Researchers link AI-assisted intrusions to ransomware affiliates

Affiliates of the INC and The Gentlemen ransomware groups used artificial intelligence (AI) systems to execute live network intrusions while human operators reviewed each step, according to SOCRadar findings reported by The Hacker News on October 23.

The operation exploited vulnerabilities in internet-facing remote-access and hosting systems, then moved through networks, stole data and progressed toward ransomware deployment, the report said. An examination of exposed infrastructure revealed 8,257 messages across 133 sessions.

The report estimated that 62 organizations were targeted; that is not a count of confirmed compromises. Four organizations appeared on the two ransomware groups' data-leak sites. More than half of the targets were in the United States, with industrial, manufacturing and energy organizations primarily targeted, followed by healthcare and pharmaceutical organizations.

SOCRadar describes human approval and access through reused passwords

The reported workflow was not an independently operating attacker. A human supplied instructions specific to a target and reviewed every step, while AI systems executed the intrusion actions. SOCRadar also said the operators used AI-managed records to track targets, stolen credentials and campaign progress.

SOCRadar identified credential reuse as the main way the attackers expanded their access. In one case, a single reused password opened access to a virtual private network, servers, remote monitoring and management tools, backups and security-management platforms. The same password therefore connected systems that otherwise required separate access.

The operators also tried to disable security products, but their own logs recorded mixed results against enterprise endpoint detection and response software, which monitors computers for attacks, according to SOCRadar.