> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Threat actors are giving AI agents a bigger role in cyberattacks - URL: https://f4n6.co.uk/security-feed/threat-actors-are-giving-ai-agents-a-bigger-role-in-cyberattacks/ - Published: 2026-09-08T15:38:31.000Z - Updated: 2026-09-08T15:38:31.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary Google Threat Intelligence Group's (GTIG) Q3 2026 AI Threat Tracker documents threat actors moving from single AI prompts to multi-step agentic workflows that autonomously execute attack stages — vulnerability scanning, credential harvesting, real-time troubleshooting, and IP rotation — with minimal human involvement. In one Q2 2026 Mandiant incident, a financially motivated actor compromised a victim's cloud infrastructure and used an AI coding chatbot plus agent instructions to build and run a mass credential-harvesting campaign in under six hours, compromising thousands of third-party credentials. GTIG also identified an exposed C2 server running an automated credential-management framework ("Recon") that had become a production dashboard organising more than 23,800 harvested secrets, including cloud and AI service API keys. For EMEA financial services, the operational risk is twofold: your cloud identities and API keys are now the raw material for downstream attacks against you and your counterparties, and attack traffic originating from legitimate cloud IP ranges degrades IP-reputation-based controls. No CVEs are in scope for this item; no verified reference data was resolved, so no CVSS or CISA-KEV states apply. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. This is a threat-trend advisory, not an incident at a client, a specific vulnerability, or a third-party failure with an identified trigger fact. The GTIG findings do not, on the facts provided, create a distinctive obligation under any article in the regulatory reference — the general observation that "attackers exist" or "credentials should be protected" would be true of virtually any security item and is compliance-checkbox padding. Clients should nonetheless read §4 in the context of their existing DORA Art. 17 (ICT-related incident management process) and DORA Art. 24 (digital operational resilience testing — general requirements) programmes, which they already maintain; nothing here changes what they must do under those articles. ## 3\. Technical analysis & attack chain ### Confirmed attack chain — Q2 2026 Mandiant incident (financially motivated actor, cloud compromise) 1. The threat actor compromised the victim organisation's cloud infrastructure. The initial access vector is not specified in the source material. 2. From inside the victim's cloud environment, the actor deployed an autonomous multi-agent framework. 3. Using an AI coding chatbot, a prompt, and agent instructions, the actor planned, built, and executed a mass credential-harvesting campaign in less than six hours. 4. Per GTIG, the agent instructions enabled the AI to autonomously manage the vulnerability scanning pipeline, perform real-time troubleshooting, and execute IP rotation logic without manual intervention. 5. Thousands of third-party credentials were compromised. 6. Because the attacker operated from the victim's own cloud infrastructure, attack traffic passed through legitimate IP addresses — defeating IP-reputation and geo-blocking assumptions. ### Exposed "Recon" C2 server GTIG identified an exposed command-and-control server hosting an automated reconnaissance and credential management framework called "Recon." The exposed directory contained configuration and knowledge files including `AGENTS.md`, `KNOWLEDGE.md`, and `agentic_vuln_research.md`, along with `.openclaw/` and `memory/` directories. Shortly after detection, the exposed directory became a production dashboard used to organise, validate, and manage more than 23,800 harvested secrets in real time, including API keys for cloud and AI services. GTIG characterises this as a transition from "passive, endpoint-focused infostealers to offensive agentic harvesting." ### Espionage actors experimenting with automated frameworks - A PRC-nexus cyber espionage threat actor used Gemini to design a dynamic, automated penetration testing framework intended to observe target state, reason through actions, and execute tasks in unpredictable environments. Planned discovery functions included port scanning and service parsing. GTIG states the activity was limited to framework-building attempts and that GTIG disabled the associated assets. - In a separate case, another PRC-nexus cyber espionage threat actor experimented with AI development tools for an AI-assisted automated exploitation and post-exploitation pipeline. It used **CC Switch** to