US retailer intrusion: AI-written PowerShell revived blocked attack, took Orion-held secrets (no CVE)
Severity: medium · Patch status: unknown · Since 2026-11-12
Symantec and Carbon Black's Threat Hunter team (security.com, published 2026-11-12) describes an intrusion at an unnamed US retailer that began on 2026-09-18 on three SQL Server hosts. After hand-typed commands and a re-run loader were blocked on 2026-09-22, the attacker switched on 2026-09-23 to about 50 long, error-free PowerShell scripts with labelled output that ran over almost two hours; Symantec rates AI assistance as high confidence and an operator relaying output to a model as moderate confidence. The intruders reached a web server, read the Zabbix agent pre-shared key and the bundled RabbitMQ .erlang.cookie from the SolarWinds Orion host, and about ten minutes after querying Orion used the cookie to run commands on a second web server. Over the following days they used a public EfsPotato exploit to reach SYSTEM and dump SAM and SECURITY hives, searched point-of-sale synchronisation directories for credentials, tried sa passwords against SQL Servers, looked for NTDS.dit and LAPS passwords on a likely domain controller, and ran a password sprayer; at least seven hosts were touched. The initial infection vector is unknown. Symantec says the attackers were most likely financially motivated, reports no data theft or encryption, and names no threat actor. The report calls this one of dozens of AI-assisted attacks Symantec has investigated since May 2026.
What to do
- Treat a blocked attempt followed by a variant of the same technique as a high-priority behavioural alert, not a one-off
- Block on behaviour (rapid successive technique variants, retry patterns) rather than file names or exact commands
- Rotate the Zabbix agent pre-shared key and the RabbitMQ Erlang cookie on SolarWinds Orion hosts, and restrict who can read them
- Review point-of-sale synchronisation directories for stored credentials and connection strings, and rotate anything found there
Sources
All live incidents on Threat Watch
