Symantec Details AI-Assisted Intrusion and Rapid Lateral Movement at U.S. Retailer
Summary
Symantec says AI-assisted scripts helped attackers progress through a September 2026 U.S. retailer intrusion, including lateral movement via SolarWinds Orion’s RabbitMQ component. No data theft or encryption was observed; the AI model was unidentified.
Key points
- Symantec assessed with high confidence that attackers used AI assistance; script timing suggested a human operator relayed output to an AI tool, with moderate confidence.
- After error-prone commands repeatedly failed, attackers submitted long, structured PowerShell scripts with no typing errors and comments resembling model reasoning.
- About 10 minutes after querying SolarWinds Orion, attackers used its bundled Erlang tools and a stolen RabbitMQ shared secret to run commands on another server.
- Attackers searched point-of-sale synchronization scripts and configuration files for credentials, and collected registry hives and other credential material.
- The intrusion involved DLL sideloading, web shells, EfsPotato privilege escalation, and the BreakChain process-tree utility.
- The initial access method is unknown. The article reports no observed data theft or encryption and does not identify the AI model or service.
Article Details
- Attack Vectors
- Attackers issued commands through Microsoft SQL Server, likely using its xp_cmdshell feature, on several retailer servers.
- Commands were launched through a compromised IIS web server; attackers also placed ASP web shells in the web application’s images folder.
- Attackers used legitimate signed executables to sideload malicious DLLs.
- EfsPotato was built on a server and used to exploit the Windows Encrypting File System RPC interface to run commands as SYSTEM.
- Attackers took the RabbitMQ Erlang cookie bundled with SolarWinds Orion and used Orion’s erl.exe to execute an operating-system command on a second web server.
- Attackers searched point-of-sale scripts and application configuration files for credentials, then used acquired SQL logins to access remote database servers.
- Defensive Notes
- Symantec states that its Endpoint products detect and block a malicious file when the file is available to them.
- Symantec directs readers to its Protection Bulletin for the latest protection updates.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 103[.]79[.]79[.]120 | Listed as part of a Yuze infrastructure cluster. |
| IPV4 | 103[.]79[.]79[.]191 | Listed as part of a Yuze infrastructure cluster. |
| IPV4 | 108[.]165[.]20[.]205 | Later staging server used to deliver sqlrun2.ps1. |
| IPV4 | 154[.]81[.]37[.]136 | Fallback host used to deliver server.ps1. |
| IPV4 | 155[.]254[.]22[.]215 | Address tested for outbound connectivity; a separate public report identified it as a staging and command server and AI console, though a link between the operations is only suggested. |
| IPV4 | 166[.]0[.]25[.]106 | Host for the AES-encrypted reverse shell; the shell connected back to this address on port 443. |
| IPV4 | 204[.]194[.]49[.]129 | Payload-staging server used to deliver files for the retailer intrusion. |
| IPV4 | 43[.]208[.]224[.]101 | Listed as part of a Yuze infrastructure cluster. |
| IPV4 | 8[.]219[.]82[.]21 | Listed as part of a Yuze infrastructure cluster. |
| SHA256 | 3d79628bf7804dbf17e7b396ecd62ebf5d66518940c6d23daccf59a20953438a | Hash of BreakChainCs.exe, a process-tree-breaking launcher used by the attackers. |
| SHA256 | 54fb493822bcd832f7b2256015f13e3dfde815e1931e7fd39a90ea8ad3fdbd0a | Hash of server.ps1, identified as the AES-encrypted PowerShell reverse shell. |
| SHA256 | 5db5e7f655c4ee94411df8110d1b6d02bb15574ac199fa7a553ce6c3cb25bf03 | Hash of ch.exe, identified as the Chisel tunnelling tool detected on the compromised web server. |
| SHA256 | 7265d69dd8d8939dc888ce5f05190ce200ee2660f928f3b84f60e6a7b3383205 | Hash of ask.dll, identified as a malicious DLL in the second sideloading set. |
| SHA256 | 9c866c403e6bd5778fa3788cac9aac39aab1bf2d18a22c9999a4c27e30c0abf3 | Hash of log.dll, identified as a malicious DLL used in sideloading. |
| SHA256 | c21e4fb40f871e418def63a5cdf3603ed4c3c6d1b218710db8ba45538b66fa01 | Hash listed for a malicious DLL. |
| SHA256 | e95a265bf220a4330f77f842b3eeed8b1ed8c61f51d7e3f2fd33bac14b6b26af | Hash of log.dll, identified as a malicious DLL used in sideloading. |
| SHA256 | f8b67854d119da08c704b78f7c9fae0501417f5e63ffece86d2e811f1c7dea68 | Hash of Yuze, identified as a reverse-proxy tool used in an earlier intrusion. |
| URL | hxxp[:]//103[.]79[.]79[.]191/yuze | Yuze-related URL listed with the article’s network indicators. |
| URL | hxxp[:]//108[.]165[.]20[.]205:8080/sqlrun2.ps1 | URL used to deliver a PowerShell script from a later staging server. |
| URL | hxxp[:]//154[.]81[.]37[.]136/server.ps1 | Fallback URL used to deliver the attackers’ PowerShell reverse-shell script. |
| URL | hxxp[:]//166[.]0[.]25[.]106/filemanager.asp | URL associated with an ASP web shell placed on the compromised web server. |
| URL | hxxp[:]//166[.]0[.]25[.]106/server.ps1 | URL used to deliver the attackers’ PowerShell reverse-shell script. |
| URL | hxxp[:]//204[.]194[.]49[.]129:8080/ASK.exe | URL used to deliver the executable in the attackers’ second sideloading set. |
| URL | hxxp[:]//204[.]194[.]49[.]129:8080/bdreinit.exe | URL used to deliver the legitimate executable attackers paired with a malicious DLL for sideloading. |
| URL | hxxp[:]//204[.]194[.]49[.]129:8080/log.dll | URL used to deliver a malicious DLL for sideloading. |
| URL | hxxp[:]//204[.]194[.]49[.]129:8080/log.txt | URL used to deliver the text file containing the sideloaded payload. |
| URL | hxxp[:]//204[.]194[.]49[.]129:8080/qwdajhsd.asp | URL associated with an ASP web shell staged by the attackers. |
MITRE ATT&CK
T1003.002 · Security Account ManagerAttackers saved SAM registry hives and queried SAM-related data to obtain local password hashes.T1003.004 · LSA SecretsAttackers saved the SECURITY hive and queried LSA-secret locations to collect credential material.T1046 · Network Service DiscoveryAttackers scanned more than a dozen internal hosts for SQL Server, SMB, RDP, and WinRM ports.T1053.005 · Scheduled TaskAttackers in other reported cases created scheduled tasks to maintain access.T1059.001 · PowerShellAttackers ran long PowerShell scripts for discovery, credential collection, downloads, and other commands.T1068 · Exploitation for Privilege EscalationAttackers used EfsPotato, which abuses the Windows Encrypting File System RPC interface to run commands as SYSTEM.T1070.006 · TimestompIn the Vietnam university intrusion, attackers changed file dates to cover their tracks.T1078 · Valid AccountsAttackers used SQL logins and passwords they had collected; an xp_cmdshell command ran after one login succeeded.T1105 · Ingress Tool TransferAttackers downloaded executables, DLLs, text payloads, and PowerShell scripts from staging hosts.T1110.003 · Password SprayingA password-spraying operation tested credential pairs against a web service and later against an external database server.T1505.003 · Web ShellAttackers wrote ASP web shells into the compromised web application’s images folder.T1552.001 · Credentials In FilesAttackers searched point-of-sale scripts, application configuration files, and client settings for stored credentials.T1552.006 · Group Policy PreferencesIn a reported attack, the operators searched SYSVOL for Group Policy Preferences cpassword values.T1562.001 · Disable or Modify ToolsIn a separate reported attack, operators shut down security software.T1574.002 · DLL Side-LoadingAttackers paired legitimate executables, including bdreinit.exe and ask.exe, with malicious DLLs for sideloading.
