AI Attribution Audit

Seven cyber incidents circulating as a June–July 2026 “AI-enabled” cluster were each checked twice: once to confirm the incident happened as described, and once to test whether the AI element attributed to it appears in the reporting. All seven describe real activity. Two carry the AI tradecraft attributed to them, one merges two unrelated events into a single claim, and four carry no AI element that any source reports.

Scope and method

Each item was researched independently. An AI attribution was counted as supported only where a named source — a government advisory, a vendor threat-intelligence report, or the victim’s own disclosure — states the AI element. Absence of the claim in available reporting is recorded as unsupported rather than as refuted: these are open investigations, and a later report may supply what today’s does not.

Primary documents were reachable for none of the seven; every finding rests on vendor research posts, wire reporting, and regulator breach listings.

Findings

Incident	Event confirmed	AI attribution	Correction needed
DPRK IT-worker infiltration	Yes	Supported	Advisory is eleven-nation, not FBI-and-ITRC
ShinyHunters extortion cluster	Yes	Supported, different mechanism	AI is vishing and post-theft triage, not exfiltration tooling
Ivanti / Fortinet exploitation	Partly	Mis-assembled	Two unrelated events merged into one
Stryker wiper campaign	Yes	Unsupported	Dated 2026-03-11, outside the June–July window
Cisco SD-WAN zero-days	Yes	Unsupported	No source attributes discovery to AI-assisted fuzzing
AssuranceAmerica exposure	Yes	Unsupported	Employee phishing; no AI element reported
Ernst & Young platform breach	Yes	Unsupported	”Automated scripts” appears in no source

DPRK IT-worker infiltration — supported

Eleven allied governments issued a coordinated advisory on 2026-07-31 warning that North Korean IT operatives use real-time AI deepfake video to impersonate real people during live job interviews, with France, Germany, Italy, and the Netherlands joining for the first time alongside the US, Japan, and South Korea.¹ The generative-AI component spans the whole funnel: resumes, cover letters, and portfolio sites produced at volume by language models, synthetic profile images, and deepfake video and audio in the interview itself.¹

Scale is documented independently of the AI claim. The scheme routed approximately $800 million to Pyongyang in 2024, and CrowdStrike attributes 47% of state-sponsored hands-on-keyboard intrusions against US technology companies in the twelve months ending March 2026 to FAMOUS CHOLLIMA.¹

Two corrections. The advisory is an eleven-nation joint product in which the FBI participates, not an FBI publication. No Identity Theft Resource Center report on this campaign surfaced in any search; the ITRC attribution should be dropped unless a specific document is produced.

ShinyHunters extortion cluster — supported, different mechanism

AI is present in this cluster, at both ends of the operation and not where the claim places it. EclecticIQ assesses with high confidence that the group combines AI-enabled voice phishing with supply-chain compromise and malicious insiders, abusing legitimate voice-agent platforms — Vapi and Bland — whose built-in language model sustains a convincing call when the victim departs from the script.² At the other end, the group runs language models over stolen archives to index and price what it took.

That second use is documented by its failure. ShinyHunters stated that part of its own claimed tally was exaggerated because the AI tools it used to scan the stolen archive returned hallucinated file counts, corrected afterward by human review.³

The exfiltration itself is not AI-driven in any source. The Instructure campaign — 3.65 TB across approximately 275 million records from 8,809 educational institutions, escalating to defacement of roughly 330 Canvas login portals — ran on stolen authentication tokens against large cloud data stores.⁴³ “Automated data-mining frameworks orchestrating multi-terabyte exfiltration” describes token abuse against BigQuery-class systems, which predates the group’s AI adoption.

The reliable AI in this campaign is at the human interface, and the unreliable AI is behind it. A voice agent that improvises past a script works; a model counting files in a stolen archive produced a number the group had to retract.

Ivanti and Fortinet exploitation — mis-assembled

Two separate things are merged in the claim. Real Ivanti and Fortinet exploitation ran through 2026: Unit 42 documented active exploitation of Ivanti Endpoint Manager Mobile zero-days CVE-2026-1281 and CVE-2026-1340, and CISA added Ivanti Sentry’s CVE-2026-10520 to the Known Exploited Vulnerabilities catalog on 2026-06-11. None of that activity is attributed to AI.

Separately, a real AI-assisted campaign exists and is Fortinet-only: Amazon Threat Intelligence documented a financially motivated actor using commercial AI tools to compromise more than 600 FortiGate devices across 55 countries in early 2026. Its initial access was credential attack against exposed management interfaces — explicitly not a new zero-day. That campaign is evidence for AI-assisted operational scaling and is evidence against the framing attached to it: no vulnerability discovery window shrank, because no vulnerability was discovered.

Stryker wiper campaign — unsupported, and out of window

Handala, assessed by Unit 42 as affiliated with Iran’s Ministry of Intelligence and Security rather than an independent hacktivist group, executed a destructive wiper attack against Stryker on 2026-03-11 — three months before the stated window. The delivery mechanism was Microsoft Intune: compromised administrator accounts in Stryker’s mobile device management platform were used to issue remote wipe commands fleet-wide, idling approximately 56,000 employees across 61 or more countries (Censys).

Abusing an MDM console to wipe a fleet is a single privileged action against a management plane built for exactly that operation. It requires admin credentials and no automation beyond the product’s own. No source attributes automated reconnaissance, AI or otherwise.

