FBI Reports AI Use by Threat Actors in Broader Cyber Context Including Infrastructure Intrusions

April 29, 2025

The FBI has reported that threat actors, notably those linked to China and cybercriminal groups, are progressively incorporating AI tools throughout the cyberattack lifecycle. Documented instances suggest that these tools are used in various malicious activities such as AI-generated spear phishing, business identity fabrication, internal network mapping, and deepfake-enabled fraud. These advanced technologies are allegedly aiding attacks on U.S. infrastructure.

JOIN US to Govern and Map these incidents through HISPI Project Cerebellum TAIM, promoting trustworthy AI and preventing harm.

Matched TAIM controls

Suggested mapping from embedding similarity (not a formal assessment). Browse all TAIM controls

MAP 4.1 — similarity 0.690, rank 1. TAIM detail and related incidents →
MAP 4.2 — similarity 0.683, rank 2. TAIM detail and related incidents →
MEASURE 2.6 — similarity 0.681, rank 3. TAIM detail and related incidents →

Alleged deployer: government-of-china, chinese-communist-party
Alleged developer: unknown-generative-ai-developers
Alleged harmed parties: united-states-critical-infrastructure, private-companies, government-agencies, employees-targeted-by-phishing, employees-targeted-by-deepfake-impersonations

Source

Data from the AI Incident Database (AIID). Cite this incident: https://incidentdatabase.ai/cite/1055

Data source

Incident data is from the AI Incident Database (AIID).

When citing the database as a whole, please use:

McGregor, S. (2021) Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. In Proceedings of the Thirty-Third Annual Conference on Innovative Applications of Artificial Intelligence (IAAI-21). Virtual Conference.

Pre-print on arXiv · Database snapshots & citation guide

We use weekly snapshots of the AIID for stable reference. For the official suggested citation of a specific incident, use the “Cite this incident” link on each incident page.