1. Introduction

The global artificial intelligence revolution has not escaped Iran’s notice. Despite heavy sanctions and an unprecedented economic crisis, Iran is working to develop advanced capabilities in the field and aims to achieve full independence, free of the whims of foreign actors. Public statements in recent years make clear that the Iranian regime understands the significance of this revolution and its implications for Tehran’s security, domestic, and foreign policy. *

Alongside attempts to develop strategic capabilities in the field, Iranian offensive-cyber and influence actors[1] are already integrating AI into their operational toolkit to improve the quality of their attacks and operations. These indications may be an early harbinger of malicious Iranian use of AI capabilities and highlight the dangers that may be posed by the development of independent Iranian AI capabilities.

This paper reviews the goals the Iranian regime has outlined in the AI domain, the malicious uses already underway, and additional advanced actions that Iran may undertake—​or is already undertaking—​against its adversaries in general and Israel in particular.

2. The Iranian Vision for Artificial Intelligence

• Iran’s leadership frames artificial intelligence as a national strategic priority
  
  Many senior Iranian officials, alongside prominent figures in industry and academia, stress the need to develop AI capabilities in Iran and regulate activity in the field. The tone and targets are set by Iran’s Supreme Leader Ayatollah Khamenei, who dictates policy goals. The drafting and implementation of these plans are carried out by individuals and bodies subordinate to the Supreme Leader.
  
  In speeches delivered in recent years, Khamenei has stressed the importance of the AI revolution and the need for Iran to join the field in an organized and immediate manner. In April 2025 he said: “Artificial intelligence is advancing at an astonishing pace, to the point that people are amazed at the speed of this technology. Therefore, one of the fundamental issues that must be reflected upon, relied upon, and deepened is artificial intelligence.”[2]
  
  Artificial intelligence will play a central role in governance and administration in the world of the future; Iran, he argued, must understand the “deep layers” of AI rather than remain a mere “consumer.” Earlier, in September 2024, he warned that an international body ​similar to the IAEA ​may one day be established to oversee the use of AI technologies, and that Iran may be required to obtain authorization to use them—​a scenario that could restrict it to certain uses while others would be blocked.[3]
  
  Alongside Khamenei, President Pezeshkian has also spoken about artificial intelligence. In a January 2025 meeting with the Supreme Council of the Cultural Revolution, the president outlined the next stages in the domain of AI: drafting policy, passing legislation, mapping challenges and needs, and finally formulating a work plan. He added that the Vice President for Science and Technology would advance the issue with the various bodies—​research institutions, policy bodies, and with the Majlis.[4]
  
  Technology professionals in Iran have likewise stressed the significance of the AI revolution. Seyed Abolhassan Firouzabadi, former secretary of the Supreme Council of Cyberspace, said in September 2025 that artificial intelligence is expected to bring about a transformation in how governance is conducted. In his words, in light of current developments in AI, “a paradigm shift is occurring,” and “within this shift, we are experiencing fundamental crises in the field of governance.”[5]
  
  Similarly, Mohammad Mokhber, former vice president of Iran and currently a special adviser to Khamenei, stressed in January 2025 that Iran must become a developer of AI technologies rather than merely a consumer. To do so, he said, requires the involvement of young people, elites, and experts. He stressed that support for research, investment in education, the creation of necessary infrastructure, and support for knowledge-based companies would form the foundation of this effort.[6]
  
  Beyond the statements of Khamenei and senior regime officials, the Supreme Leader’s office also produces interviews with Iranian AI researchers that reinforce his claims about the need for Iran to leverage the AI field at an early stage and develop independent capabilities in the field:
  
  Dr Davoud Masaoudi, secretary-general of the Iranian Association for Artificial Intelligence and Digital Economy, explained in an exclusive January 2025 interview on the Supreme Leader’s official website that Iran is already facing sanctions and restrictions—​on hardware components and software alike—​that hinder its ability to develop independent AI capabilities. “This situation is expected to continue,” he warned, “and in the future, leading states may further restrict our access to these technologies by establishing treaties or even preventing their duplication or independent development in other countries.”[7]
  
