State-backed hackers are utilizing AI and automation to launch cyberattacks at unprecedented speed and scale, widening the gap between attackers and defenders. A China-linked group known as Vapor Panda used an AI-powered tool called Artex, alongside DeepSeek and a commercial AI model, to target more than 200 organizations across 14 countries in just 11 days last month. The group targeted government agencies in Latin America, the Middle East, and Europe, as well as U.S. organizations and telecommunications providers.
CrowdStrike senior vice president of counter adversary operations Adam Meyers tested Artex and found the tool could probe websites for weaknesses significantly faster than a human. "It was doing the stuff that you, as a pen tester, would do," Meyers said. "But it does it really at a scale and a speed that I think a human would not be able to do." Meyers noted that other AI-powered security testing tools, such as Cairn and Strix, could also be repurposed for similar attacks.
Recent attacks on European refrigeration systems have raised concerns regarding food supply security. Hackers tampered with systems at dozens of European grocery stores and French blood banks, causing temperatures to rise and food to spoil. While no clear evidence has linked these specific refrigeration attacks to AI, some investigators suspect Russia, as SentinelOne researchers reported that Russian-aligned hackers have previously claimed responsibility for similar attacks. The Pentagon is also investigating suspected hacks of refrigeration systems on military bases, which investigators suspect may be linked to Iran.
Other recent breaches have demonstrated the efficiency of automated tools. Google researchers reported that multiple hacking groups have used automated security testing tools in recent attacks, including one China-linked group that gained deep access to a victim's network in 15 minutes. Additionally, Chainalysis indicated that North Korean hackers behind a recent Binance heist likely used automation to move stolen cryptocurrency and cover their tracks.
The UK's National Cyber Security Centre warned that AI could accelerate existing hacking tactics, leaving organizations with outdated technology and weaker defenses particularly vulnerable. However, experts noted that AI-powered tools still require existing vulnerabilities to be effective. Mike Searight, a former public-sector CIO and executive advisor to Elisity, observed that many security gaps, such as those in U.S. water systems, often go unnoticed until they are reported in the news.
