Attacker impersonates 32 AI bots while scanning for credentials
Original title: Attacker Relentlessly Scans for Credentials by Impersonating AI Bots
CQ Prime says the scanner has run since late September, reached many Cequence customers in one day, and almost all requests failed.
CQ Prime Research, part of Cequence Security, says an unnamed scanner impersonated 32 AI crawlers and assistants, including ones tied to OpenAI, Anthropic, Perplexity, and Meta. It requested files that can hold passwords, API keys, and cloud credentials from organizations in retail, financial services, telecommunications, energy, and software. Researchers identified the traffic on October 21. Activity began in late September, was still active in late October, and nearly all requests were blocked or failed.
Unconfirmed: Researchers say the scanning was without success, but the unnamed actor and any residual exposure are not independently confirmed.
- On one day this month, 48% of Cequence-protected organizations received the traffic.
- Each burst sent 50 to 190 requests in about eight seconds.
- The scanner first tried random nonsense paths to find sites that answer every request.
- Targets were processed one at a time, around the clock.
Impact: Sought exposed passwords, API keys, and cloud credentials
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 0976de79337ac3812bd4e8604cb04c0d | er-ransomware-activity#recipe=similar-items&sourcecontentid=0976de79337ac3812bd4e8604cb04c0d) US Cyber Pros Plead Guilty Over BlackCat Ransomware Activ |
| md5 | 3de05debc69bdf840acf3ce3c6457ee8 | e-getting-more-violent#recipe=similar-items&sourcecontentid=3de05debc69bdf840acf3ce3c6457ee8) How Can CISOs Respond to Ransomware Getting More Violent? |
| md5 | 842bd5a84d1f4b7738c164d8542426b4 | mminent-threat-act-now#recipe=similar-items&sourcecontentid=842bd5a84d1f4b7738c164d8542426b4) Microsoft Exchange 'Under Imminent Threat,' Act Now by Ar |
| md5 | dd763fcf1c8714815d52f82a2a0d8a90 | cyber-strategy-changes#recipe=similar-items&sourcecontentid=dd763fcf1c8714815d52f82a2a0d8a90) Switching to Offense: US Makes Cyber Strategy Changes by |
From the original article
8 min read at darkreading.com
The threat actor lurked behind bots posing as agents from OpenAI, Anthropic, Meta, and others to find exposed data.
By Elizabeth Montalbano · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.