AI Fuels Cybercrime Surge, Exposing Global Infrastructure Vulnerabilities

The global digital infrastructure is facing an unprecedented cyber-security crisis, dubbed "Black October," as artificial intelligence dramatically speeds up the identification and exploitation of software vulnerabilities, according to cybersecurity expert Scott Schober.

"AI is dramatically accelerating the discovery of software weaknesses and vulnerabilities, and criminals can exploit them before a government or a company can even have enough time to respond," said Schober, CEO of Berkeley Varitronics Systems. "They know they're ahead of the curve. Governments can't keep up."

Criminals no longer need advanced technical skills to carry out sophisticated attacks, as AI can generate the necessary code. "AI can write the scripts for you. You don't have to be a programmer anymore," Schober explained. "It's like getting a master's degree without attending a day of college."

Recent incidents have highlighted these vulnerabilities. Major security flaws were discovered in PHP, the programming language underpinning approximately 70% of the world's websites, potentially allowing unauthorized access to servers. Malicious software distributed through LiteLLM, a tool for AI developers, has also been a vector for attacks. Many companies are scrambling to patch programming flaws as a result of the ongoing crisis.

The potential real-world consequences are severe, including the disruption of critical infrastructure like water supplies, power grids, and sewage processing plants. Smaller municipalities, often lacking dedicated cybersecurity teams, are particularly at risk. Seven U.S. states—New Jersey, Oregon, Minnesota, Michigan, South Dakota, Alabama, and Georgia—have reported attempts to cyber sabotage water treatment plants.

Minnesota experienced attacks on over 30 water systems in July, and an incident in Georgia led to a boil-water advisory. The Iran-linked group CyberAv3ngers claimed responsibility for the Minnesota campaign, and similar Iranian hacker groups targeted Pennsylvania's water infrastructure in 2023, according to the Center for Strategic and International Studies (CSIS).

Historically significant attacks, such as the May 2021 ransomware incident against Colonial Pipeline, underscore the disruptive potential. The shutdown of the East Coast's fuel supply system following this attack led to a $4.4 million ransom payment to Russian hackers.

"It's a concern for everybody because it affects economies, people and their livelihoods and public safety," Schober stated, emphasizing the need for stronger oversight and international cooperation to prevent widespread chaos.

While AI is also being employed to identify and fix vulnerabilities, there's a growing concern about a "vulnpocalypse"—a backlog of weaknesses that grows faster than defenders can address them. AI tools have flagged tens of thousands of potential vulnerabilities, but human capacity to review and fix them remains a bottleneck, as noted by Anthropic, which reported that only about 6,000 of nearly 29,000 flagged issues had been manually reviewed and fixed in a six-month period.

Organized criminal elements leverage AI to sift through stolen data, cross-reference personal information from various sources, and then sell refined profiles on the dark web. Major data breaches, including those affecting UnitedHealth, Facebook, Microsoft, Ticketmaster, Yahoo, and National Public Data (where 2.7 billion records were stolen in 2024), have provided ample material for such exploitation. AI also aids in consolidating scattered victim details, making fraud and extortion more targeted.

Personal data from user interactions with AI chatbots has also been compromised on a large scale.

Schober advises individuals to limit the sharing of sensitive information, such as passwords, Social Security numbers, and bank details, in chatbot conversations. He also recommends using long, unique passwords for different websites and enabling multi-factor authentication for account security. Additionally, users should carefully review any documents uploaded online for inadvertently included private details.

European authorities have advised businesses using PHP to collaborate with hosting providers, install updates promptly, and isolate exposed applications if immediate patching is not feasible.

Schober acknowledged AI's dual role in both offense and defense but stressed that criminals currently maintain a faster pace, leading the race. "It's a tool for good and for bad," he concluded.