  Dr Mohammad-Reza Hassani Ahangar, president of Imam Hossein University,​a state institution affiliated with the Islamic Revolutionary Guard Corps, ​said that “artificial intelligence, through rapid data analysis, enables political and military decision-makers to respond quickly and decisively to situations. This capability significantly increases efficiency and effectiveness in resource allocation, strategic planning, and tactical execution, giving professionals a strategic advantage in complex scenarios.”[8]
  
  There is also lively discussion within Iran’s security establishment about integrating AI capabilities into the weapons systems of the Islamic Revolutionary Guard Corps (IRGC) and the regular army. Hossein Salami, the IRGC commander who was killed during the Iran–Israel war, spoke in January 2025 about the AI revolution and the capabilities it could bring to Iran’s armed forces. In his speech, Salami identified precision and targeting—​particularly in naval warfare—​as areas in which artificial intelligence would be especially useful for Iran.[9]
  
  In addition to Salami, the IRGC Navy commander, Ali Tangsiri, addressed the issue in November 2023 and said that AI capabilities would be integrated into the corps’ missile and aviation systems.[10]
  
  Alongside them, the deputy commander of Iran’s Army Ground Forces, Nader Ne’mati, spoke of regular meetings held on artificial intelligence and the equipment required for it: “All the research organizations we have in the country, or knowledge-based companies, are working with us, and the programs they present are based on AI.” Additionally, he noted that one of the main characteristics taken into account when considering equipment for the ground forces is that they be smart systems, continuing: “If the equipment is not smart, it will not enter the ground forces at all. When the equipment is smart, AI technology at the highest level available in the country must be used.” The deputy commander further stressed: “We must advance in line with today’s technology, and most of the deterrence we see today is connected to the modern equipment we possess.”[11]

• The Governmental Institutionalization of the AI Domain
  
  In June 2024, the Majlis approved the “National Artificial Intelligence Document of the Islamic Republic of Iran.” The document is meant to anchor the vision laid out by Khamenei and outline the initial path to its implementation: establishing national infrastructure, developing specialized human capital, making Iran a center for international research, and harnessing AI to create economic advantage for Iran and improve the regime’s governance.[12]
  
  In October 2025, the Majlis approved the establishment of the National Artificial Intelligence Organization, to be subordinated to the presidential office. Its defined role is primarily policy-oriented—​implementing, coordinating, and overseeing national AI policy, alongside managing research, regulation, and representing Iran in relevant international forums.[13] President Pezeshkian said that the government would take an active role in coordinating the relevant agencies to prevent wasted opportunities and funds.[14]
  
  Alongside state-level initiatives, Iran has already begun establishing a national experimental AI platform, which was even presented to Khamenei. In January 2025, a pilot version of the platform was unveiled. It is intended to allow businesses, organizations, and citizens to develop AI and machine-learning models locally inside Iran. According to reports, the platform is already being used in medicine, industry, the economy, marketing, transportation, and education.[15]
  
  According to the head of the AI Committee of the Information Technology Organization of Iran  (a body linking the private sector with the government), regulation of the field is essential: “The most important problem for the private sector is that it does not know which institution to engage with,” he said. “The AI Directorate sits under the First Vice President, the Vice President for Science and Technology, the Ministry of Communications, the Ministry of Industry, Mine and Trade, the Administrative and Recruitment Affairs Organization, and the Supreme Council of the Cultural Revolution all see themselves as responsible, yet none of these bodies is accountable for providing solutions. Many institutions see themselves as responsible only for receiving budgets, but not for assuming responsibility for delivery. This situation has wasted resources and slowed AI development. The national AI development program can put an end to this fragmentation by establishing a national organization.”[16]
  
  It is clear that Iran recognizes the significant potential of the AI revolution in governance and politics. For the regime, it also represents a potential internal threat, yet this revolution likewise contains opportunities to refine the tools Tehran uses in foreign policy—​including in offensive cyber activity and influence operations. Accordingly, and against the backdrop of efforts to establish a local platform and concerns over Western sanctions on Iranian activity, Iranian offensive-cyber and influence actors are already leveraging existing AI tools to enhance their operational capabilities.

