Threat Report: Examining the Use of AI in Attack Techniques

This Microsoft analysis details how several nation-state-linked APT groups (Russian STRONTIUM/Forest Blizzard, North Korea’s Velvet Chollima/Emerald Sleet, Iran’s CURIUM/Crimson Sandstorm, and China-linked Charcoal/Salmon Typhoon) are experimenting with large language models to enhance reconnaissance, social engineering, code/scripting, vulnerability research, and detection evasion; the report notes these are early-stage, incremental uses rather than documented large-scale attacks and recommends foundational defenses such as multifactor authentication, zero-trust, and conditional access.