Not the technique but the price: state-linked groups attacked with AI

What happened

The report titled "Detecting and countering misuse of AI: September 2026" covers the period between December 2025 and August 2026, across seven harm areas. According to the provider, the actors involved include "suspected state-sponsored groups, financially motivated criminals, commercial spyware vendors, state propaganda institutions, and politically motivated individuals".

Two findings in the report are what make it news:

• "AI has collapsed the labor and tooling gap that used to separate well-resourced, state-sponsored operations from individual operators."
• "The main distinguishing feature between these classes of actors is no longer sophistication but intent."

And the most important line, the one worth quoting word for word: "None of the operations in this report depended on some entirely novel technique that defenders have never seen. Instead, the economics of the attacks have changed." The methods on the list are familiar: stolen credentials, unpatched edge devices, exposed services, SQL injection, phishing.

Two state-linked cases, briefly

In the Russia-linked operation — where, the report notes, the attribution is consistent with public analyses — more than twenty organisations were affected: ministries, defence and intelligence bodies, embassies, think tanks and defence-industry firms, primarily in Ukraine and Europe. The report singles out one detail that matters for the defender: when the attackers' monitoring agents saw that a security product had identified their malware, "agents would then set about the process of autonomously modifying and rebuilding the malware" to slip past detection. The report's conclusion fits in one sentence: "AI has inverted the cost back onto defenders."

In the operation tied to Chinese-language operators, roughly fifty organisations were targeted, from education through retail to energy and several government agencies. What stands out here is not a breakthrough but the industrial scale: one continuously running workflow found "more than a dozen possible zero day findings in a single month" on network devices, and thirteen scheduled collection agents worked through open-source material. One nuance matters: for this group the report does not say the work was done on state orders — only that the collection followed state intelligence priorities.

What is genuinely new: the time

The numbers worth remembering do not come from the state actors but from a financially motivated group — and that is precisely the point:

from a stolen dev key to full cloud
admin:                     ~3 hours
2100 token sets at 40+ tenants
in one operation:         ~34 hours
report summary: 2-3 hour intrusions,
victims handled in parallel

The report's summary puts intrusions at two to three hours, with a single operator handling dozens of victims in parallel. Against that, the classic incident-response reflex — "we'll look at the logs in the morning" — is not a speed problem, it is an order-of-magnitude gap.

What the report does not say matters too: it puts no percentage on how much of an operation the model carried out. The much-quoted 80–90% is a figure from a different report, published in November 2025, and it covered a single campaign. This document claims only that "A majority of the operations described in this report were enabled by AI via direct execution or orchestration." and that "Humans remained in the loop by setting the targets of attacks and reviewing exfiltration."

What the provider did

The report says the same of all of them: "In each case, we disrupted the activity, used what we learned to strengthen our safeguards, and shared intelligence with authorities and industry partners, where appropriate." The definition of disruption is spelled out: "we banned every account we could link to the actor, which shut down the whole operation". Alongside that, new classifiers went live, and the report also publishes the technical indicators, so that others can search for them.

This is not the first document of its kind: the same company published reports in April, August and November 2025, Google's threat intelligence team put out something similar in February and on 8 September, and Microsoft described a campaign against hotel guest networks in July. The genre is not new — but the whole picture is only coming together now.

What this means for a small business

Nothing that cheap defences cannot handle. Precisely because the technique is not new: the front door of the attack is where it always was.

ENISA's 2025 threat landscape says "Phishing remained the dominant intrusion vector (60%)". The Spanish cybersecurity authority's 2025 balance sheet records 122,223 incidents handled, 26% more than the year before, and one in four of those is online fraud. This is the terrain where AI gives the attacker speed and flawless grammar in the target's own language — not a new capability.

The official recommendations are correspondingly boring, and that is exactly why they work:

• Phishing-resistant multi-factor authentication. CISA's fact sheet says "Phishing-resistant MFA is the gold standard for MFA" — meaning a security key or built-in hardware authentication. An SMS code is "vulnerable to phishing, SS7, and SIM swap attacks", and is recommended as a "last resort MFA option" only.
• Dual approval on payments. Spain's INCIBE guide on CEO fraud is concrete: "apply the dual-control rule to payments", and "define clear payment procedures", including the verification steps for new bank details and IBAN changes.
• A callback on a different channel. From the same guide: "Check urgent transfers: always confirm any urgent payment request through an alternative channel". This is the cheapest protection against a cloned voice: you don't have to recognise the voice, you have to make the process impossible to skip.
• Logging. The UK NCSC's phishing guidance says "Use a security logging system to pick up on incidents your users are not aware of". The same guidance also says "Don't reprimand users who are struggling to recognise phishing emails." — because willingness to report is worth more than perfect recognition.
• Travel and guest networks. Microsoft's July analysis recommends three concrete things: "Prefer private connectivity … over public Wi-Fi whenever practical", "Do not reuse corporate credentials on hotel, conference, or guest-network registration pages", and restrict the sign-in methods attackers abuse most often.

What to do now

1. Swap the SMS code for a security key where the damage would be worst: email, banking access, the accounting system, file storage. Cheap per device, an afternoon of work.
2. Write the payment process down on one page. Who can approve, up to what amount, what happens when bank details change, and which phone number to call back on — never the number in the message.
3. Turn logging on, and check where the alert lands. If an intrusion runs its course in two to three hours, one manual check a day is not enough. It does not take an expensive system, it takes somebody's phone ringing.
4. If you run an AI agent in the business, protect that too. The NCSC's advice is to "Always run AI agents within a sandboxed environment", to keep their decision logs, and to have an instant kill switch. (More: supervised, logged AI agents.) A good place to start is prompt injection basics — the oldest weakness agents have.

Common misconceptions

• "This only touches ministries and big corporations." The victims in the report include an education company, a retailer and suppliers. And the supply chain runs right through the smaller firms.
• "A new kind of attack is coming, and there is no defence against it." The report says the opposite in as many words: the techniques are familiar, it is their economics that changed.
• "80–90% of attacks are already run by AI." That figure comes from an earlier report about a single campaign. The current document gives no ratio at all.
• "If we don't use AI, this doesn't concern us." The attacking side uses it. Your defence is independent of that.
• "An expensive security product takes care of everything." In one of the cases in the report, the attacker's agents rewrote the malware automatically when a product spotted it. Process-level defence — approval, callback, logging — works against that too.

What to take away

The news is not that "AI is being used for attacks" — that has been documented since 2024. The news is that the capability gap has vanished: the same attack that used to need an organisation can now be carried through by one person, in hours rather than weeks. That is bad news, but not an unpredictable one: the front door is still phishing and a weak second factor, and the costliest damage is still money wired to the wrong place. What a small company can actually do this week — a security key, a written payment process, a callback on another channel, an alert that works — is exactly the four things the official guidance puts first.