Stuck Hackers Turned to AI and Broke Through a Retailer in 10 Minutes

An intrusion at a U.S. retailer was going nowhere until the attackers apparently started asking an AI for help. Symantec’s Threat Hunter Team says that in September 2026 the operators’ hand-typed commands on a hacked web server, typos included, kept getting blocked. The next day they switched to long, error-free PowerShell scripts with labelled output and model-style reasoning in the comments, and within about 10 minutes of looking at the victim’s SolarWinds Orion install they had used a component bundled with it to run commands on a second server. Symantec says this is one of dozens of AI-assisted attacks it has investigated since May, most of them in September.

204.194.49[.]129:8080 (payload staging)
108.165.20[.]205:8080 (later staging)
166.0.25[.]106:443, 154.81.37[.]136 (server.ps1 hosts, reverse shell C2)
155.254.22[.]215:9458 (egress test target, named as an AI console by Gambit Security)
103.142.103[.]225, 176.97.117[.]157 (linked intrusions)
103.79.79[.]191, 103.79.79[.]120, 8.219.82[.]21, 43.208.224[.]101 (Yuze cluster)

C:\ProgramData\bdreinit.exe + log.dll + log.txt; ask.exe + ask.dll + ask.txt (-gdata)
C:\ProgramData\w3wp.exe (copied ask.exe), mmc.exe, BreakChainC.exe, BreakChainCs.exe
filemanager.asp, qwdajhsd.asp (web shells in the site’s images folder)
server.ps1, sqlrun2.ps1, i187_winspray.ps1

Source article: How AI Revived a Stalled Attack on a U.S. Retailer
Publisher: Symantec (Threat Hunter Team, Symantec and Carbon Black)
Published: Nov. 12, 2026
URL: https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer

Executive Summary

Symantec’s Threat Hunter Team investigated a September 2026 intrusion at a U.S. retail organization by an operator it does not attribute to a named group, which it assesses as most likely financially motivated. Activity began on Sept. 18 with commands launched by sqlservr.exe on three SQL Server hosts, probably through xp_cmdshell; the initial vector is unknown. On Sept. 21 to 22 the operator worked by hand through a compromised IIS application, staging Bitdefender (bdreinit.exe, log.dll, log.txt) and later G DATA (ask.exe, ask.dll, ask.txt) side-loading kits, an AES-encrypted PowerShell reverse shell and two ASP web shells, while security software repeatedly terminated the payloads. From Sept. 23 the commands became long, typo-free, labelled PowerShell scripts with model-style reasoning in comments, which Symantec assesses with high confidence as AI-assisted and with moderate confidence as an operator relaying output to an AI tool. That phase found SolarWinds Orion, read the bundled RabbitMQ broker’s Erlang cookie and used Orion’s erl.exe to run commands on a second web server, then harvested SAM, SECURITY and LSA material, searched for NTDS.dit, GPP cpasswords and LAPS passwords, compiled EfsPotato, used the BreakChain process-tree breaker and Chisel, scanned internal hosts and sprayed passwords until at least Sept. 29. Loader files and the 204.194.49[.]129 staging server overlap an August intrusion (where the open-source Yuze proxy appeared) and a July intrusion at a securities firm; the egress-test address 155.254.22[.]215 matches infrastructure Gambit Security tied to an AI-assisted operation against online retailers. No data theft or encryption was observed. Hunt leads, false positive expectations and indicators are detailed below; Symantec published no Sigma or YARA rules.

ATT&CK chain: Initial Access → Execution → Persistence → Privilege Escalation → Defense Evasion → Credential Access → Discovery → Lateral Movement → Command and Control

