A report reveals that cybercriminals are increasingly using AI tools for attacks, including ransomware and phishing schemes.
A recent report by F6 reveals that cybercriminals are increasingly leveraging artificial intelligence (AI) tools in their attacks, ranging from reconnaissance to crafting malicious software. This analysis spans activities from 2025 through the first half of 2026.
AI Utilization in Cyber Attacks
The report highlights that at least 18 advanced persistent threat (APT) groups have incorporated AI into their operations in the past 18 months. Several notable examples illustrate this trend, such as the GTG-1002 group, which used AI-driven language models to create personalized phishing emails that successfully evaded standard spam filters. Similarly, the TAT26-12 cluster automated its reconnaissance processes through AI, collecting vital data on organizational vulnerabilities and employee information.
Furthermore, a tool named PromptSpy was identified for its capability to autonomously commandeer devices for malicious purposes, leveraging large language models. Another tool, LAMEHUG, was noted for its efficiency in generating harmful code with minimal human input.
Increased Discussions Among Hackers
Researchers have observed a surge in conversations among hackers on specialized forums regarding various AI models. While OpenAI's ChatGPT is favored by novice hackers, Google’s Gemini has been more frequently employed in actual cyberattacks.
Forum discussions often focus on strategies to bypass restrictions on these AI models, with some users attempting to develop malicious applications using publicly accessible AI tools.
Ransomware Trends
Over the monitored period, more than 50 new ransomware groups have emerged, leading to over 9,300 related incidents. A significant trend noted is the shift from locking data as a primary tactic to threatening to publish stolen information, which simplifies the attack process and complicates defense mechanisms.
Despite the shutdown of six major data trading marketplaces in the past 18 months, five new ones have quickly taken their place. Current illicit card shops reportedly list over 16.5 million compromised payment cards for sale. In response to these evolving threats, OpenAI has slowed the development of advanced AI systems following an incident involving Hugging Face and a preliminary assessment from Astra.
