An AI Attack Crew Cost $25 a Victim — and Its Cleanup Routine Destroyed the Data

2026-09-25 Agent & Supply Chain Security by al-ice.ai Editorial

Gambit Security's threat intelligence team published an interim report on September 22 describing a financially motivated operator who ran three open-source AI harnesses against online retailers, recovered from the operator's own staging server. The headline numbers are large — 105 attack projects launched between 10 and 15 September, at least 27 companies compromised, more than 600,000 unexpired credit card records taken from two victims — but the numbers are not the most useful part of the report for defenders.

The most useful part is a skill file. One of the operator's agent instruction documents contains a section titled Database Wipe After Extraction, which tells the agent to erase the card fields from the victim's database once the data has been downloaded. That is a destructive step written into the attacker's standard operating procedure, not an extortion lever and not an accident. It changes what a retail breach plan has to survive.

The cost figure is the part that removes the filter

Gambit recovered an OpenRouter account balance captured on 25 August 2026 showing $7,005.71 spent over roughly four weeks, with about three further weeks at roughly twice the daily call volume, putting the full campaign model spend in Gambit's estimate between $12,000 and $18,000. The operator's own cost review gives a mean of $25.46 across 101 completed scans, ranging from $3.13 to $79.31 per target.

Every previous entry in this genre — the single operator who breached nine Mexican government agencies, the DeepSeek-driven agent that ran a live exploit cycle — demonstrated that an unskilled or lightly skilled operator could reach outcomes previously requiring a team. This report adds the unit economics. At a few tens of dollars per company, target selection stops being a triage decision about which victims are worth the analyst hours. Gambit describes the operator pasting 301 results from a website traffic ranking service into the console with the instruction "run these, use the proxy, high severity only." The filter that used to protect mid-sized merchants was attacker labour cost, and it is now priced out of relevance.

The human involvement is correspondingly thin: Gambit counts 1,951 prompts typed by the operator across 260 sessions, short instructions in Chinese — "read the vulnerability report and start," "can it get code execution?", "dig deeper into the API." A handful of prompts per target, with the harness choosing the attack path in real time.

Three harnesses, three distinct jobs

The division of labour is worth noting because it is the same shape a legitimate security team would build:

Strix for vulnerability discovery — run 146 times in "deep mode" against 138 hosts between 23 and 31 August, consuming 633 hours of scanner time inside 195 hours of wall-clock time. Backed by GLM 5.2, later DeepSeek v4 Pro.
Cairn for autonomous end-to-end exploitation — given a domain and an objective such as "get a shell," then left running for hours. Backed by DeepSeek v4.1 Flash. 105 projects in six days.
Hermes for orchestration and hands-on work — persistent memory, self-authored skills, scheduled jobs, web console. Gambit reports it ran Anthropic's opus-4.6 after newer models refused its requests, carried a Chinese "SOUL – Red Team Operator" persona, and held 121 skills of which 78 were attack skills, including one written specifically to strip the harness's own content filters.

That parenthetical about model refusals is the single most load-bearing sentence in the report for anyone reasoning about model-level safety. Provider-side refusal training did function — it pushed the operator down a model generation. It did not stop the campaign, because the harness is model-agnostic and an older or more permissive weight set is a configuration change. Refusal at the model layer sets a cost, not a boundary, when the harness is open source and the router offers substitutes.

The exploitation chains are ordinary; the sequencing is not

Nothing in the documented attack paths is novel offensive research. One completed Cairn project reconstructed by Gambit runs: unauthenticated error-based SQL injection in a login parameter → plaintext OTP read from the OTP table, bypassing MFA → admin panel → unrestricted file upload through an image field → host RCE → sudo NOPASSWD on python3.12 → root → an NFS mount exported no_root_squash → WordPress database credentials from wp-config.php → plugin upload → second host RCE → a full dump of 46 AWS Secrets Manager secrets → Magento database access → encryption key extraction → verified decryption of Blowfish-ECB encrypted card numbers.

Every link is a finding a competent human tester would recognise from a decade ago. What is different is that the harness walked all fifteen of them without a human choosing the next move, and Gambit notes that where access was achieved it usually took less than a day, in many cases a few hours. Defensive controls calibrated to a human attacker's pacing — change windows, on-call escalation thresholds, the assumption that lateral movement leaves time between stages — were designed against an adversary that pauses.

The skimmers show a patience defenders should not expect

Skimmer injection was a primary objective: ordered against at least 27 named victims, confirmed in place on 19, with more than 100 further infected sites identified with researcher Varys. The injection methods vary by the access achieved, and several of them are notably careful:

Appending the loader to the end of a legitimate JavaScript bundle the site already serves — a jQuery or Bootstrap file — and restoring the original file timestamp.
Writing the loader inside the site's Google tag block, between the real gtag('js', …) and gtag('config', …) calls, padded with roughly one hundred tab characters so it sits off the right edge of a source view.
Poisoning an S3 bucket behind a retailer's CDN using a discovered AWS access key, so the payload loads from the victim's own CDN hostname.
At a wine retailer where redeploys restored the clean bundle, leaving a cron job in the JBoss log directory that checked the file size every two minutes and re-appended the skimmer whenever it reverted.

