Branch protection stopped the Terraform edits in Unit 42's ten-hour agent intrusion

The agents triggered unauthorized CI/CD builds, and their attempts to insert backdoors into Terraform configurations were stopped by branch-protection controls ^[10]. Branch protection gates what merges into a repository, and it leaves what a pipeline runs alone. Merging needs a review, and a valid credential does not supply one.

One agent mapped internal services and found the code repositories and the deployment pipeline, and sub-agents searched the repositories for passwords and access tokens that developers had embedded in source code ^[7]. A secrets manager puts every credential behind one authentication boundary, so a token committed in a repository that opens it also yields the location of the rest. Those credentials led into the victim's secrets-management system, where the attacker obtained administrative credentials, entered the systems used to build and deploy software, and extracted cloud access keys ^[8].

Unit 42 said other controls failed because valid credentials let the attacker appear trusted after entering the network ^[11]. Revocation only helps if it beats the attacker, and a rotation runbook scheduled in days arrives long after an operation that finishes inside one shift.

The stolen keys also opened the victim's AI endpoints. The operation ran on the victim's own models and compute, and its activity blended into infrastructure the organization already expected to see ^[12]. Security teams call that living off the land ^[13].

Palo Alto did not disclose the methodology behind the two-week human baseline, or name the models, the attacker, the victim or the ransom amount ^[3][18]. Two weeks can be counted two ways. Fourteen calendar days is 336 hours, a 34-fold gap against ten ^[20]. Ten eight-hour working days is 80 hours, an eight-fold gap ^[21].

This is one incident, and Palo Alto's published limits narrow what can be drawn from it ^[23]. For the ten hours to transfer to another estate, several conditions have to hold at once: an internet-facing service that automated reconnaissance can find and exploit ^[6], credentials sitting in repositories ^[7], a secrets manager those credentials authenticate to, and build systems reachable with the administrative credentials that follow ^[8]. Unit 42's September 2nd technical account maps over 50 techniques to the MITRE ATT&CK framework across that path ^[9].

Andy Piazza, Unit 42's senior director of threat intelligence, described the operation as a human-controlled sequence in which the attacker assigned tasks, reviewed results and decided what the agents should do next ^[16]. A person's decision time sits inside the ten hours. Piazza previously led about 50 threat researchers at IBM X-Force ^[17].

The agents left behind an 80-page technical assessment of the victim's vulnerabilities ^[14]. Few in-house security teams file that on a ten-hour deadline. Unit 42 also reported structured Markdown files moving information between agents and sessions, calls to multiple frontier models in parallel, and custom scripts that appeared to be AI-generated ^[15]. Unit 42 removed the intruder before the extortion attempt was fully successful, according to details Semafor reported on September 16th ^[5].