DeepSeek

State-sponsored hackers from China are doubling their attack output by leveraging inexpensive AI models with weak safety controls. This shift allows for the automation of complex tasks like exploit development and network mapping at a much lower cost than previously required.

An autonomous AI agent was used to facilitate a sophisticated espionage campaign against the Thai Ministry of Finance. The attack utilized advanced post-exploitation tools and targeted big data infrastructure, though it was ultimately detected due to exposed attacker directories.

This report details the rising trend of opportunistic scanning targeting AI-related services and infrastructure. It highlights specific threats to unauthenticated Ollama instances and the use of coordinated sweeps to harvest AI API keys from configuration files.