How AI Agents Turned One Exposed Endpoint into a Server Takeover

This ReliaQuest analysis details a compromise where an exposed, unauthenticated Spring Batch job-submission endpoint on an Apache Tomcat server was used to run Nashorn JavaScript tasks that exfiltrated credentials and enabled xp_cmdshell; the attacker escalated to SYSTEM (using public tools), harvested registry hives, and created backdoor accounts. The investigation found a live Cairn orchestration dashboard on attacker infrastructure and programmatic command patterns (chunked 1,800-byte reads, rapid automated retries, machine-readable output, and job names tracking offsets) supporting the assessment that LLM-driven agents carried out much of the operation. Defenders are advised to restrict and authenticate job-management endpoints, retain job and exception history, hunt for unusual job sequencing and script-engine use, rotate and remove embedded credentials to secrets stores, and deploy automated detection and containment.