The newest AI malware vs. 40 years of hacker culture
A discussion on the diverging priorities of CEOs and CISOs, the emergence of AI-generated malware like VoidLink, the critical balance between data protection and service resilience, strategies for disrupting cybercrime supply chains, and a reflection on the 40-year-old "Hacker Manifesto".
CEOs vs. CISOs: A Disconnect in Priorities
According to the World Economic Forum’s Global Cybersecurity Outlook 2026, a gap exists between the top concerns of CEOs and CISOs. CEOs are more focused on strategic, future-facing threats like cyber fraud and AI vulnerabilities, driven by a concern for business resiliency. In contrast, CISOs, operating on the front lines, prioritize immediate threats such as ransomware and supply chain disruptions.
While these differing priorities can be seen as complementary, they can also create friction. The boardroom needs to listen more to CISOs, as today’s threats have a significant impact on tomorrow’s business. However, for CISOs to be effective, they must learn to speak the language of business. Security is ultimately a cost analysis, weighing the cost of an outage or breach against the cost of protection. As one panelist noted, “no company on this earth is in the business of being secure. They’re in the business of making money.”
The connecting tissue that can bridge this gap is resiliency. By framing security conversations around the ability to bounce back from an attack—whether it’s ransomware or another form of cyber attack—both leadership and technical teams can align on a common goal. The focus should be on reducing the blast radius and operationalizing the business as quickly as possible.
Interestingly, both groups ranked the exploitation of software vulnerabilities as their number three concern, highlighting a shared understanding of this fundamental attack vector.
VoidLink and the Dawn of AI-Generated Malware
Checkpoint Research has identified VoidLink as what may be the first thoroughly documented case of an advanced malware framework authored almost entirely by AI. A single threat actor was able to generate 88,000 lines of code for the Linux-based malware in about a week.
However, this doesn’t mean AI conceived of the malware independently. The process was more likely a “human in the loop guided development.” A senior engineer probably provided the AI with highly detailed design documents, sprint plans, and interface definitions. The AI then acted as a junior developer, efficiently writing the vast amounts of boilerplate code required to implement the design. This represents an automation of good software development practices at a massive scale.
The implications are significant:
- Efficiency: AI drastically lowers the barrier to entry and reduces the time required for threat actors to create sophisticated malware.
- Defense: To counter this, defenders must “fight AI with AI.” The security community must leverage AI to accelerate the development of new defenses.
- Caution: A key risk is “model collapse,” which can occur if a defensive AI is accidentally trained on its own output. Senior engineers must oversee AI development to ensure models remain effective.
While this development is impressive, the panelists believe we are only seeing the “first baby steps” of AI-generated malware; the era is in its infancy, not its prime.
Data Protection vs. Service Resilience
A recent critique by a former British prime minister suggests that current protocols prioritize data protection excessively, often at the expense of service availability and resilience. An anecdote about Ireland’s healthcare system attack illustrates this starkly: “We’re sorry we had to cancel your life-saving surgery, but don’t worry, your email is safe.”
This issue often stems from a compliance-driven mindset. Many organizations implement data security controls simply to check a box for regulations like GDPR, rather than performing a genuine risk analysis based on their specific business function. As one panelist stated, “people literally do their security programs just around how they can pass an audit. An audit that’s never saved me from getting breached.”
The solution lies in returning to fundamental principles:
- Prioritization: Organizations must perform a common-sense assessment of what data is truly critical (e.g., financial records, medical data) versus what is not (e.g., an email address).
- CIA Triad: Security professionals must remember the core tenets of Confidentiality, Integrity, and Availability. In a hospital setting, availability is paramount.
- Resilience as the Goal: Data protection should be a natural outcome of a robust resilience strategy—incorporating Zero Trust, segmentation, and incident response—not a separate, compliance-focused activity.
- Business Language: Ultimately, cybersecurity is an asset management problem. Security leaders must get a “seat at the boardroom” and discuss risk in financial terms to drive meaningful change.
Disrupting Cybercrime Supply Chains
The recent law enforcement takedown of RedVDS, a service that sold disposable virtual computers to attackers, highlights a viable strategy: attacking the cybercrime supply chain. Just as attackers target legitimate software supply chains, defenders can disrupt the infrastructure that criminals rely on.
Cybercriminals use the same types of infrastructure as legitimate businesses—cloud providers, pirated tools, and even compromised consumer hardware. These systems have the same vulnerabilities. By taking out a key service like RedVDS, authorities can create a force multiplier effect, disrupting numerous criminal operations simultaneously and forcing them to find new homes.
Defenders need to shift from a reactive to a proactive, offensive mindset. This involves not only shutting down criminal services but also potentially seizing and monitoring them to identify the entire network of users, as has been done in previous ransomware takedowns. The tools and tactics used by attackers and defenders are often identical; the key difference is the “signed letter of permission.”
The Hacker Manifesto: 40 Years Later
Forty years after its publication, Lloyd Blankenship’s “Hacker Manifesto” still resonates, though the landscape has changed dramatically. The panelists draw a clear line between different archetypes:
- Hackers: Creative individuals who make technology do something it was never intended to do, in the original MIT spirit. This includes makers, cosplayers, and bug bounty hunters.
- Cybersecurity Professionals: Those who practice security as a formal profession.
- Criminals: Those who break into systems for illicit gain.
The manifesto’s ethos of using technology for exploration and improving the world is still a “guiding star” for many. However, the stakes are now radically different. Hacking has moved from “basements to boardrooms and battlefields,” entangled with geopolitics, nation-state actors, and billion-dollar ransomware attacks. This modern context has blurred the public’s perception, often conflating the noble spirit of hacking with the malicious acts of cybercrime.