Top Highlights
- AI rescued a stalled cyberattack against a US retailer after the attacker’s hand-typed commands were blocked.
- AI-like PowerShell scripts helped the attacker steal credentials and move to another server within minutes.
- Symantec suspects human-guided AI, and says it has investigated dozens of AI-assisted attacks since May.
- Defenders should flag rapid retries and behavior changes—and prioritize time to mitigate, not just time to patch.
Inside an AI Attack Against a U.S. Retailer
AI Helped Revive a Stalled Intrusion
A cyberattack against an unnamed U.S. retailer changed course after security tools stopped the attacker’s first attempts. In September, the attacker switched from hand-typed commands to long, error-free scripts that appeared to come from an artificial intelligence tool.
Investigators inferred AI use from the scripts’ structure and the speed of the commands. They believe a person likely sent information to an AI tool and used its replies, rather than letting an independent AI agent run the attack.
The shift helped the attacker steal credentials from configuration files for the retailer’s SolarWinds Orion monitoring software. About 10 minutes after querying that system, the attacker reached a second server. This movement between systems, known as lateral movement, can expose more of an organization’s network.
Investigators did not identify how the attacker first entered the network. They also found no evidence that the attacker exploited a software vulnerability. Searches for passwords in point-of-sale scripts suggest a possible financial motive, but the investigation did not establish the attacker’s intent with certainty.
What the Incident Means for Defenders
This case reflects a broader change in how attackers may use AI. Rather than relying only on AI to write phishing messages, they can use it to refine commands during an intrusion. Still, the evidence does not show that AI acted alone. Human direction remained part of the process.
That combination could make attacks faster and help less-skilled criminals overcome failed attempts. For retailers, the stakes reach beyond computer systems: a breach can put payment data and customer trust at risk.
Defenders can watch for unusual behavior, not just known malicious files or commands. For example, a blocked attempt followed by rapid changes to similar commands may deserve urgent review. Faster containment also matters. Patching remains important, but retailers need ways to limit harm while teams investigate and fix weaknesses.
Continue Your Tech Journey
Stay informed on the revolutionary breakthroughs in Quantum Computing research.
Stay inspired by the vast knowledge available on Wikipedia.
CyberRisk-V1
