Wiz: agentic AI intrusions rising — ARTEX, Hermes and custom harnesses drive machine-speed cloud compromise
Wiz reports a clear trend across its incident response and threat hunting engagements: intrusions where AI agents perform most hands-on work and may orchestrate the attack, while a human sets objectives. These operations start from a single exposed service and expand into cloud credential theft, Kubernetes service-account token theft, lateral movement and bulk secret exfiltration at machine speed. Wiz reviews public cases — ARTEX used against South Korean financial institutions (~67,000 people's PII exfiltrated, per Zscaler and CrowdStrike) and in the ConnectWise Cloud Backup supply-chain compromise attributed by Microsoft to Storm-0940 (sign-in attempts against 2,250+ Microsoft 365 tenants, privileged access in under three hours), the Hermes agent running unattended "YOLO" mode inside Thailand's Ministry of Finance (Hunt.io), AI-assisted API/SSRF exploitation in Japan (JPCERT/CC), four additional actors with custom harnesses derived from PentestGPT or Claude Code (CrowdStrike), and an unattributed agentic breach at DIVD. Wiz then details three of its own cases and distils seven fingerprints of agentic activity. The report warns that tooling-based attribution is weakening, while agentic noise is a detection opportunity.
Detalhes técnicos
Wiz's seven fingerprinting criteria: (1) machine-paced sustained iteration — e.g. 99 bespoke scripts over ~24h, 602 unique steps over ~4.5h, 150+ scripts over ~21h, with variable LLM-like latency; (2) natural-language reasoning embedded in tooling — scripts opening with written attack plans (originals in Chinese), 803 human-readable comment lines, and commentary referencing "the other " running in parallel; (3) self-correction — versioned scripts explaining why v1 failed, re-deriving regional STS signing requirements after 401s; (4) breadth-first near-complete TTP coverage — recon → IMDS → container breakout → Kubernetes RBAC → RabbitMQ → Hazelcast → ArgoCD → InfluxDB; (5) verbosity — parallel port sweeps across hosts, 100+ ArgoCD hostname variants, /24 scans for 5432, ~25 target orgs (crypto exchanges, fintechs) in parallel; (6) probe-before-payload and OPSEC wrappers — harmless markers before real RCE, base64 beacon wrappers truncating output, tight timeouts, blending exfil into normal AWS egress; (7) disposable, purpose-descriptive artifacts — /tmp and /dev/shm scratch scripts, self-labeled IOCs such as a /stdio-rce-a endpoint and RabbitMQ global parameters named after the C2 IP. Observed techniques include unauthenticated Flowise RCE (POST /api/v1/node-custom-function, fetch-links SSRF, path traversal), IMDSv1/IMDSv2 and ECS credential endpoint abuse, Kubernetes SelfSubjectRulesReview and secret dumping, and node-role credential exchange for system:node cluster tokens.
Remediação
Wiz argues defenders should weight victimology, targeting patterns, infrastructure and objectives over tool/code similarity for attribution, and invest in behavioural detections and deep cloud/Kubernetes visibility able to separate agentic attack noise from legitimate automation, correlating individual signals into a coherent attack picture fast enough to respond before escalation.
Linha do tempo
-
Wiz: agentic AI intrusions rising — ARTEX, Hermes and custom harnesses drive machine-speed cloud compromise
ler a análise desta fonte ocultar
Wiz reports a clear trend across its incident response and threat hunting engagements: intrusions where AI agents perform most hands-on work and may orchestrate the attack, while a human sets objectives. These operations start from a single exposed service and expand into cloud credential theft, Kubernetes service-account token theft, lateral movement and bulk secret exfiltration at machine speed. Wiz reviews public cases — ARTEX used against South Korean financial institutions (~67,000 people's PII exfiltrated, per Zscaler and CrowdStrike) and in the ConnectWise Cloud Backup supply-chain compromise attributed by Microsoft to Storm-0940 (sign-in attempts against 2,250+ Microsoft 365 tenants, privileged access in under three hours), the Hermes agent running unattended "YOLO" mode inside Thailand's Ministry of Finance (Hunt.io), AI-assisted API/SSRF exploitation in Japan (JPCERT/CC), four additional actors with custom harnesses derived from PentestGPT or Claude Code (CrowdStrike), and an unattributed agentic breach at DIVD. Wiz then details three of its own cases and distils seven fingerprints of agentic activity. The report warns that tooling-based attribution is weakening, while agentic noise is a detection opportunity.
Technical Details
Wiz's seven fingerprinting criteria: (1) machine-paced sustained iteration — e.g. 99 bespoke scripts over ~24h, 602 unique steps over ~4.5h, 150+ scripts over ~21h, with variable LLM-like latency; (2) natural-language reasoning embedded in tooling — scripts opening with written attack plans (originals in Chinese), 803 human-readable comment lines, and commentary referencing "the other " running in parallel; (3) self-correction — versioned scripts explaining why v1 failed, re-deriving regional STS signing requirements after 401s; (4) breadth-first near-complete TTP coverage — recon → IMDS → container breakout → Kubernetes RBAC → RabbitMQ → Hazelcast → ArgoCD → InfluxDB; (5) verbosity — parallel port sweeps across hosts, 100+ ArgoCD hostname variants, /24 scans for 5432, ~25 target orgs (crypto exchanges, fintechs) in parallel; (6) probe-before-payload and OPSEC wrappers — harmless markers before real RCE, base64 beacon wrappers truncating output, tight timeouts, blending exfil into normal AWS egress; (7) disposable, purpose-descriptive artifacts — /tmp and /dev/shm scratch scripts, self-labeled IOCs such as a
/stdio-rce-aendpoint and RabbitMQ global parameters named after the C2 IP. Observed techniques include unauthenticated Flowise RCE (POST /api/v1/node-custom-function, fetch-links SSRF, path traversal), IMDSv1/IMDSv2 and ECS credential endpoint abuse, Kubernetes SelfSubjectRulesReview and secret dumping, and node-role credential exchange forsystem:nodecluster tokens.Remediation
Wiz argues defenders should weight victimology, targeting patterns, infrastructure and objectives over tool/code similarity for attribution, and invest in behavioural detections and deep cloud/Kubernetes visibility able to separate agentic attack noise from legitimate automation, correlating individual signals into a coherent attack picture fast enough to respond before escalation.