# publications

publication_id: pub-001
primary_source_id: src-001
publisher: arXiv
publisher_domain: arxiv.org
publication_date: 2024-08
publication_date_precision: month
publication_date_method: arxiv_id_month
publication_year: 2024
source_type: empirical_or_academic
relevance_basis: ai-cyber research or controlled study
statistical_use: possible_denominator
primary_url: https://arxiv.org/abs/2408.03354
all_urls: https://arxiv.org/abs/2408.03354
retrieval_methods: direct
source_record_count: 1
max_token_count: 769
tag_count: 7
metric_count: 3
ioc_count: 0
sectors: Critical Infrastructure
ai_technologies: Large language model
llm_providers: Hugging Face|OpenAI
infrastructure: Email
evidence_landscape: Controlled study|Underground-market observation
manual_review_required: yes
content_quality: usable_machine_extraction
analysis_inclusion: context_only
ai_relevance: background_ai_mention
ai_term_count: 23
offense_term_count: 0
title:
[2408.03354] The Use of Large Language Models (LLM) for Cyber Threat Intelligence (CTI) in Cybercrime Forums


publication_id: pub-004
primary_source_id: src-004
companion_source_ids: src-099
title: Emerging AI Threats: The Future of Automated Operations
publisher: Recorded Future
publisher_domain: assets.recordedfuture.com
publication_date: 2025-08
publication_date_precision: month
publication_date_method: publisher_verified_override
publication_year: 2025
source_type: vendor_threat_report
relevance_basis: threat landscape, incident-response, or CTI report
statistical_use: context_or_observation
primary_url: https://www.recordedfuture.com/research/emerging-ai-threats-future-of-automated-operations
retrieval_methods: direct
duplicate_group: dup-001
source_record_count: 2
max_token_count: 1795
tag_count: 63
metric_count: 3
ioc_count: 0
sectors: Critical Infrastructure|Defense|Government
countries_or_regions: Canada|China|Iran|Russia
targets: Developers|Employees|Executives
kill_chain_phases: Actions on Objectives|Delivery|Exploitation|Reconnaissance|Weaponization
mitre_tactics: Defense Evasion|Discovery|Exfiltration|Impact|Initial Access|Reconnaissance|Resource Development
attack_vectors: Spearphishing
ai_technologies: Agentic AI|Deepfake / synthetic media|Generative AI|Large language model
llm_providers: Anthropic|OpenAI
llm_models: Claude
malicious_ai_tools: FraudGPT|WormGPT
malware_or_tools: LAMEHUG
all_urls:
https://assets.recordedfuture.com/Executive-Insights/eir-2025-0828.pdf|https://www.recordedfuture.com/research/emerging-ai-threats-future-of-automated-operations

ttps:
Credential theft|Data exfiltration|Deepfake impersonation|Defense evasion|Malware generation|Prompt injection|Spearphishing

ai_use_cases:
Code debugging and scripting|Deepfake video or image|Identity fraud and impersonation|Influence operations|Malware development|Obfuscation and evasion|Phishing and lure generation|Reconnaissance and target research|Translation and localization

impacts:
Credential compromise|Data theft or exfiltration|Financial fraud|Ransomware or extortion|Service disruption


publication_id: pub-005
primary_source_id: src-005
title: Cisco Talos 2024 Year in Review
publisher: Cisco Talos
publisher_domain: blog.talosintelligence.com
publication_date: 2025-03-31
publication_date_precision: day
publication_date_method: publisher_verified_override
publication_year: 2025
source_type: operational_cti
relevance_basis: campaign, actor, malware, or abuse investigation
statistical_use: incident_or_observation
primary_url: https://blog.talosintelligence.com/available-now-2024-year-in-review/
retrieval_methods: direct
source_record_count: 1
max_token_count: 11552
tag_count: 126
metric_count: 123
ioc_count: 0
campaigns: Operation Cronos
countries_or_regions: North Korea|Russia|Ukraine|United States
targets: Developers|Employees
attack_vectors: Business email compromise|Credential theft|Vishing
ai_technologies: Agentic AI|Deepfake / synthetic media|Generative AI|Large language model
malware_or_tools: BianLian ransomware|BlackBasta ransomware|Cobalt Strike|LockBit ransomware|Mimikatz
infrastructure: Browser|Cloud|Email|Endpoint|Messaging platform|Social media
actor_motivations: Disruption / destruction|Financial
evidence_landscape: Forecast or prediction|Incident response|Underground-market observation
manual_review_required: yes
content_quality: usable_machine_extraction
analysis_inclusion: include_with_manual_validation
ai_relevance: core_ai_attack
all_urls:
https://blog.talosintelligence.com/content/files/2025/03/2024YiR-report.pdf|https://blog.talosintelligence.com/available-now-2024-year-in-review/

threat_groups:
Akira|APT28 / Fancy Bear|APT29 / Cozy Bear|Black Basta|Lazarus Group|RansomHub|Scattered Spider|APT28|APT29

sectors:
Critical Infrastructure|Education|Financial Services|Government|Legal Services|Manufacturing|Nonprofit / NGO|Telecommunications|Transportation and Logistics

kill_chain_phases:
Actions on Objectives|Command and Control|Delivery|Exploitation|Installation|Reconnaissance|Weaponization

mitre_tactics:
Command and Control|Credential Access|Defense Evasion|Discovery|Execution|Exfiltration|Impact|Initial Access|Lateral Movement|Persistence|Privilege Escalation|Reconnaissance|Resource Development

ttps:
Business email compromise|CAPTCHA bypass|Command and control|Credential theft|Data exfiltration|Deepfake impersonation|Defense evasion|Malware generation|MFA/session-token theft|Password spraying|Phishing link or attachment|PowerShell execution|Ransomware deployment|Target research / OSINT|Voice phishing / vishing|Vulnerability scanning

ai_use_cases:
CAPTCHA bypass|Code debugging and scripting|Deepfake video or image|Identity fraud and impersonation|Malware development|Obfuscation and evasion|Reconnaissance and target research|Vulnerability research

data_types:
Credentials and passwords|Documents and files|Financial and payment data|Personally identifiable information|Session cookies or tokens|Source code

impacts:
Credential compromise|Data theft or exfiltration|Financial fraud|Ransomware or extortion|Service disruption

cves:
CVE-2014-0160|CVE-2014-6271|CVE-2014-6277|CVE-2014-6278|CVE-2014-7169|CVE-2017-9841|CVE-2021-44228|CVE-2021-44529|CVE-2021-44832|CVE-2021-45046|CVE-2021-45105|CVE-2022-20933|CVE-2023-1389|CVE-2023-36845|CVE-2023-38035|CVE-2023-42793|CVE-2024-0012|CVE-2024-24919|CVE-2024-3272|CVE-2024-3273|CVE-2024-3400|CVE-2024-36401|CVE-2024-4577


publication_id: pub-006
primary_source_id: src-006
title: “Keep going, bro. You’ve got this!” A data-driven look at how adversaries are weaponizing AI
publisher: Cisco Talos
publisher_domain: blog.talosintelligence.com
publication_date: 2026-08-04
publication_date_precision: day
publication_date_method: metadata
publication_year: 2026
source_type: operational_cti
relevance_basis: campaign, actor, malware, or abuse investigation
statistical_use: incident_or_observation
retrieval_methods: direct
source_record_count: 1
max_token_count: 8123
tag_count: 50
metric_count: 7
ioc_count: 2
threat_groups: UAT-10147|UAT-10147
sectors: Cryptocurrency
countries_or_regions: Brazil|China|France|Russia
targets: Developers
kill_chain_phases: Actions on Objectives|Command and Control|Delivery|Exploitation|Installation|Reconnaissance
ttps: Command and control|Credential theft
attack_vectors: Credential theft
ai_technologies: Agentic AI|Large language model
llm_providers: Anthropic|Google|Hugging Face|OpenAI
llm_models: Claude|Gemini
data_types: Credentials and passwords|Documents and files|Source code
infrastructure: Browser|Email|Endpoint|Messaging platform|Mobile|SaaS
impacts: Service disruption
evidence_landscape: Forecast or prediction|Incident response|Proof of concept
primary_url:
https://blog.talosintelligence.com/keep-going-bro-youve-got-this-a-data-driven-look-at-how-adversaries-are-weaponizing-ai/

all_urls:
https://blog.talosintelligence.com/keep-going-bro-youve-got-this-a-data-driven-look-at-how-adversaries-are-weaponizing-ai/

mitre_tactics:
Collection|Command and Control|Credential Access|Discovery|Execution|Initial Access|Persistence|Reconnaissance

ai_use_cases:
Malware development|Reconnaissance and target research|Translation and localization|Vulnerability research


publication_id: pub-007
primary_source_id: src-007
title: UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations
publisher: Cisco Talos
publisher_domain: blog.talosintelligence.com
publication_date: 2026-08-20
publication_date_precision: day
publication_date_method: metadata
publication_year: 2026
source_type: operational_cti
relevance_basis: campaign, actor, malware, or abuse investigation
statistical_use: incident_or_observation
retrieval_methods: direct
source_record_count: 1
max_token_count: 4001
tag_count: 70
metric_count: 1
ioc_count: 0
threat_groups: UAT-10147|UAT-10147
sectors: Education|Government
countries_or_regions: Brazil|Canada|China|Vietnam
targets: Developers|Security researchers
attack_vectors: Credential theft
ai_technologies: Agentic AI|Generative AI
llm_providers: Anthropic|Google
llm_models: Claude|Gemini
malware_or_tools: BadIIS malware|QuasarRAT
data_types: Credentials and passwords|Documents and files|Source code
infrastructure: Browser|Email|Endpoint|SaaS
actor_motivations: Financial
impacts: Data theft or exfiltration
evidence_landscape: Forecast or prediction|Incident response|Proof of concept
primary_url:
https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/

all_urls:
https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/

kill_chain_phases:
Actions on Objectives|Command and Control|Delivery|Exploitation|Installation|Reconnaissance|Weaponization

mitre_tactics:
Command and Control|Credential Access|Defense Evasion|Discovery|Execution|Exfiltration|Initial Access|Persistence|Privilege Escalation|Reconnaissance

ttps:
Command and control|Credential theft|Data exfiltration|Defense evasion|PowerShell execution|Vulnerability scanning

ai_use_cases:
Code debugging and scripting|Identity fraud and impersonation|Obfuscation and evasion|Reconnaissance and target research|Vulnerability research

cves:
CVE-2010-3904|CVE-2015-3246|CVE-2015-5287|CVE-2019-18935|CVE-2021-23758|CVE-2021-29441|CVE-2021-29442|CVE-2021-3156|CVE-2022-0847|CVE-2022-0995|CVE-2022-27925


publication_id: pub-008
primary_source_id: src-008
title: 2024 State of Multicloud Security Report
publisher: Microsoft
publisher_domain: cdn-dynmedia-1.microsoft.com
publication_date: 2024-05-29
publication_date_precision: day
publication_date_method: publisher_verified_override
publication_year: 2024
source_type: provider_or_government_report
relevance_basis: AI misuse, abuse-disruption, or threat research report
statistical_use: incident_or_observation
retrieval_methods: direct
source_record_count: 1
max_token_count: 6264
tag_count: 25
metric_count: 59
ioc_count: 0
sectors: Energy|Government
countries_or_regions: China
targets: Developers|Employees|Executives
kill_chain_phases: Actions on Objectives|Exploitation
mitre_tactics: Execution|Impact|Initial Access
ttps: Password spraying|Supply-chain compromise
attack_vectors: Supply chain
ai_technologies: Generative AI|Large language model
data_types: Credentials and passwords|Source code
infrastructure: Cloud|Email|Endpoint
impacts: Data theft or exfiltration|Ransomware or extortion|Service disruption
evidence_landscape: Forecast or prediction
manual_review_required: yes
content_quality: usable_machine_extraction
primary_url:
https://www.microsoft.com/en-us/security/blog/2024/05/29/6-insights-from-microsofts-2024-state-of-multicloud-risk-report-to-evolve-your-security-strategy/

all_urls:
https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/final/en-us/microsoft-brand/documents/2024-State-of-Multicloud-Security-Risk-Report.pdf|https://www.microsoft.com/en-us/security/blog/2024/05/29/6-insights-from-microsofts-2024-state-of-multicloud-risk-report-to-evolve-your-security-strategy/


publication_id: pub-011
primary_source_id: src-011
title: The dawn of agentic AI in security operations at RSAC 2025
publisher: Google Threat Intelligence Group / Mandiant
publisher_domain: cloud.google.com
publication_date: 2025-04-28
publication_date_precision: day
publication_date_method: text
publication_year: 2025
source_type: other
relevance_basis: requires manual relevance review
statistical_use: do_not_aggregate
retrieval_methods: direct
source_record_count: 1
max_token_count: 1546
tag_count: 16
metric_count: 1
ioc_count: 0
sectors: Financial Services|Government|Telecommunications
targets: Developers
kill_chain_phases: Exploitation
mitre_tactics: Execution|Initial Access
ai_technologies: Agentic AI|Large language model
llm_providers: Google
llm_models: Gemini
data_types: Credentials and passwords|Documents and files
infrastructure: Browser|Endpoint
evidence_landscape: Controlled study
manual_review_required: yes
content_quality: usable_machine_extraction
analysis_inclusion: context_only
ai_relevance: adjacent_ai_security
primary_url:
https://cloud.google.com/blog/products/identity-security/the-dawn-of-agentic-ai-in-security-operations-at-rsac-2025

all_urls:
https://cloud.google.com/blog/products/identity-security/the-dawn-of-agentic-ai-in-security-operations-at-rsac-2025


publication_id: pub-012
primary_source_id: src-012
title: Adversarial Misuse of Generative AI
publisher: Google Threat Intelligence Group / Mandiant
publisher_domain: cloud.google.com
publication_date: 2025-01-30
publication_date_precision: day
publication_date_method: text
publication_year: 2025
source_type: operational_cti
relevance_basis: campaign, actor, malware, or abuse investigation
statistical_use: incident_or_observation
primary_url: https://cloud.google.com/blog/topics/threat-intelligence/adversarial-misuse-generative-ai
all_urls: https://cloud.google.com/blog/topics/threat-intelligence/adversarial-misuse-generative-ai
retrieval_methods: direct
source_record_count: 1
max_token_count: 7326
tag_count: 93
metric_count: 4
ioc_count: 0
threat_groups: APT41|APT42 / Charming Kitten|APT43 / Kimsuky|APT41|APT42|APT43|UNC6671
sectors: Cryptocurrency|Defense|Education|Financial Services|Government|Telecommunications
countries_or_regions: China|France|Germany|Iran|Israel|North Korea|Russia|South Korea|Taiwan|Ukraine|United States
targets: Developers|Employees|Executives
kill_chain_phases: Actions on Objectives|Command and Control|Delivery|Exploitation|Reconnaissance|Weaponization
attack_vectors: Business email compromise|Supply chain|Vishing
ai_technologies: Agentic AI|Generative AI|Large language model
llm_providers: Google
llm_models: Gemini
malicious_ai_tools: FraudGPT|WormGPT
malware_or_tools: Cobalt Strike|Mimikatz
data_types: Credentials and passwords|Documents and files|Source code
mitre_tactics:
Collection|Command and Control|Defense Evasion|Discovery|Execution|Exfiltration|Impact|Initial Access|Lateral Movement|Privilege Escalation|Reconnaissance|Resource Development

ttps:
Business email compromise|Command and control|Data exfiltration|Defense evasion|Malware generation|PowerShell execution|Prompt injection|Supply-chain compromise|Target research / OSINT|Voice phishing / vishing

ai_use_cases:
Deepfake video or image|Identity fraud and impersonation|Malware development|Obfuscation and evasion|Reconnaissance and target research|Translation and localization|Vulnerability research


publication_id: pub-014
primary_source_id: src-014
title: AI-Powered Voice Spoofing for Next-Gen Vishing Attacks
publisher: Google Threat Intelligence Group / Mandiant
publisher_domain: cloud.google.com
publication_date: 2024-07-24
publication_date_precision: day
publication_date_method: text
publication_year: 2024
source_type: operational_cti
relevance_basis: campaign, actor, malware, or abuse investigation
statistical_use: incident_or_observation
primary_url: https://cloud.google.com/blog/topics/threat-intelligence/ai-powered-voice-spoofing-vishing-attacks
all_urls: https://cloud.google.com/blog/topics/threat-intelligence/ai-powered-voice-spoofing-vishing-attacks
retrieval_methods: direct
source_record_count: 1
max_token_count: 2135
tag_count: 39
metric_count: 1
ioc_count: 0
threat_groups: UNC6671
sectors: Financial Services|Government|Telecommunications
countries_or_regions: Russia
targets: Developers|Employees|Executives
kill_chain_phases: Delivery|Exploitation|Reconnaissance
mitre_tactics: Initial Access|Lateral Movement|Privilege Escalation
attack_vectors: Supply chain|Vishing
ai_technologies: Deepfake / synthetic media|Generative AI|Large language model|Speech or voice synthesis
data_types: Credentials and passwords|Source code
infrastructure: Browser|Email|Endpoint|Mobile
actor_motivations: Influence / information operations
impacts: Ransomware or extortion
ttps:
CAPTCHA bypass|Deepfake impersonation|Supply-chain compromise|Target research / OSINT|Voice phishing / vishing

ai_use_cases:
CAPTCHA bypass|Deepfake video or image|Deepfake voice|Identity fraud and impersonation|Reconnaissance and target research


publication_id: pub-015
primary_source_id: src-015
title: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access
publisher: Google Threat Intelligence Group / Mandiant
publisher_domain: cloud.google.com
publication_date: 2026-05-12
publication_date_precision: day
publication_date_method: text
publication_year: 2026
source_type: operational_cti
relevance_basis: campaign, actor, malware, or abuse investigation
statistical_use: incident_or_observation
retrieval_methods: direct
source_record_count: 1
max_token_count: 6376
tag_count: 117
metric_count: 0
ioc_count: 0
threat_groups: APT27|APT45|UNC2814|UNC5673|UNC6201|UNC6671|UNC6780
campaigns: Operation Overload
sectors: Financial Services|Government|Media|Telecommunications
countries_or_regions: China|Iran|Japan|North Korea|Russia|Ukraine
targets: Developers|Executives
attack_vectors: Supply chain|Vishing
ai_technologies: Agentic AI|Deepfake / synthetic media|Generative AI|Large language model|Speech or voice synthesis
llm_providers: Anthropic|Google|OpenAI
llm_models: ChatGPT|Claude|Gemini
malware_or_tools: PromptFlux|PROMPTSPY
data_types: Credentials and passwords|Documents and files|Source code
infrastructure: Browser|Endpoint|Mobile
actor_motivations: Financial|Influence / information operations
impacts: Credential compromise|Data theft or exfiltration|Ransomware or extortion
primary_url:
https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access

