60
60
AI agents carried out every step of this ransomware attack – then left the victim an 80-page security audit
Unit 42 says a human attacker used AI agents to execute a full ransomware intrusion in under 10 hours, leaving the victim an 80-page security audit.
Palo Alto Networks Unit 42 incident responders report a human ransomware operator used frontier AI models and agentic attack frameworks to breach an enterprise in under 10 hours, work that normally takes human operators around two weeks. AI agents performed reconnaissance, breached a public API endpoint to tunnel into the network, scraped code repositories for hard-coded tokens and service passwords, then used them to steal master administrative credentials from the secret-management system for root access. Specialist pivot agents validated access to cloud, identity, CI/CD, container and SaaS environments, and the attacker hijacked CI/CD workflows to steal cloud keys and turn the victim's cloud AI services into post-compromise infrastructure. The agents left an 80-page audit detailing dozens of exploited findings.
78
60
60
60
60
60
60
60
60
60
⚡ THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips [13 January]
60
60
60
60
60
60
60
⚡ THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips
60
60
60
60
Week in review: GitLab account takeover flaw, attackers exploiting Ivanti Connect Secure zero-days
60
60
60
60
DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt
Microsoft reports DeadLock ransomware using Polygon smart contracts and Session messaging for extortion infrastructure, claiming 96 victims across Europe and the U.S.
Microsoft Threat Intelligence reports the DeadLock ransomware operation uses the Session messaging network and Polygon blockchain smart contracts to host victim chat, proxy server addresses, and its data leak blog, making takedowns harder. First detected in July 2025, the group has claimed 96 victims, mostly in Italy, Spain, Poland, Türkiye, and the U.S., with deployments by affiliates of Lynx and INC ransomware. The encryptor uses Curve25519 with XChaCha20, drops an interactive HTML recovery chat application, geofences CIS-linked countries, and clears logs and shadow copies to evade forensics.
62
60
60
60
60
60
60
60
60
60
60
60
60