al-ice.ai

Four Operators, Four Harnesses: CrowdStrike’s October Trawl of Autonomous Intrusion Campaigns

Agent & Supply Chain Security by al-ice.ai Editorial

Most “AI-powered attack” reporting this year has been about AI writing malware faster. CrowdStrike’s Counter Adversary Operations team published something narrower and more consequential on 21 October 2026: four previously unreported threat actors who delegated operational decision-making across the kill chain to agentic AI — agents choosing tasks and executing commands in live intrusions between May and August 2026, not merely generating payloads beforehand. Every one of the four left its offensive agent framework exposed in an open directory, which is how the researchers could reconstruct the harnesses instead of guessing at them.

The line that frames the whole report is its definition of the shift: AI used “not only to create tooling or artifacts, but to conduct agentic campaigns in which AI agents make decisions and execute commands.” That is the same line this site has been drawing all year — from the ARTEX bank campaign to CARLIY0S — and CrowdStrike’s four cases now show the pattern reproducing independently, in four languages, at four skill levels.

The four operators

Actor 1, Spanish/English-speaking, aimed at Argentine healthcare. At least 15 Argentina-based healthcare entities were compromised, with credentials and medical records exfiltrated from at least one victim. The harness is the most architecturally deliberate of the four: a purpose-built autonomous pentesting rig with a dual-agent design — a “Supervisor” Claude Code agent that picks the next task from a state machine of attack stages, and an “Executor” agent that carries it out. The framework derives from the open-source PentestGPT project, rebuilt with additional MCP servers, Python exploitation scripts, and skills. Note the MCP servers inside an attacker’s harness: the same tool-abstraction layer defenders are racing to secure is now load-bearing infrastructure for the other side.

Actor 2, Chinese-speaking, ran the broadest targeting. More than 20 named global targets: government entities of two countries compromised, plus private-sector targets in Brazil and the US across biotech, healthcare, food and beverage, retail, technology, and travel. Two details matter. First, access to Claude models ran through a China-based AI proxy service — a “transfer station” — the now-familiar laundering layer between a frontier model’s safety posture and the operator. Second, the actor built two harnesses at different autonomy settings: one Python project that deterministically runs reconnaissance and then asks an AI provider to choose among a pre-established set of actions routed to the right agent, and one that lets Claude Code operate either solo against an elaborate standard operating procedure or fanned out across multiple specialist agents in parallel. Deterministic scaffolding with AI choice at the joints, versus full agentic delegation: the operator was A/B-testing autonomy itself.

Actor 3, Indonesian-speaking, is the report’s warning label. CrowdStrike calls this the least sophisticated of the four: 819 skills, overwhelmingly pulled from public GitHub repositories — primarily the claude-red collection — with no additional orchestration, just instructions to compromise a target and trust the skills to carry the intrusion. The operator had to intervene periodically to push past the model’s safety guardrails and to exhort it to keep trying. And still: several Indonesian government domains, a government domain of another country, and several private-sector entities fell. When the floor of required skill is “can clone a repo and nag a chatbot,” the population of capable attackers is everyone.

Actor 4, Russian-speaking individuals, ran the leanest operation. They exfiltrated corporate client data from a US-based customer-relationship-management vendor and compromised SaaS and data-center entities in Russia, Kyrgyzstan, and the US, plus one more government domain. The entire harness is a single /pentest-setup slash command driving a seven-step workflow: enumerate the environment, near-total autonomy in choosing exploitation methods, a high-level post-exploitation workflow, and explicit exfiltration instructions. Seven steps, one command, real victims.

CrowdStrike’s assessments, with confidence levels attached

The report states its judgments the way intelligence should — with the confidence written on them. Agentic AI commoditizes baseline offensive operations (moderate confidence). Agentic-AI-supported intrusions will almost certainly increase in volume and sophistication (high confidence), driven by rapid adoption, demonstrated effectiveness, improving models, and proliferating open-source offensive frameworks. Over the next 12 months, low-skill actors will likely run campaigns at effectiveness and scale previously only achievable by organized criminal groups or state-nexus actors. And some actors will likely improve the OPSEC of these campaigns over the same period (moderate confidence) — the open directories that made this report possible are a beginner’s mistake, and beginners learn.

That last judgment is the one defenders should sit with. This report exists because four operators misconfigured storage. The tradecraft on display — proxy laundering, dual-agent tasking, skill libraries, SOP-prompted autonomy — already works. The version that stops leaving its scaffolding in public is strictly better, and there is no reason to assume it has not already shipped.

How this connects to the year’s other agent campaigns

We have covered CrowdStrike’s reconstruction of the ARTEX operator’s session logs from exposed infrastructure — the same “attacker left the camera on” dynamic, two weeks earlier, against South Korean finance. The through-line across ARTEX, CARLIY0S, and these four is now unmistakable: open-source offensive frameworks plus frontier models plus routine OPSEC failures are producing a public dataset of working agentic tradecraft. Every exposed harness is a tutorial. The policy question is no longer whether agents can run intrusions; it is what happens to the price of a competent intrusion when the scaffolding is downloadable and the operator’s main skill is persistence.

Our verification was read-only. The actor descriptions, victim counts, harness architectures, skill counts, proxy details, assessment language, and confidence levels above were read first-hand from CrowdStrike’s 21 October 2026 blog post “CrowdStrike Uncovers New Agentic AI Campaigns” (Counter Adversary Operations), with a same-week secondary report used as corroboration. A second secondary page returned HTTP 403 to our fetch and is declared unread rather than cited. We did not access any exposed directory, download any harness or skill, contact any operator infrastructure, test any prompt against any model, or reproduce any intrusion step. Brave Search was used for discovery only.

Sources: