Ransomware whack-a-mole, AI agents as insider threats and how to hack a humanoid robot
A discussion on the evolving cybersecurity landscape, covering the persistent threat of ransomware gangs adapting with AI, the critical failures in identity security highlighted by the Zestix case, the emergence of AI agents as a new class of insider threats, and the physical-world risks demonstrated by hacking humanoid robots.
The State of Ransomware: A Multi-Headed Hydra
Despite significant law enforcement takedowns, ransomware activity has not slowed down. The landscape is fragmenting, with large groups breaking into smaller, yet equally effective, factions. This persistence transforms the fight against ransomware into a “whack-a-mole” game, a chronic and persistent threat that requires multiple, overlapping strategies.
JR Rao likens the modern ransomware ecosystem to the mythical Hydra, a serpent that grows two new heads for each one that is severed. This resilience stems from several factors:
- Decentralization and Resilience: The ecosystem is modular, allowing operators to work independently.
- Low Barrier to Entry: Ransomware-as-a-Service (RaaS) models make it easy for new groups to form.
- Persistent Incentives: The economic model remains highly profitable.
- Knowledge Transfer: Tools, exploits, and techniques are easily shared among groups.
Jeff Crume adds that the proliferation of AI is a significant force multiplier for attackers. AI agents can automate the entire kill chain, from identifying targets and crafting hyper-personalized phishing emails to managing the attack and collecting payment, dramatically lowering the effort required to launch successful campaigns.
To combat this “hydra,” a holistic, multi-pronged defense is necessary. This includes:
- Human Defenses: Continuing to educate users, as social engineering remains a primary entry vector.
- Organizational Resilience: Developing robust plans for responding to, and rebuilding from, a ransomware attack.
- Fighting AI with AI: Defenders must leverage AI to keep pace with the scale, speed, and sophistication of AI-powered attacks.
Identity Security: The Unlearned Lesson of Zestix
The case of “Zestix,” a single threat actor linked to breaches at 50 global enterprises, underscores a fundamental and persistent failure in cybersecurity: poor identity hygiene. The actor’s method is painfully simple: searching info-stealer logs on the dark web for corporate cloud credentials and testing them. The high success rate is a direct result of two recurring issues: password reuse and the failure to enable Multi-Factor Authentication (MFA).
JR Rao emphasizes that identity is the weakest link in the security chain, and Zestix demonstrates how credential theft has become a scalable, profitable business. This reinforces the need to shift from traditional perimeter-based security to an identity-centric model like Zero Trust.
“Passwords stink. Everybody hates them. The people that have to use them don’t like them. The people that have to administer them don’t like them. Security people like us look at them and know that they’re weak.” - Jeff Crume
The path forward involves moving away from passwords entirely. While MFA is a critical immediate step, the more robust and user-friendly solution is the adoption of passkeys. However, a significant hurdle remains: legacy applications that do not support modern authentication, leaving a residual risk that organizations must address through modernization.
AI Agents: The Ultimate Insider Threat
The rapid integration of AI agents into enterprise workflows is creating a new, high-impact attack surface. Wendy Whitmore of Palo Alto warns that these agents can become a new class of insider threat if not properly governed. Unlike human insiders, AI agents can be tricked through prompt injection into misusing their high-level access without malicious intent.
JR Rao describes AI agents as the “ultimate insiders” due to their autonomy and non-determinism. This creates a paradigm shift for insider threat programs, which have historically focused on human-centric controls like awareness training. Governing AI agents requires new technical safeguards.
Jeff Crume provides a functional definition of an agent as “a model using tools in a loop autonomously,” with each component presenting a vulnerability:
- Model: Susceptible to prompt injection, the number one vulnerability for LLMs according to OWASP.
- Tools: Can be misused if not properly secured, like giving a child a power tool.
- Loop: Can perform thousands of malicious actions in seconds, faster than a human can intervene.
- Autonomously: Operates without direct oversight, necessitating a “human in the loop” for critical decisions.
Proposed technical safeguards include creating a “human anchor” for every agent, allowing actions to be traced back to a human for accountability, and using token exchange mechanisms to delegate, monitor, and curtail agent permissions based on the principle of least privilege.
Hacking Humanoid Robots: The Convergence of Cyber and Physical
A demonstration at GeekCon 2025 showed researchers hacking AI-powered humanoid robots using only voice commands—a form of audio prompt injection. The compromised robots could be instructed to physically attack objects and could even propagate the exploit to other robots via Bluetooth, creating the potential for a “physical botnet.”
This incident highlights the dangerous convergence of three distinct domains:
- Traditional OT Vulnerabilities: Exploits in firmware and wireless communications.
- AI-Specific Vulnerabilities: Prompt injection and semantic misinterpretation.
- Physical World Effects: The ability to cause direct physical manipulation and harm.
This blending of the cyber and physical realms creates risks that legacy cybersecurity practices, focused on confidentiality, integrity, and availability, are not equipped to handle. A robot, as Jeff Crume defines it, is simply an agent operating in the physical world, inheriting all the vulnerabilities of LLMs and AI agents and adding the dimension of physical action. These “vulnerabilities walking around among us” demand that principles like least privilege and human oversight be rigorously applied before they are deployed at scale.