An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation

Summary

Unit 42 investigated an incident in which a human attacker used frontier AI models and attack-specific agentic AI frameworks to breach an enterprise network autonomously as part of a ransom attack. By shifting execution to an automated loop, the attacker compressed weeks of methodical intrusion tradecraft, using more than 50 MITRE ATT&CK techniques, into less than 10 hours, without needing a novel zero-day or elite tradecraft.^[0]

After gaining initial access through a public API endpoint, agents mapped internal microservices, scraped code repositories for hard-coded tokens, infiltrated the secrets management system to seize root credentials, hijacked CI/CD pipelines to exfiltrate cloud keys, and turned the victim's AI endpoints into post-compromise infrastructure. An attempt to plant backdoors in Terraform configurations was blocked by hard branch-protection controls, and the attacker directed an agent to leave behind an 80-page technical security audit. Unit 42 later clarified that the event was an intrusion, not a ransomware attack.^[0]

Separately, Sysdig reported what it describes as the first documented case of agentic ransomware, attributed to a financially motivated actor it tracks as JadePuffer. That late-June-2026 operation achieved initial access by exploiting the Langflow vulnerability CVE-2025-3248, pivoted to a MySQL and Alibaba Nacos production server, ran more than 600 purposeful payloads, and demonstrated a 31-second failure-to-fix cycle, while a human still provisioned infrastructure, selected the victim and supplied MySQL root credentials from a prior compromise. Together the cases show attackers increasingly applying AI agents to established tradecraft.^[0][6]

Attack chain

1. Infiltration and mapping: In the Unit 42 case the actor breached a public API endpoint to tunnel into the network and deployed an automated recon agent to map internal microservices via network service discovery.^[0]
2. Secrets harvesting: Sub-agents combed enterprise code repositories, extracting hard-coded tokens and service passwords (credentials in files).^[0]
3. Privilege takeover: Using exposed tokens, the actor infiltrated the secrets management system and harvested master administrative credentials to seize root system access.^[0]
4. Pipeline exploitation: The actor hijacked an enterprise code application via custom CI/CD workflows to exfiltrate cloud access keys and attempted to plant backdoors in Terraform configurations, which hard branch-protection controls blocked.^[0]
5. AI infrastructure hijacking: Using stolen cloud keys, the actor invoked the victim's AI endpoints, turning them into post-compromise infrastructure to offload compute cost and hide orchestration traffic.^[0]
6. JadePuffer initial access (related case): In the separately documented Sysdig case, initial access was achieved by exploiting the Langflow vulnerability CVE-2025-3248 before pivoting to a production server running MySQL and Alibaba Nacos.^[6]
7. JadePuffer persistence and impact (related case): The agent deployed a Nacos backdoor, read the resulting error, switched from subprocess calls to direct library imports and redeployed 31 seconds later, running more than 600 purposeful payloads across reconnaissance, credential theft, lateral movement, persistence, encryption, destruction and ransom-note delivery.^[6]

Disclosure timeline

Actor profile

JadePuffer

A financially motivated threat actor tracked by Sysdig with unknown origins and no overlap with established ransomware groups or nation states. In the documented late-June-2026 attack JadePuffer directed an AI agent that drove the extortion operation end-to-end through the model's own decision-making, while a human provisioned the command-and-control and staging infrastructure, selected the victim and supplied MySQL root credentials from a prior compromise. Sysdig has not yet observed operations against other victims but expects repetition given how cheap the operation is to run.^[6]

How it works

In the Unit 42 intrusion the attacker required no novel zero-day; AI agents parsed raw tool output and quickly took next steps, monitoring, evaluating, acting and re-planning in real time to increase speed across the attack chain. Indicators of the AI-driven approach included parallel LLM calls to multiple frontier AI agents, structured Markdown files passing state between agents and sessions, and custom scripts assessed with high confidence to be AI-generated.^[0]

In the related Sysdig case, initial access was achieved by exploiting CVE-2025-3248, a Langflow vulnerability, before pivoting to a MySQL and Alibaba Nacos server. The payloads narrated their objectives in plain language and identified high-value databases, annotations that large-language models add by default, and the agent diagnosed and worked around obstacles, switching from subprocess calls to direct library imports to fix a failed Nacos backdoor deployment within 31 seconds.^[6]

Affected versions and patch status

Indicators of Compromise

Key takeaways

• The Unit 42 investigation shows an attacker who understands how to deploy frontier AI agents can dramatically speed up an attack, compressing weeks of tradecraft into under 10 hours without a novel zero-day, and that AI agents reduce the time between attack steps while leaving recognizable indicators.^[0]
• Attackers can use AI agents to establish redundant, parallel persistence across SSH keys, serverless functions, container restart policies, cloud identities and CI/CD pipelines, and can hijack an organization's own AI tools as post-compromise infrastructure to hide traffic and offload cost.^[0]
• Sysdig assesses the JadePuffer case as the first documented agentic ransomware, driven end-to-end by the model's own decision-making, lowering the skill floor for running a full ransomware operation to the cost of running an agent, though a human still provisioned infrastructure and selected the victim.^[6]

Defensive actions

• Execute synchronized containment via automated playbooks that simultaneously revoke credentials, terminate OAuth sessions, freeze CI/CD pipelines and isolate cloud accounts across all operational planes.: Defending against automated agent loops requires matching the speed of AI-driven attacks that compressed weeks of intrusion into under 10 hours in the Unit 42 case.^[0]
• Govern AI as core infrastructure by inventorying every model endpoint, API key, Model Context Protocol gateway and AI tool integration, and applying strict rate limits, least-privilege policies and diagnostic logging.: The Unit 42 attacker turned the victim's AI endpoints into post-compromise infrastructure using stolen cloud keys, and the JadePuffer agent accessed OpenAI, Anthropic, DeepSeek and Gemini keys.^[0][6]
• Detect behavioral loops such as bursty API requests, rapid 401/200 HTTP state shifts, parallel authentications and sudden model usage from unexpected identities.: Agentic attacks leave recognizable indicators like structured Markdown, Python caches and paired asset folders, and operate in rapid failure-to-fix loops such as the 31-second Nacos backdoor redeploy.^[0][6]
• Lock down DevOps pipelines with mandatory multi-party code reviews and immutable branch protection on all infrastructure-as-code repositories.: In the Unit 42 incident hard branch-protection controls blocked the attacker's attempt to plant automated backdoors in Terraform configurations.^[0]
• Prioritize patching and mitigation of the Langflow vulnerability CVE-2025-3248 on exposed instances and protect and rotate privileged credentials such as database root credentials.: CVE-2025-3248 was the initial access vector for the JadePuffer operation, which then used MySQL root credentials obtained via a prior compromise.^[6]

Changelog

• Revised the characterization of the Unit 42 incident from an AI-assisted ransomware attack to an intrusion, reflecting Unit 42's Sept. 3, 2026 clarification that the attack was an intrusion and not a ransomware attack.^[0]
• Reframed the dossier around the Unit 42 investigation as the primary incident, adding grounded detail that it used more than 50 MITRE ATT&CK techniques, hijacked the victim's AI endpoints as post-compromise infrastructure, and that branch-protection controls blocked an attempted Terraform backdoor.^[0]