AI-Driven Operations Reshape Espionage, Extortion and Vulnerability Hunting
Cyber operations are becoming increasingly automated as criminal and state-linked groups deploy AI-powered workflows to handle reconnaissance, credential attacks, malware development and large-scale information theft.
A new report covering activity between December 2025 and August 2026 shows that attackers are moving beyond occasional chatbot assistance. Instead, they are connecting multiple AI-driven processes to existing intrusion infrastructure, allowing repetitive technical work to run with limited human intervention.
Espionage Campaigns Put AI in the Attack Chain
One suspected Russian state-linked cluster, tracked as GTG-20006, reportedly targeted government agencies, diplomatic organizations, defense companies and military-drone suppliers across Europe and Ukraine.
Its automated workflows handled infrastructure setup, phishing operations, credential collection, lateral movement and data theft. The systems could also monitor whether malware was being detected and modify deployed files when security products identified them.
Stolen Information Included Drone Technology
In one operation, attackers collected mailboxes from drone-component manufacturers and obtained proprietary drone-vision software.
AI-assisted analysis was then used to examine the software's architecture, hardware components, suppliers and details surrounding an unreleased product.
The same activity reportedly exposed more than 300,000 national identity records and commercial information covering more than 500,000 companies from a North African government technology authority.
Criminal Groups Scale Credential Collection
Financially motivated operators linked to suspected ShinyHunters affiliates also incorporated automated workflows into their operations.
One campaign reportedly deployed 10 Amazon EC2 workers to download and decompile approximately 1.8 million Android applications, searching for embedded credentials and secrets.
Compromised API keys became particularly valuable because attackers could use them to run additional workloads while disguising activity as legitimate traffic.
Automated Research Accelerates Exploit Discovery
Another cluster, GTG-10007, reportedly focused on vulnerability research and offensive development.
Its workflows performed firmware decompilation, binary analysis, vulnerability research and proof-of-concept development. One process generated more than a dozen potential zero-day findings affecting network appliances in a single month, although the reported findings should not automatically be treated as confirmed exploitable vulnerabilities.
The Bigger Risk Is Scale
The underlying techniques remain familiar: stolen credentials, exposed services, vulnerable software and poorly protected APIs.
The difference is operational speed. Automated workflows can perform repetitive discovery and analysis across many targets without requiring an equally large human team.