Hunt Lead Grid

Staging Server and Web Shell Sweep

Symantec published the infrastructure from the retail intrusion and its linked cases: the payload staging server 204.194.49[.]129 on port 8080 (hxxp://204.194.49[.]129:8080/log.dll, log.txt, bdreinit.exe, ASK.exe and qwdajhsd.asp), the later staging server 108.165.20[.]205:8080 (sqlrun2.ps1), the reverse shell hosts 166.0.25[.]106 (C2 on 443, also serving server.ps1 and filemanager.asp) and 154.81.37[.]136 (fallback server.ps1), the egress-test target 155.254.22[.]215 on port 9458, 103.142.103[.]225 and 176.97.117[.]157 from linked intrusions, and the Yuze cluster 103.79.79[.]191, 103.79.79[.]120:8088, 8.219.82[.]21 and 43.208.224[.]101. On the web server the operator wrote filemanager.asp and qwdajhsd.asp into the application’s images folder for access that didn’t depend on the original entry point. The detection logic is a retrospective search of firewall, proxy and DNS logs for those addresses and URLs, a file sweep of IIS content directories for the two shell names and for any .asp file under an images folder, and a SHA256 sweep for the values in the appendix.

Use perimeter firewall and proxy logs, EDR file inventory and IIS logs (look for POSTs to .asp files under images). Sweep back to at least July 1, 2026, because the staging server was already in use in August and a related intrusion dates to July. Scope to internet-facing IIS servers and SQL Servers first. A clean result proves little, since the operator rebuilt and renamed tools within minutes of each block; treat this as a fast first pass before the behavioral leads. Any hit on these addresses from a server, or either shell name on disk, should go straight to incident response.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Persistence → T1505.003 (Server Software Component: Web Shell)

Sources: “How AI Revived a Stalled Attack on a U.S. Retailer”, Symantec, Nov. 12, 2026, https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer (source article)

Security-Vendor Binaries Side-Loading From ProgramData

On Sept. 22 the operator pulled bdreinit.exe (an old, legitimate Bitdefender binary), log.dll and log.txt into C:\ProgramData with Invoke-WebRequest; bdreinit.exe loads log.dll from its own folder, and the DLL decrypts the payload held in log.txt. Security software killed it about five times in under 20 minutes. On Sept. 23 the operator switched to a G DATA-signed ask.exe with ask.dll and ask.txt, launched with a -gdata argument, used a file named mmc.exe as an intermediary launcher, copied ask.exe to C:\ProgramData\w3wp.exe to mimic the IIS worker, and fetched BreakChainC.exe and later BreakChainCs.exe, which relaunched the kits in WMI and shell modes (for example breakchaincs.exe -m wmi “C:\ProgramData\bdreinit.exe”). The detection logic is to alert on any execution of bdreinit.exe, ask.exe, mmc.exe or w3wp.exe from C:\ProgramData or another user-writable folder, on a signed security-vendor binary loading an unsigned DLL from its own directory, and on any process named BreakChain*.

Use EDR process and image-load telemetry (Sysmon Event IDs 1 and 7 if no EDR). Allowlist by full signed image path: the real w3wp.exe lives under System32\inetsrv and the real mmc.exe under System32, so the same names anywhere else are suspicious. Do not hash-block bdreinit.exe or ask.exe, because they are genuine vendor files and blocking them can break those products; detect the location, the unsigned companion DLL and the parent instead. Scope to every server, with priority on web and database hosts. Symantec says the Bitdefender pairing is used by several actors, so this lead generalizes beyond this case; any hit should be escalated.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Persistence, Privilege Escalation, Defense Evasion → T1574.001 (Hijack Execution Flow: DLL); Defense Evasion → T1036.005 (Masquerading: Match Legitimate Resource Name or Location)

Sources: Symantec (above), source article

Erlang RPC From Orion’s Bundled erl.exe

About 10 minutes after first querying SolarWinds Orion on the web server, the operator read the .erlang.cookie file of the RabbitMQ broker that ships with Orion, then ran Orion’s bundled C:\Program Files (x86)\SolarWinds\Orion\erlang\erts-9.0\bin\erl.exe with -noshell -sname <random> -setcookie <cookie> -eval “io:put_chars(rpc:call(‘rabbit@<second web server>’,os,cmd,[[…]])),halt().” The command was passed as a list of character codes; the first decoded to whoami and the following ones to registry queries against the SAM database, the SECURITY hive’s cached logons and LSA secrets, and the built-in Administrator account. The detection logic is to alert on erl.exe started with both -setcookie and -eval or rpc:call, especially when its parent is cmd.exe, powershell.exe or w3wp.exe rather than the Orion or RabbitMQ service, on any non-service process reading .erlang.cookie, and on cmd.exe or reg.exe spawned by the RabbitMQ Erlang runtime (erl.exe or beam.smp) on the target host.

