E-Paper
Google, CrowdStrike and Kroll struggle to handle surge in AI-powered cyberattacks
AI-powered cyberattacks are overwhelming Google Mandiant, CrowdStrike and Kroll as US cybersecurity firms struggle to handle rising hacking threats.
Prefer HTon Google
Some of America's biggest cybersecurity companies are struggling to handle a sharp rise in cyberattacks powered by artificial intelligence (AI). The situation has become so serious that companies are turning away new customers who need urgent help after being hacked.
Three major US cybersecurity firms — Google's Mandiant, CrowdStrike and Kroll — told NBC News that they are facing an unusually high number of cyberattacks. They said the volume of attacks has reached a level they have not experienced before.
The companies said that the biggest reason behind the growing number of attacks is the use of AI tools. These tools have made hacking operations much faster, easier and cheaper to carry out.
While hackers can now use AI to attack hundreds of organisations, cybersecurity companies still need time, skilled workers and significant manpower to investigate and fix the damage caused by these attacks.
Cybersecurity firms turn away customers
Charles Carmakal, chief technology officer at Mandiant, said the company has been extremely busy over the past 12 months. However, the situation has become much worse over the past two months, with a sharp increase in hacking attempts. He said the latest surge is overwhelming both cybersecurity defence teams and companies that respond to cyberattacks. Mandiant is Google's cloud cybersecurity company.
Major cybersecurity firms often have existing contracts, also known as retainers, with large corporate customers. These contracts allow companies to receive help from cybersecurity experts when they face an attack.
Since the number of cyberattacks has increased sharply, firms are giving priority to customers who already have these agreements. As a result, businesses that do not have existing contracts are struggling to find experts to help them after being hacked, Carmakal said.
Carmakal said incident response companies are turning down most organisations that approach them for help. He described the problem as an industrywide crisis, rather than something affecting just one or two cybersecurity firms.
Also read: Trump blames Biden for US FAA ground stop, urges Congress to fund air traffic control system upgrade
AI has made it possible for very small groups of hackers to carry out large-scale attacks. Carmakal said a team with only a few people can now expand its hacking operations to hundreds of organisations.
AI hackers target hundreds of organisations
A recent hacking campaign identified by CrowdStrike shows how AI is helping sophisticated hacking groups expand their operations. The group, allegedly working for Chinese intelligence, used an AI tool released earlier this year. The tool was originally developed to help website developers identify security weaknesses in their software.
The hackers allegedly used it to find vulnerabilities and break into computer systems. Since mid-October, the group has compromised several government agencies and companies across the world and targeted hundreds of other organisations, CrowdStrike said.
CrowdStrike said agentic AI is allowing even less-skilled hackers to carry out attacks that were earlier associated with highly advanced government-backed hacking groups.
A CrowdStrike spokesperson said the threat from AI-powered hackers is already here and there are no signs that these attacks will slow down. The company said hackers are now using AI agents to carry out activities that were once largely limited to nation-state hacking groups.
AI tools have reduced the need for such expertise by helping hackers automate several steps. Many of these tools are also free to download and use, making it easier for more people to attempt cyberattacks.
AI gives hackers an advantage over defenders
Max Henderson, global head of digital forensics and incident response at Kroll, said there is a major difference between how hackers and cybersecurity teams can use AI. Hackers can experiment with AI tools repeatedly and try different methods until they find a way into a system.
They do not have to worry as much about making mistakes during these attempts. However, cybersecurity companies must be much more careful when using AI to protect businesses and their systems.
Henderson said many organisations are currently trying to introduce AI tools into their cybersecurity defence systems. However, putting these tools into use takes time because companies must ensure that they work properly and safely. On the other hand, hackers do not face the same restrictions and can focus mainly on speed.
Kroll hires staff as cyberattacks keep rising
Kroll is actively recruiting more employees to deal with the rising number of cyberattacks, Henderson said. However, hiring new workers takes time, and the company must also make sure its existing employees are not overworked.
The growing number of attacks is putting pressure on cybersecurity experts who have to investigate incidents and help affected organisations recover. In the meantime, Kroll has had to tell some new customers that it does not have enough capacity to provide complete recovery and repair services.
Henderson said cybersecurity firms have to be careful about accepting more customers than they can handle. Taking on too many cases could affect the quality of their work and put their ability to respond to existing customers at risk.
Henderson said cybersecurity work was more seasonal and predictable over the past few years. However, this year has seen a continuous rise in the number of cyberattacks. Every month has brought a higher volume of attacks than the previous month.
Although cybersecurity firms expect the surge to eventually reach a peak, that point keeps moving further away. This means companies are preparing for continued pressure on their teams and resources, rather than expecting the situation to improve immediately.
