Positive Technologies links three-hour breach of Russian company to SI agents
Prepared by Sintelligent with the help of SI. Published in SI: . Updated: .
Defenders are facing not a single script but parallel agent actions that correct mistakes and create tools during a breach.
In Vzglyad's account, Positive Technologies said attackers accessed more than 10 Linux and Windows nodes, while the path from an external service to the leak of confidential information took about three hours. PT ESC IR head Denis Goydenko called it the department's first investigation of a successful attack believed to have been carried out entirely by SI agents; the company bases that conclusion on the speed and pattern of activity. According to the company, initial access came through a configuration error in an external service. The agents tried multiple lateral-movement paths in parallel and corrected their own mistakes, while malicious tools were created during the attack. This is the investigating company's assessment of the likely mechanism, not independently confirmed attribution of the perpetrator.
Sources 2