The AI Malware Surge: Behavior, Attribution, and Defensive Readiness

Arctic Wolf Labs analyzed 22,331 files and found AI-assisted malware has become routine, lowering barriers for threat actors to produce infostealers, RATs, ransomware, and other tooling; notable findings include DeepSeek R1 artifacts, 39% of samples undetected by signature AV at collection, runtime LLM API use, language-specific developer clusters, and a small subset (≈1.4%) attributable to known APT or financially motivated groups, with extensive IOCs and layered defense recommendations.