Cybercriminals Utilize GenAI to Exploit Edge Infrastructure for Attacks

• •Attackers use generative AI to enhance cybercrime efficiency and evade detection.
• •Exploitation of edge devices and proxy networks is increasing, complicating defense efforts.
• •High-profile botnets like Kimwolf and Raptor Train demonstrate the scale of these operations.

Cybercriminals are increasingly leveraging generative AI to enhance their operations, as detailed in Lumen's 2026 Threatscape Report. This new approach allows attackers to rotate IP addresses and domain names rapidly, making detection by defenders more challenging. They are using compromised routers and other edge devices to blend into normal traffic, effectively hiding their activities. Notable examples include the Kimwolf DDoS botnet, which rapidly expanded to hundreds of thousands of bots, and the Raptor Train botnet, which managed over 200,000 compromised IoT devices. The shift towards exploiting internet-exposed edge infrastructure indicates a significant change in attack vectors, with attackers focusing on areas outside traditional endpoint security visibility. Experts emphasize the need for enhanced threat intelligence to detect adversaries early in their operations. The report highlights the growing sophistication of both criminal and nation-state actors in cyber operations.