of targets, and evade traditional Signature-based Detection systems, resulting in a growing number of cyber threats. Today, many organizations are increasingly adopting Cloud and Internet of Things (IoT) technologies in their operations, enabling a broader range of connected devices and systems. As a result, cybercriminals have more attack vectors than ever before, further increasing cybersecurity risks when AI is leveraged in cyberattacks.
In this article, BMSP will introduce AI-powered Attacks, covering their definition, how AI-powered Attacks enhance the effectiveness of cyberattacks, examples of threats that organizations should pay attention to, real-world incidents, and practical approaches to responding to them. The goal is to help organizations better prepare for AI-driven cyber threats effectively.
Table of Contents
What is an AI-powered Attack?
An AI-powered Attack, also referred to as an AI-driven cyberattack, is a cyberattack in which hackers use Artificial Intelligence (AI) and Machine Learning to enhance the effectiveness of their attacks. This includes supporting various stages of an attack, such as planning, vulnerability discovery, deceiving victims, system intrusion, evading detection, and automating attack execution. As a result, attacks can be carried out more quickly, on a larger scale, and become more difficult to detect. This may lead to data breaches, system disruptions, and damage to an organization’s reputation.
To better understand how AI is used in cyberattacks, the following are examples of AI applications in cyberattacks, based on the research paper Artificial Intelligence (AI) Cybersecurity Dimensions, which BMSP has referenced. These examples also explain why organizations should pay close attention to this emerging cyber threat.
- Automation
Hackers use AI to automate multiple stages of cyberattacks, enabling them to scale attacks across a larger number of targets while reducing the time required. Examples include vulnerability scanning, sending phishing emails, and launching attacks against multiple targets simultaneously.
- Exploit Development
AI helps analyze system vulnerabilities and accelerates the development of attack methods or exploit code used to take advantage of those vulnerabilities.
- Credential Theft
AI increases the likelihood of successfully stealing usernames, passwords, or other credentials through techniques such as phishing, password guessing, or analyzing leaked data.
- Information Gathering
AI can collect and analyze information from various sources, such as websites, social media platforms, or publicly available information (Open-source intelligence: OSINT), to study targets before launching an attack.
- Social Engineering
AI helps generate highly realistic and target-specific messages, emails, or other content. It can also create deepfakes to increase the likelihood of deceiving victims.
- Campaign Resilience
AI enables attack campaigns to adapt their techniques or methods when they are detected, allowing attacks to continue and increasing their chances of success.
- Stealth
AI helps modify the behavior or patterns of cyberattacks to evade detection by security solutions, such as Signature-based Detection or other traditional detection systems.
An AI-powered Attack is not the name of a specific type of cyberattack. Instead, it refers to the use of AI to enhance cyberattacks in multiple aspects, including automation, vulnerability discovery, credential theft, information gathering, social engineering, campaign resilience, and detection evasion. These capabilities make cyberattacks more sophisticated and more difficult to defend against than traditional attacks.
Why Should Organizations Pay Attention to AI-powered Attacks?
AI-powered Attacks do not only affect IT systems but also have a direct impact on business operations, financial performance, and an organization’s reputation. As attackers use AI to enhance the effectiveness of cyberattacks, organizations face a greater risk of experiencing cybersecurity incidents that can cause significant damage. The following are some examples of the potential impacts.
1. Operational Disruption
AI-powered Attacks can enable cyberattacks to be carried out rapidly and automatically, causing critical organizational systems, such as production systems, customer service systems, or Cloud systems, to become disrupted within a short period of time. When these systems are unable to operate normally, organizations may experience downtime, service delays, and revenue loss resulting from business interruptions. This directly affects operational efficiency and business continuity.
2. Economic & Financial Loss
AI-driven attacks not only damage information systems but also have financial consequences for organizations. Organizations may incur costs related to system recovery, security incident investigations, and Incident Response, as well as lose revenue when business operations cannot continue as usual. As attackers use AI to increase the speed and scale of cyberattacks, the resulting economic and financial losses are also likely to increase.
