In recent years, the intersection of artificial intelligence (AI) and cyber-operations has become a pivotal battleground for state actors. What was once largely the domain of human hackers sitting at keyboards is increasingly shifting into systems that learn, adapt, and automate at machine-speed. For nations seeking strategic advantage, this presents both an opportunity and a risk. In this blog post, I’ll explore how state actors are adopting AI cyber-tools, why this matters, how they are using them, and what the implications might be for global security, business and individuals.
Why AI Matters in Cyber Operations
Lowering the Barrier to Sophisticated Attack
AI, particularly machine-learning and generative models, is lowering the threshold for performing advanced cyber-operations. According to one analysis:
“AI also lowers barriers to entry for sophisticated cyber attacks, making them accessible to smaller states and non-state actors.”
This means that actors who previously might have lacked the resources or expertise to mount high-end campaigns can now leverage more automated, scalable tools.
Speed, Scale and Adaptability
Traditional cyber attacks often required significant manual work: reconnaissance, payload development, exploitation, lateral movement. AI changes that dynamic. It can automate vulnerability discovery, generate exploit code, tailor phishing campaigns, or craft disinformation all faster than humans alone. For example:
“AI enables adversarial actors to execute highly adaptive, autonomous cyber attacks at speeds far beyond human capabilities.”
This means defenders are under pressure not only to stop attacks, but to do so at machine-speed.
Asymmetry and Strategic Leverage
From a strategic point of view, AI gives state actors asymmetric advantages. A smaller or less powerful nation might leverage AI-based cyber tools to punch above its weight, disrupt larger competitors, or achieve plausible deniability via digital means. As one commentary puts it:
“The rise of AI-driven cyber weapons, zero-day vulnerabilities, and state-sponsored cyber attacks is creating an unprecedented era of digital warfare.”
Thus, the deployment of AI in cyber-operations is not just a technological shift but a strategic one.
How State Actors Are Deploying AI in Cyber Operations
Let’s look at some of the concrete ways in which states are integrating AI into their cyber toolkits.
1. Automated Reconnaissance and Exploitation
Reconnaissance mapping networks, identifying vulnerabilities has traditionally been labour-intensive. AI is accelerating this:
- AI models can analyse large volumes of network telemetry and logs to spot anomalies or weak configurations.
- Generative AI can assist in scripting exploits, creating variants of malware on the fly to evade signature-based defences. For example:
“State-sponsored cyber actors are increasingly employing AI … to develop polymorphic malware that alters its code composition to avoid detection.”
- Tools exist that allow near-real-time scanning of open-source code, repositories and supply chains for new vulnerabilities.
With these capabilities, the “time from discovery of the weakness to weaponisation” compresses dramatically.
2. Disinformation, Influence Campaigns and Deepfakes
One of the most visible uses of AI by state actors is in information warfare:
- Generative models are used to create deepfake audio/video, fake news articles, and highly plausible social-media posts tailored to specific linguistic and cultural contexts.
- For example, a recent report by Microsoft found that states such as Russia, China, Iran and North Korea are using AI at scale to produce fake content, impersonate officials, and carry out phishing or spear-phishing campaigns.
- The localisation of messaging tailoring it to target country, language, cultural norms makes it more effective and harder to detect.
So state actors are not only attacking infrastructure but the information environment, public opinion and confidence in democratic institutions.
3. Targeting Critical Infrastructure and Supply Chains
AI-driven cyber operations are increasingly being used against critical national infrastructure:
- Targets include communication networks, power grids, transportation systems, supply-chain software. As one analyst notes:
“Nation-states will increasingly target critical civilian infrastructure … by targeting critical infrastructure such as energy grids, communication networks, transportation systems, and supply chains these attacks can cripple an entire national infrastructure.”
- The supply chain is especially vulnerable. Open-source software contributions, libraries, and infrastructure are under threat as states exploit the software ecosystem:
“Open source software is at a critical point. The threats are becoming more sophisticated, driven by state actors, the misuse of AI tools like LLMs, and a focus on supply chain interference to inflict maximum damage.”
For a state actor, attacking via supply chain or critical infrastructure offers major leverage at relatively low cost.
4. Defensive and Intelligence Applications
It’s not only about attack. State actors are also adopting AI as part of their cyber-defence and intelligence apparatus:
- AI systems are deployed to monitor networks, detect anomalies, correlate threat-signals, and facilitate faster response.
- Some governments are integrating AI into military intelligence, surveillance, reconnaissance (ISR) systems, and decision-support infrastructures.
So the same technologies that enable offensive operations also enhance defensive posture leading to an arms race in cyberspace.
5. Hybrid Operations: Convergence of State Actors and Cybercrime
One feature of modern cyber operations is the blurring lines between state actors and criminal networks:
- Research shows state-sponsored groups collaborating with cybercrime organisations, sharing tools, infrastructure and even objectives.
- AI complicates attribution further: automated tooling, reused code-bases and shared platforms make it harder to distinguish between a purely criminal actor and a state-backed campaign.
This convergence complicates defence efforts and raises regulatory, legal and diplomatic challenges.
Case Studies: What the Evidence Shows
Russia, China, Iran, North Korea: AI in Cyber Ops
According to recent reporting, major state actors are already active:
- Microsoft’s threat intelligence indicated that Russia, China, Iran and North Korea are leveraging AI to escalate cyberattacks, generate disinformation and impersonate officials.
- For example, in July 2025, Microsoft identified over 200 instances of foreign adversaries using AI-generated content in one month more than double the figure from the previous year.
- These campaigns target governments, businesses and critical infrastructure (hospitals, transport networks, supply chains).
