Armed with AI, hackers target endpoint security blind spots, raising stakes for CISOs

Publisher excerpt From CSO Online

A China-linked hacking group’s use of AI agents to identify security weaknesses during a global espionage campaign is raising concerns about whether enterprises can detect gaps in their defenses before automated attacks exploit them. CrowdStrike reported that the group, tracked as VAPOR PANDA, used an AI-powered penetration testing framework called ARTEX to target more than 200 organizations worldwide over an 11-day period beginning October 17. The organizations included government agencies and businesses across at least 14 countries, with researchers confirming post-exploitation activity at nine. At a global pharmaceutical company, the attackers instructed AI agents to examine running processes and folder listings on Windows machines to determine whether CrowdStrike’s Falcon sensor was installed, according to transcripts recovered by the cybersecurity firm. ARTEX uses multiple AI agents to carry out intrusion tasks under human direction. CrowdStrike found that VAPOR PANDA used the framework to pursue attacks against several organizations simultaneously, with operators intervening at key decision points. The findings follow an October 21 report from Microsoft detailing a separate campaign involving ARTEX. Microsoft said another China-linked group, Storm-0940, used the framework to automate attacks targeting hundreds of organizations, gaining privileged cloud access in less than three hours in some cases. The campaign included the abuse of compromised ConnectWise application credentials to access customer environments. Changing economics of cyberattacks The use of AI in cyberattacks is changing the economics of state-sponsored espionage by allowing smaller teams to pursue targets without a corresponding increase in personnel, according to Akshat Tyagi, associate practice leader at HFS Research. “The techniques are familiar, but the ability to run them in parallel is not,” Tyagi said. Jonathan Ong, senior analyst for managed security services at Omdia, said AI can substantially reduce the time attackers spend on reconnaissance, even as more sophisticated exploitation continues to require technical expertise. The attacks documented by CrowdStrike exploited weaknesses that security teams have encountered for years. At a Greek government organization, attackers used authentication keys from a 2022 directory export that had likely not been rotated. At a US pharmaceutical company, an AI agent combined an unsigned SAML assertion with an XML external entity (XXE) vulnerability to obtain a cloud role with extensive administrative permissions. Security gaps become a bigger target Growing concerns about the security risks of AI adoption should not distract organizations from established defensive measures, Ong said. Tyagi added that CISOs should ensure that security monitoring extends across their environments rather than assuming existing deployments provide complete coverage. Amit Kumar Jena, development manager for AI at Kanerika, said organi…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.