Wiz Details How AI Agents Are Used in Real-World Intrusions
Summary
Wiz analyzes public reports and three investigations involving agentic attack workflows, identifying patterns such as machine-paced iteration, adaptive scripts, broad probing and self-documenting tools that may offer defenders detection opportunities.
Key points
- Public reports describe ARTEX use in intrusions, including reported exfiltration of personal information from South Korean financial institutions and Microsoft-attributed activity targeting ConnectWise Cloud Backup customers.
- Hunt.io found Hermes agent logs linked to an intrusion at Thailand’s Ministry of Finance, along with compromised systems, web shells, stolen credentials and a custom implant; initial access was unknown, and no data exfiltration evidence was found.
- In one Wiz investigation, an exposed Flowise instance was used to stage exploitation of other instances. Two other cases involved Java RCE and an AI-agent GraphQL backend; the latter led to bulk secret exfiltration and persistence across pods.
- Wiz identifies variable, machine-paced activity, self-documenting scripts and repeated self-correction as possible agentic fingerprints, including scripts generated every one to two minutes during prolonged activity.
- The investigated operations used broad, parallel reconnaissance and probing across services and targets, producing noisy activity that may be useful for detection.
- Wiz cautions that shared and adapted tooling makes attribution from code similarities less reliable, and says defenders need visibility and response processes to correlate activity and contain attacks.
Article Details
- Attack Vectors
- Exploitation of internet-facing applications and APIs, including unauthenticated code execution against exposed Flowise instances.
- AI-assisted scanning for known vulnerabilities and API exploitation, including testing for server-side request forgery.
- Password spraying and OAuth application abuse against downstream Microsoft 365 environments, reported in connection with ARTEX use.
- Cloud and Kubernetes credential theft followed by privilege escalation, lateral movement, persistence, and secret or data exfiltration.
- Compromise of ConnectWise Cloud Backup supply chain, attributed by Microsoft to Storm-0940.
- Defensive Notes
- Correlate noisy, machine-paced activity across systems to distinguish agentic attacks from legitimate automation.
- Monitor for adaptive sequences of reconnaissance, exploitation, cloud credential access, Kubernetes token use, lateral movement, and bulk data access.
- Reduce exposed attack surface, prioritize exploitable risks, and maintain visibility across cloud and other environments.
- Establish containment and remediation workflows in advance; use AI-assisted investigation and response only with adequate visibility and context.
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe article describes bulk secret and data exfiltration, including results sent through an HTTP C2 beacon.T1046 · Network Service DiscoveryThe investigated activity included port scans across multiple hosts and internal-network service discovery.T1059.004 · Unix ShellThe Flowise exploit spawned /bin/sh, and other examples executed shell commands through spawned shells.T1059.006 · PythonWiz described a Python process used in an internal-network scanning attempt for lateral movement.T1071.001 · Web ProtocolsAn example beacon wrapper posted command results to attacker C2 over HTTP.T1110.003 · Password SprayingMicrosoft reported ARTEX-assisted password spraying across downstream Microsoft 365 environments.T1190 · Exploit Public-Facing ApplicationAttack A exploited an exposed Flowise instance through an unauthenticated API endpoint, resulting in code execution.T1505.003 · Web ShellInvestigators found web shells on compromised systems at Thailand’s Ministry of Finance.T1528 · Steal Application Access TokenThe attacks stole Kubernetes service-account tokens and used them to access cluster resources.T1550.001 · Application Access TokenIn one example, a stolen Bearer token was used to retry access to Kubernetes endpoints.T1552.001 · Credentials In FilesThe article describes probing cloud-credential files and stealing credentials from compromised environments.T1552.005 · Cloud Instance Metadata APIAttack examples queried cloud instance metadata endpoints to obtain temporary role credentials.T1595.002 · Vulnerability ScanningJPCERT/CC reported AI-assisted scanning for known vulnerabilities before exploitation of APIs.T1613 · Container and Resource DiscoveryAttackers enumerated Kubernetes nodes, namespaces, pods, and other container-related resources.
Threat Actors
Storm-0940Microsoft attributed the ConnectWise Cloud Backup supply-chain compromise to Storm-0940 and reported ARTEX-assisted reconnaissance, password spraying, and OAuth application abuse against downstream Microsoft 365 environments.TeamPCPThe article describes TeamPCP as having publicly released the Shai-Hulud malware source code; it says attribution for subsequent campaigns, including activity reusing and extending that code, is suspect.
Malware
Vendors
Microsoftidentifiable information belonging to approximately 67,000 people (Zscaler, CrowdStrike). Separately, Microsoft attributed the ConnectWise Cloud Backup supply-chain compromise to Storm-0940, a China-state-alignedWizThere’s a clear trend emerging across our incident response engagements and threat hunting investigations. Wiz increasingly sees intrusions where AI agents appear to handle much of the hands-on work and potentially
Products
ConnectWise Cloud Backupto approximately 67,000 people (Zscaler, CrowdStrike). Separately, Microsoft attributed the ConnectWise Cloud Backup supply-chain compromise to Storm-0940, a China-state-aligned threat actor, and reported thatFlowiseATTACK A Exposed Flowise - LLM-workflow / AI-agent builder (Node.js) Unauthenticated POST /api/v1/node-custom-function + x-request-from: internal auth bypass; injected JS uses Puppeteer to spawn /bin/sh Turned theMicrosoft 365 Apps for Enterpriseused to accelerate reconnaissance, password spraying, and OAuth application abuse across downstream Microsoft 365 environments. The campaign attempted sign-ins against more than 2,250 tenants, with multiple cases of
Tools
ARTEXFrom ARTEX to Hermes: Agentic Attacks in the WildClaude CodeTheir approaches ranged from a custom harness derived from PentestGPT, with separate supervisor and executor agents, to Claude Code workflows with varying levels of autonomy and delegation.HermesFrom ARTEX to Hermes: Agentic Attacks in the WildPentestGPTTheir approaches ranged from a custom harness derived from PentestGPT, with separate supervisor and executor agents, to Claude Code workflows with varying levels of autonomy and delegation.
Countries
ChinaSeparately, Microsoft attributed the ConnectWise Cloud Backup supply-chain compromise to Storm-0940, a China-state-aligned threat actor, and reported that ARTEX was used to accelerate reconnaissance, passwordJapanAI-assisted API exploitation - Organizations in Japan and abroad.South Koreaactors using ARTEX, an agentic penetration-testing framework, to automate offensive operations. In South Korea, researchers reported exploitation of internet-facing applications at financial institutions and theThailandHermes - Thailand’s Ministry of Finance: Hunt.io discovered attacker-controlled infrastructure containing logs showing the Hermes AI agent running in unattended “YOLO” mode during an intrusion.
Industries
GovernmentCustom agentic workflows - Multiple sectors and countries: CrowdStrike documented four additional threat actors using AI agents in campaigns against healthcare, government, and private-sector organizations.HealthcareCustom agentic workflows - Multiple sectors and countries: CrowdStrike documented four additional threat actors using AI agents in campaigns against healthcare, government, and private-sector organizations.