3. Integrating Artificial Intelligence into Iran’s Cyber Apparatus

Official Iranian discourse regarding the use of AI in cyber activity naturally focuses on the defensive domain. Gholam-Reza Jalali, head of the National Organization for Passive Defense (NOPD), emphasized in May 2023 that “we are today witnessing the addition of artificial intelligence to the cyber arena,” and said that “AI is a highly valuable engine that has proven effective in several fields.”[17] According to him, the organization concluded that in the Persian year 1402 (2024–2025), “AI will enter the field of cyber defense, where many local Iranian companies already operate.” Monitoring, surveillance, detection, handling cyber threats, and stabilization and ensuring functional continuity, are, in Jalali’s view, among AI’s potential uses.[18]

In addition, the head of the NOPD stated that today’s modern infrastructures are mostly smart infrastructures, and noted that “after the events of  September 11, a new discipline emerged called Critical Infrastructure Protection (CIP). The NOPD, in cooperation with the country’s academic community, presented a local model for infrastructure protection by studying this new science.”[19]

However, there is Western evidence that Iran is harnessing the AI revolution for its offensive cyber apparatus as well. Among other things, a Microsoft report published in October 2025 prompted an official denial from the Iranian delegation to the UN. The delegation claimed that Iran does not initiate cyberattacks against other states but hinted that it “responds” to attacks launched against it by others.[20] This section of the paper reviews the evidence and case studies of Iranian use of AI capabilities in its offensive cyber activities.

4. Iran’s Offensive Uses of Artificial Intelligence Tools

In parallel with developing its own independent capabilities, Iran is already using Western AI systems to improve its offensive cyber apparatus. Some of these uses are detected by various technology companies that develop AI products and work to block Iranian attempts to exploit their systems for cyberattacks.

According to an October 2025 Microsoft report, Iranian use of AI capabilities for cyberattacks has been steadily increasing in recent years and is helping hackers working for Tehran to improve impersonation, intrusion, and the dissemination of disinformation toward Iran’s targets.[21] In addition, several Western companies have exposed specific uses that Iran-linked hackers are attempting employing their models:

• Iranian Hacker Group STORM-2035: Influence Operations and Disinformation
  
  OpenAI reported in August 2024 that known Iranian actors from the STORM-2035 group used its models to execute influence operations. The group is known for operating news sites intended to inflame divisions around the U.S. elections that year by highlighting contentious issues in American politics and opposing compromise on them, including LGBTQ rights and the Israel–Hamas conflict.[22]
  
  The group is linked to a broader campaign active since at least 2020 that operated dozens of fake news sites in English, Arabic, French, and Spanish. The campaign operators used OpenAI’s ChatGPT to generate content for online entities involved in Iranian influence operations. They used ChatGPT to author long articles published on a site linked to the group and produced posts for the X platform.[23]
  
  According to online reports, the group publishes content on dedicated sites in Arabic, French, Spanish, and English. Its core output revolves around pro-Palestinian, pro-Iranian messaging and anti-Israeli and anti-American themes. The group also operated support of the Assad regime, publishing articles denying his unpopularity inside Syria.[24]
  
  Additional activities linked to the group were also identified in the context of Scottish independence, Irish unification (domestic UK issues), and Iran–U.S. negotiations. Operators communicated with ChatGPT in Persian while requesting output in Spanish and English. The generated content was also published as supposedly “authentic” posts by citizens of the UK, U.S., Ireland, and Venezuela, using profile pictures taken from websites. It appears the operators attempted to maintain greater operational secrecy after being previously blocked—​an attempt that failed.[25]

• Iranian Cyber Persona “CyberAv3ngers” (IRGC)
  
  In addition STORM-2035, hackers linked to the IRGC and the “CyberAv3ngers” persona used OpenAI models to conduct vulnerability research and improve their offensive tools, primarily for network scanning and identifying common passwords for industrial control systems. According to the report,[26] the group showed particular interest in targets in Jordan and Central Europe. The attackers also used the model to improve their technical skills in other ways—​assistance in locating vulnerable infrastructure, camouflaging malicious code, using security tools for intrusion, and searching for public information about vulnerabilities in various products. The report further noted that the group’s searches went beyond its known target map (industrial control systems), possibly indicating new areas the group intends to focus on.[27]
  
