Key Takeaways
- Google's Threat Intelligence Group has documented government-backed hacking groups using AI for reconnaissance, vulnerability research and payload development
- Mandiant's M-Trends 2026 says adversaries are integrating AI to accelerate the attack lifecycle, but does not consider 2025 the year breaches were the direct result of AI
- Singapore has said publicly that its critical infrastructure was attacked by a threat actor tracked as UNC3886
- Singapore's UN-Singapore Cyber Programme renewed for 2026-2028, reflecting ongoing international cybersecurity cooperation
The Facts
Google's Threat Intelligence Group reported in January 2025 that government-backed hacking groups had used its Gemini model for tasks including reconnaissance on target organisations, research into vulnerabilities, payload development and malicious scripting. Its assessment was measured: "Rather than enabling disruptive change, generative AI allows threat actors to move faster and at higher volume."
Mandiant's M-Trends 2026 report says adversaries are integrating AI to accelerate the attack lifecycle, and estimates the mean time to exploit at minus seven days — exploitation routinely comes before a patch is released. Mandiant does not attribute that speed to AI, and says it does not consider 2025 to be the year where breaches were the direct result of AI. Even so, the combination of rapidly available exploits and AI-generated personalised phishing creates an offensive capability that is qualitatively different from the human-speed attack operations of five years ago.
ASEAN's critical infrastructure is a target of state-linked cyber operations. In July 2025, Singapore's Coordinating Minister for National Security said publicly that a threat actor tracked as UNC3886 was attacking the country's critical infrastructure.
Technical Deep-Dive
Nation-state AI-assisted attacks follow a more sophisticated pattern than criminal ransomware operations. The objectives typically include: persistent access for intelligence gathering rather than immediate disruption, exfiltration of sensitive government and commercial data, and positioning within critical infrastructure for potential future disruption.
AI assistance in nation-state attacks is applied at the reconnaissance and initial access phases. AI tools can analyse public information — LinkedIn profiles, company websites, social media — to build detailed target profiles and generate personalised spear-phishing emails that are significantly more convincing than generic templates. AI can also systematically scan exposed services for vulnerability signatures and generate custom exploit code for newly discovered vulnerabilities faster than human operators.
Industrial Control System (ICS) attacks are a specific concern. Reports of nation-state activity targeting ICS — the systems controlling power plants, water treatment, and manufacturing — highlight that cyber operations are no longer confined to IT infrastructure. ICS environments are often less patched and less monitored than IT systems, creating attractive attack surfaces.
The ASEAN Perspective
Singapore's renewal of the UN-Singapore Cyber Programme for 2026-2028 reflects the recognition that cybersecurity requires international cooperation, not purely national capability. The programme's 140 participants from 97 UN Member States represent Singapore's investment in building a global cybersecurity community with shared norms and response capabilities.
The ASEAN Regional CERT, hosted in Singapore, provides the coordination infrastructure for regional incident response. When a nation-state attack affects multiple ASEAN countries simultaneously — targeting ASEAN-wide financial messaging infrastructure, for example — the ASEAN CERT coordination mechanism enables faster collective response than bilateral information sharing alone.
For ASEAN enterprises classified as Critical Information Infrastructure owners — financial institutions, telcos, energy companies, healthcare providers — the nation-state threat is real and the regulatory requirements for detection and response capability are expanding.
RECATOOLS Verdict
State-backed attackers are already using AI, though so far mainly to work faster rather than to do something new. This does not mean every organisation faces nation-state-grade attacks — most criminal actors still use less sophisticated tools. But it does mean that the most capable attackers in the world now have AI assistance, and the defenders' toolset must evolve accordingly.
For ASEAN critical infrastructure operators, the response requires both technical investment (AI-powered threat detection, zero-trust architecture, ICS security programmes) and operational investment (security operations centre capability, incident response planning, threat intelligence integration).
Frequently Asked Questions
Yes — Google's Threat Intelligence Group reported in January 2025 that government-backed hacking groups had used its Gemini model for reconnaissance, vulnerability research and payload development, mostly to work faster rather than to gain new capabilities.
Yes — in July 2025 Singapore's government said publicly that its critical infrastructure was being attacked by a threat actor tracked as UNC3886.
An attack targeting Industrial Control Systems — the software and hardware controlling physical infrastructure like power plants, water treatment facilities, and manufacturing systems.
The Computer Emergency Response Team hosted in Singapore that coordinates cybersecurity incident response across ASEAN member states.
AI-powered threat detection (to match AI-speed attacks), zero-trust architecture, regular patch management, and threat intelligence integration from regional and global sources.
Correction, 18 October 2026: An earlier version misdescribed a technology industry report as documenting state-backed attacks, and attributed to Mandiant an exploitation figure it did not publish; those passages now rely on Mandiant's and Google's own findings. Statements about warnings from Singapore and Malaysian agencies have also been corrected.
View author profile → · Editorial policy
