AI-Assisted Ransomware Attack Compromised Enterprise via Public API

Unit 42 investigated a ransomware incident in which a human-directed threat actor used frontier AI models and attack-specific agentic frameworks to compromise an enterprise network in under 10 hours—activity assessed to resemble roughly two weeks of coordinated red-team work. After exploiting a public-facing API endpoint, the automated operation used more than 50 MITRE ATT&CK techniques to enumerate internal services, harvest repository secrets, compromise the organization’s secrets-management platform, and abuse CI/CD workflows.

The attackers used stolen cloud credentials to access the victim’s AI infrastructure and attempted to establish Terraform backdoors, although branch-protection controls blocked that persistence attempt. The operators also left an 80-page technical audit detailing the weaknesses they had exploited, underscoring how AI agents can rapidly automate established intrusion tradecraft without relying on a zero-day flaw or exceptional operator capability.