A Sneaky Hacking Tool Targeting AI Infrastructure Is Lurking in Victims’ Blind Spots

一款针对人工智能基础设施的隐蔽黑客工具正潜伏在受害者的盲区中

As AI tools proliferate and become deeply ingrained in software development around the world, new research from the cybersecurity firm Crowdstrike shows how attackers are actively targeting the AI toolchain to steal access credentials, gain deeper access to a target environment, exfiltrate sensitive data, and even destroy target files and systems—all while finding new ways to cover their tracks.

随着人工智能工具的普及并深入渗透到全球软件开发中，网络安全公司 Crowdstrike 的最新研究显示，攻击者正积极瞄准人工智能工具链，以窃取访问凭证、获取目标环境的更深层访问权限、窃取敏感数据，甚至破坏目标文件和系统——同时还在不断寻找新的方法来掩盖其行踪。

Researchers discovered a worm in the wild while investigating AI software supply chain attacks. Adam Meyers, CrowdStrike’s senior vice president of counter adversary work, says that the company has not yet attributed the activity to a specific actor, but that it fits into larger evolutions in how attackers like TeamPCP (which Crowdstrike tracks as “Altered Spider”) and North Korean groups are targeting the AI software supply chain.

研究人员在调查人工智能软件供应链攻击时，在野外发现了一种蠕虫病毒。CrowdStrike 对抗对手工作高级副总裁 Adam Meyers 表示，该公司尚未将此活动归因于特定的攻击者，但它符合攻击者（如 Crowdstrike 追踪的“Altered Spider”团队 TeamPCP 以及朝鲜黑客组织）针对人工智能软件供应链攻击方式的演变趋势。

“This is one of the campaigns that we’ve seen showing that this is an emerging attack class,” Meyers tells WIRED. “As AI coding agents become the development standard, supply chain threats are evolving to exploit those trust relationships. For the first time we’re experiencing how much AI and the AI toolchain has played into the broader tech ecosystem.”

“这是我们所见过的表明这是一种新兴攻击类型的活动之一，”Meyers 告诉《连线》（WIRED）杂志。“随着人工智能编码代理成为开发标准，供应链威胁正在演变以利用这些信任关系。我们第一次体验到人工智能和人工智能工具链在更广泛的技术生态系统中发挥了多大的作用。”

The worm CrowdStrike identified works in phases. First it does reconnaissance to assess the target environment. Then it looks for access tokens and other sensitive data, like cryptographic keys and server access credentials that it can deliver to attackers. As the malware gains privileges, it further unpacks itself and continues to grab credentials, particularly “npm” tokens that give access to key software package management servers and other development capabilities like pull requests.

CrowdStrike 识别出的这种蠕虫病毒分阶段工作。首先，它进行侦察以评估目标环境。然后，它寻找访问令牌和其他敏感数据，例如可以发送给攻击者的加密密钥和服务器访问凭证。随着恶意软件获得权限，它会进一步解包并继续获取凭证，特别是能够访问关键软件包管理服务器以及拉取请求（pull requests）等其他开发功能的“npm”令牌。

The deeper the malware bores into the system, the more sensitive data it can grab. At this point, the malware can also deploy its destructive capability, or what Meyers calls a “death switch,” to destroy files or block legitimate access to the compromised infrastructure.

恶意软件深入系统越深，能获取的敏感数据就越多。此时，恶意软件还可以部署其破坏性功能，即 Meyers 所称的“死亡开关”（death switch），以销毁文件或阻止对受损基础设施的合法访问。

The key finding, though, is that much of the worm’s malicious activity takes place in what are essentially blind spots, because so much of its behavior mimics legitimate actions. “It’s like a needle in a haystack, except this is a needle in a needle stack,” Meyers says. “This looks very much like a lot of the automation organizations are using to build code, so it’s very difficult to detect.”

然而，关键的发现是，该蠕虫的大部分恶意活动都发生在本质上的盲区中，因为它的许多行为都在模仿合法操作。“这就像大海捞针，只不过这是在针堆里找针，”Meyers 说。“这看起来非常像许多组织用于构建代码的自动化工具，因此很难被检测到。”

Meyers adds, too, that in these AI software development pipelines, it is harder to gather the data points that security scanners and analysis tools traditionally use to detect potentially suspicious activity.

Meyers 还补充说，在这些人工智能软件开发流水线中，安全扫描器和分析工具传统上用于检测潜在可疑活动的数据点更难收集。

“There’s a lot of telemetry overlap because legitimate AI coding systems are operating the same way as this worm, so it becomes very difficult to discern from the telemetry you have available to you what is legitimate and what is illegitimate,” Meyers says.

“存在大量的遥测重叠，因为合法的人工智能编码系统与这种蠕虫的运行方式相同，因此很难从你现有的遥测数据中分辨出什么是合法的，什么是违法的，”Meyers 说。

To hide in plain sight even more insidiously, the authors of the worm included time delays where various capabilities will execute hours or even days after the groundwork is laid, making it even harder for defenders to establish a cause and effect of certain events leading to certain outcomes.

为了更隐蔽地隐藏在众目睽睽之下，蠕虫的作者加入了时间延迟，各种功能会在基础工作完成后数小时甚至数天执行，这使得防御者更难建立导致特定结果的事件之间的因果关系。

Meyers says that Crowdstrike has been working on strategies to connect more of the dots, but he emphasizes that as AI software development explodes, there is a pressing need for all players to collaborate on structural solutions.

Meyers 表示，Crowdstrike 一直在研究将更多线索串联起来的策略，但他强调，随着人工智能软件开发的爆发式增长，所有参与者迫切需要就结构性解决方案进行合作。

“It’s a limited detection surface because only so much of this activity is actually going to produce any sort of telemetry signal for us to look at,” Meyers says, “so it becomes extremely onerous to determine what is legitimate and what is illegitimate behavior.”

“这是一个有限的检测面，因为只有一小部分活动会产生我们可以查看的遥测信号，”Meyers 说，“因此，确定什么是合法行为，什么是非法行为变得极其困难。”