Use EDR process creation with full command lines on both the source and target servers, file-read auditing on .erlang.cookie where available, and network flow on the Erlang distribution ports between Orion and RabbitMQ hosts. Baseline which hosts legitimately talk Erlang distribution to each other; in most Orion deployments it is a small, stable set. Rotating the cookie and restricting read access to the service account is the durable control; blocking erl.exe outright is the wrong choice because it breaks Orion’s messaging. A hit means the attacker already holds a shared secret that authenticates every node, so escalate, rotate the cookie on all nodes and check every host that accepts it. The pattern applies to any product bundling RabbitMQ or another Erlang runtime.

Hunt Lead Level: 2 (Pro)

ATT&CK: Lateral Movement, Defense Evasion → T1550 (Use Alternate Authentication Material) (our mapping; Symantec does not publish ATT&CK IDs)

Sources: Symantec (above), source article

Database and Web Workers Spawning Credential Harvesting

The first commands, on Sept. 18, ran as cmd.exe directly under sqlservr.exe on three SQL Servers, with labelled scripts running whoami /priv, cmdkey /list and a Get-CimInstance Win32_Service query for RMS, Store and Dynamics service accounts, then searching point-of-sale sync folders for credentials and testing egress to 155.254.22[.]215:9458. On one host about 20 PowerShell commands appended base64 text to a file under ProgramData, decoded it with certutil and compiled it with csc.exe into EfsPotato. On Sept. 24 and 25 SQL hosts saved the SAM and SECURITY hives to a new ProgramData folder, a likely domain controller was searched for NTDS.dit, SYSVOL for GPP cpassword values and Active Directory for LAPS passwords, and sa logins were tried until xp_cmdshell ran on one server. The detection logic is to alert when sqlservr.exe or w3wp.exe is the parent or grandparent of reg.exe save of SAM, SECURITY or SYSTEM, of certutil -decode, of csc.exe, of cmdkey /list, or of any file search for NTDS.dit or cpassword.

Use EDR process lineage, SQL Server audit logs for sp_configure changes to xp_cmdshell and for failed sa logins, and Windows Security event 4688 with command lines. Look back 90 days, since the vector is unknown and activity spanned at least Sept. 18 to 29. Scope to database and web servers. Expect some legitimate xp_cmdshell use by DBAs for file housekeeping; allowlist those exact commands and owners rather than the feature. Disabling xp_cmdshell where it isn’t needed removes the vector. Any hive save or NTDS.dit search from these parents should be escalated as credential theft, followed by a reset of the affected accounts, and the pattern generalizes to most SQL Server and IIS intrusions.

Hunt Lead Level: 2 (Pro)

ATT&CK: Persistence → T1505.001 (Server Software Component: SQL Stored Procedures); Credential Access → T1003.002 (OS Credential Dumping: Security Account Manager), T1003.004 (OS Credential Dumping: LSA Secrets), T1003.003 (OS Credential Dumping: NTDS), T1552.006 (Unsecured Credentials: Group Policy Preferences); Defense Evasion → T1027.004 (Obfuscated Files or Information: Compile After Delivery)

Sources: Symantec (above), source article

AI-Relayed Script Cadence Through a Web Shell

Symantec measured the shift precisely. On Sept. 22 the web shell carried about 110 short, hand-typed actions with three typos (systemifo, pwoershell). On Sept. 23 it carried around 50 scripts over roughly two hours, with a median length above 500 characters, no typos, banner-labelled sections such as ===FILES MENTIONING CONN STRINGS=== or “### cmdkey ###”, errors wrapped in handlers, and comments that stated a hypothesis and revised earlier conclusions. The gap between submissions never fell below seven seconds, and two-to-eight-minute pauses came before changes of strategy, with no fixed-interval beaconing. Symantec’s other AI-assisted cases showed the same labelled style with roughly one-second gaps and sessions about three hours apart. The detection logic is to collect every PowerShell script block or command line whose process chain starts at w3wp.exe or sqlservr.exe, and alert when a host shows several submissions in an hour over a length threshold (for example 500 characters) containing repeated banner lines, quoted section labels or multi-line comments, with a second rule on very short regular gaps that point to automation.