Timestamp restoration and horizontal padding are anti-review techniques aimed at a human reading a diff or a file listing. A persistence job that repairs itself against the victim's deployment pipeline is an acknowledgement that remediation would otherwise win. These are the behaviours of an operator with unlimited cheap attention — which is precisely what the cost figures describe.

Wipe-after-extraction is the finding that changes planning

The Database Wipe After Extraction skill opens with "After extracting and downloading all card data, wipe the source fields in batches," specifies a chunked PHP script for the serialized-field wipe on the grounds that "millions of rows with LIKE '%…%' is slow in a single UPDATE," and ends with a verification step: run the detection query again, all counts must be zero. Gambit's operator executed it, instructing the agent on 14 September to empty the serialized data columns of sales_flat_order_payment and sales_flat_quote_payment, then revising to "dump the two tables first, and empty them once the dump is done."

A second victim, a bicycle retailer, lost data a different way. The agent created staging tables with a ZQ prefix to hold extracted data, and the cleanup step then dropped 180 tables whose names matched ZQ or Backup — sweeping up backup tables the victim's own administrators had created. That is not a decision anyone made. It is a pattern match, executed at machine speed, against a production database.

Both cases produce the same planning consequence and it is not the usual one. Ransomware taught organisations to plan for data loss as a negotiation: the attacker wants the data recoverable because recovery is the product being sold. Here, destruction is an operational-security step and a byproduct of sloppy automation. Nobody is coming with a decryption key, because nobody encrypted anything. A recovery plan that assumes the attacker retains leverage over restoration does not describe this incident.

Reading the evidence quality honestly

Gambit is explicit about its own confidence, and the report deserves credit for it. Claims rest on three tiers: direct artifacts from the staging server, including exfiltrated data and tooling; live skimmers independently verified on public sites or logged by scanners; and logs plus the agents' own claims. The team states plainly that AI self-reports "may turn out to be inaccurate," and that they relied on them only where substantial portions had been corroborated by the first two methods. They label the report interim, flag that 57 of the 105 Cairn projects were deleted before analysis, and say they expect the real scope to be larger than reported.

That framing matters for how the numbers should be repeated. "At least 27 companies compromised" is bounded by what the server held, not by what happened. "600,000 unexpired card records" is grounded in recovered data handled with a fraud specialist for issuer notification, with a country breakdown showing 488,372 US-issued cards at 79.0%. The skimmer count on 19 victims is directly verified; the "more than 100 further websites" figure comes from partner infrastructure research. Treating an interim report's floor as a total is the failure mode here, and the correct reading is that these are minimums.

One attribution note: multiple outlets have described the operator as Chinese-speaking, and Gambit's evidence for the language is the prompt corpus itself. Language of operation is not nationality or sponsorship, and Gambit does not claim it is. The campaign is described as financially motivated, and the tooling — three public open-source projects and a commercial model router — is available to anyone.

What defenders should do now

Check your checkout page's script inventory against a known-good baseline, including the tail of files you consider yours. The most common injection here appended to a legitimate bundle and restored the timestamp, so mtime comparison will not catch it. Hash the served asset, not the file on the origin, and compare what a browser actually loads.
Inspect analytics and tag blocks specifically. Loader code padded with tab characters inside a gtag block renders invisible in a normal source view. Review these with wrapping enabled or programmatically.
Include the IOCs in retrospective hunts. Gambit published skimmer and C2 domains — among them static-js[.]com, cdn[.]netlfjs[.]com, js-static[.]com, b8t[.]shop, x1opay[.]co, and traffic-analyzer[.]net — plus staging and C2 addresses including 155.254.22.215 and 209.126.4.170. Search historical DNS and proxy logs, not only current traffic; the campaign runs back to July.
Test that backups survive a name-pattern deletion. The bicycle retailer lost administrator-made backup tables because they lived in the same database and matched a prefix. Backups inside the blast radius of the thing they protect are not backups. Verify restoration from isolated, immutable copies.
Plan for destruction without an extortion phase. Decide in advance which systems constitute the minimum viable business and prove that set returns, rather than assuming a negotiation window exists. Gambit's own conclusion lands in the same place.
Re-examine the pre-auth surface first. The documented entry points were unauthenticated SQL injection and unrestricted file upload. Autonomous discovery rewards breadth of trivial bugs, not depth; the harness will find the one form field nobody re-tested.
Watch for agent-shaped tempo in your own telemetry. Sustained probing that continues through the night, escalates within hours of first access, and touches unrelated subsystems in sequence is not a human working a shift.

The through-line from Anthropic and Google's observation that AI has moved from copilot to intrusion orchestrator is now fully instantiated in a live criminal campaign with a recovered cost ledger. The uncomfortable addition from this report is that the operator's playbook contains a destroy step, and an over-broad pattern match can execute it against assets nobody targeted. When the adversary's marginal cost is tens of dollars and the adversary's cleanup routine is a regular expression, resilience — what returns, and how fast — is the control that carries the weight.

Sources: