8 Minutes to Admin. We Caught It in the Wild.

Sergej Epp, CISO, Sysdig, speaks at [un]prompted 2026 on: 8 Minutes to Admin. We Caught It in the Wild. Welcome to VibeHacking. We caught two AI-assisted attack campaigns —an 8-minute AWS escalation from stolen creds to full admin, and EtherRAT, a f...

Sergej Epp, CISO, Sysdig, speaks at [un]prompted 2026 on: 8 Minutes to Admin. We Caught It in the Wild. Welcome to VibeHacking.

We caught two AI-assisted attack campaigns —an 8-minute AWS escalation from stolen creds to full admin, and EtherRAT, a fileless Node.js implant using Ethereum smart contracts for C2. Neither campaign introduced novel attack primitives. Both compressed known techniques to speeds and scales that break traditional detection models. This talk dissects both operations from primary forensic evidence, introduces a behavioral methodology for attributing AI-assistance when proof is impossible, and shows why blockchain C2—the attacker's resilience play—is actually the defender's greatest forensic gift.