AI Attacks: How Companies Can Strengthen Their Network

Cyberattacks on corporate networks are multiplying at an alarming rate, with artificial intelligence (AI) playing a central role in this escalation. Cybercriminals are leveraging machines capable of operating at speeds far exceeding those of humans, forcing companies to adopt automated systems for defense. However, despite this automation, humans remain the weak link in the security chain.

According to a recent survey conducted by Mandiant, a cybersecurity firm integrated into Google Cloud, attackers operating directly on compromised networks primarily fall into two groups. On one hand, cybercriminals seek financial gain through tools such as ransomware. On the other hand, espionage groups aim for stealthy and prolonged access.

Targeted Sectors and Attack Methods

Mandiant has identified that over 16 industrial sectors are targeted by these attacks, with a preference for the high-tech sector (17%) and the financial sector (14.6%). Nearly one-third of detected intrusions are due to exploits, while highly interactive voice social engineering is the second most common attack vector. This method targets IT helpdesk services to bypass multi-factor authentication (MFA) and gain access to software-as-a-service (SaaS) environments.

Evolution of Ransomware Tactics

Ransomware groups are no longer content with merely encrypting data. They are now attacking companies' recovery capabilities by deleting backups in cloud storage. By targeting the virtualization storage layer or encrypting the datastores of hypervisors, they can render all associated virtual machines inoperable simultaneously.

Recommended Defensive Strategies

To counter these sophisticated threats, Mandiant proposes five key strategies to strengthen corporate network security:

• Treat virtualization and management platforms as Tier-0 assets, applying the strictest access constraints.
• Decouple backup environments from the company's Active Directory domain and use immutable storage to protect recovery capabilities.
• Deploy advanced threat detection across the entire ecosystem and extend log retention policies beyond the usual 90 days.
• Regularly audit SaaS integrations and route all SaaS applications through a central identity provider (IdP).
• Implement behavior-based detection models to flag abnormal activities.

Mandiant researchers emphasize that "identity is the new perimeter." It is no longer sufficient to simply change passwords and enforce MFA. Strengthening identity controls and continuous verification, especially with third-party vendors, is now essential.