An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation
Palo Alto Networks' Unit 42 investigated a ransomware breach where the attacker let AI agents do the hands-on work: mapping the network, stealing credentials, and hijacking cloud systems inside one company. What normally takes human attackers about two weeks was finished in under 10 hours.
- Report priority
- Medium
What is known
The attacker broke in through a public-facing API, then set AI agents loose to explore the internal network, search code repositories for hard-coded passwords and tokens, and use those to reach the company's central credential vault and cloud accounts, all while the agents kept re-planning their next move on their own.
What to do
Unit 42 recommends removing hard-coded credentials from code repositories, tightly restricting public-facing APIs, enforcing branch-protection and code-review rules on infrastructure files, and monitoring for unusual automated activity across cloud and CI/CD systems.
Reported details
The attacker breaks into the company through a public-facing API and tunnels into the internal network. An automated agent then maps out the company's internal microservices while other agents search code repositories and find passwords and access tokens left in the code. The attacker uses those stolen tokens to break into the company's credential vault, grabs top-level administrator access, hijacks the company's automated software-deployment system to steal cloud access keys, and then uses those stolen cloud keys to take over the company's own AI computing systems for further attacks.
Unit 42 attributed the speed of this ransomware intrusion to an attacker orchestrating multiple frontier LLM agents in parallel, coordinated through structured Markdown files passed between agent sessions, with custom AI-generated scripts managing operations. The attack chain used more than 50 MITRE ATT&CK techniques, mapped separately to the MITRE ATLAS framework for AI-specific tactics: exploiting a public-facing application for initial access, automated service discovery, credential harvesting from code repositories, privilege escalation via the secrets manager, and CI/CD pipeline abuse to exfiltrate cloud keys and attempt Terraform backdoor edits, which branch-protection controls blocked. The attacker also had an agent generate an 80-page technical audit of the victim's security posture.