Iran Executes Complex Attacks Using Cheap Chinese AI Models

Shalev Hulio, CEO and co-founder of Dream, stated that artificial intelligence has enabled Iran to execute cyberattacks that were previously beyond its technical capacity. Speaking at Cyber Week at Tel Aviv University and in subsequent interviews, Hulio described how access to advanced models has altered the mechanics of offensive operations.

Hulio identified Chinese-developed models as a primary driver of this shift. He noted that these tools often feature fewer safety restrictions than American counterparts. "What we are seeing now is that because of AI and because of access to AI, the Iranian threat actors are becoming much more sophisticated," Hulio said. He observed that these actors are using the technology to discover zero-day vulnerabilities and to move laterally through networks with minimal human intervention.

The integration of AI extends across the entire attack lifecycle. Hulio explained that the technology generates convincing phishing campaigns and identifies software flaws. A specific concern is the use of AI to reverse-engineer software patches. Once vendors release updates, attackers analyze the fixes to determine the underlying vulnerability and rapidly locate systems that remain unpatched.

Hulio argued that cheap, high-quality Chinese models have changed the economics of cyber warfare. "In the past, sophisticated cyberattacks were conducted mostly by nation-states or very sophisticated hackers," he recalled. "Now, basically anyone who has access to Chinese models without guardrails can use them in order to create and conduct sophisticated cyberattacks." This accessibility allows smaller groups to conduct operations that previously required large teams of specialists.

Iran’s cyber ambitions now target a global audience beyond Israel. Hulio pointed to recent attacks against water infrastructure in both Israel and the United States. The nation is also targeting universities and private individuals to steal and expose personal information. "They are trying to position themselves as a global threat actor, and I think it's a risk," Hulio warned.

Hulio compared dependence on foreign AI providers to reliance on foreign energy supplies. He advocated for sovereign AI strategies where governments control the full technological stack, from computing infrastructure to applications. "No country should depend on foreign models" for critical applications, he asserted.

Hulio identified quantum computing as the next transformative technology. He estimated that a major shift, or Q-Day, will occur within the next 18 to 24 months. "And when this happens, there will be a cure for cancer within a year," he said.