Artificial intelligence no longer merely generates content; it is taking over the execution layer of the attack cycle. This report examines an eCrime actor that runs its entire operation, from reconnaissance through exploitation to persistence, via an autonomous LLM agent.
The actor automates CVE monitoring, proof-of-concept harvesting, target scanning and exploit execution without human intervention, driven by commands issued from a messaging application. The analysis is first-hand: it is built on a working directory the actor left exposed to the internet through its own infrastructure.
What is inside
- Threat actor profile and the architecture of the AI agent behind it
- Campaign timeline and analysis
- Technical infrastructure: command and control, and the tooling around it
- Victim analysis
- MITRE ATT&CK mapping
- Indicators of compromise
- Defence recommendations