AI-based tools have been integrated into real cyberattacks, from initial reconnaissance to the generation of malicious code. This is according to a report by F6, covering 2025 and the first half of 2026.
AI in Attacks
According to analysts, at least 18 APT groups have conducted attacks using AI over the past year and a half. F6 documented several cases of artificial intelligence being used in real attacks.
The GTG-1002 group used language models to generate phishing emails, tailoring texts to specific victims and bypassing standard spam filters. The TAT26-12 cluster employed AI to automate reconnaissance, gathering data on employees, infrastructure, and organizational vulnerabilities.
A tool called PromptSpy was highlighted as specialized software for attacking corporate systems built on LLM. Its purpose is to extract system prompts and manipulate model behavior.
Another tool, LAMEHUG, was used to generate malicious code with minimal human involvement.
Forum Discussions
Researchers noted that hackers are increasingly discussing various AI models on thematic forums.
While ChatGPT by OpenAI is the most popular solution among novice hackers, Gemini by Google is more frequently used in full-scale attacks.
Forum participants discuss ways to bypass model restrictions. Some have attempted to create malicious applications using publicly available AI.
Evolution of Ransomware
Over the monitored period, more than 50 new groups distributing ransomware emerged, with over 9300 related incidents.
A notable trend is the shift away from data encryption as the primary pressure tool. Instead, attackers focus on the threat of publishing stolen information, reducing technical attack requirements and complicating defense.
In the past year and a half, six major shadow marketplaces for data trading have been shut down, but five new ones have emerged in their place.
Active card shops have recorded over 16.5 million compromised payment cards for sale.
In August, OpenAI slowed the development of advanced AI systems following an incident with Hugging Face and a preliminary assessment by Astra.
