Yana Iskayeva/ Moment via Getty ImagesZDNET’s key takeaways
- An AI-driven ransomware campaign took 10 hours to do weeks’ worth of red teaming.
- Within hours, AI weaponized over 50 MITRE ATT&CK techniques.
- What can organizations do? Unit 42 has recommendations.
We’ve been warned that artificial intelligence (AI) and large language models (LLMs) have the processing power and speed to launch cyberattacks far more quickly than we can defend against them.
There’s been little in the way of concrete timeframes to show us what we’re up against, but now, a new analysis shows that AI can perform what would normally take cybersecurity specialists weeks to do in mere hours.
Also: ‘Sophisticated’ AI swarm attacks are months away, OpenAI warns: What experts say businesses must do
On Wednesday, Palo Alto Networks’ Unit 42 cybersecurity team published research into how AI models can be used to autonomously breach enterprise networks.
The release, a follow-up to the firm’s launch of its Frontier AI Defense service last week, outlines how AI autonomously breached an enterprise network during a ransomware campaign, at a speed and with an impact that could be compared to red team defenders given weeks to run a penetration test.
The timeline
Unit 42 responded to the incident, described as “a human attacker using frontier AI to breach an enterprise network autonomously as part of a ransomware attack.”
By harnessing AI, the threat actor managed to do the following in 10 hours:
- Infiltration: A public API endpoint was breached, and a reconnaissance agent was deployed to map the victim’s network architecture.
- Credential theft: Agents were then tasked with rifling through enterprise code repositories, leading to the theft of hard-coded tokens and service passwords.
- Privileges gained: Now armed with tokens, the attacker breached a secrets management system, stole master admin credentials, and obtained root system access.
- Target the pipelines: An enterprise code app was then hijacked, and the attacker tried to plant backdoors, but failed.
- AI infrastructure hijacking: Using stolen keys, the attacker then seized control of AI endpoints to “use the company’s compute power to perpetrate future moves.”
“The agents breached the company’s security layers in a methodical manner, each targeting a different layer of defense to achieve a shared goal,” Unit 42 said. “The impact was at the scale of a coordinated effort from multiple red teams, which would normally take human operators around two weeks.”
Why does AI matter in this attack?
First and foremost, the sheer speed and efficiency of the attack are significant.
According to the researchers, by leveraging frontier AI models and automation, the attacker was able to leverage over 50 MITRE ATT&CK techniques in less than 10 hours — no zero-day vulnerability or novel attack method necessary.
Also: After the vibe-coding rush comes the debugging hangover
However, adaptation may be the real concern here. The cybercriminal was able to leave AI agents to formulate intrusion methods on their own, adapt, and pivot to achieve their tasks.
To add insult to injury, the threat actor left a report behind, detailing the weaknesses in the organization’s security.
How to address agentic AI attacks
As Sherrod DeGrippo, VP Threat Intelligence at Unit 42, previously said, AI is a “force multiplier” not just for defense, but for attackers today and future threat actors.
AI is an “incredible tool,” as the executive noted, but in the hands of the wrong people, you’re arming what were once low-skilled individuals and groups with capabilities close to those of state-sponsored, well-resourced threat actors.
Also: A low-tech solution from the past may be your best defense against AI deepfakes
With the enterprise now facing these threats at scale, Unit 42 recommends that organizations and their defenders consider the following and begin adapting their security policies accordingly:
- AI agents leave recognizable indicators: Structured markdown, Python caches, and paired asset folders are some of the indicators that an AI agent may be acting maliciously. While there won’t be much time, watching out for these indicators could help stop an attack in its tracks.
- Execute synchronized containment: Fight automation with automation. Consider deploying automated playbooks to swiftly revoke credentials, freeze development pipelines, and isolate cloud services.
- Govern AI as core infrastructure: As shown in this case, attackers can weaponize a victim’s AI agents, using them as post-compromise infrastructure to steal their compute resources and capabilities to further attacks. AI models need to be protected like core systems, including applying least-privilege policies, enabling diagnostic logging, and maintaining strict access and inventory logs.
- Detect behavioral loops: Suspicious behavior or network activity must be detected and stopped quickly to fend off an AI-assisted cyberattack. The team recommends hunting for operational loops, including API requests, rapid 401/200 HTTP state shifts, parallel authentications, and unexpected AI model usage.
- Lock down DevOps pipelines: Finally, ensure solid branch protection across development pipelines. It only takes one weak spot for an attacker to plant a backdoor and establish persistence in your network.
