Threat actors are no longer just experimenting with GenAI — they’re operationalizing it at scale. How should cyber-defenders respond?

In the past year alone, AI-enabled adversary FAMOUS CHOLLIMA infiltrated over 320 organizations globally — a 220% year-on-year increase — by leveraging GenAI at every stage of the hiring and employment process.

GenAI was used by the North Korean state-sponsored bad actor, from generating persuasive resumes and using real-time deepfakes in interviews, to deploying AI-assisted coding tools once hired.

As GenAI tools become more accessible and intuitive, CrowdStrike has assessed that its use for social engineering and targeted attacks will surge in the near to mid-term. This presents an urgent challenge for organizations to evolve their defenses.

CybersecAsia.net gathered more insights from Fabio Fratucello, Field CTO, World Wide, CrowdStrike:

How are threat actors weaponizing GenAI to augment and enhance their attacks?

Fratucello: The CrowdStrike 2025 Threat Hunting Report shows a significant shift in modern cyberattacks as adversaries increasingly weaponize GenAI to scale their operations and accelerate their attacks. Adversaries such as FAMOUS CHOLLIMA are integrating GenAI throughout their sophisticated insider operations, from building fake resumes, to conducting deepfake interviews, and even automating their coding tasks across multiple roles.

CrowdStrike tracked more than 320 cases of FAMOUS CHOLLIMA operatives working as remote IT workers over the past year – a 220% year-on-year increase – highlighting the pervasive threat of GenAI-driven adversary operations.

Besides attacks, in what other ways are cybercriminals leveraging AI?

Fratucello: Adversaries are increasingly targeting the AI agents and systems that transform organization’s operations.

As outlined in the 2025 Threat Hunting Report, CrowdStrike has observed multiple threat actors exploiting vulnerabilities in tools used to build AI agents, gaining unauthenticated access, establishing persistence, harvesting credentials, and deploying malware and ransomware.

These attacks demonstrate how the enterprise attack surface is expanding with agentic AI adoption, with autonomous workflows and non-human identities the next frontier of adversary exploitation.

How should cyber-defenders respond to attackers sharpening their edge and speed with AI-generated code?

Fratucello: Organizations need to leverage AI to enhance their defenses and counter adversaries’ weaponization of AI. A modern security platform built with AI capabilities from the ground up provides organizations with the foundation they need to power a truly agentic Security Operations Centre (SOC).

They must secure their AI deployments through proactive monitoring of integrations, protection against model tampering, and detecting misconfigurations. For instance, they can leverage tools such as CrowdStrike’s AI Security Posture Management (AI-SPM), which provides comprehensive visibility and protection for AI models by detecting misconfigurations and identifying vulnerabilities.

Solutions like CrowdStrike Falcon Shield secure AI agents across the SaaS stack, by providing agent visibility, mapping agents to human creators, detecting risky behavior, and enabling automatic threat containment.

Falcon Data Protection provides real-time, unified security for how data moves in the AI era, by expanding coverage of runtime protection for local applications and cloud environments to prevent inadvertent exposure and block data leakage across managed and unmanaged GenAI tools. This provides organizations with comprehensive visibility and protection across endpoints, cloud, GenAI, and SaaS applications, and empowers them to securely innovate with AI, while Charlotte AI AgentWorks offers organizations a no-code platform that enables any security team to build, test, and deploy their own agents directly within the Falcon platform — while maintaining enterprise-grade security and governance.

Together, these agentic innovations sharpen defenders’ response by delivering machine-speed capabilities to automate repetitive tasks, accelerate outcomes, and empower analysts to focus on the strategic decisions that strengthen their security. 

What can organizations do today to strengthen their resilience and futureproof themselves against AI-powered threats?

Fratucello: Adversaries’ weaponization of AI is compressing the attack timeline, turning operations that once took months into seconds and collapsing the defender’s window of response. This means organizations’ threat intelligence capability must evolve beyond simply informing defenders to actively countering threats at the speed of AI.

AI can rapidly accelerate defenders’ investigation and threat responses, by eliminating high-friction tasks better suited to machines, while ensuring they remain firmly in command.

For example, CrowdStrike’s Threat AI is an agentic threat intelligence system that automates the most complex, time-consuming intelligence workflows to accelerate security outcomes – informed by years of real-world decisions from CrowdStrike Counter Adversary Operations’ elite threat hunters and intelligence experts – to deliver mission-ready agents for every security analyst that can reason across threat data, proactively hunt adversaries, and take decisive action across the kill chain.