🤖 AI-assisted intrusion chain reached SYSTEM without zero-days

Researchers assessing a recent server compromise found strong signs that large language model-driven agents automated much of the attack. An exposed Apache Tomcat/Spring Batch endpoint enabled Nashorn-based code execution, followed by credential theft from config files, SQL Server abuse via xp_cmdshell, and privilege escalation with PrintSpoofer and GodPotato. A live Cairn dashboard was seen on the same IP as the malicious requests.

The case stands out because early execution remained inside the application process, limiting process-based visibility, while operators adapted quickly through short command cycles and iterative error correction. It also shows how plaintext credentials and overprivileged service accounts can turn one unauthenticated endpoint into full host takeover.

🛰️ Open sources - closed narratives
@sitreports