Threat actor uses AI-generated malware in network intrusion
A hacking script written with AI help steals data from Windows networks. Attackers use it to find and dump sensitive info like user lists and passwords.
- Report priority
- Medium
How it works
- Attackers send a script built with AI tools to Windows servers.
- The script scans for weak spots and steals network data like user accounts and passwords.
What to do
Check if you or your team recently ran a script called '100% Working AD Information Gathering Script' or similar on Windows servers.
Delete the script immediately and scan your network for unauthorized access using tools like Huntress's free checks.
Technical details
An attacker emails a fake 'network audit tool' to a company's IT team. The script runs on a Windows server, checks for exposed user data, and sends stolen account details to the attacker's hidden server.
Huntress recovered a PowerShell script, publicly titled 'Untitled1.ps1' on disk, deployed after RDP access via compromised VPN credentials on a domain-joined Windows Server. The script used a five-method fallback chain to locate the domain controller, then exported AD users, computers, groups, OUs, subnets, and trusts to CSV files and an HTML report under C:\AD_Reports<datetime. Roughly 30 minutes later the actor ran s5cmd.exe, a legitimate S3 transfer utility, to exfiltrate the data, followed by SharpShares.exe to find more file shares. Huntress attributed the script to AI generation from an unedited placeholder server name, redundant fallback logic, and heavily colorized console output, and detected the intrusion through PowerShell Event ID 4104 behavioral logging rather than file signatures.