  The Iranians are not relying solely on ChatGPT to enhance their cyber warfare. Google, which operates the Gemini model, also reported in January 2025 that it had detected use of its models by hackers affiliated with Iran.[28]
  
  According to Google, members of the group searched for ways to extract information from devices running the Android operating system (phones, tablets, etc.), focusing on SMS messages, account details, and contact lists. The hackers attempted to improve their code using the model, identify bugs in the code, and generate code snippets for a variety of uses.[29]
  
  In addition, the hackers used the model to search for information on organizations of interest—​such as security bodies, cybersecurity companies, and entities dealing broadly with defense and military affairs (apparently in several countries). Their interest focused mainly on disrupting Israeli defense and weapons systems, satellite and remote-sensing systems, UAVs, counter-drone systems, and seeking general information on the Israel–Iran conflict. They also used the model for general research not necessarily linked to operations they were conducting.[30]
  
  The hackers also used the model to generate content related to AI and cyber topics, content tailored to the targeting of security organizations (likely through phishing), and translations of text from Hebrew and English into Persian and vice versa. This use aligns closely with the group’s expertise in social engineering, of which phishing is a prominent example.[31]

• Iranian Hacker Group APT-42 (IRGC)
  
  A May 2024 report indicates that actors linked to the APT-42 attack group, which belongs to the IRGC, also use the Gemini model. This group specializes primarily in obtaining unauthorized access through social engineering (SE) and targets organizations, entities, and activists—​mainly in the Middle East.[32]
  
  APT-42 actors also used Gemini to research known vulnerabilities from the web and even focused on specific products they apparently intended to target. In addition, they tried to develop offensive cyber tools by attempting to mislead the model into producing material for a “red team,” simulating an attack team for cybersecurity drills.[33]

• Fear of Capability Denial
  
  Iran’s use of AI tools in its offensive cyber apparatus reflects both its shortage of high-quality indigenous tools—which drives it to seek capabilities it cannot develop independently—and its limitations in developing and exploiting advanced language-model technologies, which further push it to rely heavily on AI. Account shutdowns and the disruption of Iranian activity in this field are clearly reflected in the statements of Iran’s leadership, which express concern that access to AI capabilities may be blocked, and therefore highlight the need for independent domestic AI capabilities.
  
  Iran suffers from severe restrictions on its defense sector that have for many years denied it access to advanced weapons and forced it to develop strategic capabilities independently—​capabilities that have failed the test in confrontations with Israel, which is equipped with sophisticated American and Israeli weaponry. It is likely that Iran’s leadership sees the restrictions imposed by technology companies as a sign of things to come and is therefore working to establish autonomous AI capabilities before near-complete denial of access to such technologies is imposed.

5. International Trends That May Inspire Future Capabilities

Alongside the Iranians, many other actors are using artificial intelligence for cyberattacks and covert influence campaigns against target states. These operations are often more sophisticated than those currently carried out by Iran but serve to indicate possible directions Iranian actors could pursue against Israel. Needless to say, the offensive cyber domain—​like the AI domain—​is developing rapidly, along with the sophistication and creativity of its uses. The examples below provide a glimpse of what may lie ahead but by no means represent the limits of capability in this field.

• North Korea’s “Remote Work” Fraud — A Potential New Penetration Model for Iran
  
  The North Korean IT-worker fraud—one of the more unique cybercrimes uncovered in recent years—​illustrates additional capabilities and methods Iranian attackers could adopt.
  
  In 2022, Google’s Cyber Threat Intelligence (CTI) service identified a large-scale fraud operation run by North Korea: individuals linked to the North Korean regime posed as IT workers and worked inside organizations around the world, in a wide range of sectors, to generate revenue for the regime while circumventing sanctions. These workers also exploited the access they received inside corporate networks to provide North Korean hackers with convenient entry points into those organizations.
  
