AI agents help compress ransomware intrusion to under 10 hours, raising stakes for CISOs
Unit 42 reports AI agents compressed a ransomware intrusion from weeks to under 10 hours, using 50+ MITRE ATT&CK techniques against an enterprise network.
Palo Alto Networks Unit 42 investigated a ransomware incident where AI agents moved through an enterprise network in under 10 hours, work that would have taken human operators roughly two weeks. The attacker entered via a public-facing API endpoint, used automated reconnaissance to map microservices, searched source-code repositories for credentials, and accessed a secrets-management system. They hijacked enterprise code workflows to exfiltrate cloud access keys, attempted Terraform backdoors (blocked by branch protections), and used stolen credentials to access the victim's own AI services as attack infrastructure. Over 50 MITRE ATT&CK techniques were observed; the actor confirmed using frontier AI models and agentic frameworks during negotiations.
- AI agents compressed intrusion timeline to under 10 hours vs ~2 weeks manually
- Attack chain: API endpoint entry → repo credential search → secrets-management access → cloud key exfiltration
- Attempted Terraform backdoors were blocked by branch protection controls
- Stolen cloud credentials were used to access victim's AI services as attacker infrastructure
- Vendors
- Palo Alto NetworksUnit 42
- Organizations
- Greyhound ResearchOmdiaIDC
- AI models
- frontier models
From the original article
4 min read at csoonline.com
A ransomware attacker used AI agents to move through an enterprise network in less than 10 hours, according to Palo Alto Networks researchers, who estimated that similar work could have taken human operators about two weeks. The incident involved more than 50 techniques mapped to the MITRE ATT&CK framework, according to the company’s Unit 42 threat research team. The techniques themselves were largely familiar.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.