[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fmuugmKzyWzTrsqLN_q1SfwH2s_iNC-c44ejFr5gKP-Y":3},{"article":4,"iocs":44,"watch_terms":48,"solutions":49,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"9a8e9133-a7b7-4741-a0e6-1bb8f87763d7","Attackers Are Learning to Live Off the AI Toolchain","attackers-are-learning-to-live-off-the-ai-toolchain-b6268e","Sandworm_Mode is an early example of malware that exploits trusted AI tools and workflows to make malicious activity virtually indistinguishable from normal activity.","Sandworm_Mode is an emerging malware that demonstrates attackers' growing ability to exploit trusted AI tools and workflows. This technique allows malicious activities to blend seamlessly with legitimate operations, making detection significantly more challenging.","Sandworm_Mode malware leverages AI toolchains to mask malicious activity as normal operations.","https:\u002F\u002Fwww.darkreading.com\u002Fcyber-risk\u002Fattackers-live-off-ai-toolchain","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt3487664d9c613ba9\u002F6a61308f2c3e688b979308a0\u002Fai_TSViPhoto_shutterstock.jpg?width=720&quality=80&disable=upscale","2026-07-22T21:29:01+00:00","2026-07-22T22:00:15.306523+00:00",7,[17,20],{"name":18,"type":19},"Sandworm","threat_actor",{"name":21,"type":22},"AI toolchain","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":23,"icon":25,"name":26,"slug":27},null,"Malware","malware",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45],{"type":27,"value":46,"context":47},"Sandworm_Mode","Malware name exploiting AI toolchains",[],{"controls":50,"vendors":134},[51,80,109],{"slug":52,"name":53,"problem":54,"products":55},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":81,"name":82,"problem":83,"products":84},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-security-operations","Google Security Operations","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fsecurity-operations","Cloud SIEM and SOAR, formerly Chronicle.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"guardsix","Guardsix","\u002Fvendor-logos\u002Fguardsix.png","guardsix-siem","Guardsix SIEM","https:\u002F\u002Fguardsix.com\u002Fproduct\u002Fsiem","SIEM with automation, developed and hosted in Europe.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"splunk","Splunk","\u002Fvendor-logos\u002Fsplunk.png","enterprise-security","Splunk Enterprise Security","https:\u002F\u002Fwww.splunk.com\u002Fen_us\u002Fproducts\u002Fenterprise-security.html","SIEM for detection, investigation and response, on premises or in the cloud.",{"slug":43,"name":110,"problem":111,"products":112},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[113,118,126],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":114,"product_name":115,"url":116,"description":117},"google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",[],{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":150},"malware-exploits-trusted-ai-tools-to-blend-in-and-evade-detection","Malware Exploits Trusted AI Tools to Blend In and Evade Detection","The emergence of Sandworm_Mode malware highlights a dangerous evolution in attacker tradecraft: weaponizing legitimate AI tools and workflows to mask malicious activity. By living off trusted AI toolchains, attackers exploit the inherent trust organizations place in these platforms, making traditional signature-based detection nearly blind to the threat. This technique is particularly insidious because security teams may dismiss anomalous behavior as normal AI operations, dramatically extending attacker dwell time. As AI adoption accelerates across enterprises, the attack surface of trusted-but-abused tools expands in parallel, raising the stakes for defenders who lack AI-specific monitoring strategies.",[140,141,142,143,144,145,146,147,148,149],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 8 – Audit Log Management","CIS Control 12 – Network Infrastructure Management","NIST SP 800-161 – Supply Chain Risk Management","NIST SP 800-53 AU-2 – Audit Events","NIST SP 800-53 SI-7 – Software, Firmware, and Information Integrity","NIST AI RMF – Govern 1.1 and Map 1.5","MITRE ATT&CK T1195 – Supply Chain Compromise","MITRE ATT&CK T1072 – Software Deployment Tools Abuse","ITIL – Service Configuration Management",{}]