ITSEC Asia: Autonomous AI Agents Are Lowering the Barriers to Cybercrime

PT ITSEC Asia Tbk, the leading AI and cybersecurity company in Indonesia and the APAC Region, has released a new threat intelligence whitepaper examining how attackers use AI agents to identify targets, exploit vulnerabilities and steal or destroy data.

Titled AI-Powered Cyberattacks in the Global Threat Landscape, the research identifies a growing shift towards autonomous AI agents capable of conducting multiple stages of cyberattacks and adapting when an attack fails, all with limited human intervention.

Based on reported cyber campaigns and global threat intelligence, ITSEC Asia’s Threat Intelligence Team found that AI is increasingly being used to reduce the time and manual effort required to carry out attacks. By automating the different stages of an intrusion—from reconnaissance and vulnerability exploitation to credential collection or data extraction and destruction—AI is making sophisticated cyberattacks easier and faster to execute.

Patrick Dannacher, President Director of ITSEC Asia, said “AI is changing the economics of cybercrime. Attackers can now carry out activities that previously required considerable technical expertise, time and resources at a much lower cost. For businesses, this creates a different level of exposure. Security teams need to recognise that attacks can move faster, reach more targets and affect critical systems before conventional response processes can catch up. Preparing for this shift requires organisations to rethink how they protect their infrastructure, identities and data,”

How AI Is Changing Cyberattacks

ITSEC Asia’s research examines five cases that demonstrate how AI and automation are being used across different types of cyber operations.

One of the most concerning examples is the JadePuffer case, where researchers reported that an AI agent adapted its actions during a database extortion operation. Related cloud activity that Microsoft tracks as Storm-3168 showed how attackers used compromised credentials for cloud applications and services to access and delete resources.

Other cases show how attackers can use AI to reach more targets. In the Scarlet Loop case, attackers reportedly scanned more than 84,000 URLs across 107 countries and 47 sectors and used AI to help identify sites with accounts holding funds or rewards, such as digital wallets and loyalty programs.

The report also examines ARTEX, a framework that coordinates multiple AI agents to conduct reconnaissance, vulnerability scanning and exploitation. In a separate campaign associated with the CAIRN framework, Reuters reported that more than 1,200 websites were targeted and more than 100 companies were breached.

Businesses Need to Prepare

ITSEC Asia identifies compromised cloud identities as one of the highest priority risks. Attackers can exploit stolen credentials and excessive permissions to access cloud resources and move across systems, sometimes without deploying traditional malware.

The report recommends that organisations strengthen their defences in four areas:

1. Monitoring unusual account activity by improving behavioural threat detection through technologies such as Extended Detection and Response (XDR) and User and Entity Behavior Analytics (UEBA).
2. Zero Trust security principles should be applied to strengthen identity verification, restrict access and limit unauthorised movement across systems.
3. Organisations should increase automation in their incident response through Security Orchestration, Automation and Response (SOAR), allowing security teams to contain threats faster.
4. Dedicated security practices should be introduced to protect AI models, training data and the systems used to develop and deploy them.

Over the next six to twelve months, ITSEC Asia expects more ransomware campaigns that use AI agents to target cloud and database services, broader abuse of cloud credentials, and more attacks on enterprise AI infrastructure. It also expects greater use of AI-generated audio and video in impersonation and fraud.

“Ultimately, cybersecurity is a business responsibility. As organizations adopt AI across their operations, security considerations need to be part of every strategic decision, from technology investments to how data is managed and who has access to critical systems. The organizations that take this seriously today will be in a better position to protect their customers, maintain trust and sustain their business in the years ahead,” Patrick added.

Access the Whitepaper

AI-Powered Cyberattacks in the Global Threat Landscape was prepared by the ITSEC Asia Threat Intelligence Team and issued in November 2026. The full whitepaper can be accessed through the Whitepapers section of ITSEC Asia’s Investor Relations page: https://qrfy.io/r/whitepaper-nov26.