Forest Blizzard, a threat group attributed to Russia’s GRU, hijacked network traffic to steal credentials and tokens for Microsoft accounts and other services.

The program comes as the tech industry races to secure software before similar AI-powered offensive capabilities become too much for defenders to handle.

Acting director Nick Andersen said relationships, not actor risk management agency designations, should guide which agency is at the forefront.

The vendor said six of the 83 vulnerabilities it addressed this month are more likely to be exploited.

Attackers have turned AI into a “force multiplier” for the country’s expansive scheme to get and keep operatives hired at global companies, researchers said.

Microsoft, which led the effort, said it seized 330 domains that powered the phishing platform’s core infrastructure. The alleged creator was also named in a civil complaint.

Too many defenders and researchers are paying attention to defects and unsubstantiated exploit concepts that aren’t worth their time, VulnCheck’s Caitlin Condon said.

Microsoft said three of the exploited vulnerabilities were publicly known, suggesting attackers already had details about the defects prior to Tuesday’s release.

It stems from how the Internet Assigned Numbers Authority functions, the official said.

The Microsoft-BitLocker episode highlights a larger design problem: when providers retain recovery keys, encryption becomes conditional.