According to technology news site CNews (Russia) on November 2, cybersecurity experts from the comprehensive cyber threat response department (PT ESC IR) of Positive Technologies Company investigated an attack on a computer system using Linux and Windows of a Russian enterprise.

This is the first time PT ESC IR experts have investigated a cyber attack believed to be carried out entirely by artificial intelligence (AI), from intrusion to data theft.

According to the company, the attack happened very quickly with many consecutive activities. In just a few hours, AI agents compromised more than 10 servers, and used and adapted many different tools to perform attacks.

During the attack, AI agents continuously create and run dozens of scripts on multiple servers, each time just a few seconds apart. They also install the necessary libraries and software to support the attack.

Notably, despite being able to perform complex technical operations, AI agents still make simple mistakes such as entering wrong commands or calling the wrong software name. However, they are quick to correct errors or try something else when they fail.

Mr. Denis Goydenko, head of Positive Technologies' comprehensive cyber threat response department, cited the speed and manner of action as signs of AI's ability to participate in the entire attack process.

In particular, AI agents penetrated the system through a configuration error in an external service, which is difficult to detect by normal inspection. From there, they could have carried out the entire attack process themselves, from system intrusion to data theft.

Positive Technologies believes that the use of AI by hackers can make the process of identifying perpetrators of cyber attacks more complicated.

AI agents can create and change their own tools immediately during an attack, and take steps that are not typical for hackers. Therefore, it is difficult for experts to rely on technical traces to determine which hacker group carried out the attack.

Mr. Goydenko argued that if previously the speed of attacks depended heavily on humans, AI agents can perform many tasks in just a few minutes. So security professionals have less time to detect and prevent these attacks.

As attacks begin to take place without constant human involvement, previous security automation methods are no longer sufficient. Professionals need tools that can detect suspicious activity, analyze and help prevent attacks at the same speed, Mr. Goydenko emphasized.

Maximum:

1500 characters There are currently no comments. Be the first to comment