Use PowerShell script block logging (event 4104) and EDR command lines, joined to process lineage. Baseline 30 days per server of command length and banner use, because some management tools emit structured output; those run from their own service accounts and signed parents, not from IIS or SQL workers. Content-matching “AI phrases” is the wrong control: wording changes between models, as Symantec saw between Sept. 19 and 22, but the structure and the parent do not. Treat any hit as an active hands-on intrusion. The value of this lead is that it keeps working when every tool name and hash has been swapped, which Symantec says these operators did within seconds to minutes of a block.

Hunt Lead Level: 3 (Elite)

ATT&CK: Execution → T1059.001 (Command and Scripting Interpreter: PowerShell)

Sources: Symantec (above), source article

Hash Appendix

Retail intrusion tooling

SHA256 values come from the source article. Symantec published no MD5 or SHA1, and they were not filled from OTX AlienVault or VirusTotal this run, so every MD5 and SHA1 below is not available. bdreinit.exe and ask.exe are unmodified legitimate Bitdefender and G DATA binaries used for side-loading: blocking their hashes can break those products, so detect the path and companion DLL instead. ch.exe is the open-source Chisel tool and Yuze is open source; the hashes identify the attacker’s copies only.

MD5s / SHA1s: (not available) for every file in this section.

SHA256s

54fb493822bcd832f7b2256015f13e3dfde815e1931e7fd39a90ea8ad3fdbd0a  # server.ps1 -> AES-encrypted PowerShell reverse shell
a6579b16f895cf9ac4c31ba20606f2ad1ac4d1458e95c296da2afc1039881513  # bdreinit.exe -> legitimate Bitdefender binary used for side-loading (C:\ProgramData)
9c866c403e6bd5778fa3788cac9aac39aab1bf2d18a22c9999a4c27e30c0abf3  # log.dll (variant 1) -> malicious DLL loaded by bdreinit.exe
e95a265bf220a4330f77f842b3eeed8b1ed8c61f51d7e3f2fd33bac14b6b26af  # log.dll (variant 2) -> malicious DLL loaded by bdreinit.exe
c21e4fb40f871e418def63a5cdf3603ed4c3c6d1b218710db8ba45538b66fa01  # unnamed DLL -> malicious DLL
6500890307f3860899f96452fea3effde777e6fcf369dc1e8861bdb65836d55e  # ask.exe -> legitimate G DATA-signed binary used for side-loading
7265d69dd8d8939dc888ce5f05190ce200ee2660f928f3b84f60e6a7b3383205  # ask.dll -> malicious DLL loaded by ask.exe
3d79628bf7804dbf17e7b396ecd62ebf5d66518940c6d23daccf59a20953438a  # BreakChainCs.exe -> process-tree-breaking launcher
f042d705e1de3b5f9b8161ff59aa3ff80c684f5aaeac42be589a579ab1c7cf51  # BreakChain launcher -> earlier build
5db5e7f655c4ee94411df8110d1b6d02bb15574ac199fa7a553ce6c3cb25bf03  # ch.exe -> Chisel tunnelling tool
f8b67854d119da08c704b78f7c9fae0501417f5e63ffece86d2e811f1c7dea68  # yuze -> Yuze reverse proxy (August intrusion)
ef7c23619cf9293002fbe4f50147e806de0168cf186ca01fea2e113dc2eb1dce  # DoH backdoor (1) -> DNS-over-HTTPS backdoor
b739635832c7f7f2be4821982980d2977165a2c8226f5912e6431db8c0cf6eea  # DoH backdoor (2) -> DNS-over-HTTPS backdoor
0241f569f4ce1bf0f2470867d6ba40f23f78d4d3ee2fbc423c91f3b591f446bc  # DoH backdoor (3) -> DNS-over-HTTPS backdoor
c9a5e9799f2844a71d0085697b3c2adb5528f4b9516146826193ddbe4d89423c  # privesc tool (1) -> privilege escalation tool
fad5dc8987df3206fdc50d0f4889bee06721d54a373bdc2f5545ba560562647e  # privesc tool (2) -> privilege escalation tool
2b7ed8dc34a83430029764d64f81c8f42e19c81fe923742558c96799a34dcf19  # sandbox test utility -> sandbox-evasion test utility
7c8eb7d23337536ed2aec14f1425c2fcd13976a4390cfecf653533e6a3bd87c4  # test.ps1 -> seen in an earlier intrusion at a different organization
7e866f007b8e42b0888c922c290c92d4f5f285089865a8e62788a9b4409e2bcf  # rollback.exe -> seen in an earlier intrusion at a different organization

