AI Threat Tracking Report: "First AI-Driven Zero-Day Attack Detected"

For the first time, hackers have been found developing zero-day (zero-day refers to hacking attacks that begin as soon as a vulnerability is discovered) hacking codes with the help of AI and attempting to use them in large-scale campaigns. Analysts say that state-backed hacking groups are now integrating AI not just as a supporting tool, but as a core engine to enhance both the speed and sophistication of their attacks.

On May 12, Google's Threat Intelligence Group (GTIG) announced in its 'AI Threat Tracking Report' that it had discovered the first instance of a threat actor using AI to successfully develop a zero-day exploit. Attack code believed to have been developed with AI assistance was observed as a criminal group prepared for a large-scale vulnerability attack. GTIG stated, "There are traces in the attack code that support the use of AI, but it was not developed through Mythos."

Threat actors supported by North Korea and China are also actively utilizing AI to analyze vulnerabilities and develop attack code. The North Korean threat group APT45 used AI to validate thousands of attack codes and to build attack assets on a large scale.

Attackers are leveraging agentic AI tools such as Openclaw to command attack processes in test environments and strengthen their capabilities. GTIG discovered a case where a China-linked threat actor used agent tools to autonomously conduct exploratory attacks to identify vulnerabilities in a Japanese technology company.

John Hultquist, Chief Analyst at GTIG, stated, "The vulnerability war driven by AI has already begun," and added, "Threat actors are advancing the speed, scale, and sophistication of their attacks by leveraging AI in multiple ways."

This content was produced with the assistance of AI translation services.