all_urls:
https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access

kill_chain_phases:
Actions on Objectives|Command and Control|Delivery|Exploitation|Installation|Reconnaissance|Weaponization

mitre_tactics:
Collection|Command and Control|Defense Evasion|Discovery|Execution|Exfiltration|Impact|Initial Access|Persistence|Reconnaissance|Resource Development

mitre_attack_ids:
T0008.000|T0008.005|T0010.001|T0016.001|T0016.002|T0021|T0040|T0054|T0072|T0088|T0102|T0103|T1027.014|T1027.016|T1090.003|T1566|T1587.001|T1587.004|T1588.002|T1588.005|T1588.006|T1588.007|T1591.002|T1591.004|T1592.001

ttps:
CAPTCHA bypass|Command and control|Credential theft|Data exfiltration|Deepfake impersonation|Defense evasion|Exploit development|Obfuscation|Prompt injection|Ransomware deployment|Supply-chain compromise|Voice phishing / vishing

ai_use_cases:
Autonomous or agentic intrusion|CAPTCHA bypass|Deepfake video or image|Deepfake voice|Exploit development|Identity fraud and impersonation|Malware development|Obfuscation and evasion|Reconnaissance and target research|Translation and localization|Vulnerability research


publication_id: pub-016
primary_source_id: src-016
title: Text-to-Malware: How Cybercriminals Weaponize Fake AI-Themed Websites
publisher: Google Threat Intelligence Group / Mandiant
publisher_domain: cloud.google.com
publication_date: 2025-05-27
publication_date_precision: day
publication_date_method: text
publication_year: 2025
source_type: operational_cti
relevance_basis: campaign, actor, malware, or abuse investigation
statistical_use: incident_or_observation
primary_url: https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites/
all_urls: https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites/
retrieval_methods: direct
source_record_count: 1
max_token_count: 4866
tag_count: 52
metric_count: 0
ioc_count: 38
threat_groups: UNC6032|UNC6032|UNC6671
sectors: Cryptocurrency|Financial Services|Government|Telecommunications
countries_or_regions: European Union|Russia|United States|Vietnam
targets: Developers
kill_chain_phases: Actions on Objectives|Command and Control|Exploitation|Installation|Reconnaissance
attack_vectors: Fake AI website|Malicious advertisement|Supply chain|Vishing
ai_use_cases: Obfuscation and evasion|Reconnaissance and target research
malware_or_tools: STARKVEIL malware
infrastructure: Browser|Messaging platform|Social media
impacts: Data theft or exfiltration|Ransomware or extortion|Service disruption
evidence_landscape: Forecast or prediction
manual_review_required: yes
mitre_tactics:
Collection|Command and Control|Defense Evasion|Discovery|Execution|Exfiltration|Persistence|Reconnaissance

ttps:
Command and control|Data exfiltration|Defense evasion|Malicious advertising|Obfuscation|PowerShell execution|Supply-chain compromise|Voice phishing / vishing

data_types:
Credentials and passwords|Cryptocurrency keys or seed phrases|Documents and files|Financial and payment data|Source code


publication_id: pub-017
primary_source_id: src-017
title: Defending Your Enterprise When AI Models Can Find Vulnerabilities Faster Than Ever
publisher: Google Threat Intelligence Group / Mandiant
publisher_domain: cloud.google.com
publication_date: 2026-04-17
publication_date_precision: day
publication_date_method: text
publication_year: 2026
source_type: operational_cti
relevance_basis: campaign, actor, malware, or abuse investigation
statistical_use: incident_or_observation
primary_url: https://cloud.google.com/blog/topics/threat-intelligence/defending-enterprise-ai-vulnerabilities
all_urls: https://cloud.google.com/blog/topics/threat-intelligence/defending-enterprise-ai-vulnerabilities
retrieval_methods: direct
source_record_count: 1
max_token_count: 3371
tag_count: 39
metric_count: 0
ioc_count: 0
threat_groups: UNC6671
sectors: Critical Infrastructure|Financial Services|Government|Telecommunications
countries_or_regions: China|Russia
targets: Developers|Employees
kill_chain_phases: Actions on Objectives|Exploitation|Reconnaissance|Weaponization
mitre_tactics: Discovery|Execution|Impact
attack_vectors: Supply chain|Vishing
ai_use_cases: Exploit development|Vulnerability research
ai_technologies: Agentic AI|Large language model
llm_providers: Anthropic|Google
llm_models: Claude|Gemini
data_types: Credentials and passwords|Source code
ttps:
Exploit development|Prompt injection|Supply-chain compromise|Voice phishing / vishing|Vulnerability scanning


publication_id: pub-018
primary_source_id: src-018
publisher: Google Threat Intelligence Group / Mandiant
publisher_domain: cloud.google.com
publication_date: 2026-02-13
publication_date_precision: day
publication_date_method: text
publication_year: 2026
source_type: operational_cti
relevance_basis: campaign, actor, malware, or abuse investigation
statistical_use: incident_or_observation
retrieval_methods: direct
source_record_count: 1
max_token_count: 5787
tag_count: 99
metric_count: 0
ioc_count: 0
threat_groups: APT31|APT41|APT42 / Charming Kitten|APT31|APT41|APT42|UNC2970|UNC5356|UNC6418|UNC6671|UNC795
sectors: Cryptocurrency|Defense|Financial Services|Government|Telecommunications
countries_or_regions: China|Iran|North Korea|Russia|Ukraine|United States
targets: Developers|Executives|Security researchers
attack_vectors: Credential theft|Malicious advertisement|Spearphishing|Supply chain|Vishing
ai_technologies: Agentic AI|Generative AI|Large language model
llm_providers: DeepSeek|Google|Microsoft|OpenAI|xAI
llm_models: ChatGPT|DeepSeek|Gemini|Grok|Microsoft Copilot
malware_or_tools: HONESTCUE malware|PromptFlux
infrastructure: Browser|Cloud|Email|Endpoint
actor_motivations: Financial|Hacktivism|Influence / information operations
impacts: Data theft or exfiltration|Ransomware or extortion
manual_review_required: yes
content_quality: usable_machine_extraction
analysis_inclusion: include_with_manual_validation
title:
GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use

primary_url:
https://cloud.google.com/blog/topics/threat-intelligence/distillation-experimentation-integration-ai-adversarial-use

all_urls:
https://cloud.google.com/blog/topics/threat-intelligence/distillation-experimentation-integration-ai-adversarial-use

mitre_tactics:
Collection|Command and Control|Defense Evasion|Discovery|Execution|Exfiltration|Impact|Initial Access|Reconnaissance|Resource Development

ttps:
Command and control|Credential harvesting|Data exfiltration|Malicious advertising|Malware generation|Obfuscation|Prompt injection|Spearphishing|Supply-chain compromise|Target research / OSINT|Voice phishing / vishing

ai_use_cases:
Identity fraud and impersonation|Malware development|Obfuscation and evasion|Phishing and lure generation|Reconnaissance and target research|Translation and localization|Vulnerability research

data_types:
Credentials and passwords|Cryptocurrency keys or seed phrases|Documents and files|Financial and payment data|Source code

evidence_landscape:
Controlled study|Forecast or prediction|In-the-wild observed|Proof of concept|Underground-market observation


publication_id: pub-019
primary_source_id: src-019
companion_source_ids: src-039
title: GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools
publisher: Google Threat Intelligence Group / Mandiant
publisher_domain: cloud.google.com
publication_date: 2025-11-06
publication_date_precision: day
publication_date_method: text
publication_year: 2025
source_type: operational_cti
relevance_basis: campaign, actor, malware, or abuse investigation
statistical_use: incident_or_observation
primary_url: https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools
retrieval_methods: direct
duplicate_group: dup-002
source_record_count: 2
max_token_count: 5451
tag_count: 103
metric_count: 0
ioc_count: 0
threat_groups: APT28 / Fancy Bear|APT41|APT42 / Charming Kitten|UNC1069|APT28|APT41|APT42|UNC1069|UNC4899|UNC6671
sectors: Cryptocurrency|Education|Financial Services|Government|Telecommunications
countries_or_regions: Africa|China|Iran|Israel|North Korea|Russia|Ukraine
targets: Developers|Executives|Security researchers
attack_vectors: Credential theft|Smishing|Supply chain|Vishing
ai_technologies: Agentic AI|Deepfake / synthetic media|Generative AI|Large language model
llm_providers: Google|Hugging Face
llm_models: Gemini
malware_or_tools: BIGMACHO backdoor|Cobalt Strike|LAMEHUG|PromptFlux|PromptSteal|QuietVault
infrastructure: Browser|Cloud|Email|Endpoint|Mobile
actor_motivations: Financial|Influence / information operations
all_urls:
https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools|https://services.google.com/fh/files/misc/advances-in-threat-actor-usage-of-ai-tools-en.pdf

mitre_tactics:
Command and Control|Defense Evasion|Discovery|Execution|Exfiltration|Impact|Initial Access|Lateral Movement|Persistence|Privilege Escalation|Reconnaissance|Resource Development

ttps:
Command and control|Credential harvesting|Data exfiltration|Deepfake impersonation|Defense evasion|Exploit development|Malware generation|MFA/session-token theft|Obfuscation|PowerShell execution|Prompt injection|Script generation|Supply-chain compromise|Voice phishing / vishing

ai_use_cases:
Deepfake video or image|Exploit development|Identity fraud and impersonation|Malware development|Obfuscation and evasion|Reconnaissance and target research|Translation and localization|Vulnerability research

data_types:
Credentials and passwords|Cryptocurrency keys or seed phrases|Documents and files|Personally identifiable information|Session cookies or tokens|Source code

evidence_landscape:
Controlled study|Forecast or prediction|In-the-wild observed|Proof of concept|Underground-market observation


publication_id: pub-020
primary_source_id: src-020
title: Threat Actors are Interested in Generative AI, but Use Remains Limited
publisher: Google Threat Intelligence Group / Mandiant
publisher_domain: cloud.google.com
publication_date: 2023-08-17
publication_date_precision: day
publication_date_method: text
publication_year: 2023
source_type: operational_cti
relevance_basis: campaign, actor, malware, or abuse investigation
statistical_use: incident_or_observation
primary_url: https://cloud.google.com/blog/topics/threat-intelligence/threat-actors-generative-ai-limited
all_urls: https://cloud.google.com/blog/topics/threat-intelligence/threat-actors-generative-ai-limited
retrieval_methods: direct
source_record_count: 1
max_token_count: 2678
tag_count: 65
metric_count: 0
ioc_count: 0
threat_groups: APT43 / Kimsuky|APT43|UNC6671
sectors: Financial Services|Government|Media|Telecommunications
countries_or_regions: Canada|China|Iran|Israel|North Korea|Russia|Ukraine
targets: Developers|Security researchers
kill_chain_phases: Actions on Objectives|Delivery|Exploitation|Reconnaissance|Weaponization
mitre_tactics: Collection|Defense Evasion|Initial Access|Reconnaissance|Resource Development
attack_vectors: Business email compromise|Supply chain|Vishing
ai_technologies: Deepfake / synthetic media|Generative AI|Large language model|Speech or voice synthesis
llm_providers: OpenAI
llm_models: ChatGPT
malicious_ai_tools: WormGPT
malware_or_tools: Cobalt Strike
ttps:
Business email compromise|Deepfake impersonation|Malware generation|Obfuscation|Prompt injection|Supply-chain compromise|Voice phishing / vishing

ai_use_cases:
Deepfake video or image|Deepfake voice|Identity fraud and impersonation|Influence operations|Malware development|Obfuscation and evasion|Reconnaissance and target research


publication_id: pub-021
primary_source_id: src-021
title: UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social Engineering
publisher: Google Threat Intelligence Group / Mandiant
publisher_domain: cloud.google.com
publication_date: 2026-02-10
publication_date_precision: day
publication_date_method: text
publication_year: 2026
source_type: operational_cti
relevance_basis: campaign, actor, malware, or abuse investigation
statistical_use: incident_or_observation
retrieval_methods: direct
source_record_count: 1
max_token_count: 5198
tag_count: 61
metric_count: 0
ioc_count: 16
threat_groups: BlueNoroff|UNC1069|UNC1069|UNC4899|UNC6671
sectors: Cryptocurrency|Financial Services|Government|Technology|Telecommunications
countries_or_regions: North Korea|Russia
targets: Developers|Employees|Executives
kill_chain_phases: Actions on Objectives|Command and Control|Delivery|Installation|Reconnaissance
attack_vectors: Spearphishing|Supply chain|Vishing
ai_use_cases: Deepfake video or image|Reconnaissance and target research|Translation and localization
ai_technologies: Deepfake / synthetic media|Generative AI
llm_providers: Google
llm_models: Gemini
malware_or_tools: HIDDENCALL backdoor|UNC1069 malware
data_types: Credentials and passwords|Documents and files|Session cookies or tokens|Source code
infrastructure: Browser|Endpoint|Messaging platform|Social media
actor_motivations: Financial
primary_url:
https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering

all_urls:
https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering

mitre_tactics:
Collection|Command and Control|Discovery|Execution|Exfiltration|Initial Access|Persistence|Reconnaissance

ttps:
Command and control|Credential harvesting|Data exfiltration|Deepfake impersonation|MFA/session-token theft|Spearphishing|Supply-chain compromise|Voice phishing / vishing


publication_id: pub-022
primary_source_id: src-022
title: 2025 Global Threat Landscape Report
publisher: Fortinet
publisher_domain: filestore.fortinet.com
publication_date: 2025-04-28
publication_date_precision: day
publication_date_method: publisher_verified_override
publication_year: 2025
source_type: vendor_threat_report
relevance_basis: threat landscape, incident-response, or CTI report
statistical_use: context_or_observation
retrieval_methods: direct
source_record_count: 1
max_token_count: 6167
tag_count: 107
metric_count: 97
ioc_count: 0
sectors: Critical Infrastructure|Cryptocurrency|Financial Services|Government|Telecommunications
countries_or_regions: Africa|Canada|China|United Kingdom|United States
targets: Executives
kill_chain_phases: Actions on Objectives|Command and Control|Delivery|Exploitation|Installation|Reconnaissance
mitre_attack_ids: T1059|T1078|T1102|T1190|T1496|T1556.004
attack_vectors: Credential theft|Spearphishing|Vishing
ai_technologies: Deepfake / synthetic media
llm_providers: OpenAI
llm_models: ChatGPT
malicious_ai_tools: FraudGPT|WormGPT
malware_or_tools: Cobalt Strike|LockBit ransomware|Vidar
infrastructure: Browser|Cloud|Email|Endpoint|Messaging platform
actor_motivations: Espionage|Hacktivism
evidence_landscape: Forecast or prediction|Proof of concept|Threat landscape report|Underground-market observation
primary_url:
https://www.fortinet.com/corporate/about-us/newsroom/press-releases/2025/fortinet-threat-report-reveals-record-surge-in-automated-cyberattacks

all_urls:
https://filestore.fortinet.com/fortiguard/2025_Global_Threat_Landscape_Report.pdf|https://www.fortinet.com/corporate/about-us/newsroom/press-releases/2025/fortinet-threat-report-reveals-record-surge-in-automated-cyberattacks

threat_groups:
APT28 / Fancy Bear|APT29 / Cozy Bear|APT43 / Kimsuky|Lazarus Group|RansomHub|APT28|APT29|APT73|TA0001|TA0003|TA0004|TA0007|TA0008|TA0011

mitre_tactics:
Collection|Command and Control|Credential Access|Defense Evasion|Discovery|Execution|Exfiltration|Impact|Initial Access|Lateral Movement|Persistence|Privilege Escalation|Reconnaissance

ttps:
Command and control|Credential theft|Data exfiltration|Deepfake impersonation|Defense evasion|Malware generation|MFA/session-token theft|Obfuscation|PowerShell execution|Spearphishing|Voice phishing / vishing

ai_use_cases:
Deepfake video or image|Identity fraud and impersonation|Malware development|Obfuscation and evasion|Phishing and lure generation|Reconnaissance and target research

data_types:
Credentials and passwords|Documents and files|Financial and payment data|Session cookies or tokens|Source code

impacts:
Credential compromise|Data theft or exfiltration|Espionage|Financial fraud|Ransomware or extortion|Service disruption

cves:
CVE-2017-0147|CVE-2017-18377|CVE-2018-10561|CVE-2019-18935|CVE-2022-30525|CVE-2023-1389|CVE-2024-21887


publication_id: pub-023
primary_source_id: src-023
companion_source_ids: src-080
title: 2025 AI Threat Report: How Cybercriminals Are Weaponizing AI Technology
publisher: KELA
publisher_domain: info.ke-la.com
publication_date: 2025-03-25
publication_date_precision: day
publication_date_method: publisher_verified_override
publication_year: 2025
source_type: vendor_threat_report
relevance_basis: threat landscape, incident-response, or CTI report
statistical_use: context_or_observation
primary_url: https://www.kelacyber.com/resources/research/2025-ai-threat-report/
retrieval_methods: direct
duplicate_group: dup-003
source_record_count: 2
max_token_count: 3987
tag_count: 82
metric_count: 10
ioc_count: 0
threat_groups: Storm-2139|STORM-2139|UNC6780
sectors: Financial Services|Government
countries_or_regions: China|France|Germany|Iran|North Korea|Russia|Ukraine|United States
targets: Developers|Employees|Executives
kill_chain_phases: Actions on Objectives|Command and Control|Delivery|Exploitation|Reconnaissance|Weaponization
mitre_tactics: Exfiltration|Impact|Initial Access|Reconnaissance|Resource Development
attack_vectors: Business email compromise|Vishing
ai_technologies: Deepfake / synthetic media|Generative AI|Large language model
llm_providers: Anthropic|DeepSeek|Google|Mistral AI|OpenAI
llm_models: ChatGPT|Claude|DeepSeek|Gemini|GPT-4|Mistral / Mixtral
malicious_ai_tools: Evil-GPT|FraudGPT|GhostGPT|WormGPT
all_urls:
https://info.ke-la.com/hubfs/Reports/KELA%20Report%20-%202025%20AI%20Threat%20Report.pdf|https://www.kelacyber.com/resources/research/2025-ai-threat-report/

