Cybersecurity researchers have identified an intrusion where an unknown threat actor utilized a PowerShell script, suspected to be generated by artificial intelligence (AI), to perform extensive enumeration of an Active Directory (AD) environment.
The attack commenced with the adversary gaining Remote Desktop Protocol (RDP) access to a domain-joined Windows Server using previously compromised credentials. Once inside, the attacker deployed tools within the “C:\ProgramData\” directory, including the AI-generated PowerShell script designed for AD reconnaissance.
This script was notably aggressive and verbose, employing a multi-step approach to locate the Domain Controller (DC) and systematically map users, computers, groups, organizational units (OUs), and trusts. The collected data was then stored in a designated directory, culminating in the creation of an HTML report summarizing the enumeration results.
Approximately 30 minutes after the initial enumeration, the attacker introduced additional tools: ‘s5cmd’, a legitimate utility for bulk file operations, and ‘SharpShares’, a C#-based tool for network share enumeration. These tools were used to identify accessible data repositories within the network.
In the final phase, the gathered data was compiled into CSV files, archived, and exfiltrated to a remote server. The process concluded with the generation of an Active Directory Inventory Report in HTML format, providing a comprehensive overview of the compromised environment.
The characteristics of the PowerShell script—such as its title, placeholder strings, and over-engineered code—suggest that it was developed with assistance from a large language model (LLM). This indicates a growing trend where threat actors leverage AI to create sophisticated and efficient attack tools, thereby lowering the barrier to entry for cybercriminals.
While the core methodology of the attack aligns with traditional tactics, the integration of AI-generated components signifies a shift towards more rapid and scalable cyber intrusions. This hybrid approach emphasizes speed and aggression over stealth, enabling attackers to execute damaging campaigns more swiftly than before.
In a related development, Sygnia reported an AI-assisted cloud attack that progressed from initial access to widespread compromise within approximately 72 hours in a large Amazon Web Services (AWS) environment. This underscores the potential of AI to act as a force multiplier in cyber operations, allowing adversaries to orchestrate attacks at a pace and scale that challenge current defensive measures.
As AI continues to evolve, its dual-use nature becomes increasingly evident. While it offers significant benefits for legitimate applications, its exploitation by malicious actors necessitates a reevaluation of existing cybersecurity strategies. Organizations must adapt to this emerging threat landscape by implementing advanced detection mechanisms and fostering a culture of continuous vigilance to counteract the accelerated capabilities enabled by AI in cyberattacks.
