Agentic Ransomware Just Cut the Time OT Defenders Thought They Had
Sysdig's discovery of a fully autonomous ransomware operation shows how fast intrusions move when AI handles the decision-making, and why that timeline compression matters even for OT networks a few hops from the internet.
Ransomware crews used to need a human at the keyboard for the messy middle part: escalating privileges, deciding which shares to hit, tuning evasion when an EDR agent flagged something. Sysdig says it found an operation where that middle part is now handled by an autonomous agent, an AI system that makes those calls itself, in real time, without waiting for an operator to approve each step. Researchers are calling it the first fully agentic ransomware campaign, and whether or not it’s the literal first, it’s a preview of where the median attack is heading.
Pair that with the kernel-level evasion techniques Sysdig also documented, and the combination gets ugly fast. Kernel-mode tooling lets malware blind or bypass the security sensors sitting above it in the OS, so the usual detection signals, process creation anomalies, unusual network calls, never get generated in the first place. An agentic decision loop that adapts around defenses, running on top of tooling that already evades the sensors watching for it, means dwell time inside a network gets shorter, not because attackers are rushing, but because they no longer need the pauses a human operator used to introduce.
Why This Isn’t Just an IT Problem
The instinct in OT circles is to read this and think “ransomware, that’s an IT thing, we’ve got segmentation.” Fair, mostly. But most ransomware doesn’t start in the OT network. It becomes an OT incident the moment a plant has to shut down production because the business systems that schedule, invoice, or safety-case the plant go dark. Colonial Pipeline didn’t get its pipeline controllers encrypted. It shut down anyway. The compressed timeline Sysdig describes shrinks the window between “ransomware lands on a laptop in finance” and “the SOC has to decide whether to isolate the OT network as a precaution,” and that decision window is exactly where a lot of OT incident response plans still assume hours, not minutes.
The other reason this matters for OT specifically: a lot of detection strategy in industrial environments leans on the assumption that attackers move slowly and clumsily once they cross from IT into OT, because they’re unfamiliar with the protocols, the vendor quirks, the segmentation logic. That assumption was already shaky. An agent that can be pointed at a new environment and told to find the path of least resistance doesn’t need years of manual OT tradecraft. It needs training data and time, and time is getting cheaper for attackers every quarter.
None of this means OT defenses stop working. It means the assumptions behind how those defenses get tested need to catch up to how fast the threat actually moves.
The practical takeaway isn’t “buy an AI defense tool to fight an AI attacker,” even though that pitch is coming from every vendor booth this year. It’s that segmentation rules, firewall policies, and jump-host configurations validated eighteen months ago and never rechecked are exactly the kind of thing an agentic operator finds first, because agents are relentless about probing for the boundary that was configured once and never re-tested. If your IT/OT segmentation has drifted since the last tabletop exercise, and it almost certainly has, that drift is the gap that gets found faster now, not slower.
The uncomfortable question every OT security lead should be asking this quarter isn’t “are we ready for agentic ransomware.” It’s “when did we last actually verify, not assume, that the segmentation controls between our IT and OT networks still do what the diagram says they do.” Sysdig’s research is a signal that the cost of getting that answer wrong just went up, because the attacker side of the equation no longer needs to sleep.