{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Peak retail season involves high transaction volumes and code freezes that attackers exploit. Autonomous AI agents can compress intrusion timelines to hours, making it impossible for standard manual reviews to intervene before impact."
      },
      "name": "Autonomous AI Retail Intrusions and Cloud Fraud",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1566",
        "attack.t1059",
        "attack.t1041",
        "attack.t1486",
        "attack.t1110.004",
        "credential access",
        "execution",
        "impact",
        "initial access",
        "persistence"
      ],
      "series": {
        "slug": "unwrapping-retail-peak-season-cyber-threats",
        "index": 2,
        "title": "Unwrapping Retail Peak Season Cyber Threats",
        "total": 2
      },
      "related": [
        {
          "hunt": "retail-commerce-exploit-skimmer",
          "reason": "Digital skimming and server-side e-commerce exploits are handled in a separate hunt focused on web-facing infrastructure.",
          "relation": "out-of-scope-alternative"
        },
        {
          "hunt": "ecommerce-edge-exploitation-api-abuse",
          "relation": "follows"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        }
      },
      "analysis": "A rule might alert on a single proxy login, but this hunt correlates the identity lead with sub-10-hour cloud velocity and AI agent execution patterns\u2014the 'compressed timeline' that signifies an autonomous threat.",
      "coverage": [
        {
          "stage": "initial-access-employee-social-engineering",
          "steps": [
            "suspicious-logon-leads"
          ],
          "status": "covered"
        },
        {
          "stage": "execution-autonomous-agent",
          "steps": [
            "autonomous-agent-processes",
            "high-velocity-api-activity"
          ],
          "status": "covered"
        },
        {
          "stage": "impact-cloud-fraud-exfiltration",
          "steps": [
            "high-velocity-api-activity"
          ],
          "status": "covered"
        },
        {
          "stage": "initial-access-commerce-exploit",
          "reason": "Belongs to another part of the 'Unwrapping Retail Peak Season Cyber Threats' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "credential-access-api-stuffing",
          "reason": "Belongs to another part of the 'Unwrapping Retail Peak Season Cyber Threats' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "persistence-digital-skimmer-injection",
          "reason": "Belongs to another part of the 'Unwrapping Retail Peak Season Cyber Threats' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Adobe Commerce XXE Exploitation",
            "slug": "initial-access-commerce-exploit",
            "tactic": "initial-access",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "CVE-2024-34102",
              "CosmicSting",
              "Adobe Commerce",
              "XML External Entity (XXE) crafted documents",
              "unpatched e-commerce servers"
            ]
          },
          {
            "name": "Employee Phishing and Smishing",
            "slug": "initial-access-employee-social-engineering",
            "tactic": "initial-access",
            "techniques": [
              "T1566"
            ],
            "observables": [
              "Storm-0539",
              "phishing messages",
              "smishing messages",
              "social engineering of retail employees"
            ]
          },
          {
            "name": "Automated Credential Stuffing",
            "slug": "credential-access-api-stuffing",
            "tactic": "credential-access",
            "techniques": [
              "T1110.004"
            ],
            "observables": [
              "automated scripts targeting mobile app APIs",
              "web login API traffic spikes",
              "stolen credential databases",
              "login failures followed by success"
            ]
          },
          {
            "name": "Digital Skimming and Backdoor Installation",
            "slug": "persistence-digital-skimmer-injection",
            "tactic": "persistence",
            "techniques": [
              "T1505.003",
              "T1195"
            ],
            "observables": [
              "JavaScript payment skimming scripts",
              "checkout flow modification",
              "persistent server backdoors",
              "unauthorized client-side script manipulation"
            ]
          },
          {
            "name": "Autonomous AI Agent Activity",
            "slug": "execution-autonomous-agent",
            "tactic": "execution",
            "techniques": [
              "T1059"
            ],
            "observables": [
              "Cairn autonomous penetration testing agent",
              "Bling Libra AI reconnaissance",
              "Claude AI accelerated exfiltration",
              "autonomous penetration testing harnesses"
            ]
          },
          {
            "name": "Cloud Gift Card Fraud and Data Theft",
            "slug": "impact-cloud-fraud-exfiltration",
            "tactic": "impact",
            "techniques": [
              "T1486",
              "T1041"
            ],
            "observables": [
              "unauthorized gift card issuance",
              "loyalty account balance draining",
              "Storm-0539 cloud infrastructure exploitation",
              "exfiltration of payment card records",
              "ALPHV inventory replenishment disruption"
            ]
          }
        ],
        "summary": "Retailers during peak shopping season face a diverse threat landscape including digital skimming via CVE-2024-34102, AI-accelerated autonomous intrusions, and cloud-based gift card fraud following employee phishing. These campaigns prioritize operational disruption through ransomware or direct financial gain via credential stuffing and payment record exfiltration."
