AI: Unit 42 Warns of Rising Hacktivists and Offers 4 Countermeasures

Unit 42, the research team at Palo Alto Networks, warns that AI serves as a force multiplier for less skilled actors, particularly hacktivists. After conducting internal tests over three weeks, the entity claims to have found dozens of vulnerabilities and outlines four response areas for businesses.

Unit 42 Finds Companies Insufficiently Prepared and Calls on CISOs to Frame AI

Sherrod DeGrippo, Vice President of Threat Intelligence at Unit 42, believes that no one is fully prepared for a constantly evolving situation. She recommends that Chief Information Security Officers (CISOs) establish a top-down agentic AI strategy and remain ready to adapt it. According to her, organizations are not ready but are striving to get there. AI-related threats are now being discussed at the board level. DeGrippo describes the impact of AI on threats and defense as a transformative period, where preparation is only possible up to a certain point.

Three Weeks of Testing Equivalent to One to Two Years of Auditing

According to Unit 42, three weeks of internal testing allowed its teams to achieve a penetration testing volume comparable to one to two years of traditional audits. They report discovering several dozen vulnerabilities in client environments using AI models dedicated to penetration testing. These findings stem from initial analyses conducted as part of Frontier AI Defense, a service launched in April that combines threat intelligence and telemetry with advanced AI models to address security challenges related to artificial intelligence. The team describes AI as an amplifying factor of capabilities and notes that cybercriminals are already experimenting with artificial intelligence and language models at various points in the attack chain, including optimizing phishing campaigns, performing translations, or engaging in ransom negotiations. They specify that AI is now involved at every stage of the process, citing JadePuffer as an example of a fully agentic ransomware attack, with each phase orchestrated by artificial intelligence.

Less Skilled Actors Empowered, Hacktivism Highlighted

Unit 42 believes that AI has caused a generational and lasting shift in cybersecurity and predicts that hacktivism will take center stage. Script kiddies, once perceived as relatively harmless, may no longer constitute a separate category, as artificial intelligence enhances their influence. Sherrod DeGrippo indicates that the usual classification of cyberattacks has transformed, and socially motivated groups now have, thanks to AI, tools and a level of sophistication equivalent to those of state-sponsored groups. She anticipates that this segment will grow, attracting less experienced profiles but with skills considered exponentially enhanced, emphasizing that anyone who knows how to use a tool now has access to exceptional qualified means. This typology distinguishes between financial motivations and state-sponsored operations, as well as smaller categories like hacktivists or actors with social or political motivations. Unit 42 identifies the power gain provided by AI to these socially motivated actors as a point of vigilance.

Four Proposed Priorities to Strengthen Security Posture

Unit 42 recommends implementing a zero-trust architecture, with access limited to the bare minimum to reduce the risks of lateral movement and access to sensitive resources in the event of a compromise. The entity also advocates for enhancing employee education and training beyond an annual phishing detection exercise, as the human factor is often the weak link. It advises monitoring and regulating employees' use of AI, as unsanctioned or shadow AI can lead to security and compliance issues. Finally, it suggests collaborating with AI and cybersecurity experts or investing in specialized platforms, believing that existing solutions may not be sufficient to address upcoming risks.