AI-Powered Tools Accelerate Zero-Day Exploitation For Cybercriminals

The report warns that attackers now deploy AI as autonomous operators—scanning networks, discovering and exploiting zero-days, and dynamically modifying malware—reducing exploit timelines from months to minutes. It cites an autonomous espionage operation attributed to GTG-1002 and APT28’s LAMEHUG campaign, describes AI-driven payloads (MalTerminal, PROMPTFLUX, PROMPTLOCK, QUIETVAULT) used for ransomware and data theft, and notes defenses and tracking frameworks (e.g., MITRE ATLAS) updating to categorize these automated capabilities while acknowledging AI hallucinations can produce non-functional exploits.