AI to Help Cyber Criminals Execute More Frequent Attacks — Here’s How

UK's intelligence, security, and cyber agency GCHQ warns that the use of AI is expected to increase the global ransomware threat in the next two years. The National Cyber Security Centre (NCSC) report outlines that AI is already being used in malicious cyber activities, likely increasing the frequency and impact of cyber attacks, especially ransomware.

The report highlights that AI's role in cyber operations lowers the entry barrier for bad actors, enabling them to conduct more effective access and information-gathering operations. This increased access, combined with improved victim targeting, is anticipated to contribute to an increase in global ransomware threats.

Key Findings

AI is expected to increase the frequency and impact of cyber attacks in the next two years, but the influence on cyber threats will vary. The threat in 2025 stems from the evolution of existing tactics, techniques, and procedures (TTPs). Both state and non-state actors, regardless of skill level, are currently utilizing AI to varying extents.

AI enhances capabilities in reconnaissance and social engineering, making them more effective, efficient, and harder to detect. More sophisticated AI applications in cyber operations are likely to be limited to actors with access to quality training data, expertise in both AI and cyber, and ample resources. Such advanced applications are not expected to become prevalent before 2025.

AI is predicted to amplify the impact of cyber attacks against the UK by enabling threat actors to analyze exfiltrated data more rapidly and effectively, using it to train AI models. This, in turn, lowers the entry barrier for novice cybercriminals, hackers-for-hire, and hacktivists, facilitating more effective access and information-gathering operations. This increased access is anticipated to contribute to the global ransomware threat over the next two years.

The study also notes the emergence of criminal generative AI (GenAI) and 'GenAI-as-a-service,' indicating a growing trend of commoditization in AI-enabled cyber capabilities.

Solution?

Ransomware remains a significant cyber threat for UK organizations, prompting a £2.6 billion investment by the government under its Cyber Security Strategy. The NCSC, in collaboration with private industry, is incorporating AI into cyber security strategies to enhance threat detection and security practices.

The NCSC urges organizations and individuals to adopt protective measures outlined in their guidance to strengthen defenses against ransomware attacks. The report underscores the evolution, rather than revolution, of AI in cyber threats, emphasizing the need to manage the risks associated with AI technology. The NCSC's focus on securing future technology is evident in its Guidelines for Secure AI System Development, and further discussions on these themes are anticipated at CYBERUK 2024 in May.

“We must ensure that we both harness AI technology for its vast potential and manage its risks – including its implications on the cyber threat. The emergent use of AI in cyber attacks is evolutionary, not revolutionary, meaning that it enhances existing threats like ransomware but does not transform the risk landscape in the near term,” said NCSC CEO Lindy Cameron.