A recent cyberattack on a US retail organization has highlighted the growing threat posed by AI-driven attacks. The attack, disclosed by Symantec, occurred in September and involved a threat actor who initially struggled to breach the retailer’s defenses using hand-typed commands. These attempts were blocked, prompting the attacker to switch tactics by deploying AI-generated scripts that enabled rapid lateral movement within the network.
The timing and nature of the commands led investigators to believe that AI was involved. The scripts generated were error-free and sophisticated, suggesting automation rather than manual input. Symantec's investigation, which has studied numerous AI-assisted attacks since May, noted a concentration of such activities in September.
In this incident, the initial access vector was not identified, but the attacker eventually gained access to a web server and extracted credentials from SolarWinds Orion monitoring software. The attacker's actions, including searching for point-of-sale passwords, indicate a possible financial motivation. Symantec noted the potential of AI to transform the cyberattack landscape, allowing even less skilled attackers to execute complex attacks efficiently.
Dick O'Brien, principal intelligence analyst at Symantec, pointed out that AI's ability to test and retry techniques quickly could serve as a pattern for defenders to monitor. The attack underscores the importance of focusing on behavioral blocking rather than relying solely on patching, emphasizing a shift towards reducing mean time to mitigate threats.
