The growing influence of AI on cybersecurity threats

The official and personal information systems of Lithuanian public sector employees continue to be targeted by cyber capabilities of Chinese and Russian intelligence services. Cyber espionage groups controlled by Chinese and Russian intelligence services are engaged in ongoing espionage activities and are attempting to gain new access to target information systems. It is highly likely that hostile states will remain motivated and will attempt to intercept information using effective and low-resource-requiring cyber tools in the near and medium term.

Although access to systems can only be gained through technical means, the human factor remains the biggest vulnerability, and hostile intelligence services actively exploit it. By manipulating people’s emotions, they persuade users of information systems to perform actions that allow hackers to gain access to the information they seek or to the systems where data is stored. Hackers use various psychological tools to create an emotional impact that reduces people’s attentiveness and critical thinking.

Chinese and Russian intelligence services are looking for new methods to gain illegal access and carry out malicious activities themselves while also adopting successful tactics from criminal hackers, who are motivated by financial gain. Therefore, the range of their methods increases and makes it more difficult for investigators to distinguish between malicious state actors and criminal hackers. It is highly likely that all actors involved in illegal activities in cyberspace will use the proven models of malicious cyber activity as well as look for new approaches.

It is highly likely that the newly developed technologies will significantly change the cyber security landscape. For instance, there are more opportunities to use AI for cyber-attacks: from writing and customising a text to creating and modifying a malicious code. AI is also being trained to identify vulnerabilities in IT systems. Moreover, AI tools create additional security vulnerabilities. It is likely that the use of AI for malicious activities will grow in the near term, not only because of wider use of AI tools in society but also due to new ways to use this evolving technology in order to increase the effectiveness of cyber-attacks.

Technological development creates new challenges in taking responsibility for cybersecurity. Since organisations increasingly use cloud services, they tend to believe that it is the service providers’ primary responsibility to ensure cybersecurity. Without organisations themselves taking steps to actively address cybersecurity practices of their employees and the implementation of safeguards such as dual authentication and access control, it is likely that the use of cloud services will remain vulnerable to malicious activity.

As the use of cloud services is growing, hostile intelligence agencies are looking for vulnerabilities in cloud infrastructure to exploit. For example, it was identified that APT29, a group linked to the Foreign Intelligence Service of the Russian Federation (SVR), targeted insufficiently secured cloud service accounts and managed to gain access to the infrastructure of cloud service providers, thus gaining long-term access to the target’s data.