  North Korean operatives applied for remote-work positions at various companies, as salaried employees or contractors—​sometimes at several companies simultaneously and under different identities. During the screening process, they relied on “authentic-looking” documents attesting to their experience and education. The network relied on “laptop farms” that the operatives could access via remote-management tools and VPN connections to conceal any link to North Korea.[34]
  
  The North Koreans used AI tools, ​including Gemini, ​to write personal letters, prepare job proposals, research typical salary ranges in the field, and identify job opportunities on sites such as LinkedIn. The campaign is believed to have affected and infiltrated hundreds of U.S. companies.[35]
  
  A Microsoft report revealed that the operatives also used AI tools to generate fake profile photos and alter their voices—​likely for online interviews or professional calls.[36]
  
  A February 2025 report by OpenAI found that these operatives also used ChatGPT to pass technical screening stages and to answer professional and behavioral questions they encountered during their “employment.” In addition, they used ChatGPT to craft excuses for behavior that might appear suspicious—​such as avoiding video calls, requesting system access from unusual or problematic locations, or working at irregular hours.[37]
  
  The North Korean IT-worker fraud demonstrates the destructive potential inherent in AI tools. These tools allow users to fabricate their identities at a very high level, bypass familiar cultural and linguistic barriers, forge official documents, and obscure signs that might arouse suspicion of malicious activity. It is entirely plausible that the Iranians will adopt similar methods to gain access to sensitive organizations, rather than relying solely on refining existing phishing techniques.

• The AI Campaign in Romania/Israel — A Model Iran May Replicate
  
  A September 2025 report in Haaretz quoted Israeli researchers who identified suspicious signs of a foreign influence campaign taking shape in Israel, operating in a manner similar to the campaign that targeted Romania’s 2024 elections—​the results of which were annulled due to strong suspicions of foreign manipulation.
  
  The campaign operates through a method in which “benign” pages build an audience over a “grooming period” by posting large volumes of AI-generated content, sometimes impersonating other known pages. Then, shortly before the target date (often elections), these pages abruptly shift their appearance and purpose. During the target period, they begin promoting content with a clear political agenda to influence the audience accumulated during the “grooming phase.” A network of this nature operated in Romania to boost the candidate considered pro-Russian, though the identity of its operators remains uncertain.[38]
  
  It is entirely plausible that Iran—​which has a clear interest in influencing developments in Israel—​will adopt these methods to run a similar campaign, which does not require particularly advanced or expensive tools, and attempt to shape Israeli discourse using AI-generated content crafted to appear credible and authentic, and aligned with whatever political bias the campaign’s operators may seek to express.

• Use of Criminal “Off-the-Shelf” Tools: The Case of Qilin and the Assaf Harofeh Medical Center Attack
  
  Beyond artificial intelligence, there is additional evidence that Iran’s cyber apparatus is attempting to incorporate other tools not developed in Iran but by criminal cyber actors.
  
  On Yom Kippur, October 2025, a seemingly criminal attempt was made to attack Assaf Harofeh Medical Center with ransomware. Subsequent research revealed that the attack was in fact politically motivated and carried out by Iranian actors.[39] At first it appeared to be a financially driven attack by the Qilin group, but after some time the group removed the ransomware posting.[40]
  
  Researcher Erez Dessa later reported that the reason for removing the post was that Iranian actors had used the group’s “affiliate program”—​a scheme under which anyone launching a ransomware attack with Qilin’s tools pays the group a share of the profits. But the Iranian attack was not carried out for profit; it was conducted to target Israel for political reasons. This realization may have prompted Qilin to distance itself from the attack.[41]
  
  This case may indicate another direction through which Iran is attempting to strengthen its cyber capabilities by using “off-the-shelf” tools developed by criminal ransomware groups around the world, many of which offer affiliate programs that make their attack tools available to hackers globally. Iran, which has long carried out extensive ransomware operations against its adversaries, may use this model to diversify and increase the number of ransomware attacks it conducts.

What the Future Holds

Is Iran’s cyber apparatus on the verge of a fundamental transformation due to the AI revolution? We can assume that as long as sanctions remain effective, Iran will struggle to develop significant technological capabilities on its own. As a result, Iran’s offensive cyber apparatus is likely to evolve accordingly and Tehran will continue carrying out attacks of medium-to-low sophistication, as it has until now.

