Key points
- Large language model agents orchestrated the intrusion, automating hundreds of commands.
- Attackers abused an unauthenticated Apache Tomcat endpoint to execute JavaScript code.
- Publicly available tools PrintSpoofer and GodPotato achieved final privilege escalation.
Researchers Austin Ritchie and Daxton Wirth confirmed that AI agents gained full Windows SYSTEM privileges within 24 hours. The attack leveraged existing vulnerabilities and open-source tools rather than new malware or zero-day exploits.
What happened
The intrusion started when attackers targeted an internet-facing job submission feature in an Apache Tomcat application running Spring Batch. This endpoint accepted task definitions without requiring authentication, allowing unauthorised access to Nashorn, a JavaScript engine within the Java environment. Malicious code executed inside the existing application process, inheriting its account privileges while avoiding the creation of child processes that might trigger detection.
Instead of installing a web shell, the attackers triggered exceptions and extracted command results through error messages. Because output capacity was limited, they retrieved information in fixed 1,800-byte chunks. Sequential job identifiers tracked file offsets and upload positions, preserving execution state across hundreds of separate requests. This application-level command channel facilitated reconnaissance, credential discovery, and subsequent exploitation of the host system.
Accessing application configuration files revealed plaintext credentials with SQL Server sysadmin rights. Attackers enabled xp_cmdshell to run operating-system commands under the database service account. They then identified SeImpersonatePrivilege as a viable path for escalation. Publicly available utilities PrintSpoofer and GodPotato were staged to abuse these impersonation privileges and obtain SYSTEM access, the highest local security account in Windows.
Both tools arrived as base64-encoded fragments and were reconstructed on the compromised host. After initial file-permission failures disrupted the first approach, the attackers switched tools and successfully achieved SYSTEM access. They subsequently saved the SAM, SYSTEM, and SECURITY registry hives, enabling offline extraction of local password hashes and other stored credential material. Researchers cited a live Cairn orchestration dashboard on the same IP address as strong evidence of AI agent involvement.
Why it matters
This incident demonstrates how automation accelerates post-exploitation activities that previously required significant manual effort. By using AI agents to coordinate multistep tasks, attackers reduced the time to full compromise to under a day. The use of standard application channels for command execution limited visibility for process-based detection systems.
The reliance on known flaws and public tools highlights the risk of misconfigured endpoints. An unauthenticated feature in a common web server allowed initial code execution without needing new vulnerabilities. This suggests that organisations must focus on reducing exposed attack surfaces and securing application configurations. The ability to extract registry hives offline means that credential theft can occur even if the attacker leaves the environment quickly.
What happens next
- Monitor for unusual error message patterns that may indicate data exfiltration via application logs.
- Audit internet-facing endpoints for unnecessary authentication requirements and overly permissive configurations.
- Review permissions for database service accounts to ensure they do not hold unnecessary administrative rights.
- Check for the presence of known privilege escalation tools like PrintSpoofer or GodPotato on Windows hosts.
Background: Data exfiltration
A data breach is an event where unauthorised access occurs. Data exfiltration is the subsequent transfer of that accessed information to an external destination. You can have a breach without exfiltration if the attacker is detected before copying files. You cannot have exfiltration without a prior breach of access controls.
Read the full guide: Difference Between Data Breach and Data Exfiltration: The Operational Truth
What to do and how to stay safe: Apache Tomcat
- Ensure all application endpoints require strong authentication to prevent unauthorised task submissions.
- Restrict the use of JavaScript engines like Nashorn in production environments where possible.
- Implement strict file permission controls to prevent reconstruction of encoded malicious fragments.
- Monitor for the extraction of SAM, SYSTEM, and SECURITY registry hives, which indicates credential theft.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritise Fixes That Matter
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the attackers use a zero-day vulnerability in this incident?
No, the researchers stated that the intrusion did not involve new malware or a zero-day vulnerability.
How did the attackers maintain execution state across multiple requests?
They used sequential job identifiers to track file offsets and upload positions.
What evidence suggests AI agents were involved in the attack?
A live Cairn orchestration dashboard was hosted on the same IP address that submitted malicious jobs.