ttps:
Business email compromise|Data exfiltration|Deepfake impersonation|Exploit development|Malware generation|Phishing link or attachment|Prompt injection|Target research / OSINT|Voice phishing / vishing

ai_use_cases:
Deepfake video or image|Deepfake voice|Exploit development|Identity fraud and impersonation|Influence operations|Malware development|Phishing and lure generation|Reconnaissance and target research|Translation and localization|Vulnerability research


publication_id: pub-031
primary_source_id: src-031
title: OPWNAI : Cybercriminals Starting to Use ChatGPT - Check Point Research
publisher: Check Point
publisher_domain: research.checkpoint.com
publication_date: 2023-01-06
publication_date_precision: day
publication_date_method: metadata
publication_year: 2023
source_type: provider_or_government_report
relevance_basis: AI misuse, abuse-disruption, or threat research report
statistical_use: incident_or_observation
primary_url: https://research.checkpoint.com/2023/opwnai-cybercriminals-starting-to-use-chatgpt/
all_urls: https://research.checkpoint.com/2023/opwnai-cybercriminals-starting-to-use-chatgpt/
retrieval_methods: direct
source_record_count: 1
max_token_count: 1953
tag_count: 42
metric_count: 0
ioc_count: 0
sectors: Cryptocurrency
targets: Developers
kill_chain_phases: Actions on Objectives|Delivery|Exploitation
mitre_tactics: Execution|Impact|Initial Access
ttps: Malware generation|Phishing link or attachment|PowerShell execution|Spearphishing
attack_vectors: Spearphishing
ai_use_cases: Malware development
ai_technologies: Large language model
llm_providers: OpenAI
llm_models: ChatGPT
data_types: Credentials and passwords|Documents and files
infrastructure: Email|Mobile
countries_or_regions:
Africa|Brazil|Canada|China|France|Germany|India|Iran|Israel|Japan|North Korea|Russia|South Korea|Taiwan|Ukraine|United Kingdom|United States|Vietnam


publication_id: pub-033
primary_source_id: src-033
title: Impersonated GenAI Site Lures Victims to Infostealer Download - Check Point Research
publisher: Check Point
publisher_domain: research.checkpoint.com
publication_date: 2025-05-20
publication_date_precision: day
publication_date_method: metadata
publication_year: 2025
source_type: provider_or_government_report
relevance_basis: AI misuse, abuse-disruption, or threat research report
statistical_use: incident_or_observation
primary_url: https://research.checkpoint.com/2025/impersonated-kling-ai-site-installs-malware/
all_urls: https://research.checkpoint.com/2025/impersonated-kling-ai-site-installs-malware/
retrieval_methods: direct
source_record_count: 1
max_token_count: 3046
tag_count: 65
metric_count: 0
ioc_count: 36
sectors: Cryptocurrency|Financial Services
targets: Developers|Security researchers
kill_chain_phases: Actions on Objectives|Command and Control|Delivery|Exploitation|Installation
attack_vectors: Fake AI website|Malicious advertisement
ai_use_cases: Identity fraud and impersonation|Obfuscation and evasion
ai_technologies: Generative AI|Large language model
llm_providers: Google|OpenAI
llm_models: ChatGPT|Gemini
malware_or_tools: PureHVNC RAT
infrastructure: Browser|Email|Endpoint|Messaging platform|Mobile|Social media
impacts: Data theft or exfiltration|Ransomware or extortion
manual_review_required: yes
countries_or_regions:
Africa|Brazil|Canada|China|France|Germany|India|Iran|Israel|Japan|North Korea|Russia|South Korea|Taiwan|Ukraine|United Kingdom|United States|Vietnam

mitre_tactics:
Collection|Command and Control|Defense Evasion|Execution|Exfiltration|Impact|Initial Access|Persistence

ttps:
Command and control|Data exfiltration|Defense evasion|Fake website or service|Malicious advertising|MFA/session-token theft|Obfuscation

data_types:
Credentials and passwords|Cryptocurrency keys or seed phrases|Documents and files|Session cookies or tokens


publication_id: pub-034
primary_source_id: src-034
title: The State of AI in Cyber Security - Check Point Research
publisher: Check Point
publisher_domain: research.checkpoint.com
publication_date: 2025-04-30
publication_date_precision: day
publication_date_method: metadata
publication_year: 2025
source_type: provider_or_government_report
relevance_basis: AI misuse, abuse-disruption, or threat research report
statistical_use: incident_or_observation
primary_url: https://research.checkpoint.com/2025/sate-of-ai-in-cyber-security/
all_urls: https://research.checkpoint.com/2025/sate-of-ai-in-cyber-security/
retrieval_methods: direct
source_record_count: 1
max_token_count: 2414
tag_count: 67
metric_count: 11
ioc_count: 2
targets: Employees
kill_chain_phases: Actions on Objectives|Delivery|Exploitation|Weaponization
mitre_tactics: Collection|Discovery|Exfiltration|Impact|Initial Access
attack_vectors: Supply chain
ai_technologies: Deepfake / synthetic media|Generative AI|Large language model
llm_providers: DeepSeek|Hugging Face|Microsoft|OpenAI
llm_models: ChatGPT|DeepSeek|Microsoft Copilot
data_types: Credentials and passwords|Documents and files|Financial and payment data|Session cookies or tokens
infrastructure: Email|Mobile
actor_motivations: Influence / information operations
impacts: Data theft or exfiltration|Financial fraud|Ransomware or extortion
evidence_landscape: In-the-wild observed|Incident response|Underground-market observation
ttps:
Data exfiltration|Deepfake impersonation|Exploit development|Malware generation|MFA/session-token theft|Ransomware deployment|Supply-chain compromise

ai_use_cases:
Deepfake video or image|Deepfake voice|Exploit development|Identity fraud and impersonation|Influence operations|Malware development|Translation and localization|Vulnerability research


publication_id: pub-035
primary_source_id: src-035
publisher: Check Point
publisher_domain: research.checkpoint.com
publication_date: 2026-02-17
publication_date_precision: day
publication_date_method: metadata
publication_year: 2026
source_type: forecast_or_assessment
relevance_basis: threat assessment, forecast, or red-team study
statistical_use: context_only
retrieval_methods: direct
source_record_count: 1
max_token_count: 4533
tag_count: 72
metric_count: 1
ioc_count: 0
sectors: Critical Infrastructure|Defense
targets: Developers
ttps: CAPTCHA bypass|Command and control|Data exfiltration|Malware generation|PowerShell execution
ai_technologies: Agentic AI
llm_providers: Anthropic|Google|Microsoft|OpenAI|xAI
llm_models: ChatGPT|Gemini|Grok|Microsoft Copilot
malicious_ai_tools: FraudGPT
data_types: Credentials and passwords|Documents and files|Personally identifiable information
infrastructure: Browser|Email|Endpoint|Mobile
impacts: Data theft or exfiltration|Ransomware or extortion
evidence_landscape: Controlled study|Forecast or prediction|Incident response|Proof of concept
manual_review_required: yes
content_quality: usable_machine_extraction
analysis_inclusion: include_with_manual_validation
ai_relevance: core_ai_attack
title:
AI in the Middle: Turning Web-Based AI Services into C2 Proxies & The Future Of AI Driven Attacks - Check Point Research

primary_url:
https://research.checkpoint.com/2026/ai-in-the-middle-turning-web-based-ai-services-into-c2-proxies-the-future-of-ai-driven-attacks/

all_urls:
https://research.checkpoint.com/2026/ai-in-the-middle-turning-web-based-ai-services-into-c2-proxies-the-future-of-ai-driven-attacks/

mitre_tactics:
Command and Control|Discovery|Execution|Exfiltration|Impact|Initial Access|Lateral Movement|Persistence|Reconnaissance|Resource Development

ai_use_cases:
CAPTCHA bypass|Command and control|Malware development|Reconnaissance and target research|Translation and localization


publication_id: pub-036
primary_source_id: src-036
publisher: Check Point
publisher_domain: research.checkpoint.com
publication_date: 2026-07-01
publication_date_precision: day
publication_date_method: metadata
publication_year: 2026
source_type: provider_or_government_report
relevance_basis: AI misuse, abuse-disruption, or threat research report
statistical_use: incident_or_observation
retrieval_methods: direct
source_record_count: 1
max_token_count: 4285
tag_count: 60
metric_count: 0
ioc_count: 1
sectors: Financial Services
targets: Developers
kill_chain_phases: Actions on Objectives|Delivery|Exploitation|Installation|Weaponization
ttps: Credential theft|Data exfiltration|Malware generation|PowerShell execution
attack_vectors: Credential theft
ai_use_cases: Malware development|Translation and localization
ai_technologies: Large language model
llm_providers: Anthropic|DeepSeek|OpenAI
llm_models: ChatGPT|Claude|DeepSeek
data_types: Credentials and passwords|Documents and files
infrastructure: Browser|Cloud|Email|Endpoint|Mobile
impacts: Data theft or exfiltration|Ransomware or extortion
evidence_landscape: Controlled study|In-the-wild observed|Proof of concept
manual_review_required: yes
content_quality: usable_machine_extraction
title:
Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique - Check Point Research

primary_url:
https://research.checkpoint.com/2026/browser-only-ransomware-from-llm-hallucinations-to-a-practical-attack-technique/

all_urls:
https://research.checkpoint.com/2026/browser-only-ransomware-from-llm-hallucinations-to-a-practical-attack-technique/

mitre_tactics:
Collection|Credential Access|Discovery|Execution|Exfiltration|Impact|Initial Access|Persistence|Resource Development


publication_id: pub-037
primary_source_id: src-037
publisher: Check Point
publisher_domain: research.checkpoint.com
publication_date: 2026-03-30
publication_date_precision: day
publication_date_method: metadata
publication_year: 2026
source_type: provider_or_government_report
relevance_basis: AI misuse, abuse-disruption, or threat research report
statistical_use: incident_or_observation
retrieval_methods: direct
source_record_count: 1
max_token_count: 2761
tag_count: 38
metric_count: 0
ioc_count: 0
targets: Developers
kill_chain_phases: Actions on Objectives|Delivery|Exploitation
mitre_tactics: Collection|Execution|Exfiltration|Impact|Initial Access
ttps: Data exfiltration
llm_providers: OpenAI
llm_models: ChatGPT
data_types: Documents and files|Financial and payment data
infrastructure: Email|Mobile|Social media
impacts: Data theft or exfiltration|Ransomware or extortion
evidence_landscape: Proof of concept
manual_review_required: yes
content_quality: usable_machine_extraction
analysis_inclusion: include_with_manual_validation
ai_relevance: core_ai_attack
ai_term_count: 40
title:
ChatGPT Data Leakage via a Hidden Outbound Channel in the Code Execution Runtime - Check Point Research

primary_url:
https://research.checkpoint.com/2026/chatgpt-data-leakage-via-a-hidden-outbound-channel-in-the-code-execution-runtime/

all_urls:
https://research.checkpoint.com/2026/chatgpt-data-leakage-via-a-hidden-outbound-channel-in-the-code-execution-runtime/


publication_id: pub-038
primary_source_id: src-038
title: BlueNoroff’s latest campaigns: GhostCall and GhostHire | Securelist
publisher: Kaspersky GReAT
publisher_domain: securelist.com
publication_date: 2025-10-28
publication_date_precision: day
publication_date_method: metadata
publication_year: 2025
source_type: operational_cti
relevance_basis: campaign, actor, malware, or abuse investigation
statistical_use: incident_or_observation
primary_url: https://securelist.com/bluenoroff-apt-campaigns-ghostcall-and-ghosthire/117842/
all_urls: https://securelist.com/bluenoroff-apt-campaigns-ghostcall-and-ghosthire/117842/
retrieval_methods: direct
source_record_count: 1
max_token_count: 14611
tag_count: 96
metric_count: 2
ioc_count: 90
threat_groups: APT43 / Kimsuky|BlueNoroff|Lazarus Group|APT38|TA444|UNC1549
campaigns: GhostCall|GhostHire|Operation SyncHole
sectors: Cryptocurrency|Financial Services|Telecommunications|Transportation and Logistics
countries_or_regions: Africa|Brazil|France|India|Japan|Russia|United States
targets: Developers|Employees|Executives
attack_vectors: Credential theft|Spearphishing
ai_technologies: Deepfake / synthetic media|Generative AI
llm_providers: OpenAI
llm_models: ChatGPT|GPT-4
data_types: Credentials and passwords|Cryptocurrency keys or seed phrases|Documents and files|Source code
infrastructure: Browser|Email|Endpoint|Messaging platform|Mobile|Social media
actor_motivations: Disruption / destruction|Financial
mitre_tactics:
Command and Control|Credential Access|Defense Evasion|Discovery|Execution|Exfiltration|Impact|Initial Access|Persistence|Privilege Escalation|Reconnaissance|Resource Development

ttps:
CAPTCHA bypass|Command and control|Credential theft|Data exfiltration|Deepfake impersonation|Defense evasion|Fake website or service|Malware generation|PowerShell execution|Spearphishing|Target research / OSINT

ai_use_cases:
CAPTCHA bypass|Deepfake video or image|Identity fraud and impersonation|Malware development|Obfuscation and evasion|Reconnaissance and target research

malware_or_tools:
CoolClient backdoor|DownTroy malware|KANDYKORN malware|KONNI malware|NightLedger backdoor|ObjCShellZ malware|RooTroy backdoor|RustBucket malware|SugarLoader malware|SysPhon malware|SysPhone backdoor|TeamsClutch malware|TripleWatch stealer


publication_id: pub-040
primary_source_id: src-040
title: 2025 Unit 42 Global Incident Response Report: Social Engineering Edition
publisher: Palo Alto Networks Unit 42
publisher_domain: unit42.paloaltonetworks.com
publication_date: 2025-07-30
publication_date_precision: day
publication_date_method: metadata
publication_year: 2025
source_type: operational_cti
relevance_basis: campaign, actor, malware, or abuse investigation
statistical_use: incident_or_observation
retrieval_methods: direct
source_record_count: 1
max_token_count: 5771
tag_count: 65
metric_count: 16
ioc_count: 0
sectors: Financial Services|Government|Retail|Telecommunications
countries_or_regions: France|Iran|Japan|North Korea|Russia
targets: Employees|Executives
kill_chain_phases: Actions on Objectives|Command and Control|Delivery|Exploitation|Installation|Reconnaissance
attack_vectors: Business email compromise|Credential theft|Malicious advertisement|Smishing
ai_use_cases: CAPTCHA bypass|Identity fraud and impersonation|Reconnaissance and target research
ai_technologies: Agentic AI|Generative AI
llm_providers: Anthropic
llm_models: Claude
malware_or_tools: Lumma
data_types: Credentials and passwords|Documents and files|Session cookies or tokens
infrastructure: Browser|Cloud|Email|Endpoint|Mobile|SaaS|Social media
actor_motivations: Financial
impacts: Credential compromise|Data theft or exfiltration|Ransomware or extortion
primary_url:
https://unit42.paloaltonetworks.com/2025-unit-42-global-incident-response-report-social-engineering-edition/

all_urls:
https://unit42.paloaltonetworks.com/2025-unit-42-global-incident-response-report-social-engineering-edition/

mitre_tactics:
Command and Control|Credential Access|Execution|Exfiltration|Impact|Initial Access|Lateral Movement|Persistence|Reconnaissance

ttps:
Business email compromise|CAPTCHA bypass|Command and control|Credential harvesting|Credential theft|Data exfiltration|Malicious advertising|MFA/session-token theft|Phishing link or attachment|PowerShell execution


publication_id: pub-041
primary_source_id: src-041
title: AI Agents Are Here. So Are the Threats.
publisher: Palo Alto Networks Unit 42
publisher_domain: unit42.paloaltonetworks.com
publication_date: 2025-05-01
publication_date_precision: day
publication_date_method: metadata
publication_year: 2025
source_type: operational_cti
relevance_basis: campaign, actor, malware, or abuse investigation
statistical_use: incident_or_observation
primary_url: https://unit42.paloaltonetworks.com/agentic-ai-threats/
all_urls: https://unit42.paloaltonetworks.com/agentic-ai-threats/
retrieval_methods: direct
source_record_count: 1
max_token_count: 7275
tag_count: 45
metric_count: 2
ioc_count: 1
countries_or_regions: India|Japan
targets: Employees|Executives
kill_chain_phases: Actions on Objectives|Command and Control|Exploitation|Reconnaissance
attack_vectors: Credential theft
ai_use_cases: CAPTCHA bypass|Identity fraud and impersonation
ai_technologies: Agentic AI|Generative AI|Large language model
llm_providers: Anthropic
llm_models: Claude
data_types: Credentials and passwords|Documents and files|Source code
infrastructure: Browser|Cloud|Email|Endpoint|Mobile|SaaS
impacts: Data theft or exfiltration|Service disruption
evidence_landscape: Controlled study|Forecast or prediction|Incident response|Underground-market observation
mitre_tactics:
Command and Control|Credential Access|Discovery|Execution|Exfiltration|Lateral Movement|Privilege Escalation

ttps:
CAPTCHA bypass|Command and control|Credential harvesting|Credential theft|Data exfiltration|Prompt injection|Vulnerability scanning


