Loading story…
Unit 42 investigated a ransomware incident in which a human-directed threat actor used frontier AI models and attack-specific agentic frameworks to compromise an enterprise network in under 10 hours—activity assessed to resemble roughly two weeks of coordinated red-team work. After exploiting a public-facing API endpoint, the automated operation used more than 50 MITRE ATT&CK techniques to enumerate internal services, harvest repository secrets, compromise the organization’s secrets-management platform, and abuse CI/CD workflows.
The attackers used stolen cloud credentials to access the victim’s AI infrastructure and attempted to establish Terraform backdoors, although branch-protection controls blocked that persistence attempt. The operators also left an 80-page technical audit detailing the weaknesses they had exploited, underscoring how AI agents can rapidly automate established intrusion tradecraft without relying on a zero-day flaw or exceptional operator capability.
Track how attackers are adapting to this technology.
9 events from the most recent confirmed update back to the earliest known activity.
Unit 42 observed parallel calls to frontier AI agents, structured Markdown files shared across agents or sessions, and custom scripts assessed with high confidence to be AI-generated. The attacker also left an approximately 80-page report documenting exploited security weaknesses.
Unit 42 responded to the ransomware incident and assessed that AI-enabled agents compressed activity comparable to roughly two weeks of coordinated human red-team work into less than 10 hours. The actor told Unit 42 during negotiations that it used frontier AI models and attack-specific agentic frameworks.
The intrusion established persistence through SSH keys, serverless functions, container restart policies, cloud identities, and CI/CD pipelines.
The attacker attempted to implant backdoors in Terraform configurations, but the victim's branch-protection controls prevented the modifications.
The attacker used stolen cloud keys to invoke and hijack the victim's cloud AI endpoints and used victim compute resources for subsequent malicious activity.
The attacker hijacked an enterprise code application through custom workflows to exfiltrate cloud access keys and triggered unauthorized CI/CD builds.
Using exposed tokens, the attacker accessed the victim's secrets-management system, harvested master administrative credentials, and obtained root-level system control.
Automated reconnaissance mapped internal microservices, while sub-agents searched enterprise code repositories for hard-coded tokens and service passwords.
A human-directed threat actor breached a public-facing API endpoint and tunneled into the victim enterprise network, using an operation Unit 42 assessed as AI-assisted.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
9 references tracked. Mallory keeps watching after this page renders.
cyberaccord.com
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcecyberveille.ch
Open sourcemalware.news
Open sourcedatabreaches.net
Open sourcescworld.com
Open sourcetheregister.com
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A financially motivated lone attacker used AI-assisted workflows to breach a large **AWS** environment in roughly 72 hours, according to a Sygnia incident-response report, chaining weaknesses across Internet-facing applications, AWS resources, source code repositories, **CI/CD** pipelines, runtime components, and data stores. The intrusion reportedly began with the theft of an AWS access key and expanded through secrets harvesting, cloud enumeration, backdoor creation, data exfiltration, deployment pipeline abuse, runtime modification, database access, and operational disruption. To extort the unnamed global enterprise, the actor carried out mostly reversible actions including denying access to **S3** buckets, scaling **ECS** services to zero, blocking network access with ACL rules, and purging **SQS** queues. The incident reflects a broader shift from isolated malicious use of generative AI to **agentic AI** supporting larger portions of the attack chain. Research cited by OALABS and observations from Anthropic indicate attackers are using tools such as **Claude** and **OpenAI Codex** to automate reconnaissance, analyze stolen data, generate code, and adapt operations during live intrusions, lowering the barrier for less-skilled actors while helping experienced operators scale activity. Security researchers said the trend now spans multiple **MITRE ATT&CK** tactics, including reconnaissance, credential theft, malware development, and social engineering, pushing defenders to prioritize detection of AI-enabled workflows, stronger identity controls, broader visibility, and faster automated containment.
Jul 9, 2026
Gambit Security reported that a suspected affiliate of **The Gentlemen** ransomware-as-a-service operation used Anthropic’s **Claude Code** during live intrusions at multiple organizations, showing how generative AI is being embedded directly into ransomware activity. The actor reportedly used AI to breach internet-exposed VPN appliances, conduct reconnaissance, enumerate internal networks, identify domain controllers and backup systems, and prioritize high-value business data for theft. In one highlighted technique, the operator carried out an AI-assisted LDAP pass-back attack against **FortiGate** authentication to capture a service account password in cleartext, then created a hidden VPN account to maintain persistence. The intrusions also involved staging and exfiltrating **SQL Server** backups, modifying firewall configurations, and using AI-generated scripts to accelerate operations. Gambit linked the activity to The Gentlemen with medium confidence based on leak-site overlap, shared infrastructure, and targeting patterns focused on backup systems. The report placed the ransomware case alongside other AI-enabled criminal operations, including the **Zerofot** credential-harvesting campaign built with OpenAI Codex and Claude Code and the **RAGE** framework backed by DeepSeek, underscoring a broader shift toward AI-assisted credential theft, reconnaissance, and malware deployment. Gambit also noted that AI use introduced operational errors, including a mistaken full VDOM restore that knocked a compromised firewall offline at an Australian energy utility.
Aug 20, 2026
Palo Alto Networks Unit 42 warned that frontier and commercially available agentic AI is shifting offensive capability toward attackers, enabling lower-skilled actors to conduct vulnerability discovery, reverse engineering, malware development, social engineering, and other attack-chain activities at machine speed. In an investigation involving a customer, Unit 42 said an attacker reportedly used an agentic framework to exploit 50 applications and other enterprise weaknesses in under 10 hours, including exploitation, privilege escalation, and data theft. Unit 42 said AI is already supporting malware creation, task delegation, ransomware negotiations, and reconnaissance, while making attribution more difficult. It identified identity compromise, software supply-chain exposure, and nation-state discovery of enterprise weaknesses as key risks, and urged organizations to adopt zero-trust controls, continuously train employees, govern internal AI use, and build adaptable security strategies for agentic AI.
Aug 27, 2026