      },
      "severity": "high",
      "rationale": "Focus on administrative accounts and retail employees with access to gift card management or e-commerce control panels.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary has compromised a retail employee account via social engineering and is now using an autonomous AI agent to conduct high-velocity reconnaissance and fraudulent gift card issuance within a sub-10-hour window.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Hostnames identified as suspicious in the lead step to focus the endpoint investigation."
        },
        "fraud_api_ops": {
          "from": {
            "ref": "unit42-retail-threats-2026",
            "kind": "article",
            "observed": "2026-10-28"
          },
          "type": "list[string]",
          "default": [
            "CreateAccessKey",
            "PutUserPolicy",
            "AttachUserPolicy",
            "UpdateAccessKey",
            "CreateUser",
            "IssueGiftCard"
          ],
          "description": "Cloud API operations linked to Storm-0539 fraud and persistence."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "agent_keywords": {
          "from": {
            "ref": "unit42-retail-threats-2026",
            "kind": "article",
            "observed": "2026-10-28"
          },
          "type": "list[string]",
          "default": [
            "cairn",
            "harness",
            "claude",
            "gpt-4",
            "autonomous"
          ],
          "description": "Keywords associated with autonomous agents or AI harnesses identified in retail intrusions."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://unit42.paloaltonetworks.com/unwrapping-retail-cyber-threats/",
          "gates": [
            "dry-run",
            "lint",
            "critic"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://unit42.paloaltonetworks.com/unwrapping-retail-cyber-threats/",
          "name": "Unit 42 \u2014 Unwrapping Retail Peak Season Cyber Threats"
        }
      ],
      "blind_spots": [
        {
          "id": "limited-idp-telemetry",
          "risk": "A smishing attack may look like a legitimate remote login if risk signals from the IdP are delayed or incomplete.",
          "stage": "initial-access-employee-social-engineering",
          "question": "whether a smishing attempt occurred on a personal mobile device before the enterprise login",
          "requires": "detailed IdP risk logs and behavioral context"
        },
        {
          "id": "insufficient-cloud-audit-retention",
          "risk": "If the 10-hour intrusion window occurred just outside the standard retention period, the evidence of gift card issuance or data theft is lost.",
          "stage": "impact-cloud-fraud-exfiltration",
          "question": "whether sensitive data was exfiltrated before the lookback window",
          "requires": "long-term cloud data event auditing"
        },
        {
          "id": "obfuscated-ai-prompts",
          "risk": "Defenders can see the agent process but not the exact objective it was given if interactions occur over encrypted channels to remote model APIs.",
          "stage": "execution-autonomous-agent",
          "question": "what specific instructions were given to the autonomous agent",
          "requires": "local LLM interaction logging or HTTPS decryption"
        }
      ]
    },
    "name": "Autonomous AI Retail Intrusions and Cloud Fraud",
    "description": "This hunt focuses on the internal and cloud control plane impact of AI-powered retail intrusions. We identify suspicious authentication leads\u2014such as proxy-based logins or risk-flagged sessions\u2014and use them as a gate to trigger deeper investigation into endpoint and cloud telemetry. The hunt specifically looks for the execution of autonomous penetration testing agents like Cairn and high-velocity cloud API operations used by groups like Storm-0539 for gift card fraud and data theft."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "unwrapping-retail-peak-season-cyber-threats",
          "index": 2,
          "title": "Unwrapping Retail Peak Season Cyber Threats",
          "total": 2
        },
        "coverage": [
          {
            "stage": "initial-access-employee-social-engineering",
            "steps": [
              "suspicious-logon-leads"
            ],
            "status": "covered"
          },
          {
            "stage": "execution-autonomous-agent",
            "steps": [
              "autonomous-agent-processes",
              "high-velocity-api-activity"
            ],
            "status": "covered"
          },
          {
            "stage": "impact-cloud-fraud-exfiltration",
            "steps": [
              "high-velocity-api-activity"
            ],
            "status": "covered"
          },
          {
            "stage": "initial-access-commerce-exploit",
            "reason": "Belongs to another part of the 'Unwrapping Retail Peak Season Cyber Threats' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "credential-access-api-stuffing",
            "reason": "Belongs to another part of the 'Unwrapping Retail Peak Season Cyber Threats' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "persistence-digital-skimmer-injection",
            "reason": "Belongs to another part of the 'Unwrapping Retail Peak Season Cyber Threats' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An adversary has compromised a retail employee account via social engineering and is now using an autonomous AI agent to conduct high-velocity reconnaissance and fraudulent gift card issuance within a sub-10-hour window.",
        "blind_spots": [
          {
            "id": "limited-idp-telemetry",
            "risk": "A smishing attack may look like a legitimate remote login if risk signals from the IdP are delayed or incomplete.",
            "stage": "initial-access-employee-social-engineering",
            "question": "whether a smishing attempt occurred on a personal mobile device before the enterprise login",
            "requires": "detailed IdP risk logs and behavioral context"
          },
          {
            "id": "insufficient-cloud-audit-retention",
            "risk": "If the 10-hour intrusion window occurred just outside the standard retention period, the evidence of gift card issuance or data theft is lost.",
            "stage": "impact-cloud-fraud-exfiltration",
            "question": "whether sensitive data was exfiltrated before the lookback window",
            "requires": "long-term cloud data event auditing"
          },
          {
            "id": "obfuscated-ai-prompts",
            "risk": "Defenders can see the agent process but not the exact objective it was given if interactions occur over encrypted channels to remote model APIs.",
            "stage": "execution-autonomous-agent",
            "question": "what specific instructions were given to the autonomous agent",
            "requires": "local LLM interaction logging or HTTPS decryption"
          }
        ],
        "scoping_notes": "Focus on administrative accounts and retail employees with access to gift card management or e-commerce control panels.",
        "beyond_detection": "A rule might alert on a single proxy login, but this hunt correlates the identity lead with sub-10-hour cloud velocity and AI agent execution patterns\u2014the 'compressed timeline' that signifies an autonomous threat."
