Incident Responders & Threat Analysts - Undocumented AI-Run Intrusions

Everyone wants to know how attackers use AI. Most answers describe what AI could do. I went looking for what it actually did. In June, at BlueHat, I watched VoidLink get taken apart. A malware framework built with AI, in weeks. The talk was about how it was built. I left thinking about what we do with what we now know. So for the third of four pieces from Babel's data, I followed the AI. Fifteen months of dated reporting, 342 reports, every documented case read by hand. 19 investigations hold up. AI did not give attackers new moves. It gave them new tools, better lies and a faster hand. A C2 framework in weeks. A ransomware brand whose victims were all invented, none of them ever breached. An agent that moved a botnet to new infrastructure in six minutes. In every case, a human set the task and stayed at the keyboard. For defenders, that breaks three habits. Trusting a signature to last. Trusting a user to spot a bad lure. Assuming there is time. In the spirit of the subject, AI helped me write this post. Don't worry, I was at the keyboard the whole time. So were the attackers. Full assessment, every case sourced to the report it came from: https://lnkd.in/dZitrCZb Runs on Babel, free to use. If you have seen an AI-run intrusion that is not in the record yet, I want to hear about it. #IntelligenceMatters