Page 229 - Cyber Defense eMagazine RSAC Special Edition 2025

AI: A devil in disguise?

In recent years, AI has made groundbreaking strides — it’s transformed industries and strengthened
cybersecurity systems, with automated detection and response strategies for example. However, with
this has come a new wave of cyber threats that are more sophisticated and unpredictable than ever
before. Unlike traditional malware that follows static attack patterns, AI-powered malware can adapt to
environments and analyze security measures, adjusting tactics to bypass defenses. These advanced AI-
driven threats refine their attack strategies in real-time, making them increasingly difficult to detect and
pose a greater threat to networks.

BlackMatter ransomware is a prime example. A direct evolution of the notorious DarkSide strain,
BlackMatter has quickly gained a reputation as one of the most advanced ransomware threats. It uses
AI-driven encryption strategies and live analysis victim defenses to evade traditional endpoint detection
and response (EDR) systems, defeating standard cybersecurity tools.

As AI-powered cyber threats increase in sophistication, businesses must recognize the risks and
understand the growing challenges in defending against them, so they can outsmart AI-driven malware
before it strikes.

Independent attacks

As AI has advanced, it’s developed a mind of its own and can operate autonomously without any human
supervision or intervention. It’s learned how to evade detection in real-time and slip past traditional
cybersecurity defenses. This has led to more frequent attacks and successful breaches, which have
overwhelmed security teams.

What’s more, AI-powered malware can operate without instruction. Once it’s infected a single device, it
can automatically copy its behaviour across other networks, rapidly polluting multiple connected systems
in minutes.

Intelligent attacks

Ransomware attacks have become even more destructive as AI-driven malware has learned to pinpoint
the most valuable files and systems to exploit. AI can target databases like financial records, proprietary
information, or intellectual property to maximize disruption and force victims to pay a ransom.

With machine learning, AI-powered malware can mimic legitimate system activity, making it harder for
traditional security tools to detect. It can even time its attacks strategically, waiting until out-of-hour
periods to execute malicious actions and avoid detection.

229