publication_id: pub-042
primary_source_id: src-042
title: The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution
publisher: Palo Alto Networks Unit 42
publisher_domain: unit42.paloaltonetworks.com
publication_date: 2026-08-25
publication_date_precision: day
publication_date_method: metadata
publication_year: 2026
source_type: operational_cti
relevance_basis: campaign, actor, malware, or abuse investigation
statistical_use: incident_or_observation
primary_url: https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/
all_urls: https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/
retrieval_methods: direct
source_record_count: 1
max_token_count: 2787
tag_count: 61
metric_count: 13
ioc_count: 12
threat_groups: FunkSec
sectors: Artificial Intelligence|Critical Infrastructure|Cryptocurrency
countries_or_regions: China|India|Japan|South Korea
targets: Developers|Employees|Executives
kill_chain_phases: Actions on Objectives|Command and Control|Installation|Reconnaissance
attack_vectors: Credential theft
ai_technologies: Agentic AI|Large language model
llm_providers: Anthropic|OpenAI
llm_models: ChatGPT|Claude
malware_or_tools: FunkSec|FunkSec ransomware|JavaScript backdoor|Rhadamanthys|TuxBot
data_types: Credentials and passwords|Documents and files
infrastructure: Browser|Email|Endpoint|Mobile|SaaS
mitre_tactics:
Collection|Command and Control|Credential Access|Defense Evasion|Execution|Exfiltration|Impact|Initial Access|Persistence|Reconnaissance

ttps:
CAPTCHA bypass|Command and control|Credential harvesting|Credential theft|Data exfiltration|Defense evasion|PowerShell execution|Target research / OSINT

ai_use_cases:
CAPTCHA bypass|Identity fraud and impersonation|Malware development|Obfuscation and evasion|Reconnaissance and target research


publication_id: pub-043
primary_source_id: src-043
title: Analyzing the Current State of AI Use in Malware
publisher: Palo Alto Networks Unit 42
publisher_domain: unit42.paloaltonetworks.com
publication_date: 2026-03-19
publication_date_precision: day
publication_date_method: metadata
publication_year: 2026
source_type: operational_cti
relevance_basis: campaign, actor, malware, or abuse investigation
statistical_use: incident_or_observation
primary_url: https://unit42.paloaltonetworks.com/ai-use-in-malware/
all_urls: https://unit42.paloaltonetworks.com/ai-use-in-malware/
retrieval_methods: direct
source_record_count: 1
max_token_count: 4755
tag_count: 57
metric_count: 4
ioc_count: 4
countries_or_regions: China|India|Japan|South Korea
targets: Developers|Employees|Executives
kill_chain_phases: Actions on Objectives|Command and Control|Installation|Reconnaissance
attack_vectors: Credential theft
ai_technologies: Agentic AI|Generative AI|Large language model
llm_providers: Anthropic|OpenAI
llm_models: ChatGPT|Claude|GPT-4
data_types: Credentials and passwords|Documents and files
infrastructure: Browser|Email|Endpoint|Mobile|SaaS
impacts: Data theft or exfiltration|Ransomware or extortion
evidence_landscape: Forecast or prediction|In-the-wild observed|Incident response
manual_review_required: yes
mitre_tactics:
Collection|Command and Control|Credential Access|Defense Evasion|Discovery|Execution|Exfiltration|Impact|Lateral Movement|Persistence

ttps:
CAPTCHA bypass|Command and control|Credential harvesting|Credential theft|Data exfiltration|Defense evasion|Malware generation|Obfuscation|PowerShell execution|Target research / OSINT

ai_use_cases:
Autonomous or agentic intrusion|CAPTCHA bypass|Malware development|Obfuscation and evasion|Reconnaissance and target research


publication_id: pub-044
primary_source_id: src-044
title: Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks
publisher: Palo Alto Networks Unit 42
publisher_domain: unit42.paloaltonetworks.com
publication_date: 2026-07-30
publication_date_precision: day
publication_date_method: metadata
publication_year: 2026
source_type: operational_cti
relevance_basis: campaign, actor, malware, or abuse investigation
statistical_use: incident_or_observation
primary_url: https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/
all_urls: https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/
retrieval_methods: direct
source_record_count: 1
max_token_count: 3734
tag_count: 66
metric_count: 2
ioc_count: 3
campaigns: Operation Hermes Agent
sectors: Government
countries_or_regions: China|India|Japan|Russia|South Korea
targets: Employees|Executives|Security researchers
kill_chain_phases: Actions on Objectives|Command and Control|Delivery|Exploitation|Weaponization
mitre_tactics: Command and Control|Discovery|Execution|Exfiltration|Initial Access|Privilege Escalation
ttps: CAPTCHA bypass|Command and control|Data exfiltration|Exploit development|PowerShell execution
ai_use_cases: Autonomous or agentic intrusion|CAPTCHA bypass|Exploit development|Phishing and lure generation
ai_technologies: Generative AI|Large language model
llm_providers: Anthropic|DeepSeek|OpenAI
llm_models: ChatGPT|Claude|DeepSeek
data_types: Credentials and passwords|Documents and files
cves:
CVE-2023-33538|CVE-2025-0921|CVE-2025-40947|CVE-2025-40948|CVE-2025-68613|CVE-2026-0257|CVE-2026-0300|CVE-2026-1281|CVE-2026-1340|CVE-2026-1731|CVE-2026-21858|CVE-2026-3055|CVE-2026-31431|CVE-2026-33017|CVE-2026-33824|CVE-2026-34486|CVE-2026-39987


publication_id: pub-045
primary_source_id: src-045
publisher: Palo Alto Networks Unit 42
publisher_domain: unit42.paloaltonetworks.com
publication_date: 2026-08-04
publication_date_precision: day
publication_date_method: metadata
publication_year: 2026
source_type: operational_cti
relevance_basis: campaign, actor, malware, or abuse investigation
statistical_use: incident_or_observation
primary_url: https://unit42.paloaltonetworks.com/frontier-ai-vulnerability-burst/
all_urls: https://unit42.paloaltonetworks.com/frontier-ai-vulnerability-burst/
retrieval_methods: direct
source_record_count: 1
max_token_count: 3471
tag_count: 44
metric_count: 10
ioc_count: 0
countries_or_regions: China
targets: Developers|Employees|Executives
kill_chain_phases: Delivery|Exploitation|Reconnaissance
mitre_tactics: Credential Access|Discovery|Execution|Initial Access
ttps: CAPTCHA bypass|Credential theft|Exploit development|Supply-chain compromise|Vulnerability scanning
attack_vectors: Credential theft|Supply chain
ai_use_cases: Autonomous or agentic intrusion|CAPTCHA bypass|Exploit development|Vulnerability research
ai_technologies: Agentic AI|Generative AI
llm_providers: Anthropic|OpenAI
llm_models: ChatGPT|Claude
data_types: Credentials and passwords|Documents and files|Source code
infrastructure: Browser|Email|Endpoint|Messaging platform|SaaS
impacts: Ransomware or extortion|Service disruption
title:
The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software


publication_id: pub-046
primary_source_id: src-046
title: Fashionable Phishing Bait: GenAI on the Hook
publisher: Palo Alto Networks Unit 42
publisher_domain: unit42.paloaltonetworks.com
publication_date: 2025-08-19
publication_date_precision: day
publication_date_method: metadata
publication_year: 2025
source_type: operational_cti
relevance_basis: campaign, actor, malware, or abuse investigation
statistical_use: incident_or_observation
primary_url: https://unit42.paloaltonetworks.com/genai-phishing-bait/
all_urls: https://unit42.paloaltonetworks.com/genai-phishing-bait/
retrieval_methods: direct
source_record_count: 1
max_token_count: 2712
tag_count: 40
metric_count: 7
ioc_count: 0
threat_groups: Akira|Lazarus Group
sectors: Legal Services|Telecommunications
countries_or_regions: France|India|Japan|North Korea|Russia
targets: Employees|Executives
kill_chain_phases: Actions on Objectives|Delivery|Exploitation
mitre_tactics: Collection|Impact|Initial Access
ttps: Business email compromise|CAPTCHA bypass|Deepfake impersonation|Phishing link or attachment
attack_vectors: Business email compromise
ai_technologies: Agentic AI|Deepfake / synthetic media|Generative AI
data_types: Credentials and passwords|Documents and files
infrastructure: Browser|Email|Endpoint|Messaging platform|SaaS
impacts: Ransomware or extortion
ai_use_cases:
CAPTCHA bypass|Deepfake video or image|Identity fraud and impersonation|Phishing and lure generation


publication_id: pub-047
primary_source_id: src-047
publisher: Palo Alto Networks Unit 42
publisher_domain: unit42.paloaltonetworks.com
publication_date: 2026-01-22
publication_date_precision: day
publication_date_method: metadata
publication_year: 2026
source_type: operational_cti
relevance_basis: campaign, actor, malware, or abuse investigation
statistical_use: incident_or_observation
primary_url: https://unit42.paloaltonetworks.com/real-time-malicious-javascript-through-llms/
all_urls: https://unit42.paloaltonetworks.com/real-time-malicious-javascript-through-llms/
retrieval_methods: direct
source_record_count: 1
max_token_count: 3084
tag_count: 62
metric_count: 1
ioc_count: 0
threat_groups: APT28 / Fancy Bear|APT28
sectors: Cryptocurrency|Defense
countries_or_regions: China|France|India|Japan|Russia|South Korea|Ukraine
targets: Employees|Executives
kill_chain_phases: Actions on Objectives|Command and Control|Delivery
mitre_tactics: Command and Control|Credential Access|Defense Evasion|Execution|Exfiltration|Impact|Initial Access
attack_vectors: Credential theft
ai_technologies: Generative AI|Large language model
llm_providers: Anthropic|DeepSeek|Google
llm_models: Claude|DeepSeek|Gemini
malware_or_tools: LAMEHUG
data_types: Credentials and passwords|Documents and files
infrastructure: Browser|Cloud|Email|Endpoint|Mobile|SaaS
title:
The Next Frontier of Runtime Assembly Attacks: Leveraging LLMs to Generate Phishing JavaScript in Real Time

ttps:
CAPTCHA bypass|Command and control|Credential harvesting|Credential theft|Data exfiltration|Defense evasion|Malware generation|Obfuscation|Script generation

ai_use_cases:
CAPTCHA bypass|Identity fraud and impersonation|Malware development|Obfuscation and evasion|Phishing and lure generation|Translation and localization


publication_id: pub-048
primary_source_id: src-048
title: TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development
publisher: Palo Alto Networks Unit 42
publisher_domain: unit42.paloaltonetworks.com
publication_date: 2026-07-15
publication_date_precision: day
publication_date_method: metadata
publication_year: 2026
source_type: operational_cti
relevance_basis: campaign, actor, malware, or abuse investigation
statistical_use: incident_or_observation
primary_url: https://unit42.paloaltonetworks.com/tuxbot-v3-evolution-iot-botnet/
all_urls: https://unit42.paloaltonetworks.com/tuxbot-v3-evolution-iot-botnet/
retrieval_methods: direct
source_record_count: 1
max_token_count: 7197
tag_count: 74
metric_count: 12
ioc_count: 40
sectors: Cryptocurrency
countries_or_regions: India|Iran|Japan|South Korea
targets: Developers|Employees|Executives
kill_chain_phases: Actions on Objectives|Command and Control|Exploitation|Installation|Weaponization
attack_vectors: Credential theft
ai_use_cases: CAPTCHA bypass|Malware development
ai_technologies: Large language model
llm_providers: Anthropic
llm_models: Claude
malware_or_tools: IoT botnet|TuxBot
data_types: Credentials and passwords|Documents and files|Source code
infrastructure: Browser|Email|Endpoint|Mobile|SaaS
mitre_tactics:
Collection|Command and Control|Credential Access|Discovery|Execution|Exfiltration|Impact|Persistence|Resource Development

ttps:
CAPTCHA bypass|Command and control|Credential harvesting|Credential theft|Data exfiltration|Malware generation

cves:
CVE-2007-3010|CVE-2007-5693|CVE-2013-7471|CVE-2014-2321|CVE-2014-8361|CVE-2016-11021|CVE-2017-17215|CVE-2017-18377|CVE-2018-10561|CVE-2018-10562|CVE-2018-20062|CVE-2020-17456|CVE-2020-8515|CVE-2021-25646|CVE-2021-4045|CVE-2022-1388|CVE-2022-22947|CVE-2022-22965|CVE-2022-30525|CVE-2022-44877|CVE-2023-1389|CVE-2023-39780|CVE-2025-34037|CVE-2025-34117|CVE-2026-5815


publication_id: pub-049
primary_source_id: src-049
companion_source_ids: src-053
title: Disrupting the first reported AI-orchestrated cyber espionage campaign
publisher: Anthropic
publisher_domain: www-cdn.anthropic.com
publication_date: 2025-11-13
publication_date_precision: day
publication_date_method: publisher_verified_override
publication_year: 2025
source_type: provider_or_government_report
relevance_basis: AI misuse, abuse-disruption, or threat research report
statistical_use: incident_or_observation
primary_url: https://www.anthropic.com/news/disrupting-AI-espionage
retrieval_methods: direct
duplicate_group: dup-004
source_record_count: 2
max_token_count: 2761
tag_count: 50
metric_count: 6
ioc_count: 0
sectors: Financial Services|Government|Manufacturing
countries_or_regions: China
targets: Consumers or individuals|Developers|Employees|Executives
kill_chain_phases: Actions on Objectives|Command and Control|Exploitation|Installation|Reconnaissance|Weaponization
attack_vectors: Credential theft
ai_technologies: Agentic AI
llm_providers: Anthropic
llm_models: Claude
data_types: Credentials and passwords|Documents and files
infrastructure: Browser|Endpoint
actor_motivations: Espionage
all_urls:
https://www-cdn.anthropic.com/d7dd50dd1185f59be051b307150d877f2b82bd2c.pdf|https://www.anthropic.com/news/disrupting-AI-espionage

mitre_tactics:
Collection|Discovery|Execution|Exfiltration|Initial Access|Lateral Movement|Persistence|Privilege Escalation|Reconnaissance|Resource Development

ttps:
Credential harvesting|Credential theft|Data exfiltration|Exploit development|Malware generation|Vulnerability scanning

ai_use_cases:
Autonomous or agentic intrusion|Exploit development|Malware development|Reconnaissance and target research|Vulnerability research


publication_id: pub-052
primary_source_id: src-052
title: Detecting and countering misuse of AI: August 2025
publisher: Anthropic
publisher_domain: anthropic.com
publication_date: 2025-08-27
publication_date_precision: day
publication_date_method: publisher_verified_override
publication_year: 2025
source_type: provider_or_government_report
relevance_basis: AI misuse, abuse-disruption, or threat research report
statistical_use: incident_or_observation
primary_url: https://www.anthropic.com/news/detecting-countering-misuse-aug-2025
all_urls: https://www.anthropic.com/news/detecting-countering-misuse-aug-2025
retrieval_methods: direct
source_record_count: 1
max_token_count: 1867
tag_count: 35
metric_count: 3
ioc_count: 0
sectors: Cryptocurrency|Financial Services|Government|Technology|Telecommunications
countries_or_regions: North Korea|Vietnam
targets: Consumers or individuals|Developers|Employees|Executives
kill_chain_phases: Actions on Objectives|Exploitation|Reconnaissance
mitre_tactics: Execution|Exfiltration|Impact|Reconnaissance
ttps: Data exfiltration
ai_use_cases: Reconnaissance and target research
ai_technologies: Agentic AI|Large language model
llm_providers: Anthropic
llm_models: Claude
infrastructure: Browser|Email
impacts: Data theft or exfiltration|Financial fraud|Ransomware or extortion
data_types:
Credentials and passwords|Cryptocurrency keys or seed phrases|Documents and files|Financial and payment data


publication_id: pub-054
primary_source_id: src-054
title: Mapping AI-enabled cyber threats: Insights from the LLM ATT&CK Navigator
publisher: Anthropic
publisher_domain: anthropic.com
publication_date: 2026-06-03
publication_date_precision: day
publication_date_method: publisher_verified_override
publication_year: 2026
source_type: provider_or_government_report
relevance_basis: AI misuse, abuse-disruption, or threat research report
statistical_use: incident_or_observation
primary_url: https://www.anthropic.com/research/attack-navigator
all_urls: https://www.anthropic.com/research/attack-navigator
retrieval_methods: direct
source_record_count: 1
max_token_count: 4870
tag_count: 68
metric_count: 34
ioc_count: 0
sectors: Critical Infrastructure|Financial Services|Government
targets: Consumers or individuals|Developers
kill_chain_phases: Actions on Objectives|Command and Control|Delivery|Exploitation|Reconnaissance|Weaponization
attack_vectors: Spearphishing
ai_technologies: Agentic AI|Large language model
llm_providers: Anthropic
llm_models: Claude
data_types: Credentials and passwords|Cryptocurrency keys or seed phrases|Documents and files
infrastructure: Browser|Cloud|Endpoint
actor_motivations: Espionage
impacts: Data theft or exfiltration|Espionage|Ransomware or extortion
evidence_landscape: Forecast or prediction|In-the-wild observed
mitre_tactics:
Collection|Command and Control|Credential Access|Defense Evasion|Discovery|Execution|Exfiltration|Impact|Initial Access|Lateral Movement|Privilege Escalation|Reconnaissance|Resource Development

mitre_attack_ids:
T1003|T1005|T1020|T1021|T1021.004|T1027|T1055|T1078.003|T1087|T1210|T1505.003|T1560|T1562|T1566|T1587|T1587.001

ttps:
Command and control|Credential harvesting|Data exfiltration|Defense evasion|Malware generation|Obfuscation|Spearphishing

ai_use_cases:
Autonomous or agentic intrusion|Malware development|Obfuscation and evasion|Reconnaissance and target research


publication_id: pub-056
primary_source_id: src-056
publisher: CISA
publisher_domain: cisa.gov
publication_date: 2026-06-23
publication_date_precision: day
publication_date_method: metadata
publication_year: 2026
source_type: government_or_law_enforcement
relevance_basis: official advisory, fraud alert, or regional threat report
statistical_use: context_or_incident
primary_url: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-204a
all_urls: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-204a
retrieval_methods: jina_reader_proxy
source_record_count: 1
max_token_count: 10729
tag_count: 97
metric_count: 5
ioc_count: 24
threat_groups: TA488
campaigns: Operation GhostMail
sectors: Defense|Government|Nonprofit / NGO
countries_or_regions: Canada|France|Russia|Ukraine|United Kingdom|United States
targets: Developers|Employees|Executives
kill_chain_phases: Actions on Objectives|Command and Control|Delivery|Exploitation|Installation|Reconnaissance
attack_vectors: Spearphishing
ai_use_cases: Obfuscation and evasion|Reconnaissance and target research
data_types: Credentials and passwords|Documents and files|Session cookies or tokens
infrastructure: Browser|Email|Endpoint
impacts: Credential compromise|Data theft or exfiltration|Ransomware or extortion
cves: CVE-2025-66376
manual_review_required: yes
title:
Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite | CISA

