Loading...
AI isn’t just showing up in your vendors’ workflows—it’s changing how attackers operate, too. Not by giving them “zero-day magic,” but by giving them speed and scale.
Black Kite’s ongoing monitoring of more than 150 ransomware groups shows that most attackers aren’t using AI to create new exploits or build autonomous malware. Instead, they’re using AI for something more practical—and, in many ways, more dangerous: to make reconnaissance, deception, and compromise dramatically faster.
Here’s a look at how cybercriminals are using AI today, where their tactics are headed next, and how third-party risk management (TPRM) strategies need to evolve in response.
Cybercriminals have always been pragmatic. They don’t innovate for novelty—they innovate for efficiency. They adopt what works, abandon what doesn’t, and weaponize legitimate tools for malicious ends. AI fits that approach perfectly.
So far, our research team has seen attackers mostly use AI for support functions—phishing content generation, translation, and voice or image manipulation—but those efficiencies compound quickly.
Phishing emails no longer sound “off.” Fake vendor invoices look authentic. Data mining that once required teams of analysts is now done by one person with the right prompt. The impact isn’t what AI creates—it’s how much time it compresses.
And when time compresses, risk scales—especially across interconnected vendor ecosystems.
Before we explore how attackers will use AI to accelerate supply chain attacks in the future, it’s important to understand how they’re using AI right now. (Dive deeper into this topic with our blog, AI in Ransomware: How Threat Actors Are (and Aren’t) Using AI.)
Most threat actors today aren’t deploying “AI malware.” They’re using AI the same way defenders do: to save time and increase productivity. Current use cases include:
Criminals follow ROI, not hype. The tactics remain the same, but AI multiplies their efficiency. AI isn’t changing what cybercriminals do, but how fast they can do it.
If AI’s current role is acceleration, its next will be amplification. In the near term, AI will expand adversary capability in three critical ways—and all of them directly impact your supply chain:
AI can already analyze public and leaked data to uncover relationships between organizations—who connects to whom, what technologies they use, and where dependencies overlap. Over time, these same capabilities will become faster and more automated, with AI acting as a tireless analyst continuously scanning for weak or high-value links in the chain.
Supply chain targeting won’t happen in predictable cycles—it will happen in real time. Threat actors won’t need to spend weeks mapping your ecosystem to find your weakest vendor. Their models will already flag which suppliers present the greatest opportunity or exposure, long before defenders even realize they’re exposed.
AI won’t be used to write sophisticated new ransomware overnight, but it can easily repackage existing code into endless variants that can slip past traditional detection methods.
Cybercriminals will increasingly use AI models to adapt existing malware for specific environments, adjusting configurations, modifying payloads, and exploiting known weaknesses with minimal human effort. The danger isn’t “AI malware.” It’s conventional malware that’s evolving and spreading faster than defenders can keep up.
AI is accelerating a shift that’s already underway in the ransomware ecosystem. Large, disciplined operations are giving way to smaller, more opportunistic groups. As our 2025 Ransomware Report shows, dozens of smaller groups are replacing once-dominant names like LockBit and AlphV.
AI will likely accelerate this decentralization by automating the operational drudgery—drafting ransom notes, translating communications, even managing negotiations. Illicit, criminal-facing LLMs like WormGPT are lowering the entry barrier even further. The result isn’t necessarily more advanced attacks, but many more of them—and each new actor puts more pressure on the supply chain.
The supply chain has always been a force multiplier for attackers. One compromised vendor can expose hundreds of downstream companies. AI doesn’t change that dynamic, it simply removes the manual work of finding the weakest link.
By analyzing public business data, leaked credentials, and shared infrastructure metadata, AI can map interdependencies between companies. It can also reveal which suppliers rely on the same third-party services or technologies, helping attackers model which compromise would create the greatest downstream impact and prioritize those targets accordingly.
We’ve already seen how that plays out. The 2024 CDK Global ransomware attack disrupted thousands of automotive dealerships through a single upstream breach. The Clop campaign against MFT software spread across retail and logistics ecosystems. Those operations were largely manual. With AI, similar campaigns will scale faster, spread wider, and be even harder to contain.
While the most advanced AI-driven attacks haven’t yet materialized, broader adoption is inevitable. To build resilience now, CISOs and TPRM leaders should:
AI isn’t making attackers more creative—it’s making them more efficient. And efficiency at scale is what turns isolated vulnerabilities into systemic risk. The evolution of AI-driven threats won’t be defined by a single breakthrough, but by velocity. Adversaries will iterate, adapt, and exploit faster than manual defenses can respond.
That’s why continuous, predictive risk intelligence is now critical. The Black Kite Research Group tracks global threat actors and third-party exposures in real time, translating early indicators into quantifiable insights about who is being targeted, how, and why.
Attackers aren’t rewriting their playbooks with AI, they’re just running them faster. With Black Kite, organizations can identify at-risk vendors sooner, understand the methods likely to be used against them, and take informed action before threats turn into incidents.
Access the first truly global framework for assessing AI risk: Global Adaptive AI Assessment Framework™, BK-GA³™. Available free to the public here.