August 5, 2025
5 min read
Aman Mishra
Adversaries use AI to automate attacks, target autonomous agents, and expand their reach across cloud and enterprise systems in 2025.
Threat Actors Exploit AI to Scale Attacks and Target Autonomous Agents
Adversaries are increasingly leveraging artificial intelligence (AI) to boost their operational efficiency amid a rapidly evolving threat landscape. By scaling attacks and focusing on autonomous AI agents that underpin modern enterprise ecosystems, threat actors are reshaping cybercrime tactics. According to frontline intelligence from CrowdStrike’s 2025 Threat Hunting Report, elite threat hunters and analysts reveal that threat actors are harnessing generative AI (GenAI) to optimize resource-constrained operations. This enables infiltration of organizations with unprecedented speed and precision. This shift empowers even lower-skilled eCrime and hacktivist groups to automate complex tasks traditionally requiring advanced expertise, such as malware development, script generation, and technical problem-solving.AI Weaponization
For example, the DPRK-nexus adversary FAMOUS CHOLLIMA has infiltrated over 320 companies in the past 12 months—a 220% year-over-year increase—by integrating GenAI throughout the hiring and employment lifecycle. These actors fabricate convincing resumes, use real-time deepfake technologies to mask identities during video interviews, and employ AI-driven coding tools to covertly perform job functions. Similarly, adversaries like EMBER BEAR and CHARMING KITTEN exploit GenAI to spread pro-Russia narratives and craft sophisticated phishing lures using large language models (LLMs), targeting organizations in the U.S. and EU. This weaponization extends to exploiting vulnerabilities in AI software stacks, enabling unauthenticated access, credential harvesting, persistence mechanisms, and malware deployment. Emerging GenAI-built malware families such as Funklocker and SparkCat exemplify this trend. As enterprises accelerate AI adoption, the attack surface expands. Threat actors prioritize AI-integrated systems to transform traditional insider threats into persistent, scalable campaigns.Cross-Domain Intrusions
Adding to the risk, adversaries are mastering cross-domain attacks that traverse endpoints, identity systems, cloud environments, and unmanaged assets to evade conventional security controls. The resurgence of SCATTERED SPIDER highlights this capability. Operators use voice phishing (vishing) and help desk impersonation to reset credentials, bypass multifactor authentication (MFA), and move laterally across SaaS and cloud infrastructures. In one incident, SCATTERED SPIDER advanced from initial access to ransomware encryption in under 24 hours, leveraging personally identifiable information (PII) to impersonate employees and authenticate via help desk verifications. Post-account takeover, these actors pivot to integrated platforms for data warehousing, document management, and identity access management, establishing footholds for persistence, data exfiltration, and further propagation. Cloud intrusions surged 136% in the first half of 2025 compared to all of 2024, driven by a 40% increase in activity from suspected China-nexus actors such as GENESIS PANDA and MURKY PANDA, who exploit misconfigurations and trusted access to evade detection. GLACIAL PANDA’s deep embedding in telecommunications networks has fueled a 130% rise in nation-state espionage within the sector. CrowdStrike now tracks over 265 named adversaries and 150 activity clusters, reporting a 27% year-over-year increase in interactive intrusions. Notably, 81% of these intrusions are malware-free and rely on hands-on-keyboard tactics to bypass legacy detection methods. eCrime accounts for 73% of these intrusions, while vishing volumes are projected to double by the end of the year. The government sector has experienced a 71% overall increase in interactive intrusions and a 185% spike in targeted activities, underscoring the urgent need for organizations to integrate these insights into defensive strategies to counter AI-augmented threats effectively.Source: GBHackers