Ukraine and the AI Warfront
While this blog focuses on state actors more broadly, the ongoing conflict in Ukraine offers insight into how AI is being used in practice:
- Ukraine has embraced AI tools for situational awareness, battlefield management and cyber-defence. For example, the system Delta (Battle‑Management System) integrates drone-feeds, satellite imagery, sensor data in real time.
- While this is defensive/offensive in a conventional sense rather than purely cyber, it underscores the trend: AI in warfare, including cyber and hybrid warfare, is no longer theoretical.
Implications for Supply-Chains and Open-Source
The software ecosystem is under increasing pressure:
- Open-source software, used widely by governments and industry, is vulnerable to infiltration, malicious contributions and hidden vulnerabilities. One analysis warns:
“We envision a future where OSS is universally trusted… but that future is threatened when state-actors exploit AI to infiltrate projects and masquerade as legitimate contributors.”
If malicious actors (state-backed or otherwise) can influence open-source code, the downstream effects for software integrity worldwide are immense.
Implications & Risks
Strategic Stability and Escalation
The integration of AI into cyber operations poses risks for strategic stability:
- Because cyber-attacks can be plausible-deniable, covert and automated, they may reduce the threshold for conflict.
- AI-enabled attacks on infrastructure may provoke escalation or miscalculation.
- The speed of AI operations means that human decision-loops may struggle to keep up, potentially leading to unintended consequences.
Attack Surface Expansion
With AI, the attack surface increases:
- More systems from embedded devices to cloud-based services become vulnerable not just to known threats, but to AI-generated, polymorphic threats.
- Supply chains, open-source ecosystems, third-party software become attractive vectors for state actors.
Business & Civilian Targets at Risk
While state actors often target other states, business and civilian infrastructure are increasingly collateral or even primary targets:
- Critical infrastructure (energy, healthcare, transport) can be crippled by AI-driven cyber operations.
- Companies may find themselves in the cross-fire, either as targets or involuntary participants (for example via third-party software supply-chains).
Attribution and Deterrence Challenges
Some of the classic tools of deterrence attribution, retaliation are less effective:
- AI-enabled operations can be automated, obfuscated and disguised, making attribution harder.
- The convergence of criminal and state-backed actors further muddles the picture.
- Legal and diplomatic frameworks are still catching up to the new realities of AI-augmented digital warfare.
Ethical, Legal and Governance Issues
Deploying AI in cyber operations raises complex questions:
- Where do we draw the line between a cyber-weapon and a tool? Who is accountable when AI autonomously targets systems?
- How should international law, arms-control regimes and norms adapt to AI-enabled cyber warfare?
- Internally within states: how do you ensure oversight, human-in-the-loop decision-making, and avoid unintended escalation?
What Defenders and Policymakers Should Consider
Given this landscape, what should those responsible for defence both national and corporate be thinking about?
Prioritise AI-Aware Defence
Defenders must assume attackers will use AI and design systems accordingly:
- Use AI/ML for anomaly detection, threat hunting, supply-chain monitoring, adversarial behaviour detection.
- Emphasise defence-in-depth: given the increased speed and scale of attacks, early detection is critical.
- Monitor for emergent techniques: generative phishing, deepfake misuse, supply-chain infiltration via AI-augmented methods.
Strengthen Supply-Chain Resilience
Because state actors are targeting supply chains and open-source ecosystems, organisations should:
- Vet third-party and open-source components with greater scrutiny.
- Monitor for anomalous contributions or modifications.
- Build robust incident-response plans for supply-chain infiltration.
Build Attribution and Response Capabilities
While attribution is challenging, it is still critical:
- Invest in threat intelligence, detection of patterns indicative of state actor usage of AI tools.
- Enhance cooperation among states, industry and academia to share intelligence on AI-enabled threats.
- Develop credible response options technical, legal and diplomatic.
Develop Governance, Norms and Ethics
Policymakers should:
- Engage in international discussions about what constitutes unacceptable uses of AI in cyber-operations.
- Consider export controls, norms for AI in military/cyber contexts, accountability regimes.
- Ensure transparency and oversight in domestic use of AI for cyber defence/offence to maintain legitimacy and avoid escalation.
Educate and Train
Finally, both the workforce and leadership need to be prepared:
- Cyber teams must be trained in AI concepts, generative threats, and how to respond.
- Leadership must understand the strategic implications of AI in the cyber domain and integrate this into decision making.
The Path Forward: What to Watch For
As we move forward, several trends will be particularly important to monitor:
- Increased use of generative models by state actors for phishing, disinformation, malware generation.
- AI-driven zero-day campaigns where machine-learning discovers vulnerabilities and crafts exploits faster than humans can patch.
- Hybrid operations combining cyber, physical infrastructure, information operations and AI-enabled systems.
- Democratisation of cyber-tools: as AI tools become more accessible, smaller states or non-state proxies may gain capabilities previously only held by major powers.
- Escalation risks: as more states adopt these tools, the potential for accidental or deliberate escalation increases.
- Defensive adoption of AI: the arms race will continue attackers use AI, defenders adopt AI, and innovation accelerates on both sides.
Conclusion
The adoption of AI cyber-tools by state actors marks a significant shift in how cyber-operations are planned, executed and defended. What was once a largely human-driven domain is increasingly becoming one where machines, algorithms and automation play a central role both offensively and defensively.
For states, this means new strategic opportunities but also new risks. For businesses and individuals, it means that the threat landscape is evolving rapidly. For policymakers, it means we must adapt our governance models, legal frameworks, and defence postures.
In short: we are living through a transition in cyber-warfare and cyber-espionage, one driven by AI. The only sensible option is to prepare, adapt and stay ahead of the curve.