Server Takeover: AI Agents and an Exposed Spring Batch Endpoint

ReliaQuest found that AI agents carried out much of a server takeover, moving from one unauthenticated Spring Batch endpoint to SYSTEM control and a credential dump in under 24 hours (ReliaQuest). The attackers used no malware and no zero-day. A live Cairn agent orchestration panel on the attacking address was the strongest sign that agents did the work, which ReliaQuest assesses with high confidence.

What happened

The attackers wanted full control of the server and the credentials stored on it. ReliaQuest does not name the victim and describes it as one target among many the attackers had prepared for.

The entry point was a feature on an internet-facing Apache Tomcat server that ran submitted Spring Batch jobs without a login. The agents used the Nashorn JavaScript engine to run code inside the application, which started no new process. They found plaintext credentials with SQL Server sysadmin rights in configuration files, enabled xp_cmdshell, and used PrintSpoofer and GodPotato to reach SYSTEM. They then saved the SAM, SYSTEM, and SECURITY registry hives and created two administrator accounts, deleting one and leaving the other in place.

Three addresses did the work. 204.194.55[.]189 submitted the jobs and hosted the Cairn panel, 204.194.54[.]240 hosted a model proxy and tool-named files, and 94.177.131[.]113 collected output returned through error messages in 1,800-byte chunks. The agents fixed their own failed payloads within a minute, and nearly half the gaps between commands were under five seconds.

How it could have been caught

Running code inside an application hides from tools that watch for new processes, but taking over the machine still requires the operating system. The first behavior a baseline would have flagged is the database server starting a command shell, since SQL Server on that host had never done so. Every step after that, from tool downloads to registry exports, adds another first-seen process.

What this looks like in Trace

Here is the takeover traced on the victim’s server. The tools, techniques, and attacker addresses come from ReliaQuest’s report. Host names, which address each step reached, and timings are illustrative, shown as hours and minutes.

Network trace. Workload app/batch-portal, the Tomcat server and its SQL Server database. Each row is a tuple Trace’s sensor recorded, checked against the baseline.

Inference. The agents reached their model through a proxy on the attackers’ server, so those calls never crossed the victim’s network. Any agent component left on the host that needed a model would have to pass through the AI proxy or start a model process the server had never run.

Traceback. At T+1:40 the triage agent opens a case and follows the chain:

cmd → sqlservr (xp_cmdshell) → sysadmin login from tomcat (java) → batch job from 204.194.55[.]189 → no deploy → no commit → no ticket

The chain ends at a batch job with no change behind it, and that dead end is the finding.

Verdict: an outside intrusion run by AI agents through an exposed application feature. The case goes to the security team with the shell under SQL Server, the download address, and the job source attached, at T+1:40, about 11 minutes before the first SYSTEM tool ran and 26 minutes before the credential dump.

This analysis reconstructs the incident from public reporting and walks through where Trace would have raised the first alert inside the victim’s cloud. Detection times are illustrative.