AI Rescues Stalled Cyberattack, Enabling Lateral Movement
A threat actor successfully pivoted within a US retailer's network using AI-generated commands after initial manual attempts were blocked, highlighting a new frontier in automated cyberattacks.
A cyberattack against an unnamed US retail organization in September took a significant turn when the threat actor, facing persistent blocking of their manually entered commands, switched to employing AI-generated scripts. This strategic shift allowed the attacker to achieve lateral movement within the victim's network in mere minutes, demonstrating a potent new application of artificial intelligence in cyber warfare.
Symantec, which investigated the incident, noted that the timing and nature of the commands suggested automation. While not a fully autonomous agent, the activity indicated an operator interacting with an AI tool to generate and execute commands. This marks a concerning evolution from earlier uses of AI, which were primarily limited to generating phishing lures or basic reconnaissance.
The initial access vector for this attack remains unknown, but the post-incident investigation focused on the attacker's methodology once inside. After initial manual attempts were thwarted by security software, the threat actor returned the next day. For nearly two hours, they deployed long, error-free PowerShell scripts that included what appeared to be model reasoning in comments and labeled output sections.
Approximately ten minutes after querying the victim's SolarWinds Orion monitoring software, the attackers successfully moved laterally to a second server. This rapid progression underscores the efficiency gains AI can provide to threat actors, potentially lowering the skill barrier for complex network intrusions.
Investigators hypothesize the attackers were financially motivated, as evidenced by their search for point-of-sale scripts containing passwords. One contacted address was also linked to a previous operation that targeted online retailers for card data.
This incident is one of dozens of AI-assisted attacks Symantec has observed since May, with a notable concentration in September. The ability of AI to revive a stalled attack and enable critical actions like lateral movement represents a significant challenge for defenders.
Symantec's principal intelligence analyst, Dick O'Brien, suggests that defenders can potentially leverage this pattern. The specific way AI behaves, such as rapidly testing variants of a technique, can itself serve as a detection signal. Blocking based on such behavioral patterns, rather than solely on file names or exact commands, is becoming increasingly crucial.
While no specific vulnerability was exploited in this instance, the trend of AI accelerating attacks has profound implications for the ongoing patching race. O'Brien emphasizes that defenders must shift their focus from 'mean time to patch' to 'mean time to mitigate,' recognizing that patching alone may not be sufficient against rapidly evolving, AI-enhanced threats.