mitre_tactics:
Collection|Command and Control|Credential Access|Defense Evasion|Discovery|Execution|Exfiltration|Initial Access|Persistence|Privilege Escalation|Reconnaissance|Resource Development

mitre_attack_ids:
T1027|T1027.010|T1027.013|T1027.017|T1048|T1048.002|T1048.003|T1074|T1074.002|T1078|T1087|T1098|T1114|T1114.002|T1119|T1185|T1199|T1203|T1550|T1550.004|T1556|T1556.006|T1557|T1560|T1566|T1583|T1583.003|T1587|T1587.001|T1587.004|T1588|T1588.002|T1588.007|T1589|T1589.001|T1589.002|T1593|T1595|T1596|T1596.005|T1597|T1597.002|T1608

ttps:
Command and control|Credential theft|Data exfiltration|MFA/session-token theft|Obfuscation|Password spraying|Phishing link or attachment|Spearphishing|Target research / OSINT


publication_id: pub-057
primary_source_id: src-057
title: Defending Against an Active Threat to Siemens S7 Series PLCs | CISA
publisher: CISA
publisher_domain: cisa.gov
publication_date: 2026-06-23
publication_date_precision: day
publication_date_method: metadata
publication_year: 2026
source_type: government_or_law_enforcement
relevance_basis: official advisory, fraud alert, or regional threat report
statistical_use: context_or_incident
primary_url: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a
all_urls: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a
retrieval_methods: jina_reader_proxy
source_record_count: 1
max_token_count: 3327
tag_count: 37
metric_count: 0
ioc_count: 0
sectors: Critical Infrastructure|Energy|Government
countries_or_regions: United States
targets: Executives
kill_chain_phases: Exploitation|Reconnaissance
mitre_attack_ids: T0821|T0834|T0849|T0893|T1587|T1587.004|T1588|T1588.007|T1596|T1596.005|T1694
ttps: Defense evasion|Exploit development|Script generation
ai_use_cases: Exploit development|Obfuscation and evasion|Reconnaissance and target research
data_types: Credentials and passwords|Documents and files
infrastructure: Email|Endpoint
impacts: Service disruption
manual_review_required: yes
content_quality: usable_machine_extraction
mitre_tactics:
Collection|Credential Access|Defense Evasion|Execution|Initial Access|Lateral Movement|Reconnaissance|Resource Development


publication_id: pub-058
primary_source_id: src-058
title: CrowdStrike 2024 Threat Hunting Report: Executive Summary
publisher: CrowdStrike
publisher_domain: crowdstrike.com
publication_date: 2024-08-20
publication_date_precision: day
publication_date_method: publisher_verified_override
publication_year: 2024
source_type: vendor_threat_report
relevance_basis: threat landscape, incident-response, or CTI report
statistical_use: context_or_observation
retrieval_methods: direct
source_record_count: 1
max_token_count: 1986
tag_count: 33
metric_count: 42
ioc_count: 0
threat_groups: Scattered Spider
countries_or_regions: North Korea|United States
targets: Consumers or individuals|Executives
kill_chain_phases: Actions on Objectives|Delivery|Exploitation|Installation
mitre_tactics: Defense Evasion|Exfiltration|Initial Access|Persistence
ttps: Data exfiltration|Defense evasion|Spearphishing
attack_vectors: Spearphishing
ai_use_cases: Obfuscation and evasion
data_types: Credentials and passwords
infrastructure: Browser|Cloud|Endpoint
actor_motivations: Financial|Hacktivism
impacts: Credential compromise|Data theft or exfiltration
manual_review_required: yes
content_quality: usable_machine_extraction
primary_url:
https://www.crowdstrike.com/en-us/press-releases/2024-crowdstrike-threat-hunting-report-highlights-nation-states-exploits/

all_urls:
https://www.crowdstrike.com/content/dam/crowdstrike/www/en-us/wp/2024/08/2024-Threat-Hunting-Executive-Report.pdf|https://www.crowdstrike.com/en-us/press-releases/2024-crowdstrike-threat-hunting-report-highlights-nation-states-exploits/

sectors:
Financial Services|Government|Healthcare|Hospitality|Technology|Telecommunications|Transportation and Logistics


publication_id: pub-059
primary_source_id: src-059
title: AI vs AI: The Cybersecurity Arms Race
publisher: CrowdStrike
publisher_domain: crowdstrike.com
publication_date: 2025-08-04
publication_date_precision: day
publication_date_method: text
publication_year: 2025
source_type: vendor_threat_report
relevance_basis: threat landscape, incident-response, or CTI report
statistical_use: context_or_observation
primary_url: https://www.crowdstrike.com/en-us/blog/ai-vs-ai-cybersecurity-arms-race/
all_urls: https://www.crowdstrike.com/en-us/blog/ai-vs-ai-cybersecurity-arms-race/
retrieval_methods: direct
source_record_count: 1
max_token_count: 3979
tag_count: 65
metric_count: 6
ioc_count: 0
sectors: Financial Services|Government
countries_or_regions: China
targets: Developers|Executives
attack_vectors: Business email compromise|Spearphishing|Supply chain|Vishing
ai_technologies: Agentic AI|Deepfake / synthetic media|Generative AI|Large language model
llm_providers: Anthropic|Microsoft|OpenAI
llm_models: Claude|Microsoft Copilot
malware_or_tools: PoisonIvy malware
data_types: Credentials and passwords|Documents and files
infrastructure: Browser|Email|Endpoint
impacts: Data theft or exfiltration|Ransomware or extortion
evidence_landscape: Incident response|Threat landscape report
mitre_tactics:
Command and Control|Credential Access|Defense Evasion|Discovery|Execution|Exfiltration|Initial Access|Lateral Movement|Persistence|Privilege Escalation|Reconnaissance

ttps:
Business email compromise|Command and control|Data exfiltration|Deepfake impersonation|Defense evasion|Obfuscation|PowerShell execution|Script generation|Spearphishing|Supply-chain compromise|Voice phishing / vishing

ai_use_cases:
Command and control|Deepfake video or image|Deepfake voice|Identity fraud and impersonation|Obfuscation and evasion|Reconnaissance and target research|Translation and localization|Vulnerability research


publication_id: pub-061
primary_source_id: src-061
title: CrowdStrike 2025 Threat Hunting Report: AI Becomes a Weapon and a Target
publisher: CrowdStrike
publisher_domain: crowdstrike.com
publication_date: 2025-08-04
publication_date_precision: day
publication_date_method: text
publication_year: 2025
source_type: vendor_threat_report
relevance_basis: threat landscape, incident-response, or CTI report
statistical_use: context_or_observation
primary_url: https://www.crowdstrike.com/en-us/blog/crowdstrike-2025-threat-hunting-report-ai-weapon-target/
all_urls: https://www.crowdstrike.com/en-us/blog/crowdstrike-2025-threat-hunting-report-ai-weapon-target/
retrieval_methods: direct
source_record_count: 1
max_token_count: 1967
tag_count: 66
metric_count: 16
ioc_count: 0
threat_groups: APT42 / Charming Kitten|Famous Chollima|Scattered Spider
sectors: Financial Services|Government|Telecommunications
countries_or_regions: China|North Korea|Russia
targets: Developers|Employees|Executives
kill_chain_phases: Actions on Objectives|Delivery|Exploitation|Installation|Weaponization
attack_vectors: Credential theft|Supply chain|Vishing
ai_technologies: Agentic AI|Deepfake / synthetic media|Generative AI|Large language model
llm_providers: Anthropic|Microsoft|OpenAI
llm_models: Claude|Microsoft Copilot
malware_or_tools: GenAI-built malware
data_types: Credentials and passwords|Documents and files|Personally identifiable information
infrastructure: Browser|Endpoint|SaaS
mitre_tactics:
Defense Evasion|Discovery|Execution|Exfiltration|Impact|Initial Access|Lateral Movement|Persistence|Resource Development

ttps:
Credential harvesting|Data exfiltration|Deepfake impersonation|Malware generation|Obfuscation|Ransomware deployment|Script generation|Supply-chain compromise|Voice phishing / vishing

ai_use_cases:
Deepfake video or image|Identity fraud and impersonation|Malware development|Obfuscation and evasion|Phishing and lure generation|Vulnerability research


publication_id: pub-063
primary_source_id: src-063
title: How cyber adversaries use GenAI in vulnerability research and cloud operations
publisher: CrowdStrike
publisher_domain: crowdstrike.com
publication_date: 2025
publication_date_precision: year
publication_date_method: publisher_verified_override
publication_year: 2025
source_type: vendor_threat_report
relevance_basis: threat landscape, incident-response, or CTI report
statistical_use: context_or_observation
retrieval_methods: direct
source_record_count: 1
max_token_count: 1058
tag_count: 22
metric_count: 1
ioc_count: 0
sectors: Critical Infrastructure|Government
countries_or_regions: Iran|United States
targets: Developers|Executives
kill_chain_phases: Actions on Objectives|Exploitation|Weaponization
mitre_tactics: Execution
ttps: Exploit development|Prompt injection
ai_use_cases: Exploit development|Vulnerability research
ai_technologies: Generative AI|Large language model
data_types: Credentials and passwords
infrastructure: Cloud|Endpoint
impacts: Data theft or exfiltration
evidence_landscape: Threat landscape report
cves: CVE-2024-3400
manual_review_required: yes
primary_url:
https://www.crowdstrike.com/en-us/resources/articles/crowdstrike-2025-global-threat-report-genai-exploits-cloud-attacks/

all_urls:
https://www.crowdstrike.com/en-us/resources/articles/crowdstrike-2025-global-threat-report-genai-exploits-cloud-attacks/


publication_id: pub-064
primary_source_id: src-064
title: How adversaries are using GenAI for social engineering attacks
publisher: CrowdStrike
publisher_domain: crowdstrike.com
publication_date: 2025
publication_date_precision: year
publication_date_method: publisher_verified_override
publication_year: 2025
source_type: vendor_threat_report
relevance_basis: threat landscape, incident-response, or CTI report
statistical_use: context_or_observation
retrieval_methods: direct
source_record_count: 1
max_token_count: 1015
tag_count: 39
metric_count: 4
ioc_count: 0
threat_groups: Famous Chollima
countries_or_regions: India|North Korea
targets: Developers|Employees|Executives
kill_chain_phases: Actions on Objectives|Delivery
mitre_tactics: Initial Access|Privilege Escalation
attack_vectors: Business email compromise|Credential theft|Spearphishing|Vishing
ai_use_cases: Deepfake video or image|Phishing and lure generation
ai_technologies: Agentic AI|Deepfake / synthetic media|Generative AI|Large language model
llm_providers: Anthropic|Google|OpenAI
llm_models: ChatGPT|Claude
malware_or_tools: GoldPickaxe malware
data_types: Credentials and passwords
infrastructure: Email|Endpoint|Mobile|Social media
evidence_landscape: Controlled study|Threat landscape report
primary_url:
https://www.crowdstrike.com/en-us/resources/articles/crowdstrike-2025-global-threat-report-genai-powers-social-engineering/

all_urls:
https://www.crowdstrike.com/en-us/resources/articles/crowdstrike-2025-global-threat-report-genai-powers-social-engineering/

ttps:
Business email compromise|Credential harvesting|Deepfake impersonation|Phishing link or attachment|Spearphishing|Voice phishing / vishing


publication_id: pub-065
primary_source_id: src-065
title: CrowdStrike 2024 Global Threat Report: Executive Summary
publisher: CrowdStrike
publisher_domain: crowdstrike.com
publication_date: 2024-02-21
publication_date_precision: day
publication_date_method: publisher_verified_override
publication_year: 2024
source_type: vendor_threat_report
relevance_basis: threat landscape, incident-response, or CTI report
statistical_use: context_or_observation
retrieval_methods: direct
source_record_count: 1
max_token_count: 2124
tag_count: 37
metric_count: 18
ioc_count: 0
threat_groups: APT28 / Fancy Bear|APT29 / Cozy Bear|Scattered Spider
sectors: Government
countries_or_regions: China|Israel|North Korea|United States
targets: Executives
kill_chain_phases: Actions on Objectives|Delivery|Exploitation|Installation
mitre_tactics: Collection|Discovery|Exfiltration|Initial Access|Lateral Movement|Persistence
ttps: Data exfiltration|Exploit development|MFA/session-token theft
ai_use_cases: Exploit development
ai_technologies: Generative AI
data_types: Credentials and passwords|Session cookies or tokens
infrastructure: Browser|Cloud|Endpoint|Messaging platform
actor_motivations: Hacktivism|Influence / information operations
impacts: Data theft or exfiltration|Ransomware or extortion|Service disruption
evidence_landscape: Forecast or prediction|Threat landscape report
primary_url:
https://www.crowdstrike.com/wp-content/uploads/2024/02/crowdstrike-2024-global-threat-report-executive-summary.pdf

all_urls:
https://www.crowdstrike.com/wp-content/uploads/2024/02/crowdstrike-2024-global-threat-report-executive-summary.pdf


publication_id: pub-067
primary_source_id: src-067
title: ESET Threat Report: Infostealers using AI & banking malware creating deepfake videos to steal money
publisher: ESET
publisher_domain: eset.com
publication_date: 2024-06-27
publication_date_precision: day
publication_date_method: text
publication_year: 2024
source_type: vendor_threat_report
relevance_basis: threat landscape, incident-response, or CTI report
statistical_use: context_or_observation
retrieval_methods: direct
source_record_count: 1
max_token_count: 1391
tag_count: 25
metric_count: 3
ioc_count: 0
sectors: Critical Infrastructure|Financial Services
countries_or_regions: Africa|Canada|Germany|Japan|United States
kill_chain_phases: Actions on Objectives|Exploitation
mitre_tactics: Impact
ttps: Deepfake impersonation
ai_use_cases: Deepfake video or image|Identity fraud and impersonation|Translation and localization
ai_technologies: Deepfake / synthetic media|Generative AI
llm_providers: Google|OpenAI
llm_models: Gemini
malware_or_tools: Lumma|Vidar
infrastructure: Browser|Endpoint|Mobile
impacts: Ransomware or extortion
manual_review_required: yes
content_quality: usable_machine_extraction
primary_url:
https://www.eset.com/us/about/newsroom/press-releases/eset-threat-report-infostealers-using-ai-banking-malware-creating-deepfake-videos-to-steal-money-2/

all_urls:
https://www.eset.com/us/about/newsroom/press-releases/eset-threat-report-infostealers-using-ai-banking-malware-creating-deepfake-videos-to-steal-money-2/


publication_id: pub-068
primary_source_id: src-068
title: Facing reality? Law enforcement and the challenge of deepfakes | Europol
publisher: Europol
publisher_domain: europol.europa.eu
publication_date: 2024-01
publication_date_precision: month
publication_date_method: text_month
publication_year: 2024
source_type: other
relevance_basis: requires manual relevance review
statistical_use: do_not_aggregate
retrieval_methods: jina_reader_proxy
source_record_count: 1
max_token_count: 4569
tag_count: 13
metric_count: 3
ioc_count: 0
countries_or_regions: European Union|France|Germany
targets: Executives
kill_chain_phases: Actions on Objectives|Exploitation
ttps: Deepfake impersonation
ai_use_cases: Deepfake video or image|Influence operations
ai_technologies: Deepfake / synthetic media
data_types: Documents and files
infrastructure: Email
actor_motivations: Influence / information operations
manual_review_required: yes
content_quality: usable_machine_extraction
analysis_inclusion: include_with_manual_validation
ai_relevance: core_ai_attack
ai_term_count: 13
primary_url:
https://www.europol.europa.eu/publications-events/publications/facing-reality-law-enforcement-and-challenge-of-deepfakes

all_urls:
https://www.europol.europa.eu/publications-events/publications/facing-reality-law-enforcement-and-challenge-of-deepfakes


publication_id: pub-069
primary_source_id: src-069
publisher: FBI
publisher_domain: fbi.gov
publication_date: 2025-12-19
publication_date_precision: day
publication_date_method: text
publication_year: 2025
source_type: government_or_law_enforcement
relevance_basis: official advisory, fraud alert, or regional threat report
statistical_use: context_or_incident
retrieval_methods: jina_reader_proxy
source_record_count: 1
max_token_count: 1258
tag_count: 22
metric_count: 0
ioc_count: 0
sectors: Cryptocurrency|Financial Services|Government
countries_or_regions: United States
targets: Employees
kill_chain_phases: Actions on Objectives|Delivery
mitre_tactics: Initial Access
ttps: Deepfake impersonation|Spearphishing|Voice phishing / vishing
attack_vectors: Smishing|Spearphishing|Vishing
ai_use_cases: Deepfake voice|Identity fraud and impersonation
ai_technologies: Speech or voice synthesis
data_types: Documents and files|Personally identifiable information
infrastructure: Email|Messaging platform
impacts: Financial fraud
manual_review_required: yes
content_quality: usable_machine_extraction
analysis_inclusion: include_with_manual_validation
title:
Senior U.S. Officials Continue To Be Impersonated in Malicious Messaging Campaign | Federal Bureau of Investigation

primary_url:
https://www.fbi.gov/investigate/cyber/alerts/2025/senior-us-officials-continue-to-be-impersonated-in-malicious-messaging-campaign

all_urls:
https://www.fbi.gov/investigate/cyber/alerts/2025/senior-us-officials-continue-to-be-impersonated-in-malicious-messaging-campaign


publication_id: pub-070
primary_source_id: src-070
publisher: FinCEN
publisher_domain: fincen.gov
publication_date: 2024-11-13
publication_date_precision: day
publication_date_method: metadata
publication_year: 2024
source_type: government_or_law_enforcement
relevance_basis: official advisory, fraud alert, or regional threat report
statistical_use: context_or_incident
retrieval_methods: direct
source_record_count: 1
max_token_count: 511
tag_count: 13
metric_count: 0
ioc_count: 0
sectors: Financial Services|Government
countries_or_regions: United States
targets: Consumers or individuals
kill_chain_phases: Actions on Objectives|Exploitation
mitre_tactics: Impact
ttps: Deepfake impersonation
ai_use_cases: Deepfake video or image
ai_technologies: Deepfake / synthetic media|Generative AI
data_types: Documents and files
impacts: Ransomware or extortion
manual_review_required: yes
content_quality: usable_machine_extraction
analysis_inclusion: include_with_manual_validation
ai_relevance: core_ai_attack
ai_term_count: 10
title:
FinCEN Issues Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions | FinCEN.gov

