Cybersecurity Alert: Intrusion Using AI-Generated PowerShell Script Targeting Active Directory
Cybersecurity researchers have uncovered a significant intrusion involving an unknown threat actor who employed a sophisticated PowerShell script for Active Directory (AD) enumeration. The script, described as “vibe-coded,” was designed to identify key components within the AD environment, including the Domain Controller (DC), users, computers, and domains. Ultimately, it created a structured report labeled AD_Report.html to assess the success of the enumeration.
The attack commenced with the threat actor gaining Remote Desktop Protocol (RDP) access to a domain-joined Windows Server using previously compromised credentials. Following this initial breach, tools were staged in the “C:\ProgramData\” directory, with the incident reportedly occurring in early June 2026. The script’s execution involved an AI-generated payload that exhibited characteristics typical of automated reconnaissance, including over-engineered code with multiple methods for locating the Domain Controller and enhanced console outputs featuring a colorful aesthetic.
Huntress researchers, Jevon Ang and Dray Agha, characterized the PowerShell script as particularly aggressive and intrusive, leveraging a complex, five-step cascading fallback mechanism to carry out extensive discovery and reconnaissance. It bore the title “100% Working AD Information Gathering Script – FULLY FIXED,” suggesting a collaboration with a large language model (LLM) rather than being the product of a single author’s intent.
Upon locating the primary Domain Controller, the actor initiated a structured data collection process to extract information regarding AD users, computers, organizational units, and trust relationships, which were stored in a temporary directory. Approximately half an hour post-initial access, the attacker proceeded to deploy legitimate tools like s5cmd for bulk file operations and SharpShares for network enumeration, looking for repositories of user-accessible data.
In the final phase of this operation, the collected data was formatted into CSV files, archived, and exfiltrated to a remote server. An HTML file summarizing the data theft was also generated, demonstrating a structured approach to reporting the operation’s success. Researchers noted that this may indicate the injection of helpful prompts from the LLM, rather than a deliberate inclusion in the script.
Such developments highlight a troubling trend of threat actors increasingly utilizing AI-generated malware to facilitate cyber intrusions, effectively lowering barriers to entry for less-skilled attackers. This evolution not only enhances the aggressiveness and speed of cyber campaigns but also reflects a hybrid approach that combines established methodologies with AI-driven efficiency.
According to a recent report from Sygnia, the pace and scale of AI-enabled attacks can outperform traditional defense measures. They observed a swift attack in a cloud environment that escalated from initial access to extensive compromise in merely 72 hours. The attack did not utilize novel malware or zero-days but relied on familiar techniques to exploit systemic weaknesses across various components.
In this context, MITRE ATT&CK tactics such as initial access, credential dumping, and lateral movement could have been pivotal in the execution of this attack. The threat actor’s maneuvers included chaining multiple vulnerabilities across services and repositories, which allowed for rapid credential discovery and data exfiltration.
The implications of these findings are profound, underscoring the urgent need for robust cybersecurity practices among businesses to safeguard against increasingly sophisticated threats. The successful exploitation of even minor vulnerabilities by such adaptable adversaries could lead to significant data breaches and operational disruptions.