The compression happened in the gaps between steps, not in the steps themselves. Unit 42 says the operator left tactical execution to agents that monitored, evaluated, acted and re-planned in real time, parsing raw tool output and picking the next action without waiting for a human to read it [12]. Each individual move was ordinary. Entry was a public API endpoint, tunneled through to a recon agent that mapped internal microservices [7]. Escalation was hard-coded tokens in code repositories, then those tokens into the secrets management system, then master administrative credentials out of it [7]. Unit 42 is explicit that no novel zero-day and no elite tradecraft were involved, and that operational efficiency was the differentiator [6].
More than 50 ATT&CK techniques inside 10 hours works out to better than five an hour, or roughly one technique every 12 minutes, sustained [1]. Against the two-week baseline Unit 42 assigns to the equivalent human effort, that is about 34 times faster [2]. No detection window built around an operator who sleeps survives that rate.
Separate what is claimed from what was observed. The attribution to frontier models and attack-specific agentic frameworks comes from the threat actor, stated to Unit 42 during ransom negotiations [2]. Negotiation talk is self-serving by construction. What Unit 42 says it observed independently: LLM calls to multiple frontier agents in parallel, structured Markdown files handing state between agents and sessions, and custom scripts assessed with high confidence as AI-generated because of their UI elements [13]. Those artifacts, plus Python caches and paired asset folders, are what Unit 42 offers defenders as hunting indicators [14]. That is thinner than a named toolchain, and it is what exists.
One control held. The agents tried to plant backdoors in Terraform configurations and hard branch-protection rules stopped them [8]. That gate does not require an analyst to be awake, which is the only property that mattered on this timeline. Nothing stopped the next step: stolen cloud keys turned the victim's own AI endpoints into post-compromise infrastructure, which Unit 42 notes both hides orchestration traffic among expected traffic and moves the compute bill onto the victim [9][10].
The attacker also directed an agent to leave an 80-page technical audit of the organization's security posture behind, detailing dozens of exploited findings [15]. Eviction is the harder arithmetic: persistence was laid across SSH keys, serverless functions, container restart policies, cloud identities and CI/CD pipelines, and agents maintain and test that whole portfolio in parallel [11]. Unit 42 expects more attackers to add agents to their tool sets [16].