3. Data Breach
AI enhances the ability to discover vulnerabilities, gather information, and steal credentials, making it easier for attackers to gain access to an organization’s sensitive information. This may include customer data, employee information, financial data, or intellectual property. The exposure of such information can result in legal consequences, incident response costs, and a loss of trust among customers and stakeholders.
4. Reputational Damage
Research indicates that one of the significant impacts of AI-powered Attacks is the erosion of public trust and damage to an organization’s reputation. When a data breach or service disruption occurs, customers, business partners, and stakeholders may lose confidence in the organization’s operations. This can negatively affect the organization’s brand image, business relationships, and long-term competitiveness.
5. Critical Infrastructure Impact
In addition to affecting individual organizations, AI-powered Attacks may also impact critical infrastructure and essential services, such as healthcare systems, transportation systems, energy systems, and public services. If organizations responsible for these critical infrastructures are attacked, public services may be disrupted, affecting public safety, the economy, and society’s daily life on a broader scale.
AI-powered Attacks do not merely increase the speed or effectiveness of cyberattacks; they also amplify their business impact across multiple dimensions. Therefore, organizations should implement cybersecurity measures that can effectively detect, analyze, and respond to emerging cyber threats.
Real-World Examples of AI-powered Attacks
After understanding the concept and capabilities of AI-powered Attacks, the next question is whether these threats have actually affected organizations. The answer is yes. They have already occurred and have caused tangible damage, ranging from fraudulent fund transfers worth tens of millions of dollars to AI tools specifically modified to support cybercrime. The following real-world case studies demonstrate that AI-powered Attacks are not merely a theoretical concept but a cybersecurity threat that organizations around the world are facing today.
1. Deepfake Fraud in the Arup Case, Hong Kong (January 2024)
A finance employee at Arup, a British multinational engineering company, received an email claiming to be from the Chief Financial Officer (CFO), requesting a confidential financial transaction. Although the employee initially suspected that the email might be fraudulent, those concerns were eased after joining a video conference in which the CFO and several colleagues appeared to be present. In reality, everyone in the video call was an AI-generated deepfake created using publicly available videos and audio recordings of the actual executives. As a result, the employee completed 15 money transfers totaling more than HK$200 million (approximately US$25.6 million) before discovering the fraud after contacting the company’s headquarters.
2. Deepfake Voice Impersonation in the Ferrari Case (July 2024)
A senior executive at Ferrari received a WhatsApp message claiming to be from CEO Benedetto Vigna, requesting urgent assistance with a confidential acquisition. This was followed by a phone call using an AI-generated voice that closely imitated the CEO’s Italian accent. However, the executive became suspicious and asked a question about a book that the real CEO had recently mentioned. The caller was unable to answer and immediately ended the call, allowing the organization to avoid potential financial losses.
3. AI Tools for Cybercrime: WormGPT and FraudGPT
WormGPT and FraudGPT are Generative AI tools specifically modified for cybercrime. They can assist in writing phishing emails and developing malicious code. These tools first appeared in 2023. Although the original versions were shut down after being exposed by the media, similar tools have continued to emerge to this day. This reflects the ongoing demand among cybercriminals to use AI to reduce the time and technical expertise required to carry out cyberattacks.
4. AI-Generated and Personalized Phishing
Generative AI has been used to create phishing emails and messages with accurate grammar, natural language, and personalized content tailored to individual victims by utilizing information from public profiles or leaked data. As a result, these phishing messages are much more difficult to distinguish from legitimate communications than traditional phishing attempts, which often contain spelling mistakes or unnatural language. Consequently, recipients are more likely to trust these messages and click on malicious links.
These four cases demonstrate that AI-powered Attacks have already caused real damage to organizations worldwide, from deepfake scams that are nearly impossible to distinguish with the naked eye to AI tools that enable cybercriminals with limited technical expertise to carry out effective attacks. Notably, the Ferrari case illustrates that organizations can defend against these threats not only through advanced technologies but also through strong identity verification processes and employee awareness training that encourages staff to question unusual requests, even when they appear highly convincing. Therefore, organizations should combine both process-based and technology-based security measures to effectively address AI-driven cyber threats, which are expected to become increasingly sophisticated in the future.
