Symantec Details Apparent AI-Assisted Attack on US Retailer
Summary
Symantec says an attacker targeting an unnamed US retailer used apparent AI-generated PowerShell scripts after earlier commands and payloads were blocked, then stole SolarWinds Orion credentials and moved laterally. The initial access vector is unknown.
Key points
- Symantec described a September attack against an unnamed US retail organization; investigators did not identify the initial access vector.
- After hand-typed commands and staged payloads were blocked, the attacker submitted long, error-free PowerShell scripts with labeled outputs and comments resembling model reasoning.
- Investigators said the activity appeared more consistent with an operator relaying output to an AI tool than with an autonomous agent.
- The attacker accessed a web server and stole credentials from configuration files associated with SolarWinds Orion, then moved laterally to a second server.
- Symantec said the incident was among dozens of AI-assisted attacks it investigated since May, with activity concentrated around September.
- Symantec recommended treating blocked attempts followed by variants as high-priority alerts and focusing on behavioral detection; it also highlighted time to mitigate as a measure beyond time to patch.
Article Details
- Victim Organization
- Unnamed US retail organization
- Incident Type
- Cyberattack involving suspected AI-assisted PowerShell activity, credential theft, and lateral movement
- Data Types Exposed
- Credentials and passwords from configuration files
- Operational Impact
- The attacker gained access to a Web server and moved laterally to a second server. Symantec reported that the attacker harvested credentials; the article does not describe broader operational disruption.
- Claim Status
- confirmed