Unit 42 Traces AI-Orchestrated Ransomware Breach to 10-Hour Campaign

Key Takeaways

• A human-directed attacker used frontier AI agents to compress intrusion work that could take two weeks into less than 10 hours.
• The campaign relied on familiar weaknesses, including an exposed API, hard-coded credentials and excessive cloud permissions, rather than a novel zero-day.
• Defenders require synchronized containment across identity, cloud, CI/CD and AI systems to keep pace with automated attack loops.

Palo Alto Networks Unit 42 has investigated a ransomware incident in which a human attacker used frontier AI models and attack-specific agentic frameworks to penetrate an enterprise network in less than 10 hours. The campaign employed more than 50 MITRE ATT&CK techniques and produced an impact comparable to work that multiple red teams might ordinarily conduct over roughly two weeks.

The case, disclosed September 2, illustrates a practical shift in offensive AI. The central issue was not an AI-created zero-day or an entirely new class of malware. Instead, agents handled reconnaissance, credential discovery, privilege escalation and cloud operations in parallel, repeatedly evaluating results and selecting subsequent actions.

AI served as an operational force multiplier, reducing the pauses that typically occur while human operators interpret tool output, coordinate tasks and decide where to move next. A capable attacker remained in charge, but much of the tactical execution moved into automated loops.

Initial access came through a public-facing API endpoint. An automated reconnaissance agent then mapped internal microservices, while sub-agents searched code repositories for hard-coded tokens and service passwords. The exposed credentials provided a route into the secrets management system, where the attacker obtained administrative credentials and root-level access.

From there, the campaign expanded into the software delivery environment. The attacker triggered unauthorized continuous integration and continuous delivery builds and used custom workflows to extract cloud access keys. An attempt to insert backdoors into Terraform configurations failed because immutable branch-protection controls blocked the changes.

Using stolen cloud credentials, the attacker gained access to master keys associated with the victim’s cloud AI infrastructure. The compromised AI endpoints were then repurposed as post-compromise resources, allowing the actor to run additional operations using the victim’s compute capacity and potentially blend orchestration calls into legitimate model traffic.

Enterprise AI services are increasingly becoming part of the attack surface and, after compromise, part of the attacker’s infrastructure. Security teams that inventory conventional servers and cloud accounts but overlook model endpoints, Model Context Protocol gateways and AI API keys create blind spots that allow automated exploitation.

Investigators observed several artifacts consistent with agentic execution. These included parallel calls to multiple frontier models, structured Markdown files used to transfer information between agents and sessions, Python caches, paired asset folders and custom operational scripts assessed with high confidence as AI-generated. The attacker also instructed an agent to leave an 80-page technical audit documenting dozens of exploited findings.

The 80-page audit demonstrates that the same systems used to conduct an intrusion can document it at machine speed.

The incident aligns with a wider acceleration in cyber operations. Across 750 high-stakes incidents, Unit 42 reported that AI-driven automation increased attack speed fourfold year over year, with its fastest cases progressing from initial access to data exfiltration in about 72 minutes. Separately, ENISA found that more than 80% of phishing emails observed between September 2024 and February 2025 contained AI-generated content.

Even so, widespread autonomous malware remains less mature in actual deployments. An August 2026 analysis covered 405 AI-enabled malware samples, finding only 12 in production telemetry. The nearer-term risk is more grounded: attackers are applying AI to known techniques faster, at greater scale and with less manual coordination.

For defenders, speed becomes an architectural requirement. Automated containment playbooks can revoke credentials, terminate OAuth sessions, freeze CI/CD pipelines and isolate cloud accounts together, rather than waiting for separate teams to act sequentially. Behavioral monitoring should also look for bursty API activity, rapid shifts between HTTP 401 and 200 responses, parallel authentication attempts and unexpected model usage.

The broader design principle reflects the compromised-identity assumptions in NIST SP 800-207. Least-privilege access, short-lived credentials, segmented administrative paths and strong verification limit what an automated agent achieves after one account is compromised. Multi-party code review and immutable branch protections provide critical secondary defenses during rapid automated attacks.