Security Now Examines AI-Driven Intrusions, Ledger Wallet Implants and ECDSA Curve Origins
· 2:31:36 · Watch on YouTube ↗
Summary
Security Now discusses Unit 42's report of an AI-assisted enterprise intrusion, Ledger wallet implants that stole recovery phrases, and Microsoft's record patch cycle, alongside claims about AI tracing ECDSA curve origins.
Key points
- Unit 42 reported that an attacker used AI agents to compromise an unnamed enterprise in fewer than 10 hours, compressing work it estimated would take multiple human red teams about two weeks.
- The reported intrusion began through a publicly accessible web service. Agents mapped internal services, harvested hardcoded credentials and obtained administrative secrets.
- Attackers reportedly abused CI/CD workflows to extract cloud keys and used the victim's AI infrastructure for further operations. Branch protection blocked attempted Terraform backdoors.
- Unit 42 recommended synchronized credential revocation and containment, inventories of AI endpoints and keys, least privilege, behavioral monitoring and mandatory infrastructure-code reviews.
- Ledger described a coordinated hardware-tampering operation involving genuine devices redistributed through resellers. Hidden implants captured recovery phrases during setup and transmitted them over mobile networks.
- Ledger advised recent CryptoBillis buyers not to initialize devices and affected users to consider moving assets to a new signer with a new seed. The transcript notes that blockchain records alone cannot establish where keys leaked.
- Citing Bleeping Computer, the episode reports 1,411 Microsoft Patch Tuesday fixes and experimental risk cohorts for organizing updates. Microsoft also acknowledged a Smart App Control activation issue affecting some Windows 11 devices.
Article Details
- Topics
- [11:22] Microsoft's AI-assisted vulnerability discovery and record Patch Tuesday updates
- [25:43] Experimental risk cohorts for organizing enterprise patch deployment
- [46:43] Unit 42's investigation of an AI-assisted enterprise extortion intrusion
- [57:09] Agentic attack detection, persistence and synchronized containment
- [01:16:15] Ledger hardware-wallet implants, recovery phrase theft and reseller risks
- Windows 11 Smart App Control activation issue and registry workaround
- AI-assisted investigation of ECDSA curve parameter origins
MITRE ATT&CK
T1098.004 · SSH Authorized KeysUnit 42 described overlapping persistence established through SSH keys, alongside other cloud and pipeline mechanisms.T1190 · Exploit Public-Facing ApplicationUnit 42 reported that the attacker breached a publicly accessible web service to enter the enterprise network.T1200 · Hardware AdditionsLedger described genuine hardware wallets fitted with hidden components that captured recovery phrases during setup and transmitted them over mobile networks.T1552.001 · Credentials In FilesAI subagents reportedly searched enterprise code repositories for hardcoded tokens and service passwords.T1555 · Credentials from Password StoresThe attacker reportedly used exposed tokens to access a secrets management system and harvest master administrative credentials.