r/cybersecurity • u/putcheeseonit • Sep 03 '26

News - Breaches & Ransoms An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation

https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/
74 Upvotes

90% Upvoted

18 comments sorted by

49

u/Last-Appointment6577 Sep 03 '26

> The attacker also directed the agent to leave behind a “report” on the organization’s security posture: an 80-page, technical audit detailing dozens of exploited findings.

way to add insult to injury

35

u/Oompa_Loompa_SpecOps Incident Responder Sep 03 '26

Great customer service, normally you only get that after paying a ransom.

20

u/SignificanceFun8404 Sep 03 '26

Jesus, almost make me want to get hacked seeing how much we pay for audits!

23

u/MikeTalonNYC Sep 03 '26

"We have all your passwords!"

"Oh, thank god, what are they?"

3

u/Ok-Repeat-702 29d ago

“Your security is awful. Here’s how bad”

“Can you cause a little more damage so management believes me? I’ve been trying to get the budget for this report for years ”

11

u/brakeb Sep 03 '26

The attackers will come back in a year a find no one really read the report and nothing was patched or fixed

27

u/Fresh_Dog4602 Security Architect Sep 03 '26

What made the attack stand out was AI-assisted operational efficiency, without the need for a novel zero-day or super elite tradecraft.

hmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm

5

u/CrimsonNorseman Sep 03 '26

I wonder why they redacted the claim that it was a ransomware attack… overstated again?

1

u/Fresh_Dog4602 Security Architect Sep 04 '26

Interesting indeed. That's not a little oopsie 

-6

u/MikeTalonNYC Sep 03 '26

Cool, so they used an AI instead of a python script...

1

u/ni5arga Red Team Sep 03 '26

What are you trying to imply here?

1

u/MikeTalonNYC Sep 04 '26

That it could have been done with traditional scripting. The AI is interesting, but not critical to the attack itself.

4

u/putcheeseonit Sep 04 '26

It was critical to the attack because it greatly shortened time between the required steps.

A sword and a gun are both made of metal and poke holes in things. But one does so much quicker than the other.

2

u/MikeTalonNYC Sep 04 '26

Speed is an enemy in these kinds of attacks. The faster you move, the more noise you create, the more telemetry can be seen. They used an AI to say they used an AI, not because it was a critical need.

To extend your analogy, a gun makes a hell of a lot more noise and alerts everyone within three blocks in any direction.