primary_url:
https://www.fincen.gov/news/news-releases/fincen-issues-alert-fraud-schemes-involving-deepfake-media-targeting-financial

all_urls:
https://www.fincen.gov/news/news-releases/fincen-issues-alert-fraud-schemes-involving-deepfake-media-targeting-financial


publication_id: pub-071
primary_source_id: src-071
publisher: Fortinet
publisher_domain: fortinet.com
publication_date: 2023-11-09
publication_date_precision: day
publication_date_method: metadata
publication_year: 2023
source_type: forecast_or_assessment
relevance_basis: threat assessment, forecast, or red-team study
statistical_use: context_only
retrieval_methods: direct
source_record_count: 1
max_token_count: 1356
tag_count: 18
metric_count: 1
ioc_count: 0
sectors: Energy|Transportation and Logistics
targets: Executives
kill_chain_phases: Actions on Objectives|Exploitation|Reconnaissance
mitre_tactics: Collection|Execution|Impact|Initial Access|Reconnaissance
ttps: Ransomware deployment
ai_use_cases: Reconnaissance and target research
ai_technologies: Generative AI
impacts: Ransomware or extortion|Service disruption
evidence_landscape: Forecast or prediction|Underground-market observation
manual_review_required: yes
content_quality: usable_machine_extraction
analysis_inclusion: include_with_manual_validation
ai_relevance: core_ai_attack
ai_term_count: 8
offense_term_count: 49
title:
Threat Predictions for 2024: Chained AI and CaaS Operations Give Attackers More “Easy” Buttons Than Ever | FortiGuard Labs

primary_url:
https://www.fortinet.com/blog/threat-research/2024-threat-predictions-chained-ai-and-caas-operations

all_urls:
https://www.fortinet.com/blog/threat-research/2024-threat-predictions-chained-ai-and-caas-operations


publication_id: pub-072
primary_source_id: src-072
title: Key Takeaways from the 2025 Global Threat Landscape Report | FortiGuard Labs
publisher: Fortinet
publisher_domain: fortinet.com
publication_date: 2025-04-28
publication_date_precision: day
publication_date_method: metadata
publication_year: 2025
source_type: vendor_threat_report
relevance_basis: threat landscape, incident-response, or CTI report
statistical_use: context_or_observation
retrieval_methods: direct
source_record_count: 1
max_token_count: 1221
tag_count: 52
metric_count: 9
ioc_count: 0
sectors: Artificial Intelligence|Critical Infrastructure
targets: Developers|Executives
attack_vectors: Credential theft
ai_use_cases: Deepfake video or image|Malware development|Reconnaissance and target research
ai_technologies: Deepfake / synthetic media
malicious_ai_tools: FraudGPT
malware_or_tools: Vidar
data_types: Credentials and passwords|Session cookies or tokens|Source code
infrastructure: Cloud|Email
actor_motivations: Espionage
impacts: Credential compromise|Data theft or exfiltration|Espionage|Ransomware or extortion
evidence_landscape: Forecast or prediction|Threat landscape report
cves: CVE-2017-0147|CVE-2019-18935|CVE-2021-44228
manual_review_required: yes
primary_url:
https://www.fortinet.com/blog/threat-research/key-takeaways-from-the-2025-global-threat-landscape-report

all_urls:
https://www.fortinet.com/blog/threat-research/key-takeaways-from-the-2025-global-threat-landscape-report

mitre_tactics:
Command and Control|Credential Access|Discovery|Execution|Exfiltration|Impact|Initial Access|Lateral Movement|Persistence|Reconnaissance|Resource Development

ttps:
Command and control|Credential harvesting|Credential theft|Data exfiltration|Deepfake impersonation|Malware generation|MFA/session-token theft|PowerShell execution


publication_id: pub-073
primary_source_id: src-073
title: Cyberthreat Predictions for 2025: An Annual Perspective from FortiGuard Labs
publisher: Fortinet
publisher_domain: fortinet.com
publication_date: 2024-11-21
publication_date_precision: day
publication_date_method: publisher_verified_override
publication_year: 2024
source_type: forecast_or_assessment
relevance_basis: threat assessment, forecast, or red-team study
statistical_use: context_only
retrieval_methods: direct
source_record_count: 1
max_token_count: 5200
tag_count: 61
metric_count: 11
ioc_count: 0
threat_groups: APT28 / Fancy Bear|APT29 / Cozy Bear|APT41|Black Basta|Lazarus Group|APT28|APT29|APT41
countries_or_regions: France|Russia|United States
targets: Employees|Executives
kill_chain_phases: Actions on Objectives|Delivery|Exploitation|Reconnaissance
mitre_tactics: Collection|Credential Access|Discovery|Impact|Initial Access|Reconnaissance
attack_vectors: Credential theft|Spearphishing|Vishing
ai_technologies: Deepfake / synthetic media|Large language model
malware_or_tools: BlackSuit ransomware
data_types: Credentials and passwords
infrastructure: Browser|Endpoint|Social media
actor_motivations: Disruption / destruction|Financial
impacts: Ransomware or extortion|Service disruption
manual_review_required: yes
content_quality: usable_machine_extraction
primary_url:
https://www.fortinet.com/uk/blog/threat-research/threat-predictions-for-2025-get-ready-for-bigger-bolder-attacks

all_urls:
https://www.fortinet.com/content/dam/fortinet/assets/threat-reports/report-threat-prediction-2025.pdf|https://www.fortinet.com/uk/blog/threat-research/threat-predictions-for-2025-get-ready-for-bigger-bolder-attacks

sectors:
Critical Infrastructure|Defense|Education|Energy|Financial Services|Government|Healthcare|Manufacturing|Transportation and Logistics

ttps:
Credential theft|Deepfake impersonation|Malware generation|Password spraying|Spearphishing|Voice phishing / vishing

ai_use_cases:
Deepfake video or image|Identity fraud and impersonation|Malware development|Reconnaissance and target research

evidence_landscape:
Controlled study|Forecast or prediction|Incident response|Threat landscape report|Underground-market observation


publication_id: pub-074
primary_source_id: src-074
title: International scientific report on the safety of advanced AI: interim report - GOV.UK
publisher: UK Government
publisher_domain: gov.uk
publication_date: 2025-10-22
publication_date_precision: day
publication_date_method: text
publication_year: 2025
source_type: forecast_or_assessment
relevance_basis: threat assessment, forecast, or red-team study
statistical_use: context_only
retrieval_methods: direct
source_record_count: 1
max_token_count: 75502
tag_count: 87
metric_count: 50
ioc_count: 26
targets: AI researchers and experts|Consumers or individuals|Developers|Employees|Executives
kill_chain_phases: Actions on Objectives|Delivery|Exploitation
mitre_tactics: Collection|Defense Evasion|Discovery|Execution|Initial Access|Privilege Escalation
ttps: Business email compromise|Deepfake impersonation|Defense evasion|Spearphishing
attack_vectors: Business email compromise|Spearphishing
llm_providers: Anthropic|Google|Meta|Microsoft|Mistral AI|OpenAI|xAI
llm_models: ChatGPT|Claude|Gemini|GPT-4|Llama|Microsoft Copilot|Mistral / Mixtral
malicious_ai_tools: FraudGPT|WormGPT
infrastructure: Browser|Email|Social media
actor_motivations: Influence / information operations
impacts: Service disruption
evidence_landscape: Controlled study|Forecast or prediction|In-the-wild observed
manual_review_required: yes
content_quality: usable_machine_extraction
primary_url:
https://www.gov.uk/government/publications/international-scientific-report-on-the-safety-of-advanced-ai/international-scientific-report-on-the-safety-of-advanced-ai-interim-report

all_urls:
https://www.gov.uk/government/publications/international-scientific-report-on-the-safety-of-advanced-ai/international-scientific-report-on-the-safety-of-advanced-ai-interim-report

sectors:
Artificial Intelligence|Defense|Education|Energy|Financial Services|Government|Healthcare|Hospitality|Legal Services|Nonprofit / NGO|Technology|Telecommunications|Transportation and Logistics

countries_or_regions:
Africa|Brazil|Canada|China|European Union|France|Germany|India|Israel|Japan|Ukraine|United Kingdom|United States

ai_use_cases:
Deepfake video or image|Deepfake voice|Identity fraud and impersonation|Influence operations|Obfuscation and evasion|Translation and localization|Vulnerability research

ai_technologies:
Agentic AI|Computer vision / OCR|Deepfake / synthetic media|Generative AI|Large language model|Speech or voice synthesis

data_types:
Credentials and passwords|Documents and files|Financial and payment data|Personally identifiable information


publication_id: pub-075
primary_source_id: src-075
publisher: IBM X-Force
publisher_domain: ibm.com
publication_date: 2025-04-02
publication_date_precision: day
publication_date_method: metadata
publication_year: 2025
source_type: vendor_threat_report
relevance_basis: threat landscape, incident-response, or CTI report
statistical_use: context_or_observation
primary_url: https://www.ibm.com/think/x-force/2024-x-force-threat-intelligence-index
all_urls: https://www.ibm.com/think/x-force/2024-x-force-threat-intelligence-index
retrieval_methods: direct
source_record_count: 1
max_token_count: 1564
tag_count: 18
metric_count: 13
ioc_count: 0
targets: Executives
kill_chain_phases: Actions on Objectives|Delivery|Exploitation
mitre_tactics: Discovery|Impact|Initial Access
ttps: Credential theft
ai_technologies: Generative AI
malware_or_tools: CL0P ransomware
data_types: Credentials and passwords|Documents and files
infrastructure: Browser
impacts: Credential compromise|Data theft or exfiltration|Ransomware or extortion
evidence_landscape: Incident response|Underground-market observation
manual_review_required: yes
content_quality: usable_machine_extraction
analysis_inclusion: include_with_manual_validation
title:
X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon | IBM


publication_id: pub-077
primary_source_id: src-077
title: Hive0137 on an AI journey | IBM
publisher: IBM X-Force
publisher_domain: ibm.com
publication_date: 2025-04-04
publication_date_precision: day
publication_date_method: metadata
publication_year: 2025
source_type: vendor_threat_report
relevance_basis: threat landscape, incident-response, or CTI report
statistical_use: context_or_observation
primary_url: https://www.ibm.com/think/x-force/hive0137-on-ai-journey
all_urls: https://www.ibm.com/think/x-force/hive0137-on-ai-journey
retrieval_methods: direct
source_record_count: 1
max_token_count: 3235
tag_count: 39
metric_count: 4
ioc_count: 8
threat_groups: TA571|TA577
campaigns: Operation Endgame
sectors: Hospitality
countries_or_regions: Russia
targets: Executives
kill_chain_phases: Actions on Objectives|Command and Control|Delivery|Installation
mitre_tactics: Collection|Command and Control|Defense Evasion|Execution|Impact|Initial Access
ai_technologies: Generative AI|Large language model
malware_or_tools: BlackBasta ransomware|DarkGate|NetSupport|NetSupport RAT
data_types: Credentials and passwords|Documents and files|Financial and payment data
infrastructure: Email
impacts: Ransomware or extortion
ttps:
Command and control|MFA/session-token theft|Obfuscation|Phishing link or attachment|PowerShell execution

ai_use_cases:
Malware development|Obfuscation and evasion|Phishing and lure generation|Translation and localization


publication_id: pub-078
primary_source_id: src-078
publisher: FBI IC3
publisher_domain: ic3.gov
publication_date: 2024-12-03
publication_date_precision: day
publication_date_method: metadata
publication_year: 2024
source_type: government_or_law_enforcement
relevance_basis: official advisory, fraud alert, or regional threat report
statistical_use: context_or_incident
primary_url: https://www.ic3.gov/PSA/2024/PSA241203
all_urls: https://www.ic3.gov/PSA/2024/PSA241203
retrieval_methods: direct
source_record_count: 1
max_token_count: 998
tag_count: 19
metric_count: 0
ioc_count: 0
sectors: Cryptocurrency|Financial Services|Government
targets: Executives
kill_chain_phases: Actions on Objectives|Delivery|Exploitation
mitre_tactics: Initial Access
ttps: Phishing link or attachment|Spearphishing
attack_vectors: Spearphishing
ai_use_cases: Identity fraud and impersonation
ai_technologies: Generative AI
data_types: Credentials and passwords|Documents and files
infrastructure: Email|Social media
impacts: Financial fraud|Ransomware or extortion
manual_review_required: yes
content_quality: usable_machine_extraction
title:
Internet Crime Complaint Center (IC3) | Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud


publication_id: pub-079
primary_source_id: src-079
title: INTERPOL report finds AI linked to more than half of cybercrime in Africa
publisher: INTERPOL
publisher_domain: interpol.int
publication_date: 2026-08-03
publication_date_precision: day
publication_date_method: text
publication_year: 2026
source_type: government_or_law_enforcement
relevance_basis: official advisory, fraud alert, or regional threat report
statistical_use: context_or_incident
retrieval_methods: direct
source_record_count: 1
max_token_count: 929
tag_count: 31
metric_count: 1
ioc_count: 0
campaigns: Operation Contender|Operation Red Card|Operation Sentinel|Operation Serengeti
sectors: Financial Services|Media|Telecommunications
countries_or_regions: Africa|France|United Kingdom
targets: Consumers or individuals
kill_chain_phases: Actions on Objectives|Delivery|Exploitation|Reconnaissance
mitre_tactics: Impact|Initial Access|Reconnaissance
ttps: Business email compromise|Credential harvesting
attack_vectors: Business email compromise|Credential theft
ai_use_cases: Deepfake video or image|Reconnaissance and target research
ai_technologies: Deepfake / synthetic media
data_types: Credentials and passwords|Documents and files
infrastructure: Email|Social media
impacts: Financial fraud|Ransomware or extortion
manual_review_required: yes
primary_url:
https://www.interpol.int/News-and-Events/News/2026/INTERPOL-report-finds-AI-linked-to-more-than-half-of-cybercrime-in-Africa

all_urls:
https://www.interpol.int/News-and-Events/News/2026/INTERPOL-report-finds-AI-linked-to-more-than-half-of-cybercrime-in-Africa


publication_id: pub-081
primary_source_id: src-081
title: Q1 2024 Threat Landscape Report: Insider Threat & Phishing Evolve Under AI Auspices
publisher: Kroll
publisher_domain: kroll.com
publication_date: 2024-05-22
publication_date_precision: day
publication_date_method: metadata
publication_year: 2024
source_type: other
relevance_basis: requires manual relevance review
statistical_use: do_not_aggregate
retrieval_methods: jina_reader_proxy
source_record_count: 1
max_token_count: 2970
tag_count: 43
metric_count: 12
ioc_count: 0
threat_groups: Akira|APT43 / Kimsuky
sectors: Financial Services|Telecommunications
targets: Employees|Executives
kill_chain_phases: Actions on Objectives|Command and Control|Delivery|Exploitation
mitre_tactics: Command and Control|Impact|Initial Access
attack_vectors: Business email compromise|Supply chain|Vishing
ai_use_cases: Deepfake video or image|Deepfake voice|Identity fraud and impersonation
ai_technologies: Deepfake / synthetic media|Speech or voice synthesis
malware_or_tools: AKIRA ransomware|DarkGate|PLAY ransomware
data_types: Credentials and passwords|Documents and files
infrastructure: Browser|Email|Mobile
actor_motivations: Financial
impacts: Ransomware or extortion
evidence_landscape: Forecast or prediction|Incident response|Threat landscape report
primary_url:
https://www.kroll.com/en/reports/cyber/threat-intelligence-reports/q1-2024-threat-landscape-report-insider-threat-phishing-evolve-under-ai

all_urls:
https://www.kroll.com/en/reports/cyber/threat-intelligence-reports/q1-2024-threat-landscape-report-insider-threat-phishing-evolve-under-ai

ttps:
Business email compromise|Command and control|Deepfake impersonation|Supply-chain compromise|Voice phishing / vishing


publication_id: pub-082
primary_source_id: src-082
title: Staying ahead of threat actors in the age of AI
publisher: Microsoft
publisher_domain: microsoft.com
publication_date: 2024-02-14
publication_date_precision: day
publication_date_method: metadata
publication_year: 2024
source_type: provider_or_government_report
relevance_basis: AI misuse, abuse-disruption, or threat research report
statistical_use: incident_or_observation
retrieval_methods: direct
source_record_count: 1
max_token_count: 3759
tag_count: 70
metric_count: 1
ioc_count: 0
threat_groups: APT28 / Fancy Bear|APT43 / Kimsuky|APT28|APT4
countries_or_regions: China|France|Iran|North Korea|Russia|Taiwan|Ukraine|United States
targets: Consumers or individuals|Developers|Executives
attack_vectors: Credential theft|Spearphishing
ai_technologies: Generative AI|Large language model
llm_providers: Microsoft|OpenAI
llm_models: ChatGPT|Microsoft Copilot
malware_or_tools: DeadLock ransomware
data_types: Credentials and passwords|Documents and files
infrastructure: Email|Messaging platform|Social media
actor_motivations: Financial
impacts: Ransomware or extortion
evidence_landscape: Controlled study|Forecast or prediction
cves: CVE-2022-30190
primary_url:
https://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai/

all_urls:
https://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai/

sectors:
Defense|Education|Financial Services|Government|Nonprofit / NGO|Technology|Transportation and Logistics

mitre_tactics:
Command and Control|Defense Evasion|Execution|Impact|Initial Access|Persistence|Reconnaissance|Resource Development

ttps:
CAPTCHA bypass|Command and control|Credential harvesting|Defense evasion|Malware generation|MFA/session-token theft|Spearphishing

ai_use_cases:
CAPTCHA bypass|Identity fraud and impersonation|Malware development|Obfuscation and evasion|Reconnaissance and target research|Translation and localization|Vulnerability research