      }
    },
    {
      "id": "suspicious-logon-leads",
      "type": "query",
      "label": "Identify suspicious authentication leads",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "identity",
        "content": "SELECT actor_user_name, src_endpoint_ip, src_location_country, is_proxy, risk_state, debug_behaviors, device_hostname, time FROM hb_auth_signin WHERE (is_proxy = 'true' OR risk_state IN ('atRisk', 'confirmedCompromised') OR LOWER(debug_behaviors) LIKE '%negative%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_auth_signin",
        "description": "Find employee logins that exhibit markers of compromise, such as proxy usage or negative risk behaviors, as a lead for an identity-based intrusion.",
        "expected_signal": "A list of users and hosts associated with atypical or high-risk authentication. Silence suggests no such logins were logged by the provider."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify suspicious authentication leads",
        "reads": [
          "actor_user_name",
          "src_endpoint_ip",
          "src_location_country",
          "is_proxy",
          "risk_state",
          "debug_behaviors",
          "device_hostname",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT actor_user_name, src_endpoint_ip, src_location_country, is_proxy, risk_state, debug_behaviors, device_hostname, time FROM hb_auth_signin WHERE (is_proxy = 'true' OR risk_state IN ('atRisk', 'confirmedCompromised') OR LOWER(debug_behaviors) LIKE '%negative%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A list of users and hosts associated with atypical or high-risk authentication. Silence suggests no such logins were logged by the provider.",
        "verified": "dry-run",
        "verified_at": "2026-10-29"
      }
    },
    {
      "id": "evaluate-logon-lead",
      "type": "analytic",
      "label": "Evaluate logon leads",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity"
        ],
        "context": [
          "suspicious-logon-leads"
        ],
        "objective": "Examine the suspicious-logon-leads rows and determine if any accounts show patterns of takeover, such as successful logins from a proxy immediately followed by a risk detection.",
        "description": "Assess whether the suspicious logins justify a deeper investigation into subsequent attacker actions.",
        "max_iterations": 3,
        "expected_signal": "A decision on whether the logins are indicative of active compromise.",
        "success_criteria": "A verdict on the likelihood of account compromise."
      },
      "parents": [
        {
          "id": "suspicious-logon-leads"
        }
      ]
    },
    {
      "id": "gate-to-investigation",
      "type": "checkpoint",
      "label": "Gate: Proceed to investigation?",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the evaluate-logon-lead verdict suggests a high probability of account compromise for at least one user",
        "condition": "the evaluate-logon-lead verdict suggests a high probability of account compromise for at least one user",
        "blind_spot": "limited-idp-telemetry",
        "confidence": "medium",
        "description": "Only open the expensive investigation queries if the initial identity lead is credible.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "evaluate-logon-lead"
        }
      ]
    },
    {
      "id": "autonomous-agent-processes",
      "type": "query",
      "label": "Search for autonomous agent execution",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{agent_keywords}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR instr(',' || '{{agent_keywords}}' || ',', ',' || LOWER(process_original_file_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_process_activity",
        "description": "Detect the execution of autonomous penetration testing agents or AI-harness processes on the identified hosts.",
        "expected_signal": "Process events where the image name or original file name matches an AI agent keyword. Silence suggests no such processes were active on the scoped hosts."
      },
      "parents": [
        {
          "id": "gate-to-investigation",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Search for autonomous agent execution",
        "reads": [
          "device_hostname",
          "process_name",
          "process_cmd_line",
          "user_name",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{agent_keywords}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR instr(',' || '{{agent_keywords}}' || ',', ',' || LOWER(process_original_file_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Process events where the image name or original file name matches an AI agent keyword. Silence suggests no such processes were active on the scoped hosts.",
        "verified": "dry-run",
        "verified_at": "2026-10-29"
      }
    },
    {
      "id": "high-velocity-api-activity",
      "type": "query",
      "label": "Detect high-velocity cloud API bursts",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT actor_user_name, COUNT(*) as op_count, MIN(time) as first_seen, MAX(time) as last_seen FROM hb_cloud_api_activity WHERE (instr(',' || '{{fraud_api_ops}}' || ',', ',' || api_operation || ',') > 0 OR api_category = 'GiftCardManagement') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name HAVING op_count > 10 AND (julianday(last_seen) - julianday(first_seen)) * 24 <= 10",
        "surface": "hb_cloud_api_activity",
        "description": "Identify the compressed timeline of an autonomous intrusion by looking for actors performing dozens of sensitive operations in a sub-10-hour window.",
        "expected_signal": "A single user account performing high volumes of sensitive API operations in a very short timeframe. Silence proves no such high-velocity bursts occurred in the audit log."
      },
      "parents": [
        {
          "id": "gate-to-investigation",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Detect high-velocity cloud API bursts",
        "reads": [
          "actor_user_name",
          "api_operation",
          "api_category",
          "time"
        ],
        "source": "hb_cloud_api_activity",
        "target": "endpoint",
        "content": "SELECT actor_user_name, COUNT(*) as op_count, MIN(time) as first_seen, MAX(time) as last_seen FROM hb_cloud_api_activity WHERE (instr(',' || '{{fraud_api_ops}}' || ',', ',' || api_operation || ',') > 0 OR api_category = 'GiftCardManagement') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name HAVING op_count > 10 AND (julianday(last_seen) - julianday(first_seen)) * 24 <= 10",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "new_this_window"
        },
        "expected": "A single user account performing high volumes of sensitive API operations in a very short timeframe. Silence proves no such high-velocity bursts occurred in the audit log.",
        "verified": "dry-run",
        "prevalence": {
          "by": "api_operation",
          "key": [
            "actor_user_name"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-10-29"
      }
    },
    {
      "id": "triage-intrusion",
      "type": "analytic",
      "label": "Correlate intrusion evidence",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity"
        ],
        "context": [
          "evaluate-logon-lead",
          "autonomous-agent-processes",
          "high-velocity-api-activity"
        ],
        "objective": "Determine if the combined evidence from all queries indicates a coordinated, AI-driven retail intrusion aimed at fraud or data theft.",
        "description": "Correlate the suspicious logins, AI agent execution, and rapid cloud activity to confirm an autonomous intrusion.",
        "max_iterations": 5,
        "expected_signal": "A confirmed verdict per host/account with cited evidence.",
        "success_criteria": "A verdict of malicious or suspicious for at least one entity."
      },
      "parents": [
        {
          "id": "autonomous-agent-processes",
          "kind": "merge"
        },
        {
          "id": "high-velocity-api-activity",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage-intrusion verdict is malicious for an account involving fraudulent API activity or AI agent execution",
        "condition": "the triage-intrusion verdict is malicious for an account involving fraudulent API activity or AI agent execution",
        "blind_spot": "insufficient-cloud-audit-retention",
        "confidence": "high",
        "description": "Select the response path based on the confirmed threat.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-intrusion"
        }
      ]
    },
    {
      "id": "revoke-compromised-sessions",
      "type": "action",
      "label": "Revoke compromised sessions",
      "config": {
        "target": "identity",
        "description": "Immediately halt the intrusion by revoking the identity context.",
        "instructions": "Revoke all active sessions and rotate credentials for the users identified in triage-intrusion.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-review",
      "type": "task",
      "label": "Remediate fraud impact",
      "config": {
        "assignee": "analyst",
        "description": "Determine the financial and data impact of the intrusion.",
        "instructions": "Examine the high-velocity API logs for specific gift card IDs issued or customer files downloaded. Coordinate with fraud teams to invalidate fraudulent currency."
      },
      "parents": [
        {
          "id": "gate-to-investigation",
          "branch": "default"
        },
        {
          "id": "gate-to-investigation",
          "branch": "on_unavailable"
        },
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "revoke-compromised-sessions"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Close out",
      "config": {
        "assignee": "analyst",
        "description": "Document findings and negative results.",
        "instructions": "Log the examined accounts and hosts; record any false positives from legitimate cloud automation harnesses."
      },
      "parents": [
        {
          "id": "gate-to-investigation",
          "branch": "on_refutes"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "analyst-review"
        }
      ]
    }
  ]
}