AI Assisted Attack Enabled Rapid Lateral Movement at US Retailer

A US retailer was the target of an AI-assisted cyberattack in September, according to Symantec’s post-incident analysis shared by Dark Reading. After hand-typed commands were repeatedly blocked, the threat actor used what appeared to be AI-generated scripts to drive a second stage, enabling lateral movement within minutes and the harvesting of credentials.

Symantec notes that the timing of the commands suggested automation rather than purely manual activity, though investigators also observed that the timing could reflect an operator relaying output to an AI tool rather than a fully autonomous agent.

The investigation traces initial access to a Web server and the theft of credentials from configuration files associated with SolarWinds Orion monitoring software. Symantec emphasises that no vulnerability was publicly exploited and no patching was required in this incident, but highlights that AI-facilitated hands-on-keyboard activity is changing attacker tradecraft and accelerating breach timelines.

The firm details that after traditional payloads were repeatedly terminated, attackers submitted long, error-free PowerShell scripts with output sections and comments that read as a model’s reasoning, and roughly ten minutes after querying Orion, lateral movement occurred to a second server. Symantec’s analysis suggests a financially motivated operation, with activity part of a broader pattern of AI-assisted breaches observed since May, concentrated around September.

The report frames AI as a potential catalyst for faster, more scalable attacks, while defenders are urged to monitor for rapid retry patterns and variants following a blocked attempt.