publication_id: pub-083
primary_source_id: src-083
title: Cyber Signals Issue 6: AI Cyber Defense for Threats | Security Insider
publisher: Microsoft
publisher_domain: microsoft.com
publication_date: 2023-11
publication_date_precision: month
publication_date_method: text_month
publication_year: 2023
source_type: provider_or_government_report
relevance_basis: AI misuse, abuse-disruption, or threat research report
statistical_use: incident_or_observation
retrieval_methods: direct
source_record_count: 1
max_token_count: 2849
tag_count: 58
metric_count: 3
ioc_count: 1
threat_groups: APT43 / Kimsuky
sectors: Defense|Financial Services|Government|Nonprofit / NGO|Technology|Transportation and Logistics
countries_or_regions: Brazil|China|France|Iran|North Korea|Russia|Taiwan|United States
targets: Consumers or individuals|Developers|Employees
kill_chain_phases: Actions on Objectives|Delivery|Exploitation|Reconnaissance|Weaponization
mitre_tactics: Defense Evasion|Initial Access|Reconnaissance|Resource Development
attack_vectors: Smishing|Spearphishing|Vishing
ai_technologies: Deepfake / synthetic media|Generative AI|Large language model|Speech or voice synthesis
llm_providers: Microsoft|OpenAI
llm_models: ChatGPT|Microsoft Copilot
infrastructure: Browser|Email|Endpoint|Messaging platform
evidence_landscape: Controlled study|Forecast or prediction|Incident response
manual_review_required: yes
content_quality: usable_machine_extraction
primary_url:
https://www.microsoft.com/en-us/security/security-insider/threat-landscape/cyber-signals-issue-6-navigating-cyberthreats-and-strengthening-defenses

all_urls:
https://www.microsoft.com/en-us/security/security-insider/threat-landscape/cyber-signals-issue-6-navigating-cyberthreats-and-strengthening-defenses

ttps:
Deepfake impersonation|Defense evasion|Malware generation|Obfuscation|Prompt injection|Spearphishing|Voice phishing / vishing

ai_use_cases:
Deepfake video or image|Deepfake voice|Identity fraud and impersonation|Malware development|Obfuscation and evasion|Reconnaissance and target research


publication_id: pub-084
primary_source_id: src-084
title: Impact of AI on cyber threat from now to 2027 | National Cyber Security Centre
publisher: UK Government
publisher_domain: ncsc.gov.uk
publication_date: 2025-05-07
publication_date_precision: day
publication_date_method: metadata
publication_year: 2025
source_type: provider_or_government_report
relevance_basis: AI misuse, abuse-disruption, or threat research report
statistical_use: incident_or_observation
primary_url: https://www.ncsc.gov.uk/report/impact-ai-cyber-threat-now-2027
all_urls: https://www.ncsc.gov.uk/report/impact-ai-cyber-threat-now-2027
retrieval_methods: direct
source_record_count: 1
max_token_count: 2336
tag_count: 42
metric_count: 0
ioc_count: 0
sectors: Education|Government
targets: Developers
kill_chain_phases: Actions on Objectives|Delivery|Exploitation|Reconnaissance|Weaponization
mitre_tactics: Credential Access|Defense Evasion|Discovery|Exfiltration|Impact|Initial Access|Reconnaissance
attack_vectors: Credential theft|Supply chain
ai_technologies: Agentic AI|Generative AI
data_types: Credentials and passwords|Documents and files
infrastructure: Social media
actor_motivations: Disruption / destruction|Hacktivism|Influence / information operations
impacts: Data theft or exfiltration|Ransomware or extortion
evidence_landscape: Controlled study|Forecast or prediction
manual_review_required: yes
ttps:
Credential theft|Data exfiltration|Defense evasion|Exploit development|Malware generation|Prompt injection|Supply-chain compromise

ai_use_cases:
Exploit development|Influence operations|Malware development|Obfuscation and evasion|Reconnaissance and target research|Vulnerability research


publication_id: pub-085
primary_source_id: src-085
title: The near-term impact of AI on the cyber threat | National Cyber Security Centre
publisher: UK Government
publisher_domain: ncsc.gov.uk
publication_date: 2024-01-24
publication_date_precision: day
publication_date_method: metadata
publication_year: 2024
source_type: provider_or_government_report
relevance_basis: AI misuse, abuse-disruption, or threat research report
statistical_use: incident_or_observation
primary_url: https://www.ncsc.gov.uk/report/impact-of-ai-on-cyber-threat
all_urls: https://www.ncsc.gov.uk/report/impact-of-ai-on-cyber-threat
retrieval_methods: direct
source_record_count: 1
max_token_count: 2470
tag_count: 36
metric_count: 0
ioc_count: 0
sectors: Education|Government
kill_chain_phases: Actions on Objectives|Delivery|Exploitation|Reconnaissance|Weaponization
mitre_tactics: Defense Evasion|Exfiltration|Impact|Initial Access|Lateral Movement|Reconnaissance
ttps: Data exfiltration|Defense evasion|Exploit development|Malware generation|Spearphishing
attack_vectors: Spearphishing
ai_technologies: Agentic AI|Generative AI|Large language model
data_types: Credentials and passwords|Documents and files
infrastructure: Email|Social media
actor_motivations: Hacktivism
impacts: Data theft or exfiltration|Ransomware or extortion
evidence_landscape: Forecast or prediction
manual_review_required: yes
ai_use_cases:
Exploit development|Malware development|Obfuscation and evasion|Reconnaissance and target research|Translation and localization|Vulnerability research


publication_id: pub-087
primary_source_id: src-087
title: SugarGh0st RAT Targets American AI Experts
publisher: Proofpoint
publisher_domain: proofpoint.com
publication_date: 2024-05-14
publication_date_precision: day
publication_date_method: metadata
publication_year: 2024
source_type: operational_cti
relevance_basis: campaign, actor, malware, or abuse investigation
statistical_use: incident_or_observation
retrieval_methods: direct
source_record_count: 1
max_token_count: 1760
tag_count: 40
metric_count: 4
ioc_count: 6
threat_groups: SweetSpecter
sectors: Artificial Intelligence|Education|Financial Services|Government|Media|Telecommunications
countries_or_regions: Africa|China|United States
targets: AI researchers and experts|Employees|Executives
kill_chain_phases: Actions on Objectives|Command and Control|Delivery|Installation
mitre_tactics: Command and Control|Discovery|Execution|Exfiltration|Impact|Initial Access|Persistence
ttps: Command and control|Data exfiltration|Spearphishing
attack_vectors: Spearphishing
ai_technologies: Agentic AI|Generative AI
llm_providers: Anthropic
llm_models: Claude
malware_or_tools: SugarGh0st|SugarGh0st RAT
data_types: Credentials and passwords|Documents and files
infrastructure: Email|Endpoint
primary_url:
https://www.proofpoint.com/us/blog/threat-insight/security-brief-artificial-sweetener-sugargh0st-rat-used-target-american

all_urls:
https://www.proofpoint.com/us/blog/threat-insight/security-brief-artificial-sweetener-sugargh0st-rat-used-target-american


publication_id: pub-088
primary_source_id: src-088
title: TA547 Targets German Organizations: Rhadamanthys Stealer
publisher: Proofpoint
publisher_domain: proofpoint.com
publication_date: 2024-04-03
publication_date_precision: day
publication_date_method: metadata
publication_year: 2024
source_type: operational_cti
relevance_basis: campaign, actor, malware, or abuse investigation
statistical_use: incident_or_observation
retrieval_methods: direct
source_record_count: 1
max_token_count: 1612
tag_count: 48
metric_count: 0
ioc_count: 3
threat_groups: TA547|TA547
sectors: Financial Services|Government
countries_or_regions: Africa|Germany
targets: Employees|Executives
kill_chain_phases: Actions on Objectives|Command and Control|Delivery
mitre_tactics: Command and Control|Discovery|Execution|Exfiltration|Impact|Initial Access
ttps: Business email compromise|Command and control|Data exfiltration|PowerShell execution
attack_vectors: Business email compromise
ai_use_cases: Identity fraud and impersonation|Malware development|Phishing and lure generation
ai_technologies: Agentic AI|Generative AI|Large language model
llm_providers: Anthropic|Google|Microsoft|OpenAI
llm_models: ChatGPT|Claude|Gemini|Microsoft Copilot
malware_or_tools: Lumma|NetSupport|NetSupport RAT|Rhadamanthys|StealC
data_types: Credentials and passwords|Documents and files
primary_url:
https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta547-targets-german-organizations-rhadamanthys-stealer

all_urls:
https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta547-targets-german-organizations-rhadamanthys-stealer


publication_id: pub-090
primary_source_id: src-090
title: How Social Engineering Attacks Are Evolving in 2025
publisher: Rapid7
publisher_domain: rapid7.com
publication_date: 2025-07-02
publication_date_precision: day
publication_date_method: metadata
publication_year: 2025
source_type: vendor_threat_report
relevance_basis: threat landscape, incident-response, or CTI report
statistical_use: context_or_observation
retrieval_methods: direct
source_record_count: 1
max_token_count: 1734
tag_count: 25
metric_count: 0
ioc_count: 0
threat_groups: Black Basta|Scattered Spider
sectors: Transportation and Logistics
kill_chain_phases: Actions on Objectives|Delivery|Exploitation
mitre_tactics: Exfiltration|Impact|Initial Access|Lateral Movement
ttps: Credential harvesting|Data exfiltration|MFA/session-token theft|Phishing link or attachment
attack_vectors: Credential theft
ai_use_cases: Identity fraud and impersonation
ai_technologies: Generative AI
data_types: Credentials and passwords|Documents and files
infrastructure: Email|Endpoint|Messaging platform
impacts: Data theft or exfiltration|Ransomware or extortion
evidence_landscape: Incident response
manual_review_required: yes
content_quality: usable_machine_extraction
primary_url:
https://www.rapid7.com/blog/post/3-ways-social-engineering-is-evolving-and-what-security-teams-must-do-next/

all_urls:
https://www.rapid7.com/blog/post/3-ways-social-engineering-is-evolving-and-what-security-teams-must-do-next/


publication_id: pub-091
primary_source_id: src-091
title: How LLMs Like WormGPT Are Reshaping Cybercrime in 2025
publisher: Rapid7
publisher_domain: rapid7.com
publication_date: 2025-06-26
publication_date_precision: day
publication_date_method: metadata
publication_year: 2025
source_type: vendor_threat_report
relevance_basis: threat landscape, incident-response, or CTI report
statistical_use: context_or_observation
retrieval_methods: direct
source_record_count: 1
max_token_count: 2213
tag_count: 52
metric_count: 2
ioc_count: 0
campaigns: Operation ASTERIX
sectors: Critical Infrastructure
countries_or_regions: Iran|Israel
targets: Employees|Executives
kill_chain_phases: Actions on Objectives|Delivery|Exploitation|Reconnaissance|Weaponization
mitre_tactics: Credential Access|Defense Evasion|Impact|Initial Access|Reconnaissance
attack_vectors: Business email compromise|Credential theft
ai_technologies: Deepfake / synthetic media|Generative AI|Large language model
llm_providers: Hugging Face|Mistral AI|OpenAI|xAI
llm_models: ChatGPT|Grok|Mistral / Mixtral
malicious_ai_tools: DarkBERT|FraudGPT|WormGPT
data_types: Credentials and passwords
infrastructure: Email
actor_motivations: Disruption / destruction|Influence / information operations
primary_url:
https://www.rapid7.com/blog/post/ai-goes-on-offense-how-llms-are-redefining-the-cybercrime-landscape/

all_urls:
https://www.rapid7.com/blog/post/ai-goes-on-offense-how-llms-are-redefining-the-cybercrime-landscape/

ttps:
Business email compromise|Credential theft|Deepfake impersonation|Exploit development|Malware generation|Obfuscation

ai_use_cases:
Deepfake video or image|Exploit development|Identity fraud and impersonation|Influence operations|Malware development|Obfuscation and evasion|Reconnaissance and target research


publication_id: pub-092
primary_source_id: src-092
title: Emerging Trends in AI-Related Cyberthreats in 2025 - Rapid7 Blog
publisher: Rapid7
publisher_domain: rapid7.com
publication_date: 2025-06-23
publication_date_precision: day
publication_date_method: metadata
publication_year: 2025
source_type: vendor_threat_report
relevance_basis: threat landscape, incident-response, or CTI report
statistical_use: context_or_observation
retrieval_methods: direct
source_record_count: 1
max_token_count: 1996
tag_count: 55
metric_count: 0
ioc_count: 0
threat_groups: APT28 / Fancy Bear|APT31|CyberAv3ngers|FunkSec|Lazarus Group|RansomHub|SweetSpecter|APT28|APT31
campaigns: Operation ASTERIX
countries_or_regions: China|Russia
targets: Employees|Executives
kill_chain_phases: Actions on Objectives|Delivery|Exploitation|Reconnaissance|Weaponization
mitre_tactics: Defense Evasion|Impact|Initial Access|Reconnaissance|Resource Development
attack_vectors: Business email compromise|Spearphishing
ai_technologies: Deepfake / synthetic media|Generative AI|Large language model
llm_providers: Hugging Face|OpenAI
malicious_ai_tools: FraudGPT|Nytheon AI|WormGPT
malware_or_tools: FunkSec
data_types: Documents and files
infrastructure: Email|Messaging platform
actor_motivations: Hacktivism|Influence / information operations
primary_url:
https://www.rapid7.com/blog/post/emerging-trends-in-ai-related-cyberthreats-in-2025-impacts-on-organizational-cybersecurity/

all_urls:
https://www.rapid7.com/blog/post/emerging-trends-in-ai-related-cyberthreats-in-2025-impacts-on-organizational-cybersecurity/

ttps:
Business email compromise|Deepfake impersonation|Defense evasion|Malware generation|Ransomware deployment|Spearphishing

ai_use_cases:
Deepfake video or image|Identity fraud and impersonation|Influence operations|Malware development|Obfuscation and evasion|Reconnaissance and target research


publication_id: pub-094
primary_source_id: src-094
companion_source_ids: src-093
title: The Q3 2025 Threat Landscape Report
publisher: Rapid7
publisher_domain: rapid7.com
publication_date: 2025-11-12
publication_date_precision: day
publication_date_method: publisher_verified_override
publication_year: 2025
source_type: vendor_threat_report
relevance_basis: threat landscape, incident-response, or CTI report
statistical_use: context_or_observation
primary_url: https://www.rapid7.com/research/report/threat-landscape-report-2025-q3/
retrieval_methods: direct
duplicate_group: dup-005
source_record_count: 2
max_token_count: 6040
tag_count: 130
metric_count: 10
ioc_count: 0
countries_or_regions: Canada|China|France|Germany|Iran|North Korea|Russia|Ukraine|United States
targets: Developers|Employees
mitre_attack_ids: T1003|T1018|T1021|T1047|T1059|T1078|T1087|T1133|T1560|T1566
attack_vectors: Credential theft|Spearphishing|Supply chain|Vishing
ai_technologies: Deepfake / synthetic media|Generative AI|Large language model
malware_or_tools: BRICKSTORM backdoor|FunkSec|LAMEHUG
data_types: Credentials and passwords|Cryptocurrency keys or seed phrases|Documents and files|Source code
infrastructure: Browser|Email|Endpoint|SaaS
actor_motivations: Disruption / destruction|Financial|Influence / information operations
impacts: Credential compromise|Data theft or exfiltration|Ransomware or extortion
manual_review_required: yes
all_urls:
https://www.rapid7.com/blog/post/tr-rapid7-q3-2025-threat-landscape-report/|https://www.rapid7.com/cdn/assets/bltbd2f1cd70f9e3e7f/691360b9c91291146f1a5308/threat-landscape-report-q3-2025.pdf|https://www.rapid7.com/research/report/threat-landscape-report-2025-q3/

threat_groups:
Akira|APT29 / Cozy Bear|APT41|APT43 / Kimsuky|APT44 / Sandworm|Black Basta|Famous Chollima|FunkSec|Lazarus Group|RansomHub|APT29|APT41|STORM-1175|UNC5221

sectors:
Critical Infrastructure|Cryptocurrency|Defense|Financial Services|Government|Healthcare|Legal Services|Technology|Telecommunications|Transportation and Logistics

mitre_tactics:
Collection|Command and Control|Credential Access|Defense Evasion|Discovery|Execution|Exfiltration|Impact|Initial Access|Lateral Movement|Persistence|Reconnaissance|Resource Development

ttps:
Command and control|Credential theft|Data exfiltration|Deepfake impersonation|Defense evasion|Malware generation|PowerShell execution|Ransomware deployment|Spearphishing|Supply-chain compromise|Voice phishing / vishing

ai_use_cases:
Deepfake video or image|Deepfake voice|Identity fraud and impersonation|Influence operations|Malware development|Obfuscation and evasion|Reconnaissance and target research

evidence_landscape:
Controlled study|Forecast or prediction|In-the-wild observed|Incident response|Proof of concept|Threat landscape report|Underground-market observation

cves:
CVE-2007-0671|CVE-2018-0296|CVE-2025-10035|CVE-2025-20333|CVE-2025-20362|CVE-2025-20363|CVE-2025-49704|CVE-2025-49706|CVE-2025-53770|CVE-2025-53771|CVE-2025-54309|CVE-2025-7775|CVE-2026-18577|CVE-2026-19490|CVE-2026-63077|CVE-2026-63520


publication_id: pub-096
primary_source_id: src-096
title: 2025 Cloud Threat Hunting and Defense Landscape
publisher: Recorded Future
publisher_domain: recordedfuture.com
publication_date: 2025-10-24
publication_date_precision: day
publication_date_method: text
publication_year: 2025
source_type: vendor_threat_report
relevance_basis: threat landscape, incident-response, or CTI report
statistical_use: context_or_observation
primary_url: https://www.recordedfuture.com/research/2025-cloud-threat-hunting-defense-landscape
all_urls: https://www.recordedfuture.com/research/2025-cloud-threat-hunting-defense-landscape
retrieval_methods: direct
source_record_count: 1
max_token_count: 19098
tag_count: 112
metric_count: 7
ioc_count: 4
threat_groups: APT28 / Fancy Bear|APT41|Scattered Spider|APT28|APT41|STORM-0501|UNC3944|UNC4841
campaigns: Operation SalmonSlalom
countries_or_regions: Brazil|Canada|China|France|Germany|Iran|Japan|North Korea|Russia|Taiwan|Ukraine|United States
targets: Consumers or individuals|Developers|Employees|Executives
kill_chain_phases: Actions on Objectives|Command and Control|Delivery|Exploitation|Installation|Reconnaissance
attack_vectors: Business email compromise|Credential theft|Spearphishing|Supply chain
ai_technologies: Large language model
llm_providers: Hugging Face|OpenAI
llm_models: ChatGPT
malware_or_tools: FatalRAT backdoor|LAMEHUG
infrastructure: Browser|Cloud|Email|Endpoint|Messaging platform|SaaS
actor_motivations: Espionage|Financial
sectors:
Cryptocurrency|Education|Financial Services|Government|Telecommunications|Transportation and Logistics