However, artificial intelligence tools and the use of “outsourced” tools may help the Iranians make their cyberattacks more effective in several ways:

1. Increasing the rate of successful attacks —We can assume that using different and varied malware from around the world, developed by criminal actors, will ultimately allow the Iranians to carry out more successful attacks against Israel, which will have to contend with a wider range of tools developed by diverse actors who continually refine them.
   
   
2. Higher-quality cyberattacks — Whether by obtaining access through a phishing scheme or by other forms of impersonation, artificial intelligence tools today allow hackers to impersonate the victim’s environment at a high level, even without deep familiarity with the local language or culture. Many Iranian groups use phishing as a tool for gaining access, and effective use of artificial intelligence tools could significantly increase their chances of success.
   
   
3. Higher-quality influence operations — Although we are currently unaware of Iranian influence operations against Israel with high quality content, artificial intelligence tools may shift this trend. These tools enable the creation of online content and network personas at a higher level than currently known, thereby improving the effectiveness of Iranian influence campaigns.

---

* The information on which this paper is based is current as of November 23, 2025. I would like to thank Daniel Hirschfeld for his assistance with the extensive research for this paper.

[1] The term “influence operations” or “influence” in this article refers to Iranian attempts to sway (to influence) public opinion in their target countries in accordance with Iranian interests.
[2] “‘Artificial Intelligence, the Engine Driving Growth and Empowering the State’ (Persian),” the official website of Iran’s Supreme Leader, April 7, 2025, https://farsi.khamenei.ir/others-note?id=59954.
[3] “‘The Leader’s Remarks on the Importance of Artificial Intelligence: Take Control of the Depths of Artificial Intelligence’ (Persian),” September 4, 2024, the official website of Iran’s Supreme Leader, https://farsi.khamenei.ir/video-content?id=57479.
[4] “‘Delay and Backwardness in the Field of Artificial Intelligence Cause Harm and Are Irreversible | Emphasis on the Government’s Determination to Remove Obstacles and Meet the Requirements for Developing the Country’s Artificial Intelligence Capabilities’ (Persian),” official website of Iran’s President, January 7, 2025, https://president.ir/fa/156530.
[5] “‘Firouzabadi: The Assassination of the Military Commanders Had Nothing to Do with WhatsApp | We Have Many Volunteers to Block and Filter, But… | Security Threats Lurk for Iran’ (Persian),” https://www.eghtesadnews.com/بخش-اخبار-سیاسی-57/749894-فیروزآبادی-ترور-فرماندهان-نظامی-ربطی-به-واتس-اپ-نداشت-برای-بستن-فیلترکردن-داوطلب-زیاد-داریم-اما-خطر-امنیتی-در-کمین-ایران-است
[6] “‘Iran Aims to Be Among the World’s Top Ten Countries in Artificial Intelligence’ (Persian),” Tasnim News Agency, January 29, 2025, https://www.tasnimnews.com/fa/news/1403/11/10/3247062.
[7] “‘Iran Has Great Potential for Progress in Artificial Intelligence’ (Persian),” official website of the Office of Iran’s Supreme Leader, January 23, 2025, https://farsi.khamenei.ir/others-dialog?id=59241.
[8] “‘Artificial Intelligence, the Engine for Growth and Empowering the State’ (Persian),” official website of Iran’s Supreme Leader, April 7, 2025, https://farsi.khamenei.ir/others-note?id=59954.
[9] “‘The IRGC’s Roadmap for Artificial Intelligence Is Revealed’ (in Persian),” Kayhan, January 20, 2025, https://kayhan.ir/fa/news/304811.
[10] “‘Protect Iran with Artificial Intelligence’ (Persian),” Hamshahri Online, November 28, 2023, https://newspaper.hamshahrionline.ir/id/210573.
[11] Ibid.
[12] “‘The National Artificial Intelligence Document of the Islamic Republic of Iran’ (Persian),” Majlis website, August 10, 2024, https://rc.majlis.ir/fa/law/show/1811432.