query Claude, Gemini, or Codex to write custom exploit scripts, generate spear-phishing lures, and debug errors. The operation also involved **Burp Suite** to probe web applications and identify vulnerabilities, and **Phalanx**, an open-source penetration testing framework, for automated exploitation routines. During post-exploitation, **Shai-Hulud** was deployed for command-and-control and credential harvesting. ### Key GTIG assessments - GTIG has **not** observed threat actors deploying fully autonomous pipelines against targets in the wild; adversarial adoption of agentic AI "suggests threat actor use of AI could be evolving towards this use case." GTIG describes "a gradual maturation of tradecraft." - Access to AI services and the compute to run them is itself now tracked threat activity: the cost of premium model access and high-performance compute is a primary barrier to threat actors operationalising AI. **Confidence caveats:** All findings above are single-sourced — they derive from Google/GTIG's Q3 2026 AI Threat Tracker as reported by Help Net Security. The related corpus items (Check Point, CrowdStrike, ESET) corroborate the *direction of travel* — AI-assisted autonomous exploitation, trusted-identity and cloud abuse, malicious AI skills — but not the specific incidents, tool names, or the 23,800-secret figure. Attribution to "PRC-nexus" actors is GTIG's own assessment; no MITRE ATT&CK profile is present in the verified reference data (none was resolved for this item), so treat the attribution as unconfirmed. Verify before enforcement. ## 4\. Mitigation & containment ### P1 — within 24 hours - Hunt for the specific tradecraft, not the actor: audit cloud environments for unexplained AI/agent artefacts — files named `AGENTS.md`, `KNOWLEDGE.md`, `agentic_vuln_research.md`, and directories `.openclaw/` and `memory/` on any internet-exposed or cloud-hosted server. These are the exact artefacts GTIG observed on the exposed Recon C2 server. - Review cloud egress: the Q2 2026 incident ran attack traffic from legitimate victim cloud IPs. Check cloud flow logs and egress NAT patterns for compute instances generating high-volume scanning or authentication traffic inconsistent with their workload. - Rotate and inventory API keys for cloud and AI services. The Recon dashboard managed 23,800+ harvested secrets including cloud and AI API keys — assume long-lived, unrotated API keys are already in someone's dataset. Prioritise keys with no expiry and keys scoped to model inference or compute provisioning. ### P2 — within 72 hours - Enforce egress controls on cloud workloads: default-deny egress from compute roles that do not require outbound internet, and restrict access to AI model endpoints (Anthropic, Google, OpenAI) to approved identities and approved egress paths. This directly addresses the "obtain and maintain access to AI tools" requirement GTIG identifies as a barrier — deny attackers free use of your compute and your API spend. - Set billing and usage anomaly alerts on AI service consumption (tokens, API calls, model endpoints) — unexpected model usage is a leading indicator of an actor using your environment to operationalise AI. - Review third-party credential exposure: the Q2 2026 campaign harvested *third-party* credentials from the victim's environment. Map where partner, client, or vendor credentials are stored in your estate and reduce their blast radius. ### P3 — within 7 days - Update threat modelling and purple-team scenarios to include agentic attack patterns: autonomous vulnerability scanning with self-troubleshooting, IP rotation logic, and multi-step credential harvesting executed in hours rather than weeks. Existing detection assumptions built on slow, human-paced attacker behaviour will not hold. - If your organisation deploys AI agents internally, apply the ESET-corroborated lesson: audit the skills/plugins those agents can invoke, since malicious skills can abuse agent capabilities to steal data or execute malware (single-sourced to ESET's H1 2026 report; verify before enforcement). - Brief fraud and payments teams: harvested third-party credentials and API keys feed downstream account takeover and fraud flows; retrospective review of recent authentication anomalies is warranted. