A ransomware attacker infiltrated an enterprise network in under 10 hours using AI agents to automate reconnaissance, credential harvesting, and lateral movement. Palo Alto Networks' Unit 42 team investigated the incident, estimating that human operators would have needed about two weeks to execute the same attack path. The attacker deployed over 50 techniques from the MITRE ATT&CK framework, adapting tactics dynamically based on what each automated agent discovered.
This wasn't entirely autonomous. A human directed the operation while AI agents handled tactical execution. This distinction matters because it highlights what actually failed: not exotic new vulnerabilities, but basic controls that couldn't keep pace with automated exploitation of familiar attack patterns.
Attack Timeline
The attacker entered through a public-facing API endpoint. An automated reconnaissance agent mapped internal microservices. Additional agents searched source-code repositories for exposed credentials, which provided access to a secrets-management system containing administrative credentials.
The attacker hijacked an enterprise code application through custom workflows to exfiltrate cloud access keys. They attempted to plant backdoors in Terraform configurations, but existing branch protections blocked the modification. Stolen cloud credentials were used to access the victim's AI services, effectively converting the organization's own computing resources into attacker infrastructure.
The entire sequence from initial access to attempted persistence took less than 10 hours.
Which Controls Failed or Were Missing
Long-lived credentials in code repositories. The attacker found credentials granting access to a secrets-management system. These credentials should not have been in source code at all. If they existed as service identities, they should have been short-lived tokens with narrow scope.
Inadequate API authentication and monitoring. The initial entry point was a public-facing API endpoint. Either the endpoint lacked sufficient authentication controls, or anomalous access patterns weren't detected quickly enough to trigger containment.
Siloed telemetry across systems. The attack moved from API to microservices to code repositories to secrets management to cloud services. Each environment may have logged activity, but the organization didn't correlate events across domains fast enough to recognize the attack path.
Overprivileged code workflows. The attacker hijacked an enterprise application to exfiltrate cloud access keys. The workflow had more authority than it needed, creating what security researchers call "transitive authority": one system's limited access enabling privileged actions elsewhere.
Slow containment procedures. Even if the security team detected suspicious activity within hours, the attacker moved faster than the organization's containment process. That gap between detection and action is where the damage occurred.
What the Relevant Standards Require
NIST CSF Core Function: Identify (ID.AM-2) requires organizations to inventory software platforms and applications. This includes understanding what authority each platform has and what it can cause other systems to do. A code application that can exfiltrate cloud credentials represents a risk that should appear in your asset inventory and threat model.
NIST CSF Core Function: Detect (DE.AE-3) calls for event data to be aggregated and correlated from multiple sources. Detecting this attack required connecting API access logs, repository activity, secrets-management queries, and cloud service authentication. If those systems report to separate dashboards without cross-correlation, you're reviewing alerts in isolation rather than recognizing an attack path.
NIST CSF Core Function: Respond (RS.RP-1) requires a response plan that's executed during or after an event. The plan should define who has authority to take containment actions and under what conditions. If your incident response provider has to wait for internal approval before disabling a compromised account, the attacker keeps moving while you're coordinating.
MITRE ATT&CK Technique T1552.001 (Credentials In Files) describes exactly what happened here: the attacker searched code repositories for credentials. Your secure development lifecycle should prevent credentials from reaching repositories, and your secrets-management system should rotate any credentials that do get exposed.
MITRE ATT&CK Technique T1078 (Valid Accounts) covers the use of legitimate credentials to maintain access. The attacker used administrative credentials from the secrets-management system. Your identity governance program should limit credential lifetime and scope, particularly for administrative access.
Lessons and Action Items for Your Team
Measure your containment gap. Compare how quickly a realistic attack path can reach a critical system against how long your team actually takes to detect and contain it. If the attack completes before containment takes effect, your controls are structurally insufficient. Run tabletop exercises where a red team uses agent-assisted tools to execute an attack path while your blue team responds under normal procedures. The delta between attack completion and containment tells you where to invest.
Eliminate long-lived credentials from workloads. Replace static credentials with short-lived tokens issued by your identity provider. Service accounts and application identities should authenticate using time-limited credentials with the minimum scope required for their function. This doesn't stop an attacker from stealing credentials, but it limits how long those credentials remain useful.
Correlate telemetry across domains. Your SIEM or detection platform should ingest logs from API gateways, code repositories, secrets-management systems, and cloud control planes. Build detection rules that trigger on sequences of activity across those systems, not just anomalies within a single domain. An unusual API call followed by repository access followed by secrets-management queries should generate a high-confidence alert.
Review transitive authority in your environment. Map which systems can cause actions in other systems. A code workflow that can assume a cloud role, a CI/CD pipeline that can modify production infrastructure, or a monitoring tool that can disable accounts all represent transitive authority. Limit what each system can delegate and require approval or additional authentication for high-privilege operations.
Pre-authorize containment actions for your security provider. Define which containment steps your managed security provider or incident response retainer can execute without waiting for approval: disabling a compromised account, revoking active sessions, blocking a network segment. Document these authorities in your security services agreement and test them during tabletop exercises. Speed matters more when the attacker operates on a 10-hour clock.
Implement preventive controls where detection can't keep pace. Branch protections blocked the attacker's attempt to modify Terraform configurations. That control worked because it didn't require detection or response time. Identify other choke points in your environment where you can enforce policy automatically: required code reviews, immutable infrastructure configurations, or approval workflows for privilege escalation. Prevention scales better than detection when attack cycles compress.
The core lesson isn't that AI creates fundamentally new attack techniques. It's that AI lowers the time and skill required to execute familiar techniques concurrently. Your controls have to work faster than they did when human operators needed two weeks to complete the same attack path. If your current detection-to-containment cycle takes longer than 10 hours, you're operating on the wrong clock.
