Cybercriminals are increasingly exploring the use of generative artificial intelligence (GenAI) in their attacks, although their efforts have not yet reached a level of significant exploitation, according to a recent report by Verizon. The telecom sector, in particular, is witnessing a rise in AI-driven threats, especially targeting mobile devices.

Verizon’s latest Data Breach Investigations Report reveals that cyber attackers are currently in the experimental phase with GenAI technologies, mirroring legitimate organisations’ own stages of adoption. “There is evidence of attempts to abuse the platforms themselves,” the report said, but companies like Google and OpenAI have “not reported anything successful” in terms of major security breaches directly tied to AI-specific methods.

Google’s January report highlighted that threat actors are primarily leveraging Google’s Gemini AI to enhance their productivity in more routine cybercrime tasks such as research, troubleshooting code, and content creation. Similarly, OpenAI noted that malicious users of ChatGPT employ AI for various simultaneous tasks, including debugging code and generating content that is spread across different platforms.

While criminals use large language models (LLMs) for phishing and other attacks, Google pointed out that sophisticated AI-specific attacks—like intricate prompt engineering—are currently ineffective. Typically, attackers resort to simply rephrasing or resending prompts instead of developing tailored AI-driven assaults.

Verizon’s findings also caution against underestimating the broader security risks posed by AI. Over the past two years, the proportion of malicious emails assisted by AI has doubled, increasing from about 5% to 10%, indicating a growing reliance on AI tools to enhance cyber threats.

The telecom industry faces unique vulnerabilities as GenAI becomes embedded in the operating systems of new mobile devices. Features like voice assistants, messaging apps, and camera functions increasingly incorporate GenAI capabilities, expanding the potential avenues for user data exposure. Notably, some of these AI functions come enabled by default and require users or corporate mobile device management systems to opt out to prevent automatic activation.

Verizon highlighted that device security and fraud prevention are becoming central concerns as 5G application programming interfaces (APIs) evolve. Telecom operators are beginning to offer APIs that allow partners to detect SIM swaps on a phone number, identifying potentially fraudulent device changes irrespective of intent. Industry leaders such as BT, Orange, and Telefónica are actively implementing these measures.

The telecom sector is already dealing with significant cybersecurity challenges following the Salt Typhoon hack, which is considered the largest telecom hack in U.S. history. Major operators including AT&T, Verizon, and Lumen were affected and the malicious activities from the group behind the attack continue.

On the frontline of distributed denial-of-service (DDoS) attacks, AI has become a critical component in automating various stages of these attacks, as detailed in a recent threat intelligence report by Netscout. Wireline telecom operators remain especially vulnerable to DDoS incidents, even when they are not the primary target, underscoring the persistent risk posed by these sophisticated cyberattacks.

As generative AI integrates further into telecom infrastructure and devices, both opportunities and challenges for cybersecurity continue to grow in complexity. The sector’s response involves developing advanced detection capabilities, tighter control over device AI functions, and collaboration across industry players to safeguard networks and customers alike.

Source: Noah Wire Services