Blue Team Perspective: How Attackers Exploit AI and Disposable Infrastructure

How Attackers Actually Use AI

If you're responsible for maintaining a Cloudflare WAF, you spend most of your day looking at requests coming from uncontrolled IP addresses — scanners, bots, people testing login forms, and a small subset of attackers genuinely trying to break in. Many blue team members ask the same question: how exactly do attackers leverage AI, local models, and cheap cloud infrastructure to attack a company?

Here's the core conclusion up front: attackers don't need a sophisticated AI pipeline to compromise a company. Most successful intrusions still begin with exposed services, weak authentication, stolen credentials, vulnerable software, or trusted third parties. What AI changes is the economics of certain steps — it helps operators consolidate reconnaissance findings, generate phishing content variants, reason over tool output, and repeat workflows with fewer manual steps. But AI doesn't eliminate the need for exposed attack surface, valid identities, or exploitable vulnerabilities.

To understand this problem, you can build a mental model around three tiers of attacker maturity.

Three Tiers of Attacker Maturity

Tier 1: Opportunistic Attackers

These attackers pursue minimum investment and fastest results. They might rent a VPS, pair it with scripts, public scanners, and a small wordlist. If they use an AI model, it typically runs on their own laptop or VPS.

Their infrastructure is extremely simple:

[Attacker machine or VPS] --> [Target company]

They only care about whether they get a response, not about building a persistent operational environment. The VPS might be paid for with cryptocurrency, but accounts, email addresses, payment patterns, and access habits can still leave clues pointing to a real person.

From a defensive standpoint, this is the easiest profile to detect. You'll typically see broad scanning, repeated login attempts, abnormal request rates, obvious tool fingerprints, and traffic from hosting providers or data center ASNs. Effective controls at this tier include: rate limiting on authentication and sensitive endpoints, managed WAF rules and bot management, blocklists and reputation feeds for known malicious infrastructure, strong MFA and credential stuffing protection, and alerting on scanning patterns and abnormal request volumes. Cloudflare WAF is particularly useful here because it can reduce noise before requests reach the application — the key is treating WAF rules as one layer of defense, not the entire security program.

Tier 2: Organized Attackers

These attackers are more patient and more operationally disciplined. They separate their personal identity from the infrastructure used in attacks, potentially using temporary VPS instances, separate accounts, and disposable infrastructure. A common conceptual separation looks like this:

[Attacker workstation: AI models and tools]
        |
        | Encrypted or anonymized access
        v
[Disposable VPS: network relay or attack host]
        |
        v
[Target company]

The attacker might run AI models locally and use the VPS only as a network relay. Alternatively, they might run smaller quantized models directly on the VPS — especially when the workload doesn't require a GPU. The choice depends on cost, speed, and how isolated they want their endpoint device to remain.

Attackers at this tier understand that deleting a VPS doesn't erase all traces. Provider records, payment data, upstream network logs, backups, and ISP records still exist. So they minimize the points where real identity and attack infrastructure intersect.

For blue teams, source IP becomes a less reliable primary indicator. The same operator may use different addresses, while different actors may share the same hosting subnet. More useful signals include: similar request sequences from different source IPs, consistent TLS/HTTP/automation fingerprints, targeted attempts against login/API/admin surfaces following reconnaissance, short-lived sessions with narrow focus, and technically valid but contextually anomalous credential usage. At this stage, behavioral detection matters more than static blocklists — you need to correlate identity, device posture, network origin, request patterns, and business context.

"Quantized models" refers to techniques that compress trained neural network weights from high-precision floating point (such as FP16, FP32) into lower-bit representations (such as INT8, INT4). After quantization, model size shrinks significantly, memory footprint drops, and inference speed improves, at the cost of potential accuracy loss. For organized attackers, the significance of quantization is this: models that originally required a GPU can, after quantization, run at acceptable speeds on a standard VPS CPU — avoiding the need to rent expensive GPU instances and reducing the risk of leaving obvious compute procurement traces on hosting platforms. This is the technical basis for the article's mention of "running smaller quantized models directly on the VPS — especially when the workload doesn't require a GPU." Similar local inference tools (such as llama.cpp, Ollama) further lower the barrier to deployment, making AI capabilities no longer the exclusive domain of well-resourced actors. Blue teams should treat this as part of the常态化 threat landscape.

Tier 3: Mature Actors

Mature actors treat infrastructure as disposable and identity as a separate problem. They don't rely on a single VPS, a single payment method, or a single access path. They may use infrastructure they don't directly own, including compromised systems, rented resources obtained through intermediaries, or services that make attribution harder. Their model looks more like:

[Isolated operational environment]
        |
[Relay or intermediary infrastructure]
        |
[Attack host or compromised system]
        |
[Target company]

The AI component may help with analysis, orchestration, or documentation, but it isn't the core of the intrusion. The core remains patience, valid access, a vulnerable dependency, or a person who can be deceived.

