ai assisted attacks3 articles
AI-Assisted Hacking Puts Siemens PLCs in US Critical Infrastructure Squarely in the Crosshairs
US government agencies, including the NSA, CISA, FBI, EPA, and DOE, have issued a joint advisory warning that unidentified hackers are using AI to develop exploitation scripts targeting Siemens PLCs across critical infrastructure sectors such as energy, water, and manufacturing. The attackers combine AI-generated tools with open-source industrial automation libraries to manipulate PLC memory, configuration data, and ladder logic, while also conducting persistent reconnaissance that suggests preparation for future disruptive attacks. Agencies are urging organizations to apply the latest patches, restrict internet exposure of PLCs, and implement strong access controls and ICS monitoring solutions.
Misconfigured Server Blows Cover on AI-Assisted Phishing Operation Targeting Mexico
Rapid7 discovered an exposed malware delivery server containing over 1,000 files that revealed a mid-development phishing operation targeting Windows users in Mexico, using a WebDAV working-directory hijack (CVE-2025-33053) to deliver an infostealer disguised as a government ID document. The exposed toolkit showed strong evidence of AI-assisted development, with LLM-formatted documentation, test matrices, and emoji-heavy code suggesting the operator used an open-source AI coding agent to rapidly build, test, and scale the campaign. Over roughly five and a half days the panel logged over 77,000 requests, with Mexico accounting for the vast majority of traffic, and both identified campaign chains ultimately delivered the known .NET malware PureRAT.
Avalon Malware Framework Bundles Ransomware, Credential Theft and AI-Assisted Development Into One Nasty Package
Cybersecurity researchers have uncovered a modular malware framework called **Avalon**, distributed via phishing emails, which combines credential theft, lateral movement, remote access, and ransomware (internally named CrownX) into a single toolkit. The framework employs sophisticated evasion techniques targeting major security vendors and shows signs of AI-assisted development, highlighting how AI is lowering the barrier to entry for malware creation. These findings coincide with other emerging AI-driven threats, including a fully autonomous LLM-powered ransomware attack and a novel malware that uses a public LLM API to translate plain-language attacker instructions into shell commands — requiring no coding knowledge whatsoever.