AI Across the Cyber Intrusion Lifecycle

Summary

Three unrelated threat actors are increasingly integrating AI into offensive operations to automate scripting, tool development, and information prioritization. These AI-assisted workflows enable faster exploitation, hands-on-keyboard command refinement, and identification of high-value business assets. AI use can also introduce unintended operational consequences, including accidental network outages caused by automated configuration changes.

Investigation

The Gambit Security team analyzed three separate cases: a The Gentlemen ransomware affiliate using Claude Code, the Zerofot actor leveraging Codex and Claude Code for key harvesting, and the RAGE framework supporting cryptocurrency mining. Operational security mistakes by the attackers exposed infrastructure and AI-driven conversations to researchers. The findings show how AI can accelerate the transition from initial access to understanding complex business logic.

Mitigation

Organizations should monitor for unusual AI-assisted behavior, including rapid customized script execution and automated discovery of backup or recovery assets. Strong configuration management can help prevent accidental outages caused by automated tooling. Enhanced visibility into command-line activity and unexpected deployment changes is also critical for identifying AI-assisted hands-on-keyboard exploitation.

Response

If suspicious automated activity is detected, responders should isolate affected systems and review recent configuration changes for unintended stability issues. Investigators should examine possible data exfiltration paths, particularly unauthorized access to backup products and storage locations. Logs should also be reviewed for high-frequency, iterative command execution that may indicate an AI-driven interactive session.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary has gained access to a service account and is deploying a containerized cryptomining workload. To avoid detection by standard EDR, they attempt to use the “RAGE” toolset. The attacker attempts to launch a Compute Engine instance or a Container task that includes “RAGE” in its configuration or image metadata to fulfill their objective of resource hijacking. This action triggers the Image field in the GCP Audit log, which the detection rule is specifically monitoring.

• Regression Test Script:

  # Simulation of deploying a resource with the 'RAGE' identifier in the metadata/image field
  # Note: In a real GCP environment, this would involve the gcloud SDK or API
  
  # Simulating the API call that would populate the 'Image' field in Audit Logs
  gcloud compute instances create rage-miner-test 
      --image="projects/my-project/global/images/rage-tool-v1" 
      --metadata="description=Deployment of RAGE toolkit" 
      --zone="us-central1-a"

• Cleanup Commands:

  # Remove the test instance created during simulation
  gcloud compute instances delete rage-miner-test --zone="us-central1-a" --quiet