cyber.hendryadrian.com
Security Insights · team-cymru.com

Fortinet Threat Intelligence Leader Says AI Is Lowering Barriers for Cybercriminals

· Original article ↗

Summary

Fortinet's Aamir Lakhani says generative and agentic AI could help attackers automate and adapt attacks, while urging defenders to focus on attack intent, network impact and business-critical systems rather than relying mainly on IOCs.

Key points

  • Lakhani says generative AI is being used to rewrite code and repackage older attacks, and can help less-skilled attackers improve their operations.
  • He says some attackers are using jailbroken LLMs such as WormGPT and FraudGPT or training models locally; he estimates these tools may get attackers 60% of the way to a successful attack.
  • Lakhani recommends investigating attack intent, whether a breach occurred, potential damage and recovery needs instead of relying mainly on indicators of compromise.
  • For teams unable to analyze PCAPs in depth, he recommends using metadata and NetFlow information alongside threat intelligence.
  • He expects threat intelligence teams to identify business-critical systems and pain points, which he believes attackers may increasingly target with predictive and generative AI.
  • Lakhani says agentic AI could be attacked or manipulated, and that AI agents may automate tasks such as processing information, creating scripts and running attacks.

Article Details

Topic
How AI is changing cybercrime and threat intelligence, including its use in phishing and attack automation and the defensive focus on attack intent and critical systems.

MITRE ATT&CK

T1566 · PhishingThe article says attackers have used generative AI to help create phishing emails.

People

Aamir LakhaniFortinet's Global Director of Threat Intelligence & Adversarial AI Research; discusses AI's effects on cybercrime and threat intelligence.

Vendors

FortinetAamir Lakhani, the Global Director of Threat Intelligence & Adversarial AI Research at Fortinet, joins Will Baxter for this week’s Future of Threat Intelligence podcast. Fortinet processes telemetry from 50% of the

Tools

FraudGPTAdditionally, attackers are either using jailbroken large language models (LLMs) like WormGPT or FraudGPT, or they are running and training their own LLMs locally. This shift requires a fair amount of sophistication andWormGPTAdditionally, attackers are either using jailbroken large language models (LLMs) like WormGPT or FraudGPT, or they are running and training their own LLMs locally. This shift requires a fair amount of sophistication and

Industries

CybersecurityLeading teams in the cybersecurity space is challenging. The stresses are constant, and employees are expected to possess a wide range of hard technical skills as well as softer communication skills. This often requires

Related Articles