How AI enhances reconnaissance, obfuscation and automated attacks, explained for defenders

Why this matters

Lesson 23 dealt with AI-generated content aimed at people. This lesson covers what AI changes on the technical side of an attack: finding targets, correlating what is known about them, disguising tooling, generating attacks and scaling disruption. It is written for defenders. Each capability is explained at the level needed to recognise its effects and plan against it, and deliberately no further: there is no method here, only consequences.

The fair summary is that AI mostly makes existing attacks cheaper, faster and more numerous rather than inventing new categories. That is still a serious change, because many security programmes rely, often without saying so, on attacker effort being expensive. An obscure exposed service will not be found; a custom variant is too much work for a small target; a campaign in a minority language is not worth translating. When effort becomes cheap, those assumptions fail together.

The organisations that cope best are rarely the ones that bought an "AI threat" product. They are the ones that already knew what they had exposed, patched quickly, detected on behaviour rather than fixed indicators and could absorb load. Scenario questions on this objective usually reward that answer: the fundamentals, run faster and with less reliance on static signatures.

The lesson

Automated reconnaissance and data correlation, and the exposure they reveal

Reconnaissance has always been the slow part of a targeted attack: enumerating internet-facing assets, working out the technology stack, mapping staff, roles and reporting lines, and finding the leaked credential or forgotten subdomain that offers a way in. Each piece was usually public. Assembling them took analyst time.

Models change this in two ways.

• Automated collection and summarisation. Model-driven tooling can read a large body of public material, such as websites, job adverts, code repositories, social profiles, conference talks and breach collections, and extract what matters. A job advert naming the firewall, identity provider and ticketing system an organisation runs is reconnaissance, and a model reads thousands in the time a person reads one.
• Automated data correlation. The larger effect is joining fragments that were harmless alone. A name from a press release, an email format inferred from document metadata, a personal account from a social profile, an old password from a breach dump and a remote-access portal found through certificate transparency logs add up to an attack path. Correlation turns a scattered footprint into a targeting package.

For the defender, "technically public, but nobody will find it" stops being a risk position. The practical responses:

• Look at yourself the way an attacker would, continuously. External attack surface management, certificate transparency monitoring, secret scanning of public repositories and monitoring for staff credentials in breach data. The same AI-assisted correlation works for defenders, applied to assets they are authorised to assess.
• Shrink the footprint. Review what job adverts, published documents and their metadata, and staff profiles disclose about the technology stack and internal structure.
• Assume the targeting package exists. Phishing-resistant MFA, credential monitoring and segmentation matter more once you assume the attacker already knows names, roles and email formats.

Adversarial networks and AI-assisted obfuscation, and why signatures age faster

A generative adversarial network (GAN) pairs two models: a generator that produces candidates and a discriminator that tries to tell generated output from real. Each improves against the other until the generator's output is hard to distinguish. The idea matters beyond deepfakes, because the same arrangement can be pointed at a security control. If the discriminator's role is played by a detector, or by a model that imitates one, the generator is being trained to produce output the detector calls benign.

That is the core of AI-assisted obfuscation: changing malicious content so that it keeps its function but changes its appearance to a detector. Obfuscation is old; packing, encryption, polymorphism and metamorphism all predate modern AI. What AI changes:

• Variation becomes cheap. Each copy of a script, phishing page or document can be rewritten so that no two share a hash, string or structure a signature could key on.
• Variation can be guided. Changes are selected against a model of the detector rather than made at random. This is the input manipulation idea from lesson 17, and ML01 Input Manipulation Attack in the OWASP Machine Learning Security Top 10, aimed at a security classifier instead of an image classifier.
• Language varies too. Lures and pretexts can be paraphrased without limit, so signatures on message text decay quickly.

A signature matches a specific artefact, and its useful life was the time until the attacker changed that artefact. When change costs nothing, that life shrinks towards a single campaign or a single victim. The answer is not to abandon signatures, which still remove commodity threats cheaply, but to stop relying on them as the main layer:

• Behavioural detection of what code does, such as process lineage, privilege use, persistence and unusual destinations, which the attacker must still do however the code looks.
• Detection on techniques, mapped to MITRE ATT&CK, rather than on hashes, strings and addresses, which are the cheapest things for an attacker to change.
• Hardening the classifiers you own: adversarial testing of your own ML detectors, ensembles of different models, and not exposing detailed scores that an attacker could use to steer variations.
• Application allowlisting where feasible, because a control that permits only the known-good does not care how novel the bad is.

Automated attack generation: vector discovery, payloads and malware, at the level a defender needs

Three related capabilities sit under this heading. What follows is what each means and what it changes for defence.