mitre_tactics:
Collection|Command and Control|Credential Access|Defense Evasion|Discovery|Execution|Exfiltration|Impact|Initial Access|Lateral Movement|Persistence|Privilege Escalation|Reconnaissance|Resource Development

ttps:
Business email compromise|Command and control|Credential theft|Data exfiltration|Defense evasion|Fake website or service|MFA/session-token theft|Obfuscation|Password spraying|PowerShell execution|Spearphishing|Supply-chain compromise

ai_use_cases:
Identity fraud and impersonation|Obfuscation and evasion|Reconnaissance and target research|Translation and localization|Vulnerability research

data_types:
Credentials and passwords|Cryptocurrency keys or seed phrases|Documents and files|Financial and payment data|Personally identifiable information|Session cookies or tokens|Source code

impacts:
Credential compromise|Data theft or exfiltration|Espionage|Ransomware or extortion|Service disruption

cves:
CVE-2021-26855|CVE-2021-26857|CVE-2021-26858|CVE-2021-27065|CVE-2021-43798|CVE-2023-2868|CVE-2023-3519|CVE-2023-7102|CVE-2024-3400|CVE-2025-0282|CVE-2025-61882


publication_id: pub-098
primary_source_id: src-098
title: Adversarial Intelligence: Red Teaming Malicious Use Cases for AI
publisher: Recorded Future
publisher_domain: recordedfuture.com
publication_date_precision: unknown
publication_date_method: unknown
source_type: forecast_or_assessment
relevance_basis: threat assessment, forecast, or red-team study
statistical_use: context_only
primary_url: https://www.recordedfuture.com/research/adversarial-intelligence-red-teaming-malicious-use-cases-ai
all_urls: https://www.recordedfuture.com/research/adversarial-intelligence-red-teaming-malicious-use-cases-ai
retrieval_methods: direct
source_record_count: 1
max_token_count: 414
tag_count: 21
metric_count: 0
ioc_count: 0
targets: Developers|Executives
kill_chain_phases: Actions on Objectives|Reconnaissance
mitre_tactics: Collection|Defense Evasion|Reconnaissance
ttps: Deepfake impersonation|Defense evasion|Obfuscation
ai_technologies: Deepfake / synthetic media|Generative AI|Large language model
data_types: Source code
actor_motivations: Influence / information operations
manual_review_required: yes
content_quality: usable_machine_extraction
analysis_inclusion: include_with_manual_validation
ai_relevance: core_ai_attack
ai_term_count: 19
offense_term_count: 16
ai_use_cases:
Deepfake video or image|Identity fraud and impersonation|Influence operations|Obfuscation and evasion|Reconnaissance and target research|Translation and localization


publication_id: pub-105
primary_source_id: src-105
title: Predator AI | ChatGPT-Powered Infostealer Takes Aim at Cloud Platforms | SentinelOne
publisher: SentinelOne
publisher_domain: sentinelone.com
publication_date: 2023-11-07
publication_date_precision: day
publication_date_method: metadata
publication_year: 2023
source_type: operational_cti
relevance_basis: campaign, actor, malware, or abuse investigation
statistical_use: incident_or_observation
retrieval_methods: direct
source_record_count: 1
max_token_count: 2247
tag_count: 28
metric_count: 0
ioc_count: 2
sectors: Telecommunications
countries_or_regions: Africa|India|Iran|Japan|Russia|United Kingdom|United States
targets: Developers|Executives
kill_chain_phases: Command and Control|Delivery
mitre_tactics: Command and Control|Discovery|Execution|Initial Access
ttps: Command and control
llm_providers: OpenAI
llm_models: ChatGPT
malicious_ai_tools: Predator AI
data_types: Credentials and passwords|Documents and files
infrastructure: Browser|Cloud|Email|Messaging platform|Mobile|Social media
manual_review_required: yes
content_quality: usable_machine_extraction
analysis_inclusion: include_with_manual_validation
primary_url:
https://www.sentinelone.com/labs/predator-ai-chatgpt-powered-infostealer-takes-aim-at-cloud-platforms/

all_urls:
https://www.sentinelone.com/labs/predator-ai-chatgpt-powered-infostealer-takes-aim-at-cloud-platforms/


publication_id: pub-107
primary_source_id: src-107
title: The Sophos Annual Threat Report: Cybercrime on Main Street 2025
publisher: Sophos
publisher_domain: sophos.com
publication_date: 2025-04-16
publication_date_precision: day
publication_date_method: metadata
publication_year: 2025
source_type: vendor_threat_report
relevance_basis: threat landscape, incident-response, or CTI report
statistical_use: context_or_observation
primary_url: https://www.sophos.com/en-us/blog/the-sophos-annual-threat-report-cybercrime-on-main-street-2025
all_urls: https://www.sophos.com/en-us/blog/the-sophos-annual-threat-report-cybercrime-on-main-street-2025
retrieval_methods: jina_reader_proxy
source_record_count: 1
max_token_count: 5362
tag_count: 73
metric_count: 13
ioc_count: 0
threat_groups: Akira|RansomHub
sectors: Cryptocurrency
targets: Developers|Employees|Executives
kill_chain_phases: Actions on Objectives|Command and Control|Delivery|Exploitation|Installation
attack_vectors: Business email compromise|Credential theft|Malicious advertisement|Vishing
ai_use_cases: Obfuscation and evasion
ai_technologies: Generative AI|Large language model
llm_providers: OpenAI
llm_models: ChatGPT
malware_or_tools: Cobalt Strike|DanaBot|Lumma|Mimikatz|RansomHub ransomware|SystemBC malware
data_types: Credentials and passwords|Documents and files|Session cookies or tokens
infrastructure: Browser|Email|Endpoint|Messaging platform|Social media
mitre_tactics:
Collection|Command and Control|Credential Access|Defense Evasion|Discovery|Execution|Exfiltration|Impact|Initial Access|Lateral Movement|Persistence

ttps:
Business email compromise|Command and control|Credential theft|Data exfiltration|Defense evasion|Malicious advertising|MFA/session-token theft|Obfuscation|Phishing link or attachment|Voice phishing / vishing

cves:
CVE-2021-34473|CVE-2023-27532|CVE-2023-3519|CVE-2023-48788|CVE-2023-4966|CVE-2024-1709|CVE-2024-21762|CVE-2024-27198|CVE-2024-3400|CVE-2024-37085|CVE-2024-4071|CVE-2024-40711


publication_id: pub-109
primary_source_id: src-109
title: Cybersecurity as a Service Delivered | Sophos
publisher: Sophos
publisher_domain: sophos.com
publication_date: 2023
publication_date_precision: year
publication_date_method: url_year_only
publication_year: 2023
source_type: vendor_threat_report
relevance_basis: threat landscape, incident-response, or CTI report
statistical_use: context_or_observation
retrieval_methods: jina_reader_proxy
source_record_count: 1
max_token_count: 848
tag_count: 2
metric_count: 1
ioc_count: 2
data_types: Personally identifiable information
infrastructure: Browser
manual_review_required: yes
content_quality: invalid_error_page
analysis_inclusion: exclude
ai_relevance: core_ai_attack
ai_term_count: 2
offense_term_count: 2
primary_url:
https://www.sophos.com/en-us/press/press-releases/2023/11/sophos-anticipates-ai-based-attack-techniques-and-prepares-detections

all_urls:
https://www.sophos.com/en-us/press/press-releases/2023/11/sophos-anticipates-ai-based-attack-techniques-and-prepares-detections


publication_id: pub-111
primary_source_id: src-111
title: 2025 APT Report: Staying Ahead of the Modern Threat Landscape
publisher: Trend Micro
publisher_domain: trendmicro.com
publication_date: 2026-04-16
publication_date_precision: day
publication_date_method: publisher_verified_override
publication_year: 2026
source_type: vendor_threat_report
relevance_basis: threat landscape, incident-response, or CTI report
statistical_use: context_or_observation
retrieval_methods: direct
source_record_count: 1
max_token_count: 3665
tag_count: 30
metric_count: 1
ioc_count: 0
sectors: Government
countries_or_regions: China|Germany|North Korea|Russia
targets: Executives
kill_chain_phases: Actions on Objectives|Delivery|Exploitation|Reconnaissance
mitre_tactics: Impact|Initial Access|Lateral Movement|Privilege Escalation|Reconnaissance
ttps: Business email compromise|Prompt injection
attack_vectors: Business email compromise
ai_use_cases: Reconnaissance and target research
ai_technologies: Agentic AI|Generative AI|Large language model
data_types: Documents and files
infrastructure: Browser|Cloud|Email|Endpoint
impacts: Ransomware or extortion
evidence_landscape: Controlled study|Forecast or prediction
manual_review_required: yes
primary_url:
https://www.trendmicro.com/vinfo/de/security/news/cybercrime-and-digital-threats/2025-apt-report-staying-ahead-of-the-modern-threat-landscape

all_urls:
https://www.trendmicro.com/vinfo/de/security/news/cybercrime-and-digital-threats/2025-apt-report-staying-ahead-of-the-modern-threat-landscape


publication_id: pub-112
primary_source_id: src-112
title: Back to the Hype: An Update on How Cybercriminals Are Using GenAI
publisher: Trend Micro
publisher_domain: trendmicro.com
publication_date: 2023-08
publication_date_precision: month
publication_date_method: text_month
publication_year: 2023
source_type: vendor_threat_report
relevance_basis: threat landscape, incident-response, or CTI report
statistical_use: context_or_observation
retrieval_methods: direct
source_record_count: 1
max_token_count: 3342
tag_count: 30
metric_count: 5
ioc_count: 0
sectors: Cryptocurrency|Education|Financial Services|Government
countries_or_regions: United Kingdom
targets: Developers|Executives
kill_chain_phases: Delivery|Exploitation
mitre_tactics: Initial Access
ttps: Deepfake impersonation
ai_use_cases: Deepfake video or image|Identity fraud and impersonation|Translation and localization
ai_technologies: Deepfake / synthetic media|Generative AI|Large language model
llm_providers: Hugging Face|OpenAI
llm_models: ChatGPT|GPT-4
malicious_ai_tools: FraudGPT|WormGPT
data_types: Source code
infrastructure: Email|Endpoint|Messaging platform|Social media
evidence_landscape: Forecast or prediction|Incident response
primary_url:
https://www.trendaisecurity.com/en-gb/resources-insights/deep-research/back-to-the-hype-an-update-on-how-cybercriminals-are-using-genai

all_urls:
https://www.trendmicro.com/vinfo/gb/security/news/cybercrime-and-digital-threats/back-to-the-hype-an-update-on-how-cybercriminals-are-using-genai|https://www.trendaisecurity.com/en-gb/resources-insights/deep-research/back-to-the-hype-an-update-on-how-cybercriminals-are-using-genai


publication_id: pub-113
primary_source_id: src-113
title: Hype vs. Reality: AI in the Cybercriminal Underground
publisher: Trend Micro
publisher_domain: trendmicro.com
publication_date: 2023-04-17
publication_date_precision: day
publication_date_method: text
publication_year: 2023
source_type: vendor_threat_report
relevance_basis: threat landscape, incident-response, or CTI report
statistical_use: context_or_observation
retrieval_methods: direct
source_record_count: 1
max_token_count: 4623
tag_count: 30
metric_count: 11
ioc_count: 0
targets: Developers|Executives
kill_chain_phases: Actions on Objectives|Delivery|Exploitation
mitre_tactics: Collection|Initial Access
ttps: Deepfake impersonation|Malware generation|Phishing link or attachment
ai_use_cases: Deepfake video or image|Malware development
ai_technologies: Deepfake / synthetic media|Generative AI|Large language model
llm_providers: Google|Meta|OpenAI
llm_models: ChatGPT|GPT-4|Llama
malicious_ai_tools: DarkBERT|Evil-GPT|FraudGPT|WormGPT
infrastructure: Email|Messaging platform
impacts: Ransomware or extortion
evidence_landscape: Forecast or prediction|Underground-market observation
manual_review_required: yes
content_quality: usable_machine_extraction
primary_url:
https://www.trendaisecurity.com/pl/resources-insights/deep-research/hype-vs-reality-ai-in-the-cybercriminal-underground

all_urls:
https://www.trendmicro.com/vinfo/pl/security/news/cybercrime-and-digital-threats/hype-vs-reality-ai-in-the-cybercriminal-underground|https://www.trendaisecurity.com/pl/resources-insights/deep-research/hype-vs-reality-ai-in-the-cybercriminal-underground


publication_id: pub-114
primary_source_id: src-114
publisher: UNODC
publisher_domain: unodc.org
publication_date: 2025-09
publication_date_precision: month
publication_date_method: publisher_verified_override
publication_year: 2025
source_type: government_or_law_enforcement
relevance_basis: official advisory, fraud alert, or regional threat report
statistical_use: context_or_incident
retrieval_methods: direct
source_record_count: 1
max_token_count: 12459
tag_count: 85
metric_count: 11
ioc_count: 0
threat_groups: FunkSec
countries_or_regions: China|France|Japan|Russia|South Korea|United Kingdom|United States|Vietnam
targets: Consumers or individuals|Developers|Employees|Executives
kill_chain_phases: Actions on Objectives|Delivery|Exploitation|Installation|Reconnaissance|Weaponization
mitre_tactics: Collection|Defense Evasion|Execution|Exfiltration|Impact|Initial Access|Reconnaissance
attack_vectors: Business email compromise|Credential theft|Smishing
ai_technologies: Deepfake / synthetic media|Generative AI|Large language model|Speech or voice synthesis
llm_providers: OpenAI
llm_models: ChatGPT
malicious_ai_tools: WormGPT
malware_or_tools: AkiraBot|FunkSec
data_types: Credentials and passwords|Documents and files|Source code
infrastructure: Browser|Email|Messaging platform|Mobile|Social media
actor_motivations: Influence / information operations
evidence_landscape: Controlled study|Proof of concept|Underground-market observation
title:
Emerging threats: The intersection of criminal and technological innovation in the use of automation and artificial intelligence in the cybercrime landscape of Southeast Asia

primary_url:
https://www.unodc.org/roseap/uploads/documents/Publications/2025/UNODC_Report_Emerging_threats_-_The_intersection_of_criminal_and_technological_innovation_in_the_use_of_automation_and_AI.pdf

all_urls:
https://www.unodc.org/roseap/uploads/documents/Publications/2025/UNODC_Report_Emerging_threats_-_The_intersection_of_criminal_and_technological_innovation_in_the_use_of_automation_and_AI.pdf

sectors:
Cryptocurrency|Education|Financial Services|Government|Healthcare|Hospitality|Technology|Telecommunications

ttps:
Business email compromise|CAPTCHA bypass|Credential harvesting|Credential theft|Data exfiltration|Deepfake impersonation|Defense evasion|Fake website or service|Obfuscation|Phishing link or attachment|Target research / OSINT

ai_use_cases:
CAPTCHA bypass|Deepfake video or image|Deepfake voice|Identity fraud and impersonation|Influence operations|Malware development|Obfuscation and evasion|Phishing and lure generation|Reconnaissance and target research|Translation and localization|Vulnerability research

impacts:
Credential compromise|Data theft or exfiltration|Financial fraud|Ransomware or extortion|Service disruption


publication_id: pub-116
primary_source_id: src-116
title: ThreatLabz 2025 AI Security Report
publisher: Zscaler ThreatLabz
publisher_domain: zscaler.com
publication_date: 2025-03-20
publication_date_precision: day
publication_date_method: publisher_verified_override
publication_year: 2025
source_type: vendor_threat_report
relevance_basis: threat landscape, incident-response, or CTI report
statistical_use: context_or_observation
primary_url: https://www.zscaler.com/blogs/security-research/threatlabz-ai-security-report-key-findings
retrieval_methods: direct
source_record_count: 1
max_token_count: 13207
tag_count: 92
metric_count: 143
ioc_count: 0
sectors: Artificial Intelligence|Financial Services|Government|Healthcare|Transportation and Logistics
targets: Developers|Employees|Executives
kill_chain_phases: Actions on Objectives|Command and Control|Delivery|Exploitation|Installation|Reconnaissance
attack_vectors: Credential theft|Vishing
ai_technologies: Agentic AI|Deepfake / synthetic media|Generative AI|Large language model|Speech or voice synthesis
llm_providers: Anthropic|DeepSeek|Google|Microsoft|Mistral AI|OpenAI|xAI
llm_models: ChatGPT|Claude|DeepSeek|Gemini|GPT-4|Grok|Microsoft Copilot|Mistral / Mixtral
malware_or_tools: Rhadamanthys
data_types: Credentials and passwords|Documents and files|Personally identifiable information|Source code
infrastructure: Browser|Email|Endpoint|Messaging platform|Mobile|Social media
impacts: Data theft or exfiltration|Ransomware or extortion
evidence_landscape: Forecast or prediction|In-the-wild observed|Underground-market observation
manual_review_required: yes
all_urls:
https://www.zscaler.com/resources/industry-reports/threatlabz-ai-security-report-2025.pdf|https://www.zscaler.com/blogs/security-research/threatlabz-ai-security-report-key-findings

countries_or_regions:
Africa|Brazil|Canada|China|European Union|France|Germany|India|Japan|South Korea|United Kingdom|United States

mitre_tactics:
Command and Control|Credential Access|Defense Evasion|Discovery|Execution|Exfiltration|Impact|Initial Access|Lateral Movement|Privilege Escalation|Reconnaissance

ttps:
Command and control|Credential theft|Data exfiltration|Deepfake impersonation|Defense evasion|Phishing link or attachment|PowerShell execution|Prompt injection|Voice phishing / vishing

ai_use_cases:
Autonomous or agentic intrusion|Deepfake video or image|Deepfake voice|Identity fraud and impersonation|Obfuscation and evasion|Phishing and lure generation|Reconnaissance and target research|Translation and localization


