Skip to content

Unit 42: machine-speed agentic intrusion — 50+ ATT&CK techniques executed in under 10 hours (Sep 2, 2026)

Tags

Summary

On September 2, 2026, Unit 42 (Renzon Cruz, Nicolas Bareil, Eric Semaan, Omar Jbari; updated Sep 3 to clarify it was an intrusion, not a ransomware deployment) published "An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation." Unit 42 responded to an incident in which a human attacker used frontier AI models and attack-specific agentic AI frameworks to autonomously breach an enterprise network as part of a ransom attack. The agents breached the company's security layers methodically — each targeting a different defense layer for a shared objective — with impact Unit 42 compares to multiple red teams working in coordination, a job that human operators normally take around two weeks, compressed into less than 10 hours. The attack chained more than 50 MITRE ATT&CK techniques. No novel zero-day or super-elite tradecraft was required: the differentiator was AI-assisted operational efficiency, with the human operator setting objectives and consequential decisions while specialized agents monitored, evaluated, acted, and re-planned in real time. The attacker even directed the agent to leave behind an 80-page technical audit of the victim's security posture as a post-compromise artifact (and negotiation evidence).

The 10-hour attack chain

  1. Infiltration and mapping: the actor breached a publicly accessible web service (T1190: Exploit Public-Facing Application) and tunneled into the network, deploying an automated recon agent that mapped internal microservices via service discovery (T1046; ATLAS AML.T0000 / AML.T0002 AI-Automated Reconnaissance).
  2. Secrets harvesting: sub-agents combed enterprise code repositories for hard-coded tokens and service passwords (T1552.001 Credentials in Files; ATLAS AML.T0014 Credentials Harvesting).
  3. Privilege takeover: using exposed tokens, the actor infiltrated the secrets management system, harvesting master administrative credentials and seizing root system access (T1555 Credentials from Password Stores; ATLAS AML.T0016 Privilege Escalation via Automated Pivot).
  4. Pipeline exploitation: the actor hijacked an enterprise code application via custom CI/CD workflows to exfiltrate cloud access keys, and attempted to plant backdoors in Terraform configurations — hard branch-protection controls stopped this (T1578 Modify Cloud Compute Infrastructure; ATLAS AML.T0010 ML/DevOps Pipeline Interception).
  5. AI infrastructure hijacking: with stolen cloud keys, the actor turned the victim's AI endpoints into post-compromise infrastructure, using the company's own compute to run subsequent attack moves (T1078 Valid Accounts; ATLAS AML.T0043 LLM Invocations via Stolen API Keys) — hiding orchestration traffic among expected model-traffic patterns and offloading cost onto the victim.

Observed AI-usage indicators (how defenders can tell it was agentic)

  • Parallel LLM calls to multiple frontier AI agents in the same operation.
  • Structured Markdown files passing information between agents and sessions (a machine-readable handoff format, not a human-written note).
  • Custom scripts assessed with high confidence as AI-generated (UI elements in the artifacts), managing dynamic operations.
  • Rapid 401/200 HTTP state shifts, bursty API requests, and parallel authentications — the operator-level telemetry of an agent loop.
  • Redundant overlapping persistence established in parallel: SSH keys, serverless functions, container restart policies, cloud identities, and CI/CD pipelines — a persistence portfolio that is expensive for a human to maintain and test, but cheap for an agent fleet running in parallel.

Defender heuristics (Unit 42's key lessons)

  1. AI agents compress the time between attack steps. Agents that parse raw tool output and immediately take the next step make multi-stage intrusions look like a single burst. Treat a fast, coherent multi-stage internal compromise (recon → secrets → privesc → pipeline → cloud keys) as a single agentic event even when each hop is individually "normal."
  2. Agentic attacks leave recognizable artifacts. Hunt for structured Markdown inter-agent files, Python caches, and paired asset folders on hosts; these are agent scaffolding, not developer work-in-progress.
  3. Expect redundant parallel persistence. When one persistence mechanism is found, assume the agent has planted overlapping ones (SSH keys + serverless + container restart policies + cloud identities + CI/CD) — removal must be synchronized across all operational planes.
  4. Containment must be synchronized, not sequential. Deploy automated playbooks that simultaneously revoke credentials, terminate OAuth sessions, freeze CI/CD pipelines, and isolate cloud accounts across all operational planes — an agent loop will re-pivot through any plane you leave open.
  5. Govern AI as core infrastructure. Inventory every model endpoint, API key, MCP gateway, and AI tool integration; apply strict rate limits, least privilege, and diagnostic logging — the victim's AI estate was both the stolen asset and the post-compromise C2.
  6. Detect the behavioral loop. Hunt for bursty API requests, rapid 401/200 state shifts, parallel authentications, and sudden model-usage volume from unexpected identities — the network signature of an agent loop, distinct from both human operator bursts and legitimate CI traffic.
  7. Lock down DevOps pipelines. Enforce mandatory multi-party code review and immutable branch protection on all infrastructure-as-code repositories — the one control that stopped the Terraform backdoor in this incident.

Confidence and caveats

  • This is a Unit 42 incident-response account of a single enterprise, disclosed in aggregate; no victim identity, sector, or attacker attribution is public.
  • The ransom framing: the attacker stated in negotiations they leveraged frontier AI and agentic frameworks; the post was updated Sep 3 to clarify the AI executed an intrusion in service of a ransom demand, not a ransomware deployment. Treat "AI executed the whole attack" as the operator's claim corroborated by Unit 42's observed TTPs, not as independent proof that a human played no role in any step.
  • The "under 10 hours vs two weeks" comparison is Unit 42's estimate for equivalent human red-team effort; it is a calibration point, not a benchmark.
  • ATLAS mappings (AML.T0000, AML.T0002, AML.T0010, AML.T0014, AML.T0016, AML.T0043) are Unit 42's own mapping of the observed behavior to MITRE ATLAS — use them as the durable vocabulary for "agentic intrusion" detections.

Sources