Files Symantec lists as suspicious

SHA256 values from the source article, which labels them only as suspicious files with no names; MD5 and SHA1 are not available.

935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2  # suspicious file 1
ba4038fd20e474c047be8aad5bfacdb1bfc1ddbe12f803f473b7918d8d819436  # suspicious file 2
deabe064a12641c4e95d4b133746f148d8ed4bcffd1dfe9ce1b6621dde2aa774  # suspicious file 3
d92f20d73ade9a6134bec960aed0c02873e19cd03d707c85064c73ce0f852104  # suspicious file 4
bcccfca65602e2691e25e8590a7029fa40712e05eac8bf203f3f5dc900b31ad4  # suspicious file 5
9b077fc464d9a4a2e6b227e61eae8a759de13b728e7cd2f06563a1af0de93d19  # suspicious file 6
59e51c54cf3ac4d375de96a358c15bc125fe5453ee29cf923276c429097b9eac  # suspicious file 7
330e9314bd39898984e52e2e3cc01e84c9c4c95f5bc467cf5bc75cd539dd0438  # suspicious file 8
2be9c2222cb177747f58f2ccb224a85879f1c2ffb0240e0b8968536d320b8edf  # suspicious file 9
1df54c1c5ee76f2f8f962963df3962f1a688806631da01d0e5ce85b817a5e2f7  # suspicious file 10
11b26168927a622ddc3beb592edc3bf476b897a360cbab36ad3ef0039068dd67  # suspicious file 11
1f8565e14f8bcde3eb48a6676596d0cd8b7cc3c12d903f97b0e0b3ac8725c17c  # suspicious file 12
d376e01930adabbe40634b8b16664a088d8bec2dc99aa88c16db9d302e45aaf5  # suspicious file 13
642ea33ddf7eba3043cf7b567ccffe57d6671f640e7734072f02975dfa44d893  # suspicious file 14
5ee783076e9c8b3830d8e2dccda9abf65be81a0b8dfc281ff12188f7607f1d38  # suspicious file 15
dac237636f2fb1e44e28117999e77fc42a53d3b59b80cfb84928452ffe561793  # suspicious file 16
76adf3141ccd877d98c85dbb7f6f227e70f71e8158392ac9797927260dd2faa3  # suspicious file 17
5666332a66b1fb46bfbc7e076b21a8081f22931f5688686550d42bcec6aa3207  # suspicious file 18
2ffe8c6910d08072ccb8fef133a4570c6a085289b669373b1b508bd294fe9b23  # suspicious file 19
717319bc981c2b8f76907e2985f363540cb286f68aff0c75a5841eec2d0c9b04  # suspicious file 20
7e9b60d021067dfe22b28783162ce9f55c2ccce7d221cadbf1f0f155dca6779e  # suspicious file 21
9b7b2dadba43634e8f6b38f612287865800b6c790e83a69211da55434c26a74a  # suspicious file 22
318ce2ca913ff8297f23886a6d6640f28f63ba2bb62c0c6897972265d71e1407  # suspicious file 23

References Appendix

• “How AI Revived a Stalled Attack on a U.S. Retailer”, Symantec Threat Hunter Team, Nov. 12, 2026, https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer (source article; timeline, commands, tooling, indicators)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/