• Attack vector discovery. Models help analyse code, configurations and exposed services for weaknesses, and help chain small findings into a path. The same capability is a defensive tool, and lesson 22 covers AI in vulnerability analysis within authorised scope. In an attacker's hands it shortens the window between a weakness becoming discoverable and it being found, and it brings attention to lower-value targets because the marginal cost is low. Published advisories and patches are also analysed faster, compressing the time from disclosure to exploitation.
• Payloads. A payload is the part of an attack that does the harm once delivery succeeds. AI helps adapt it to a particular environment and vary it between victims. For the defender the point is tailoring: payloads that fit your stack and differ from the ones seen elsewhere.
• Malware. Models lower the skill needed to write and modify malicious code and make variants cheap to produce. Researchers have also described malware that consults a model while running, so that behaviour differs between executions. Commercial model providers apply safeguards against these uses, and attackers respond with jailbroken, self-hosted or specially tuned models, so the defensive assumption must be that the capability is available.

What a defender takes from this:

• Exposure windows shrink. The time a known vulnerability can safely stay unpatched on an internet-facing system gets shorter. Prioritise by exploitability and exposure, using known-exploited vulnerability lists and reachability, and keep compensating controls ready for what cannot be patched at once: a virtual patch at the web application firewall, a disabled feature, an isolated system.
• Volume rises at the low end. Organisations that were too small to target receive tailored attacks, because tailoring is no longer the expensive part.
• Detection must not depend on having seen the sample, which is the obfuscation point again.
• Your own AI systems are part of the surface. A code assistant or an agent with tool access can be manipulated into doing an attacker's work, as lessons 12 and 17 describe.

AI against honeypots and in distributed denial of service

Honeypots are decoy systems, credentials or data placed so that any interaction with them is suspicious. They are valuable because they give high-confidence alerts with very few false positives. AI cuts both ways.

• Against the defender. Models can help an attacker judge whether a system is a decoy by comparing its content and responses with what a genuine system of that type would show. A static, low-interaction honeypot with implausible content or a generic banner is easier to identify, and an attacker who identifies one learns something about the defender's monitoring and steers round it.
• For the defender. The same generative capability makes better decoys: realistic documents, file shares, database records and user activity, and high-interaction honeypots that respond plausibly for longer. Honeytokens, such as fake credentials, API keys and canary documents, remain effective because they need not pass as a whole system; they only need to be used.

The practical guidance: refresh decoy content so it does not go stale, keep it consistent with the real environment, place honeytokens where automated collection will find them, such as credential stores, repositories and documentation, and treat any use of one as a priority alert.

Distributed denial of service (DDoS) attacks availability from many sources at once. AI enhancement shows up as:

• Adaptive attacks that change vector, rate and target in response to mitigation faster than a human operator could.
• Traffic that imitates real users at the application layer, with realistic sessions and pacing, so that simple rate rules separate it poorly from customers.
• Better target selection: the expensive endpoints, such as search, login and report generation, where each request costs the defender far more than it costs the attacker.

AI systems are also targets in their own right. A model endpoint is expensive per request, so a flood of costly prompts is a denial of service and a cost attack at once. The 2023 OWASP LLM list called this Model Denial of Service; the 2025 list broadens it to LLM10 Unbounded Consumption. Lessons 10 and 16 cover the limits and cost monitoring that contain it.

Defences: upstream DDoS protection with more capacity than an attacker can exhaust, behavioural traffic classification rather than fixed thresholds, rate limits per identity and per expensive operation, caching, challenges for suspect clients, and a runbook rehearsed with the provider so that mitigation does not start with finding a phone number.

The defensive changes each of these forces on a security programme

Pulled together, these are the programme changes, and the shape of answer scenarios reward:

Three changes cut across all of them:

• Speed. If the attacker's loop is automated, a defensive loop measured in days loses. Automate the parts of detection and response that are safe to automate, which lessons 25 to 27 cover, and measure time to detect and time to contain.
• Use AI on the same problems. Correlation, anomaly detection and triage scale for defenders too (lesson 21), on systems and data the defender is authorised to examine.
• Intelligence and threat models that include AI. Track how threat actors actually use AI through threat intelligence and the case studies in MITRE ATLAS (lesson 8), and add AI-enhanced variants to existing threat models and exercises rather than filing them as a separate category.

What the exam is really asking

This objective's verb is "explain", so expect questions that describe an effect and ask for its cause or its consequence: a sudden rise in unique malware hashes that all behave alike points to automated variation, and the answer is behavioural detection; a targeted lure that names internal projects points to correlation of public data, and the answer is footprint reduction and verification. The wrong answers tend to be the ones that assume the attacker still pays the old price for effort.