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The sources describe no domains, IPs, hashes, or network indicators for the described activity. The file and directory names below are artefacts observed by GTIG on a threat actor's server, not on victim machines — they are hunting leads, not atomic IOCs, and are therefore presented as behavioural indicators. ### Behavioural indicators | Behaviour | Where to observe | Confidence | | ---------------------------------------------------------------------------------------- | ------------------------------------------------------------------- | ----------------------------------------------------------- | | Presence of AGENTS.md, KNOWLEDGE.md, agentic\_vuln\_research.md files | Internet-exposed servers, cloud storage buckets, web roots | High — directly observed by GTIG on exposed Recon C2 server | | .openclaw/ and memory/ directories on exposed infrastructure | Exposed file shares, misconfigured web directories, cloud instances | High — directly observed by GTIG | | Credential-harvesting/scanning traffic originating from legitimate cloud IP ranges | Cloud flow logs, egress NAT, downstream victim logs | High — confirmed in Mandiant Q2 2026 IR case | | Rapid, high-volume vulnerability scanning with automated troubleshooting and IP rotation | Web/application firewall logs, scanning detection, auth logs | Medium — described by GTIG as agent-enabled capability | | Use of CC Switch to query Claude/Gemini/Codex for exploit script generation | Egress logs to AI model endpoints from compromised environments | Medium — observed in PRC-nexus espionage experimentation | | Shai-Hulud deployed for C2 and credential harvesting post-exploitation | EDR process telemetry, C2 beaconing patterns | Medium — single GTIG case; verify before enforcement | ## 6\. Detection ```yara rule AT_Agentic_C2_Framework_Config_Files { meta: author = "Adverse Trace" date = "2026-09-08" reference = "https://www.helpnetsecurity.com/2026/09/08/ai-agents-cyberattacks-automation-google-research/" description = "Detects configuration and knowledge files observed by GTIG on an exposed agentic credential-harvesting C2 server (Recon framework). Hunts for the artefact filenames on disk; intended for exposure audits of web roots and cloud storage, not endpoint malware scanning." strings: $f1 = "AGENTS.md" ascii $f2 = "KNOWLEDGE.md" ascii $f3 = "agentic_vuln_research.md" ascii $d1 = ".openclaw" ascii $d2 = "memory/" ascii condition: 3 of them } ``` Note: this rule targets filenames observed on the *threat actor's* infrastructure. Its defensive value is auditing your own internet-exposed surfaces for accidentally exposed agent configuration — the same exposure class GTIG found. It will not detect agent activity on a compromised host unless the actor deployed a similar framework there. No Sigma rule is authored: the sources describe behaviours (scanning, credential harvesting, AI endpoint queries) but provide no specific process names, command lines, registry keys, or event IDs to key on. A Sigma rule built from generic descriptions would be padding. ## 7\. Sources - Help Net Security — *Threat actors are giving AI agents a bigger role in cyberattacks* — https://www.helpnetsecurity.com/2026/09/08/ai-agents-cyberattacks-automation-google-research/ — 2026-09-08 - Help Net Security — *AI used to help plan the break-in, now it's doing the break-in* (Check Point AI Security Report 2026) — https://www.helpnetsecurity.com/2026/07/15/check-point-ai-security-report-2026/ — 2026-07-15 - Help Net Security — *Suppliers, logins, and AI tools are all becoming attack paths* (CrowdStrike 2026 Threat Hunting Report) — https://www.helpnetsecurity.com/2026/08/06/crowdstrike-cyber-threat-trends-report/ — 2026-08-06 - Help Net Security — *Thousands of malicious AI skills found capable of stealing data, running malware* (ESET H1 2026 Threat Report) — https://www.helpnetsecurity.com/2026/07/08/eset-ai-threat-trends-report/ — 2026-07-08 ## 8\. Adverse Trace position This is a trend advisory, not an active incident: severity is assessed as **elevated but not emergent** — GTIG explicitly states it has not yet observed fully autonomous attack pipelines deployed in the wild, and we will not inflate beyond that. The concrete near-term risk to EMEA financial services is credential and API-key exposure feeding downstream fraud and account takeover, plus the erosion of IP-reputation controls as attackers operate from legitimate cloud infrastructure; the medium-term risk is a compression of attack timelines from weeks to hours as agentic tradecraft matures. All incident detail is single-sourced to Google/GTIG and the PRC-nexus attributions are unconfirmed without MITRE profiles in the verified reference data — verify before enforcement. We will monitor for the full GTIG Q3 2026 AI Threat Tracker publication and any independent corroboration of the Recon framework, the CC Switch/Shai-Hulud pipeline, and the 23,800-secret dataset, and will issue a follow-up advisory if atomic IOCs or victim-sector detail emerges. --- [Read the original source →](https://www.helpnetsecurity.com/2026/09/08/ai-agents-cyberattacks-automation-google-research/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*