Cisco SD-WAN zero-days — unsupported

The exploitation is well documented. CVE-2026-20245 was exploited before patch to escalate from a compromised administrative account to root on Catalyst SD-WAN Manager and was reported to Cisco by Mandiant; CVE-2026-20262 is an arbitrary-file-write flaw in the management interface at CVSS 6.5; CVE-2026-20182 was exploited in targeted attacks by an actor Talos tracks as UAT-8616.⁵ By SecurityWeek’s count this is the seventh SD-WAN zero-day exploited in 2026.

Not one of the disclosing parties — Cisco, Mandiant, Talos, or Google Cloud threat intelligence — attributes discovery of these flaws to AI-assisted fuzzing. Mandiant’s named credit for CVE-2026-20245 points the other way, to conventional vendor research. The AI-assisted-fuzzing attribution has no source.

AssuranceAmerica exposure — unsupported

The Indiana Attorney General’s breach listing records 6,998,886 people affected, the largest known theft of US driver’s license data in 2026.⁶ Malicious activity targeted an employee on 2026-03-16; the company detected it on 2026-03-17, completed its investigation on 2026-06-15, and mailed notifications on 2026-07-10.⁶ Exposed data includes driver’s license numbers, Social Security numbers, tax IDs, and policy and claims records.

The company attributes initial access to phishing of an employee. Whether the credential was taken by phishing, by infostealer, or through a third party is not settled in the disclosure. “Targeted social engineering” is a fair description; nothing in it is AI-specific, and no source raises AI.

Ernst & Young platform breach — unsupported

An unauthorized party held access to a third-party IT service management platform used by EY tax support teams from 2026-03-28 to 2026-04-12 — sixteen days, consistent with the “two weeks” in the claim. EY identified anomalous activity on 2026-04-23, eleven days after access ended, and filed breach notifications with the California Attorney General on 2026-07-15. Support tickets on the platform carried client tax documents, which were downloaded.

EY has not named the platform, the vendor, the number of affected clients, or the method. “Automated scripts to siphon customer tax documents” is a plausible description of bulk ticket-attachment download and appears in no source.

Assessment

Four of seven items are ordinary intrusions wearing an AI label. Credential phishing at AssuranceAmerica, a management-console breach at EY, MDM abuse at Stryker, and vendor-found zero-days at Cisco are the 2019 playbook, unchanged. Attaching AI to them costs something specific: it inflates the apparent base rate of AI-enabled attack, and it points defensive attention at model-layer controls when the controls that would have mattered are credential hygiene, management-plane segmentation, third-party access review, and patch cadence.

The two supported cases share a shape the unsupported ones lack: AI at the human interface. Deepfake interviews and language-model-driven voice phishing both attack a person’s judgment about who is on the other end, at a volume and quality that manual operation cannot reach. That is the same mechanism as the fabricated reviewer identities in the AISI incident — synthetic identity aimed at a trust decision, not at a technical control. It is a narrower and better-evidenced claim than “AI-enabled attacks”, and it is actionable: identity-proofing in hiring and voice-channel verification are the controls, not model guardrails.

Where AI does the analytical work, it is measurably unreliable. ShinyHunters retracted a claimed tally because its own models hallucinated file counts.³ Contrast the incidents where autonomous agents produced verified results — GTG-1002, the Taiwan intrusion — which ran purpose-built harnesses with verification loops. Commodity model use by a financially motivated crew is not the same capability, and the wiki’s offensive-AI synthesis should not read the two as one trend line.

Standing recommendation

Record an incident as AI-enabled only where a named source states the mechanism, and record the mechanism rather than the label. “AI-enabled” spans a deepfake in a hiring interview, a language model triaging a stolen archive, and an autonomous agent selecting and exploiting a target — three capabilities with different defenses, different maturity, and different evidence.

Re-check triggers

This audit is a 2026-08-16 snapshot of open investigations. Four findings would change on new evidence: Meta-style retrospectives or vendor threat-intelligence reports naming AI in the Cisco, Stryker, EY, or AssuranceAmerica cases. The audit should be re-run, not edited, if such a report publishes; supersession is recorded by a forward link.

Superseded on the evidence by AI Attribution Primary-Source Review (2026-08-17), which re-tested all seven attributions against eleven primary documents. No verdict was overturned; four unsupported verdicts became sourced negatives and both supported verdicts narrowed. The method statement in Scope and method above — that primary documents were reachable for none of the seven — no longer describes the evidence.

Footnotes

1. North Korean Operatives Use Deepfakes in IT Job Interviews, Dark Reading, 2026-08. ↩ ↩² ↩³

2. ShinyHunters Calling: Financially Motivated Data Extortion Group Targeting Enterprise Cloud Applications, EclecticIQ, 2026. ↩

3. ShinyHunters 2026 breach tracker, State of Surveillance, 2026. ↩ ↩² ↩³

4. Education Sector in the Crosshairs: ShinyHunters’ Extortion Campaign Against Instructure, Halcyon, 2026. ↩

5. Active exploitation of Cisco Catalyst SD-WAN by UAT-8616, Cisco Talos, 2026. ↩

6. AssuranceAmerica Breach Exposes 7 Million Driver’s Licenses After Employee Account Hack, Security Affairs, 2026-07. ↩ ↩²