Manage attack infrastructure? AI agents can now help

"Agentic, automated reconnaissance against systems is something that is worth taking a look at. Go find out about XYZ, and come back to me with everything you've seen. Go scan the net blocks owned by this particular entity. An attacker could do this manually, but it would take a lot more time than asking an agent to do it for them."

"It's a great example of AI that can be used for regular, standard business purposes and can also be used by threat actors for malicious purposes. We have always seen threat actors stand up the infrastructure, whether that means compromising existing legitimate infrastructure and using it for malicious purposes, or purchasing accounts and setting up their own infrastructure to launch threat campaigns."

"Microsoft Threat Intelligence has observed North Korea's Coral Sleet using development platforms to quickly create and manage their attack infrastructure at scale, allowing more rapid campaigns and demonstrating how agentic AI improves the efficiency and productivity of criminal operations, resulting in attacks that are better, bigger, and faster."

AI agents are being weaponized by cybercriminals and nation-state actors to automate routine but critical tasks in cyberattacks. These tasks include reconnaissance on compromised systems, scanning networks, and managing attack infrastructure. Rather than performing these activities manually, threat actors use AI agents to execute these operations faster and at greater scale. North Korea's Coral Sleet group exemplifies this trend by leveraging development platforms to rapidly create and manage attack infrastructure. Microsoft threat intelligence identifies this as a significant concern, noting that AI tools designed for legitimate business purposes are being repurposed for malicious operations, resulting in more efficient, larger, and faster attacks.

Read at Theregister