Use Alternate Authentication Material
Instead of using a regular username and password, hackers steal digital 'keys'—like saved login sessions or special access codes—that the system already trusts. By using these stolen keys, they can sneak into other parts of a network or AI service without needing to log in again, effectively tricking the system into thinking they are a legitimate user.
Adversaries perform lateral movement by harvesting and reusing non-password authentication artifacts, such as NTLM hashes, Kerberos tickets (Pass-the-Ticket), or OAuth/API tokens. In the context of AI services, these artifacts are often intercepted from client-side storage or insecure memory, allowing the attacker to impersonate a session and bypass standard authentication workflows.
The technique involves the unauthorized acquisition and subsequent replay of authentication material—including but not limited to password hashes, Kerberos TGTs/TGSs, and application-layer access tokens—to facilitate lateral movement and privilege escalation. By injecting these artifacts into the authentication process, an adversary bypasses primary credential validation mechanisms, thereby subverting system access controls and maintaining persistent, authenticated access to AI service endpoints and integrated infrastructure.