AI-assisted tool accelerates cyberattacks, FBI warns organisations worldwide

Washington: The FBI has warned that cybercriminals are using an artificial intelligence-assisted security testing tool to accelerate attacks on organisations around the world, with some intrusions reaching privileged access in less than three hours.

In an alert issued on Friday (local time), the bureau said malicious actors had been using the open-source framework, known as ARTEX, since at least August to target organisations across sectors, including finance, government, technology, defence, energy and health care.

The FBI said the tool can automate several stages of an intrusion, from identifying potential targets to preparing or carrying out data theft. This speed can leave defenders with less time to detect and respond to an attack, it said.

The alert said some intrusions progressed from initial targeting to privileged access in under three hours.

According to the alert, the framework was originally intended for authorised security testing. Its developer removed the original online repository in October following reports of malicious use, but copies and variants remained available, the FBI said.

The bureau said the tool could lower the technical barriers to conducting complex operations and allow attackers to pursue multiple targets simultaneously. Organisations’ internet-facing applications, cloud infrastructure and systems connected to suppliers or partners were among the areas of concern identified in the alert.

The FBI cited financially motivated attacks on South Korean financial institutions that it said resulted in the personal information of approximately 67,000 people being stolen. It also described a separate supply-chain compromise affecting users of a cloud backup service, which it said enabled access to more than 2,250 downstream customer environments.

The bureau encouraged organisations to review their exposure to the internet, strengthen identity and access controls, monitor unusual activity and protect credentials. It also urged organisations that identify suspicious activity to contact the FBI or report it through the Internet Crime Complaint Center.