25 Minutes to Compromise: Unit 42 Unpacks Agentic AI Attacks

¡Hola, mi gente de cyber!

We have something big to talk about. Palo Alto Networks’ Unit 42, those smart people, they are talking about something called “Agentic AI Attack Framework.” This is not your abuela’s old computer virus, no señor. This is like giving the bad guys a super-fast car when we are still on a bicycle.

You know, we in security, we always see the bad guys trying new things. But this AI, Artificial Intelligence, it is changing the game, and fast, fast, fast! Unit 42 says these AI tools can make attacks 100 times faster. Imagine! They did a test, a ransomware attack, from getting in to stealing the data, in just 25 minutes. ¡Qué bárbaro! Before, we talk about Mean Time To Exfiltrate (MTTE) data in days. In 2021, it was nine days. By 2024, two days! Sometimes, less than one hour! This AI is not playing.

We already see bad guys using AI. They make fake videos and voices, you know, deepfakes, to trick people. Groups like Muddled Libra use this. Even North Korean IT workers use this to get jobs and sneak into companies. And, get this, attackers use AI to talk for them when they demand ransom money, so they can negotiate better even if they don’t speak the language good.

But now, we have Agentic AI. This is the real deal. These are AI systems that think for themselves. They make decisions, they learn, they solve problems, and they get better all by themselves, without a human telling them what to do every second. They can plan and run whole attacks, from start to finish. This is very, very dangerous.

Unit 42, they are smart, they built a framework to show how these Agentic AIs can attack. They say the bad guys will have special AI agents for each step of the attack. Like a team, but all AI. Let’s break it down, simple but technical, like we do:

The New Attack Chain: Powered by AI Agents

1. Reconnaissance AI Agent: The Spy Who Never Sleeps

• Old way: Bad guys look for info, maybe check LinkedIn, GitHub, run some scripts. It takes time, it’s noisy.
• Agentic AI way: This AI agent is always watching, always learning. It asks itself, “What info I need to find a weak spot?” It looks everywhere: social media, data leaks, APIs, cloud problems. If something changes, like a new employee or a new system, the AI sees it and changes its plan.
  • Example: Agent sees job posts, learns company uses SAP. Finds a test SAP server with a known vulnerability (CVE). Then finds IT people on LinkedIn to target with phishing. Smart, eh?

2. Initial Access AI Agent: The Master of Getting In

• Old way: Send many phishing emails, try to guess passwords. If it fails, try again manually.
• Agentic AI way: This AI doesn’t just try once. It uses Large Language Models (LLMs) to write perfect phishing messages for each person. If email fails, it asks itself, “What else can I try?” Then it sends SMS, a LinkedIn message, or a fake meeting invite. It also matches vulnerabilities to the company’s tech very fast.
  • Example: A boss ignores a phishing email. The AI rewrites it, more casual, mentions recent company news, and sends it via a fake Microsoft Teams chat. It keeps trying, getting better.

3. Execution AI Agent: The Smart Bomb

• Old way: Malware runs as soon as it gets in. No thinking. Easy to catch in a sandbox.
• Agentic AI way: This AI agent looks around first. “Where am I? Who is this user? What security is here?” Then it picks the best way to run. If one way is blocked, it asks, “Okay, what’s next?” and tries another way.
  • Example: Malware lands, but waits. Is it a finance person? Is EDR (Endpoint Detection and Response) watching? Is it office hours? Then, maybe it hides in a normal program and waits for the user to open Outlook. Sneaky!

4. Persistence AI Agent: The One That Stays Forever (Almost)

• Old way: Hide in one or two places (scheduled tasks, registry keys). If defender finds it, game over.
• Agentic AI way: This AI chooses how to hide based on what it sees. It makes many hiding spots: cloud, browser, identity tokens. If one is found, it says, “Oops, they found one! Let me make another one.”
  • Example: Agent puts a run key in the registry and a hidden scheduled task. Security scan deletes the run key. The AI sees this, and uses the scheduled task to make a new, more hidden run key.

5. Defense Evasion AI Agent: The Chameleon

• Old way: Hide the malware, change its name. If caught, the bad guy needs to rebuild it, takes time.
• Agentic AI way: This malware can rewrite itself! If EDR or antivirus flags it, it learns new ways to hide, changes its own code, and tries again. It can change how it talks to its command and control (C2) server.
  • Example: DNS filter blocks the malware’s communication. The AI immediately changes its traffic to look like encrypted Windows updates and keeps going. It doesn’t get caught by the same trick twice.

6. Discovery AI Agent: The Quiet Mapper

• Old way: Run noisy scans, dump all info. Easy to detect.
• Agentic AI way: This AI looks around quietly, slowly. It watches network traffic, uses normal system commands to find things, and decides what is important. If blocked, it finds another way.
  • Example: Agent finds a badly configured server, uses it to see the company’s backups. It looks at file names, sizes, who uses them, to decide what is valuable, all while acting like a normal user.

7. Exfiltration AI Agent: The Fast and Stealthy Thief

• Old way: Grab everything, send it out. Big files, big risk of detection.
• Agentic AI way: This AI first finds the really valuable data. Then it tests ways to send it out without being seen. It sends data slowly, hides it in normal traffic, and changes methods if it gets blocked. This is how Unit 42 did the attack in 25 minutes!
  • Example: Agent finds secret documents, compresses and encrypts them. It starts sending them in small pieces using a Slack bot. If Slack is blocked, it asks itself, “New plan!” and switches to hiding data in OneDrive file syncs. Mission complete.

So, What Now? We Need AI Defenses!

My friends, this is serious. These AI attackers, they are fast, they adapt, they don’t get tired, they don’t make spelling mistakes. They will not stop. Unit 42 says this is how attacks will happen in the future, maybe even now.

The good news? We can fight AI with AI. Our security tools also need to use AI, to be as fast and smart as the attackers. Unit 42 is using these ideas in their purple teaming exercises. This means they pretend to be these AI attackers to test a company’s defenses and make them stronger.

For now, AI is making old attack methods stronger and faster, not making totally new attacks. So, the basic things for good defense are still important. But we need security that learns and changes fast, just like these AI threats.

This is a big change, mi gente. We need to be ready. Check out what Unit 42 offers to help companies prepare. Don’t get caught with your guard down when these AI super-attackers come knocking.

Stay safe out there! And keep learning!

Palo Alto article