CVE
Vendors
Microsoftworked across its internet-facing web server and at least six further servers, most of which ran Microsoft SQL Server. They searched point-of-sale synchronization scripts for stored passwords, which may indicateSolarWindsin tactics led to a breakthrough for the attackers. About 10 minutes after first querying the victim's SolarWinds Orion monitoring software, the attackers had used a component bundled with it to run commands on aSymantecThis is one of dozens of AI-assisted attacks that Symantec has investigated since May 2026. The majority of this activity occurred in September, so the pace of these attacks has picked up sharply.
Products
FileZilla Serverit. The attackers collected credentials from the web server, including: connection strings; the FileZilla Server user database; FileZilla, WinSCP and PuTTY client settings; saved RDP files; IIS configuration, andIISa utility called BreakChain, which relaunches a target so that it no longer appears as a child of the IIS worker process (w3wp.exe). It offers five launch modes and the attackers used two, the WMI and shell modes.LAPSdomain account, and searched SYSVOL for Group Policy Preferences cpassword values and Active Directory for LAPS (Local Administrator Password Solution) passwords. They also tried a short list of candidate passwords forMicrosoft SQL Serverworked across its internet-facing web server and at least six further servers, most of which ran Microsoft SQL Server. They searched point-of-sale synchronization scripts for stored passwords, which may indicate aMicrosoft Windowssideloading. DLL sideloading is a technique where the attackers use the DLL search order mechanism in Windows to plant and then invoke a legitimate application that executes a malicious DLL payload.PuTTYthe web server, including: connection strings; the FileZilla Server user database; FileZilla, WinSCP and PuTTY client settings; saved RDP files; IIS configuration, and Windows logon registry values.RabbitMQThe next step was lateral movement. The attackers identified the RabbitMQ message broker that ships with Orion and read its Erlang cookie file (.erlang.cookie): the shared secret that Erlang nodes use to authenticate toSolarWinds Oriontactics led to a breakthrough for the attackers. About 10 minutes after first querying the victim's SolarWinds Orion monitoring software, the attackers had used a component bundled with it to run commands on a secondWinSCPfrom the web server, including: connection strings; the FileZilla Server user database; FileZilla, WinSCP and PuTTY client settings; saved RDP files; IIS configuration, and Windows logon registry values.Zabbix Agentinstallation, queried its local SQL Server instance for the table of monitored nodes, and read the Zabbix agent's pre-shared key. Using SQL logins and passwords that they already held, they connected to two remote
Tools
BreakChainAfter repeated terminations, the attackers deployed a utility called BreakChain, which relaunches a target so that it no longer appears as a child of the IIS worker process (w3wp.exe). It offers five launch modes andChiselActivity resumed on a larger scale on September 25. On Computer 4, the security product detected a Chisel tunnelling tool, and the attackers ran a PowerShell download cradle to fetch a script, sqlrun2.ps1, fromEfsPotatowhich was decoded with Certutil and compiled with the .NET C# compiler, csc.exe. The source was EfsPotato, a publicly available exploit that abuses the Windows Encrypting File System RPC interface to runGodPotatoa web shell or SQL Server, a privilege escalation tool from the Potato family such as PrintSpoofer, GodPotato or EfsPotato, registry hive dumps and, in some, a tunnelling tool such as Chisel. In all cases, AIPrintSpooferfiles and changed file dates to cover their tracks. They next made six failed attempts to download PrintSpoofer, a public tool that gives attackers full control of a Windows machine. When direct downloads failed,Yuzeserver used in August was the same one used against the retailer, and a reverse proxy tool known as Yuze also appeared on a host at that organization.