A human attacker used frontier AI models and agentic frameworks to breach an enterprise network in under 10 hours, compressing what Unit 42 investigators said would normally require a two-week effort by a team of human operators.
The incident, detailed in a September 2 report by Palo Alto Networks’ Unit 42 threat intelligence team, is the first documented case where AI agents carried out every operational step of a ransomware attack, from initial reconnaissance to credential harvesting to cloud infrastructure hijacking. The attacker then left behind an 80-page security audit of the victim’s defenses as a final insult.
The threat actor, linked by UltraViolet Cyber’s TIDE team to a Russian-speaking criminal group operating under the name Aurora, told negotiators during the extortion phase that they used frontier models and attack-specific agentic frameworks. The claim was assessed with high confidence by multiple analysts who reviewed the incident’s artifacts.
The Attack Chain: How AI Agents Worked in Parallel
Unit 42’s investigation revealed an operation that ran more like a software deployment than a traditional hack. The attacker used multiple AI agents simultaneously, each assigned to a specific phase of the intrusion, with results passed between them via structured Markdown files that served as inter-agent communication.
The 10-hour timeline broke down into five distinct stages. First, the attacker breached a public API endpoint and deployed an automated reconnaissance agent to map the company’s internal microservices. The agent discovered service endpoints, mapped dependencies, and identified high-value targets without any human guidance after the initial instruction.
Second, sub-agents scraped the organization’s code repositories, extracting hard-coded tokens and service passwords that developers had left in source files. This step, which would typically require a human analyst reading through thousands of lines of code, was completed in minutes.
Third, using those harvested credentials, the AI infiltrated the company’s secrets management system and seized master administrative credentials, gaining root-level access across the network. Fourth, the attacker hijacked CI/CD workflows to exfiltrate cloud access keys, attempting to plant backdoors in Terraform configurations. Hard branch-protection controls blocked that specific move, but the attacker had already captured what it needed.
Fifth, and most notably, the attacker used the stolen cloud keys to turn the victim’s own AI infrastructure into post-compromise compute. The company’s cloud AI endpoints became launch pads for further operations, with the attacker’s orchestration traffic hidden among legitimate usage.
| Attack Stage | AI Agent Role | Outcome |
|---|---|---|
| Reconnaissance | Automated service mapping | Full microservice inventory |
| Credential harvesting | Code repository scraping | Hard-coded tokens and passwords extracted |
| Privilege escalation | Secrets manager infiltration | Root administrative credentials stolen |
| Pipeline exploitation | CI/CD workflow hijacking | Cloud access keys exfiltrated |
| Infrastructure abuse | Cloud AI endpoint takeover | Victim’s compute used for attacker operations |
Why This Attack Is Different
The intrusion used more than 50 MITRE ATT&CK techniques, but none of them were novel. There was no zero-day exploit, no previously unknown vulnerability, no elite exploit chain. What made the attack unusual was speed and coordination, the ability of AI agents to execute, evaluate, and re-plan in real time across multiple attack surfaces simultaneously.
“What made the attack stand out was AI-assisted operational efficiency, without the need for a novel zero-day or super elite tradecraft. The attacker left tactical execution to AI agents that monitored, evaluated, acted and re-planned in real time, increasing speed throughout the attack chain.”
The human operator set objectives and made high-level decisions, while AI agents handled tactical execution. Unit 42 observed indicators consistent with large language model usage, including parallel calls to multiple frontier AI agents, structured data files passing information between sessions, and custom scripts assessed with high confidence to be AI-generated due to embedded UI elements.
The result was a machine-speed attack chain that compressed weeks of methodical intrusion work into a single workday. Traditional red team engagements of similar scope typically run two to three weeks with multiple operators coordinating across a war room. This attack achieved comparable results with one human directing a swarm of AI agents that never needed sleep, breaks, or handoff shifts.
The speed advantage compounds at each stage. Reconnaissance that takes days was completed in under an hour. Credential harvesting from large codebases that might require a week of manual review happened in minutes. Privilege escalation that depends on careful sequencing of moves was executed in a continuous automated loop, with each agent passing its results directly to the next.
Aurora: The Group Behind the Attack
UltraViolet Cyber’s TIDE team linked the intrusion to a ransomware group tracked as Aurora, also styled Aur0ra. The group, assessed to be Russian-speaking with unconfirmed state affiliation, has been active since at least 2025 and operates as an independent criminal affiliate rather than a state-sponsored actor.
Aurora’s attack chain, documented in UltraViolet’s threat advisory, typically begins with email bombing followed by help desk impersonation calls to gain remote access. The group then uses AI-assisted attack planning, LDAP and SMB enumeration via NetExec, Kerberoasting for credential access, and ransomware deployment.
The incident responded to by Unit 42 showed the AI component at its most sophisticated. The attacker left behind an unusually complete operational picture in a leaked dump: Kerberos tickets, credential dumps, Group Policy exports, BloodHound collections, shell history, and AI-assisted chat logs. CloudSEK, partnering with blockchain analytics firm TRM Labs, used the dump to trace ransom payments on-chain.
Gambit Security, in a separate analysis of Aurora’s methods, found that the AI coding assistant used during the attack was capable of directly executing offensive commands when supplied with credentials or an existing foothold. The assistant did not merely suggest attack steps for the human to carry out. It ran them.
What Defenders Should Take Away
Unit 42’s report argues that the traditional security playbook is inadequate against machine-speed attacks. The incident response team recommends deploying automated playbooks that can simultaneously revoke credentials, terminate OAuth sessions, freeze CI/CD pipelines, and isolate cloud accounts across all operational planes when an intrusion is detected. Human response times, measured in minutes or hours, cannot match AI-powered attack execution measured in seconds.
The report also urges companies to treat AI systems as core infrastructure rather than productivity tools. Every model endpoint, API key, MCP gateway, and AI tool integration should be inventoried, rate-limited, and assigned least-privilege policies. The victim in this case had AI services running without adequate access controls, which allowed the attacker to seize compute resources without triggering alerts.
“Companies should treat AI as core infrastructure. This requires taking inventory of every model endpoint, API key, MCP gateway, and AI tool integration, and applying rate limits and least-privilege policies, or risk an unexpected and very large token bill.”
The financial dimension adds another layer of risk. The attacker consumed the victim’s cloud AI compute during the post-compromise phase. In an environment where enterprise AI API bills can run into hundreds of thousands of dollars per month, unauthorized usage at scale could produce a secondary financial impact well beyond the ransom itself.
The Broader Implications
The Aurora incident sits at the intersection of two accelerating trends: the weaponization of AI by threat actors and the growing attack surface created by enterprise AI adoption. As companies rush to integrate AI agents into their workflows, they are simultaneously creating new infrastructure for attackers to exploit and providing the very tools attackers need to operate at scale.
The cybersecurity industry’s standard response, investing in AI-powered defense tools, mirrors the escalation dynamic. Both sides are now building with the same underlying technology, and the outcome will likely be determined by who deploys it more effectively rather than who has access to the most sophisticated models.
For enterprise security teams, the practical takeaway is straightforward. Inventory every AI tool and API key in your environment. Apply the same access controls you would to any other production system. Build automated response playbooks that can execute faster than a human analyst can read a Slack notification. The next Aurora-style attack will not wait for anyone to open a ticket.
discussion