These actors produce fewer obvious indicators. Traffic may be slower, lower volume, and more selective. They may use valid credentials, legitimate tools, and protocols that look normal. A single WAF rule will almost never stop them. The best defense is structural: reduce the number of internet-facing services, require phishing-resistant MFA for privileged access, implement least privilege and short-lived credentials, monitor identity anomalies rather than just network anomalies, maintain centralized logging across WAF/identity provider/endpoint/email/cloud platforms, and build detections around behavioral chains (reconnaissance → authentication → privilege change). Mature attackers aren't invisible — they're just harder to catch through any single isolated signal. You need context spanning time, systems, and identities.

"Phishing-resistant MFA" refers to multi-factor authentication mechanisms that can withstand real-time phishing and man-in-the-middle attacks, typically represented by hardware security keys based on the FIDO2/WebAuthn standard (such as YubiKey) or platform passkeys. Traditional MFA based on TOTP codes or push notifications can be bypassed when attackers set up reverse proxy phishing pages to forward codes in real time or induce users to approve. Phishing-resistant MFA binds authentication to the specific website's origin, and an attacker's phishing domain cannot obtain a valid signed challenge response — so even if credentials are stolen, the attacker struggles to complete authentication. This is also one of the hardest controls for mature actors to break — when the identity layer is strongly bound to hardware or platform keys, attack chains that rely solely on stealing passwords and session tokens are interrupted, forcing attackers to pivot to endpoint compromise or supply chain attacks, which are more costly paths.

What Role Do MCP and AI Agents Play

AI agent frameworks can connect language models to external tools. In legitimate security contexts, this helps penetration testers conduct reconnaissance, organize findings, and automate repetitive work. But in the wrong hands, the same pattern lets operators process tool output and repeat tasks faster.

For defenders, the key point is: AI models aren't the attack itself — they're accelerators around the attack. If your application has no exposed weaknesses, no weak identity controls, and no data worth stealing, there's a limited amount an AI agent can do. That's why AI shouldn't distract you from fundamentals — patch management, identity hardening, least privilege, secure defaults, logging, and incident response still determine most outcomes.

MCP (Model Context Protocol) is a protocol proposed and open-sourced by Anthropic in late 2024, designed to provide language models with a standardized way to call external tools, data sources, and services. It abstracts the interface between models and tools into a "client-server" model: AI applications act as clients, while tools or data sources expose capabilities as MCP servers (such as file reading, HTTP requests, database queries, code execution). For attackers, this means workflows that previously required writing glue code for each tool can now quickly mount various capabilities through a unified protocol — lowering orchestration barriers and increasing automation. For defenders, MCP servers themselves can become a new attack surface — they inherit the permissions of mounted tools, and if misconfigured (such as overly broad credentials or tool calls hijackable by prompt injection), the model can be induced to perform unintended operations. Therefore, security review around AI agents must examine not only model output but also audit the callable toolset and authorization boundaries.

Practical Implications for Cloudflare WAF Work

WAF excels at reducing automated noise and enforcing rules at the edge, but as a sole control against patient attackers using valid credentials and legitimate-looking traffic, its effectiveness is limited. The pragmatic approach is to use WAF where it's strong: filtering obvious automated abuse, enforcing rate limits and bot controls, protecting known vulnerable paths, applying geo/ASN/reputation rules where reasonable, and generating high-quality logs for downstream analysis.

Then connect those logs to the rest of your detection stack. A single blocked request is useful; but a pattern of blocked requests, failed logins, new device registrations, and privileged access attempts is far more useful.

A Better Question Than "Who's Behind This IP"

For blue team members, the most productive question usually isn't "who owns this IP" but rather: What is this activity trying to achieve, and which control should have stopped it?

IPs can be changed, VPSs can be deleted, AI models can run locally. But poor identity hygiene, exposed services, excessive permissions, and missing logs remain persistent weaknesses. Focus on making those weaknesses expensive to exploit — that's where your leverage lies.

One-line Summary

A blue team analysis of how attackers leverage AI and disposable infrastructure in layered attacks, with defensive priorities.

Paragraph Summary

The article answers "how attackers use AI and disposable infrastructure to attack enterprises" from a blue team perspective. The core conclusion: attackers don't need sophisticated AI pipelines — most intrusions still begin with exposed services, weak authentication, stolen credentials, or vulnerable software, and AI merely changes the economics of certain steps. The author builds a mental model around three maturity tiers: opportunists using scripts and VPSs for broad scanning, organized actors separating identity from infrastructure via local models and disposable VPSs, and mature actors treating infrastructure as disposable and identity as a separate problem, winning through patience and valid access. The defensive takeaway is that source IP is failing as a primary indicator, requiring a shift to behavioral chain detection that correlates identity, device, network origin, and business context; WAF should be one layer of defense-in-depth, integrated with identity platforms, endpoints, and cloud logs.