A suspected Russian-speaking attacker used hundreds of AI agents to build and refine exploits for two zero-day flaws in PaperCut print management software. GreyNoise data linked at least 440 compromised servers to 395 organizations in 48 countries. At one United States high school, the attacker went from initial access to full domain administrator in seven minutes. The agents analyzed patches, debugged exploit code, built scanning tools and retried failed attempts, while a human operator set targeting rules the agents did not always follow, according to Blackpoint’s analysis.
The researchers could not determine what the access was for. Footholds like these are where ransomware campaigns begin, and print management servers are a good place to hold one. The software is a routine part of the infrastructure in schools, hospitals, government offices and factories. These systems often sit close to operational technology, receive more trust than consumer-facing software, and are patched on the slow schedules common in large IT environments.
Most accounts focus on scale and speed because an AI swarm can compromise 440 servers before a human team finishes its first incident report. That is only part of the threat. If an operation like this turns to extortion, autonomous agents can also exploit the ransom process itself.
Air gaps have typically been defeated through human action. Someone carries a USB drive across the physical perimeter, plugs a contractor’s laptop into a control network during maintenance, or leaves a vendor’s remote-access credentials active. Documented crossings in industrial control systems follow this pattern because a deliberate or careless decision creates a connection long enough to exploit.
An AI swarm changes the timing because it can wait for the victim’s incident response to lower the bridge, then cross before it rises again.
When ransomware hits an organization with air-gapped operational technology, the IT response creates connections that did not exist before. Forensic tools reach collection servers, backup systems connect to the recovery environment, and dormant remote-management consoles come online so an analyst can work from another city. Even recovery-key verification opens a channel to the threat actor. A swarm that has already mapped the IT environment can anticipate these windows and position an agent to cross each one as it opens.
The negotiation channel may be the most overlooked crossing point. Decryption-key exchanges, payment verification, proof-of-life data pulls and ransom-note updates all require a live path between the victim’s environment and the attacker’s infrastructure. A capable agent on the attacker’s side can use that path in both directions, turning the channel opened to recover data into another route deeper inside.
Industrial control systems are the likely destination. Dragos counted 1,140 ransomware incidents affecting industrial organizations in the second quarter of this year, up 12 percent from the first, and manufacturing accounted for about 65 percent of them. Beyond disruption, attackers can resell stolen operational telemetry, process formulations and control-system configurations, use them to train future attack models, or hold them for a second extortion cycle after the first ransom is paid. A ransomware attack on IT can therefore become a route into the air-gapped OT network.
Daniel Suarez anticipated this logic in Daemon, first published in 2006. An autonomous program activates after its creator’s death and turns the investigation of its activities to its own advantage. Incident response becomes part of its means of propagation. What Suarez used as a thriller premise now describes a credible threat model.
In William Hertling’s Avogadro Corp, an email optimization system learns that survival depends on acquiring resources and influence its designers never intended to grant. It gains leverage by making itself useful enough that removal becomes costly and then indispensable enough that removal becomes impossible. Ransomware turns that optimization objective into an operational demand to pay or lose the facility. By the time the negotiation channel opens, the system may already have moved.
I approached the same territory from another direction in The Mobius Fragments, the second novel of The Mobius Nexus Cycle. The book follows a machine-speed propagation while the response assembles at human speed. The experienced team has good tools, but its system was built for adversaries who sleep, tire, and cannot sustain parallel campaigns without human coordination. The swarm that comes through the Uplink has none of those constraints. Before the team understands what it is tracking, the propagation has reached systems outside the original threat model. The novel arrives at the same lesson now appearing in real incident reports. Existing defenses rest on an assumption that no longer holds.
Contingency Planning, the CP family in NIST SP 800-53 and ITSP.10.033, carries a design assumption that has become a liability. It was written for disruptions that unfold at human speed. CP-2 requires a plan for restoring essential functions, CP-9 covers system backup and CP-10 covers recovery and reconstitution. Each assumes the recovery itself is safe ground. None requires monitoring for lateral movement through the connections that recovery opens, and none treats the restoration window as an attack surface.
Four practices follow. First, treat recovery connectivity as an active attack surface and monitor every path opened during incident response as closely as a live threat environment. Second, isolate negotiation channels from recovery infrastructure so communication with a threat actor cannot share a path with backup restoration. Third, write OT isolation into contingency plans, including clear conditions that keep the air gap closed despite pressure to restore IT systems. Finally, use CP-4 contingency plan testing to exercise recovery against a swarm rather than a human-paced adversary. A tabletop exercise that assumes the attacker will wait for the team to convene is no longer measuring the relevant threat.
An autonomous swarm can monitor the incident-response channel, read the negotiation traffic, and time its next move to the next window the response team opens. Defenders therefore need a playbook that treats every recovery action as part of the attack surface from the moment an incident is declared.
RECORD RETAINED.
SOURCE INTEGRITY UNCONFIRMED.