Criminal groups and state-linked actors appear to be using commercial models to refine and scale up attacks