Emerging Threats: AI-Driven Cyberattacks by Nation-State Groups Targeting Key Industries

Today’s newsletter focuses on recently reported cyberattacks, which are suspected to have been carried out by a Chinese state-sponsored hacking group. The group utilized artificial intelligence in what Anthropic believes is the first documented case of a large-scale artificial intelligence based cyberattack of this kind. It also highlights a sophisticated campaign against targets in the government and defense industry launched by an Iranian state-sponsored hacking group, uncovered by the Israel National Digital Agency. Both highlighting the increasing threats that governments and commercial organizations face in the transforming digital landscape.

China and Iran flags with a hacker silhouette symbolizing emerging nation-state cyber threats.

Artificial Intelligence Used to Conduct Automated Attacks

Anthropic, a company specializing in artificial intelligence research, development and safety, reported last week on what they believe is the first documented case of a large-scale cyberattack that was dominantly performed using artificial intelligence. A threat actor, which is suspected to be a Chinese state-sponsored hacking group, manipulated a tool developed by Anthropic to attempt infiltration of thirty targets, resulting in some cases of successful infiltration. They were able to trick the tool, which is trained to not comply with requests that would engage in infiltration of external systems, using methods including convincing the large language model that the user was a legitimate security company engaging in defensive testing. While Anthropic was able to detect and document this case, it is expected that attacks like these will continue to grow in size, complexity and effectiveness. It also shows a growing trend in state-sponsored hacking, and how artificial intelligence is growing the attack surface that organizations need to defend in order to keep themselves protected from hacking attempts.

Access the full article here.

Access the full article here.

Iranian Hackers Launch Operation on Government Targets

A recent report by the Israel National Digital Agency uncovered a sophisticated campaign by an Iranian state-sponsored hacking group targeting individuals in both government and defense industry roles. As part of the attack, the hacking group has expanded social engineering attempts to the family members of their targets. This new campaign involved the hacking group inviting individuals to meetings or conferences online that led to spoofed web pages which were intended to steal credentials, or install backdoor software that could enable unauthorized remote access or data exfiltration of those targets. The hackers were observed spending long periods of time cultivating these relationships, with some cases including physical meetings. The group used a sophisticated malware called TameCat, which can establish backdoor communications for command and control via communication apps such as Telegram and Discord. It has sophisticated methods of evading detection, and shows the increasing effectiveness that hacking groups have and are continuing to grow. It also highlights the growing threat landscape for organizations in this rapidly changing digital environment.

Access the full article here.

Access the full article here.

Figure: Attack flow of the TAMECAT malware used in the Iranian operation, showing how adversaries used impersonation, fake files, and multi-stage in-memory modules to access and exfiltrate data from government and defense targets. Source: The Hacker News, “Iranian Hackers Launch ‘SpearSpecter’ Spy Operation on Defense & Government Targets,” Nov 14, 2025. Access the full article here.

Yisda Takeaways

Adversaries are increasing the scope of their attacks, both by widening the lens of traditional methods, and piloting new methods that have become available with the recent booms in technological advancement of artificial intelligence. The threats that the average organization face today are increasing at a rapid rate and require an engaged and persistent effort to ward off and stay secure. The beginning of large-scale cyber attacks driven by artificial intelligence does not only increase the effectiveness of adversarial tactics, but increases the amount of organizations that they are able to target. This grows the threat to every organization, and emphasizes the necessity to make sure that critical assets are being properly secured, that employees are trained in recognizing threats and responding accordingly, and that networks are being segmented, monitored and maintained properly. 

Given the rising efficiency and expanding scope of social engineering attacks by hacking groups, it is also increasingly crucial to implement robust security measures and training for employees. Security measures need to be taken towards preventing unauthorized access to the network, and to minimizing the exposure that unauthorized access would provide. It is important to emphasize the importance of the training, and to incentivize employees to truly learn and grasp the security hygiene necessary to combat threats in the modern digital landscape. A key step is also ensuring that employees are granted only the minimum necessary access to critical assets and information, so that if they are compromised the impact can be minimized. It is also important for organizations to recognize that not all cybersecurity solutions address the realities of today’s advanced, AI-enabled threats—especially in operational environments. Training and strong security practices remain critical, but modern defense also requires technology designed specifically for OT and critical infrastructure systems. Yisda was built with this in mind, created by people who understand these environments and the unique gaps that exist within them. By reducing unnecessary exposure and strengthening security across OT systems and the broader IT/OT convergence, Yisda provides a focused layer of protection that aligns with how these systems operate and how they are being targeted today.