Shiroe

When I think of highly effective autonomous attacks, I don't think of anything from the AI era. I think of Emotet. I'd argue it was the pinnacle of sophistication for at-scale financially-motivated malware operations. The malware lands on a corporate endpoint, immediately exfiltrates the victim's SMTP (email) credentials, as well as their email inbox. Their inbox gets sent to the threat actor's backend processing pipeline, which scrapes the victim's inbox for email threads where the last reply was by someone other than the victim. The pipeline then crafts a reply to the email thread containing a backdoored Microsoft Office document, which is usually presented as an invoice or something time-sensitive that the target is likely to open. The emails were then farmed out to the infected systems, and sent using legitimate stolen SMTP credentials. The use of legit credentials + corporate systems as spam bots bypassed SPF / DKIM, and IP based spam blocklists, ensuring the email was highly likely to land in the target's inbox, not get blocked or sent to spam. The recipient receives an email from a party they know, trust, have had previous communications with, and is in reply to an existing email exchange between the target and victim. Basically email worm meets extremely effective spearphishing at scale. They say you don't gotta hand it to them, but you kinda do. The engineering that went into this botnet's infrastructure was incredible. The pipeline had a polymorphic engine that would rewrite the malware's code every time antivirus vendors tried to add detections for it. It put plenty of state-sponsored malware operations to shame. The malware was so effective that 8 different countries banded together to stop it. They hacked into the command-and-control infrastructure, then used the malware's self-update command to push out code that removed the malware from the system and then deletes itself. It set precedent for governments being able to, in extreme circumstances, mass-hack victim systems and deploy code designed to disinfect said systems. Previously, there was only law enforcement precedent for triggering the malware's built in remove command, displaying warning messages, or simply just seizing / hijacking the control infrastructure. The botnet had been running for about 12 years when it was taken out in 2021. They just don't make malware like they used to. Everything from the post AI-era is borderline slop and I'm bored out of my mind analyzing it. The below image is what the Microsoft Office documents the target received would look like. Clicking the "Enable Content" button runs the malware.

I'm relatively confident in predicting that currently, more major breaches are likely to be the result of AI use by the target, not the attacker. Ransomware actors have been consistently winning for over a decade. They've had so much time to perfect their tradecraft, and non-AI ransomware actors can now blast through entire networks in minutes. It is extremely unlikely that organizational security has, in 4 years, after decades of failure, matured enough that hackers now somehow need AI to win. What has likely happened, though, is that organizations have spent the last 4 years falling over themselves to shove AI into everything, negating longstanding security fundamentals. "only give a user/system the minimum possible access needed to do its job" has become "just give the AI access to everything and give everyone access to the AI". "use processes with well-defined and easily auditable input and output" has become "the AI correctly processes requests all the time, 60 percent of the time" "reduce attack surfaces" is now "every department should be vibe coding. It doesn't matter if you've never coded before and don't understand information security. Just make public-facing dashboards, it'll be fine." I'd say if anything, hackers aren't getting measurably more sophisticated, but the average organization's security posture has gotten exponentially worse.