Agentic Attacks Begin to Remove Humans From Parts of the Kill Chain
Summary
Intrinsec cites reports of agents automating parts of cyberattacks, including a reported campaign against 27 firms, Android malware PROMPTSPY, LLM-based C2 malware CLOSEDQUORUM, and cloud privilege escalation; it calls for AI-assisted defense and resilience.
Key points
- Gambit Security analyzed a campaign using the Strix, Cairn, and Hermes harnesses for vulnerability research, exploitation, and orchestration; the article says 27 firms were compromised and over 600,000 card numbers harvested in five days, followed by an automated database wipe.
- Google Threat Intelligence Group analyzed PROMPTSPY, Android malware whose GeminiAutomationAgent can interpret and interact with the interface; the article describes persistence using accessibility functions and the Recent Apps menu.
- Cisco Talos detected CLOSEDQUORUM, a Go malware that uses a plurality vote among DeepSeek, Gemini, and Mistral models to select actions. Its calls to legitimate AI-provider APIs can make domain blocking ineffective, according to the article.
- A Microsoft report describes Storm-3168, also known as JADEPUFFER, using agents to navigate cloud environments and escalate privileges through compromised service principals.
- Intrinsec argues that agentic attacks are not yet fully autonomous end to end, but could outpace conventional response cycles; it advocates AI-assisted defense and greater business resilience.
Article Details
- Event Type
- Reported use of autonomous AI agents in cyberattacks, including reconnaissance, exploitation, persistence, command and control, and cloud privilege escalation.
- Impact
- According to Gambit Security's analysis, an unnamed cybercrime actor compromised 27 online retailers in five days, collected more than 600,000 payment card numbers, and then automated a database wipe to remove traces. Separate reported examples describe PROMPTSPY using an agent to interact with an Android interface, CLOSEDQUORUM using AI models for C2 decision-making, and Storm-3168 using agents to navigate cloud environments and escalate privileges. The article warns that the speed and persistence of agent-assisted attacks can challenge conventional defenses.
MITRE ATT&CK
T1078.004 · Cloud AccountsStorm-3168 reportedly used compromised cloud service principals while navigating a tenant and escalating privileges.T1102.002 · Bidirectional CommunicationCLOSEDQUORUM reportedly used AI model APIs as part of its C2 decision-making process, blending malicious traffic with legitimate API calls.T1485 · Data DestructionThe unnamed cybercrime actor reportedly automated a wipe of compromised retailers' databases to remove traces.
Threat Actors
JADEPUFFERThe article identifies JADEPUFFER as an alias for Storm-3168, which a Microsoft report described as using agents to navigate cloud environments and escalate privileges via compromised service principals.Storm-3168A Microsoft report described the group using agents to navigate cloud environments and escalate privileges via compromised service principals. The article identifies JADEPUFFER as an alias for Storm-3168.
Malware
CLOSEDQUORUMCisco Talos a détecté CLOSEDQUORUM, un malware où le serveur de commande et contrôle (C2) est remplacé par un « quorum » de modèles (DeepSeek, Gemini, Mistral).PromptSpyGoogle Threat Intelligence Group a analysé PROMPTSPY, un malware Android qui utilise un module baptisé `GeminiAutomationAgent` pour analyser l’interface graphique en temps réel et interagir avec elle, en fonction d’un
Products
DeepSeekCisco Talos a détecté CLOSEDQUORUM, un malware où le serveur de commande et contrôle (C2) est remplacé par un « quorum » de modèles (DeepSeek, Gemini, Mistral).GeminiCisco Talos a détecté CLOSEDQUORUM, un malware où le serveur de commande et contrôle (C2) est remplacé par un « quorum » de modèles (DeepSeek, Gemini, Mistral).MistralCisco Talos a détecté CLOSEDQUORUM, un malware où le serveur de commande et contrôle (C2) est remplacé par un « quorum » de modèles (DeepSeek, Gemini, Mistral).
Tools
Cairnde détaillants en ligne en utilisant trois harnais différents: Strix pour la recherche de vulnérabilités; Cairn pour l’exploitation autonome avec possibilité d’injection automatique d’un skimmer; et Hermes pourHermesCairn pour l’exploitation autonome avec possibilité d’injection automatique d’un skimmer; et Hermes pour l’orchestration.Strixciblage et la compromission de centaines de détaillants en ligne en utilisant trois harnais différents: Strix pour la recherche de vulnérabilités; Cairn pour l’exploitation autonome avec possibilité d’injection