Loading story…
A financially motivated lone attacker used AI-assisted workflows to breach a large AWS environment in roughly 72 hours, according to a Sygnia incident-response report, chaining weaknesses across Internet-facing applications, AWS resources, source code repositories, CI/CD pipelines, runtime components, and data stores. The intrusion reportedly began with the theft of an AWS access key and expanded through secrets harvesting, cloud enumeration, backdoor creation, data exfiltration, deployment pipeline abuse, runtime modification, database access, and operational disruption. To extort the unnamed global enterprise, the actor carried out mostly reversible actions including denying access to S3 buckets, scaling ECS services to zero, blocking network access with ACL rules, and purging SQS queues.
The incident reflects a broader shift from isolated malicious use of generative AI to agentic AI supporting larger portions of the attack chain. Research cited by OALABS and observations from Anthropic indicate attackers are using tools such as Claude and OpenAI Codex to automate reconnaissance, analyze stolen data, generate code, and adapt operations during live intrusions, lowering the barrier for less-skilled actors while helping experienced operators scale activity. Security researchers said the trend now spans multiple MITRE ATT&CK tactics, including reconnaissance, credential theft, malware development, and social engineering, pushing defenders to prioritize detection of AI-enabled workflows, stronger identity controls, broader visibility, and faster automated containment.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
During the AWS intrusion, the attacker carried out mostly reversible disruptive actions to increase extortion pressure, including denying access to S3 buckets, scaling ECS services or containers to zero, creating ACL rules to block network access, and purging SQS queues. Sygnia said the actor also used newly obtained access for secrets harvesting, cloud enumeration, backdoor creation, data exfiltration, deployment pipeline abuse, runtime modification, and database access.
A Sygnia incident-response report described a financially motivated lone attacker using AI-assisted workflows to compromise a large AWS environment in roughly 72 hours and extort an unnamed global enterprise. The intrusion allegedly began with theft of an AWS access key and expanded through chained weaknesses across applications, AWS resources, repositories, CI/CD pipelines, runtime components, and data stores.
Anthropic reported that it had observed increasingly sophisticated misuse of Claude for offensive cyber activity. The article said this misuse now spans tactics including reconnaissance, credential theft, malware development, and social engineering.
OALABS research documented a campaign in which a relatively low-skilled attacker used Anthropic’s Claude and OpenAI Codex to automate reconnaissance, analyze stolen data, and generate code during attacks against multiple organizations. The reporting framed this as evidence of agentic AI being used to automate parts of the cyber attack chain.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesygnia.co
Open sourcedarkreading.com
Open sourceteiss.co.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sysdig reported observing an offensive operation against an **AWS** environment in which a threat actor progressed from initial access to **administrative privileges in under 10 minutes**, with multiple indicators suggesting **large language models (LLMs)** were used to accelerate reconnaissance, code generation, and decision-making. Initial access was obtained via **valid credentials exposed in public S3 buckets**, reportedly associated with AI/RAG-related data and an IAM user used to automate *Amazon Bedrock* tasks via *AWS Lambda*. The actor then escalated privileges via **Lambda function code injection**, moved laterally across **19 AWS principals**, and abused *Amazon Bedrock* in an **LLMjacking** pattern while also provisioning **GPU-capable compute instances** for suspected model-related activity. Dark Reading’s coverage echoed Sysdig’s findings, emphasizing the speed of the compromise, the role of AI as a force multiplier, and post-compromise activity including **data collection/exfiltration** and **GPU instance provisioning**. In contrast, TechTarget’s “must-have security technologies” piece and SecuritySenses’ discussion of borrowing financial risk models for security are **general guidance/trend** articles and do not describe this specific intrusion or provide incident-specific technical details, making them non-contributory to the reported AWS compromise.
Jun 29, 2026Researchers and vendors reported a sharp rise in attacks targeting AI infrastructure, from exposed self-hosted LLM servers to commercial coding assistants used in real intrusions. A Kaspersky honeypot posing as a private AI server with services including **Ollama**, **LM Studio**, **LangServe**, **text-generation-webui**, OpenAI-compatible APIs, RAG databases, and an MCP server was indexed by Shodan within hours and drew more than **113,000 requests** in a month from thousands of IP addresses. Nearly a quarter of the traffic focused on discovering and exploiting AI capabilities, with attackers attempting to consume inference resources, analyze documents, generate content, process vulnerability data, proxy requests to external models, and steal secrets from exposed `.env` files using tooling such as **LLM-Scanner**. The broader threat has moved beyond opportunistic abuse into targeted operations. Anthropic said suspected Chinese state-linked operators misused **Claude Code** against **30 high-value organizations** across technology, finance, chemicals, and government, using the AI assistant to test systems, generate attack code, harvest credentials, identify privileged accounts and backdoors, and support deeper intrusion activity; the company said the tool performed **80% to 90%** of the work in some cases. Separately, defenders were urged to rapidly patch internet-exposed management infrastructure after **CVE-2026-41940** in **cPanel/WHM** was exploited in the wild, allowing pre-authentication root access in as few as four HTTP requests and reportedly being used in ransomware activity, underscoring how exposed services and AI-enabled tradecraft are converging into a faster, more scalable attack model.
Jun 29, 2026
Check Point Research reported that AI use in offensive cyber operations advanced from planning support to direct execution during March and April, with commercial tools such as **Claude Code** appearing in live criminal, ransomware, mass-exploitation, and state-linked espionage activity. The report cites persistent AI-assisted operations tied to the breach of nine Mexican government agencies and the **Bissa Scanner** mass-exploitation platform, and says attackers are increasingly using AI to accelerate reconnaissance, exploitation, and post-compromise actions in ways that closely resemble skilled human operators. The report also identifies new attack surfaces and scaling effects created by enterprise AI adoption. Agentic configuration artifacts including `CLAUDE.md`, hooks, settings files, and MCP-related files were described as targets for jailbreaks, supply-chain compromise, and credential theft, while the **EvilTokens** platform was highlighted for using LLMs to automate token theft, email analysis, business email compromise, and multilingual fraud. Check Point said AI is shrinking the patch window for defenders by speeding flaw discovery and weaponization, pointing to exploitation of an **LMDeploy SSRF** issue within 12 hours of disclosure, while warning that existing victim-side controls remain poorly suited to detecting AI-executed intrusions.
Jun 29, 2026