How Organizations Can Defend Against AI-powered Attacks
AI-powered Attacks are transforming the cyber threat landscape, making cyberattacks more difficult to detect. Organizations should adapt their cybersecurity strategies to provide comprehensive protection by strengthening their capabilities in threat detection, analysis, and incident response. These measures enable organizations to assess risks more effectively and develop appropriate response strategies. The following are key recommendations.
1. AI-based Intrusion Detection and Anomaly Detection
AI-powered cyberattacks are often complex and capable of adapting their behavior to evade detection. Implementing AI-based Intrusion Detection and Anomaly Detection enables organizations to learn normal user and system behavior while detecting anomalies that may indicatecyberattacks in real time. This allows organizations to respond to incidents more quickly before the damage escalates.
2. Threat Intelligence
Threat Intelligence is the process of collecting, analyzing, and monitoring information about cyber threats from multiple sources to assess risks and anticipate potential attack patterns. Leveraging Threat Intelligence enables organizations to implement preventive measures in advance and continuously improve their security posture to address emerging threats where AI may be used to support cyberattacks.
3. Multi-factor Authentication (MFA) and Access Control
AI-powered Attacks often involve Credential Theft or attacks targeting user accounts. Implementing Multi-factor Authentication (MFA) together with Access Control based on the Principle of Least Privilege helps reduce the likelihood of unauthorized access, even if attackers obtain user passwords or account credentials.
4. Encryption
Encryption protects sensitive information by ensuring that data cannot be read or used if it is intercepted or exposed. Even if attackers gain access to encrypted data, the information remains protected without the appropriate decryption key. This helps reduce the impact of Data Breaches and attacks targeting an organization’s sensitive information.
5. Security Awareness
Although organizations may implement advanced cybersecurity technologies, employees remain one of the primary targets of AI-powered Attacks, particularly through Social Engineering, AI-generated Phishing, and Deepfake attacks. Therefore, organizations should provide continuous cybersecurity awareness training to help employees recognize and avoid emerging cyber threats.
6. Human–AI Collaboration
While AI can rapidly analyze data and detect cyber threats, decision-making in complex security incidents still requires the expertise of cybersecurity professionals. Collaboration between AI and human experts improves the accuracy of threat analysis, reduces false alerts, and enhances the effectiveness of security incident response.
7. SIEM (Security Information and Event Management)
SIEM (Security Information and Event Management) is a platform that collects security logs and event data from various devices and systems across an organization into a centralized location. It then analyzes event correlations, detects abnormal behavior, and generates alerts when potential security threats are identified. Integrating SIEM with AI-based Detection and Threat Intelligence provides organizations with greater visibility into the overall threat landscape and enables faster and more effective detection and response to AI-powered Attacks.
These approaches help organizations strengthen their capabilities to detect, prevent, and respond to AI-powered Attacks more effectively, reduce the likelihood of attackers gaining access to critical systems or sensitive information, minimize the potential impact of cybersecurity incidents, and support business continuity in the face of increasingly sophisticated cyber threats.
BMSP is Ready to Help Organizations Defend Against AI-powered Attacks
AI has become both a weapon used by cybercriminals and a defensive tool for organizations. Addressing AI-powered Attacks is no longer something organizations can manage alone. It requires cybersecurity experts and security solutions capable of addressing a wide range of evolving cyber threats.
BMSP is ready to help organizations defend against AI-powered Attacks by providing comprehensive cybersecurity solutions tailored to different business requirements. These include SIEM, which collects and analyzes security data in real time, Threat Intelligence, which helps organizations identify emerging cyber threats in advance, as well as other cybersecurity services and solutions designed to help organizations prevent, detect, and respond to AI-driven cyber threats.
If your organization is looking to strengthen its cybersecurity posture or is unsure where to begin, BMSP is ready to provide expert consultation and design security solutions tailored to your organization’s specific requirements and budget. Our goal is to help you build a strong cybersecurity foundation that is prepared for future cyber risks.
Contact BMSP today to receive expert guidance and an initial cybersecurity risk assessment.