[13] “‘With the Approval of Majlis Members: A National Artificial Intelligence Organization Will Be Established’ (Persian),” ISNA, October 26, 2025, https://www.isna.ir/news/1404080401607.
[14] “‘Pezeshkian: The Government Supports the Development of Artificial Intelligence’ (in Persian),” Tasnim News Agency, October 3, 2024, https://www.tasnimnews.com/fa/news/1403/07/14/3172262.
[15] “‘Experimental Version of a National Artificial Intelligence Platform; The Beginning of a New Technological Era in Iran’ (Persian),” ISNA, January 17, 2025, https://www.isna.ir/news/1403102819920.
[16] Ibid.
[17] “‘The Year 1402 Is the Year of Using Artificial Intelligence for Cyber Defense’ (Persian),” IRIB, May 20, 2023, https://www.iribnews.ir/fa/news/3855200.
[18] Ibid.
[19] Ibid.
[20] “‘The Iranian Delegation to the UN: We Do Not Initiate Cyberattacks Against Any Country’ (Persian),” IRNA, October 16, 2025, https://www.irna.ir/news/85969426.
[21] “Microsoft: Russia, China increasingly using AI to escalate cyberattacks on the US,” Associated Press, October 16, 2025, https://apnews.com/article/ai-cybersecurity-russia-china-deepfakes-microsoft-ad678e5192dd747834edf4de03ac84ee.
[22] “Iran steps into US election 2024 with cyber-enabled influence operations,” Microsoft, August 9, 2024, https://cdn-dynmedia-1.microsoft.com/…
[23] Ibid
[24] “Disrupting malicious uses of our models: An update February 2025,” OpenAI, January 2025, https://cdn.openai.com/threat-intelligence-reports/disrupting-malicious-uses-of-our-models-february-2025-update.pdf.
[25] Ibid.
[26] Ibid.
[27] “Influence and cyber operations: an update,” OpenAI, October 2024, https://cdn.openai.com/threat-intelligence-reports/influence-and-cyber-operations-an-update_October-2024.pdf.
[28] “Adversarial Misuse of Generative AI,” Google Cloud, January 30, 2025, https://cloud.google.com/blog/topics/threat-intelligence/adversarial-misuse-generative-ai.
[29] Ibid.
[30] Ibid.
[31] Ibid.
[32] “Uncharmed: Untangling Iran’s APT42 Operations,” Google Cloud, May 2, 2024, https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations.
[33] Ibid.
[34] “Staying a Step Ahead: Mitigating the DPRK IT Worker Threat,” Google Cloud, September 23, 2024, https://cloud.google.com/blog/topics/threat-intelligence/mitigating-dprk-it-worker-threat?e=48754805.
[35] “Adversarial Misuse of Generative AI,” Google Cloud, January 30, 2025, https://cloud.google.com/blog/topics/threat-intelligence/adversarial-misuse-generative-ai.
[36] “Jasper Sleet: North Korean remote IT workers’ evolving tactics to infiltrate organizations,” Microsoft, June 30, 2025, https://www.microsoft.com/en-us/security/blog/2025/06/30/jasper-sleet-north-korean-remote-it-workers-evolving-tactics-to-infiltrate-organizations.
[37] “Disrupting malicious uses of our models: An update February 2025,” OpenAI, February 2025, https://cdn.openai.com/threat-intelligence-reports/disrupting-malicious-uses-of-our-models-february-2025-update.pdf.
[38] “First Romania, Now Israel: Pro-Russian AI Disinformation Campaign Preps for Israeli Election,’” Haaretz, September 15, 2025. https://www.haaretz.com/israel-news/security-aviation/2025-09-14/ty-article-magazine/.premium/first-romania-now-israel-pro-russian-ai-disinfo-campaign-preps-for-israeli-election/00000199-47ff-dc6e-a59f-cfff2cf10000
[39] “Cyberattack on Shamir Assaf Harofeh Hospital on Yom Kippur — Iranian Operation,” (Hebrew) Kan 11, October 22, 2025, https://www.kan.org.il/content/kan-news/local/962598.
[40] “Qilin Group Removes the Publication About Assaf Harofeh Hospital — and You Played a Part in That,” Erez Dasa Cyber News (Telegram), October 3, 2025, https://t.me/CyberSecurityIL/7837.
[41] “Some Additional Details About the Assaf Harofeh Incident and the Qilin Group,” Erez Dasa Cyber News (Telegram), October 8, 2025, https://t.me/CyberSecurityIL/7860.