Check Point Report: AI Agents Compromise Enterprise Network in Under 10 Hours

The weekly Check Point Research report from September 7, 2026 documents an unprecedented convergence of AI-accelerated threats. An AI-assisted ransomware attack compromised an enterprise network in under 10 hours, while new zero-day vulnerabilities strike critical remote access and software supply chain infrastructure. The democratization of attack speed shifts the cybersecurity problem from "who attacks" to "how they automate."

The Compressed Timeline: When AI Becomes the Operator

Unit 42's technical analysis, a division of Palo Alto Networks, reconstructs the attack with surgical precision. The intrusion followed a planning-execution-monitoring loop driven by frontier AI models, with the attacker explicitly declaring the use of "frontier AI models and attack-specific agentic AI frameworks" during negotiations. The dossier does not identify the specific model used.

Agentic automation covered the entire MITRE ATT&CK kill chain: mapping internal systems, extracting root credentials from a secrets manager, abusing CI/CD pipelines, and hijacking the victim's cloud AI infrastructure for obfuscation and computational cost offloading. Unit 42 mapped this latter technique with the ATLAS framework as AML.T0043.

The temporal gap is abyssal: Unit 42 estimates an equivalent attack with human operators would have required roughly two weeks. Automation did not merely accelerate; it changed the very nature of the operation, enabling the attacker to leave an 80-page "report" on the victim's security posture.

"By shifting execution to an automated loop, the attacker compressed weeks of methodical intrusion tradecraft into less than 10 hours" — Unit 42, technical report

Zero-Day on Zero-Day: The Assault on Critical Infrastructure

The Check Point report records two vulnerabilities of particular severity, both exploited before patches were available. SonicWall patched CVE-2026-83548, scored CVSS 10.0 by the National Vulnerability Database: a pre-authentication SSRF vulnerability affecting SMA 6210, 7210, and 8200v appliances. The same advisory addresses CVE-2026-83549 (CVSS 7.8, post-auth RCE). Zero-day exploitation status is documented by the primary source.

JFrog patched CVE-2026-82329, CVSS 9.8: an authentication bypass allowing unauthenticated administrative access to self-hosted Artifactory deployments. Check Point signals exploitation observed shortly after disclosure, explicitly distinguishing self-hosted systems (requiring updates) from the cloud offering (already patched). No public exploits are available at the time of the report.

The combination of these two flaws exposes two pillars of the supply chain: corporate remote access gateways and internal software repositories. The lack of authentication required for CVE-2026-83548 and the ability to generate administrative tokens with CVE-2026-82329 eliminate traditional access control checkpoints.

The Other Fronts: From Federated Theft to APT Operations on LinkedIn

The report documents unauthorized access to approximately 5,000 Dropbox accounts, occurring between August 4 and 21, 2026, via exploitation of the Lenovo ID email verification process. According to the user notification reported by BleepingComputer, an unauthorized party registered a Lenovo ID using the victim's email address and used that identity to access the associated Dropbox account, without requiring the Dropbox password. Lenovo confirmed a "legacy integration issue."

On the APT front, Kaspersky detailed the Mirage Kitten campaign: the Iranian group uses fake recruiter profiles on LinkedIn to propose coding tests that distribute the NodeRabbit and PollCat malware. The infection chain starts from a professional contact, proceeds with an S3 link to a trojanized challenge, and installs a cross-platform RAT in Node.js. NodeRabbit uses local npm packages (colorized_terminal, pretty-log v2.1.0) and C2 hosted on Azure. Three variants have been identified across three countries: Afghanistan, Egypt, and Ethiopia. The first variant supports 11 C2 commands.

Why It Matters

The dossier does not document specific remedial measures for the AI-assisted attack, nor does it provide indicators of compromise applicable to all readers. The source does not specify the nature of data exfiltrated from Thomson Reuters C-Track, the identity of the compressed-speed attacker (nation-state or criminal), nor the exact relationship between Gambling Goblin and Earth Berberoka. The initial access vector for the Hit attack remains undisclosed by the victim.

What the report makes evident, however, is a structural transformation: the barrier to entry for complex executions is no longer human expertise but the ability to orchestrate autonomous agents. A nation-state-level APT is no longer required to compromise an enterprise network in record time. This shifts the defense market toward AI-based behavioral detection and synchronized cross-plane revocation mechanisms, though the brief does not detail specific implementations.

Zero-day vulnerabilities in remote access infrastructure and software repositories expose already fragile supply chains. The convergence of these patterns in the same weekly report suggests the inflection point is not prospective: it is documented.

Frequently Asked Questions

What is the difference between this AI-assisted attack and traditional automation?

The difference lies in the closed loop of planning-execution-monitoring with frontier LLM models, not in individual automated scripts. The attacker declared the use of specific agentic frameworks, with real-time adaptation capabilities to the victim's defensive posture.

Were the malicious npm packages from NodeRabbit published on the public registry?

No, according to Kaspersky the packages were bundled locally in the infection artifact, not published on the npm registry. This reduces traceability compared to campaigns based on typosquatting or dependency confusion.

Are SonicWall cloud appliances vulnerable?

The Check Point report distinguishes between on-premise/self-hosted deployments and cloud offerings. For JFrog, the cloud is already patched; for SonicWall, the source specifies affected models (SMA 6210, 7210, 8200v) without excluding other deployments.

Sources

• https://research.checkpoint.com/2026/7th-september-threat-intelligence-report/
• https://therecord.media/slovenia-cyberattack-casinos-reopen
• https://www.bleepingcomputer.com/news/security/dropbox-accounts-breached-through-lenovo-email-verification-flaw
• https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/
• https://securelist.com/mirage-kitten-new-backdoors-noderabbit-pollcat/121244/

Information is based on the cited source and current as of publication.

Sources