GOLD OGRE used Cursor agents to reach domain admin for Aur0ra
Sophos says three networks where agents gained domain management later appeared on the Aur0ra leak site.
76
Malware
Cobalt Strike
- Mentions · 7d3
- Mentions · 30d9
- All mentions15
- First seenAug 17, 2026
- Last mentioned10h ago
Timeline
15 articles · newest firstGOLD OGRE automated Aur0ra intrusions with Cursor and Claude
Agents moved from stolen VPN access to domain management, and three of those victims later hit the leak site.
74
ESET: Belarus-linked FrostyNeighbor wipes Ukrainian transport manufacturer
UNC1151 used Chisel, UltraVNC, Cobalt Strike and a VBScript wiper delivered through Group Policy.
74
Ransomware groups exploit Palo Alto GlobalProtect flaw CVE-2026-0257
Unit 42 has investigated intrusions since early June; Qilin, Inc, and Settra are among the operators named.
84
AI Decision Models and Their Impact on AI SOC Platforms
Decision models from TypeSafe, OpenAI, and Cribl offer scored answers aimed at SOC alert triage.
52
Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups
Qilin and Settra are still exploiting Palo Alto CVE-2026-0257 to open unauthorized VPN sessions.
78
Ransomware Actors Exploiting Palo Alto GlobalProtect Flaw for Stealthy VPN Access
Qilin and Settra are exploiting Palo Alto GlobalProtect CVE-2026-0257 for unauthorized VPN access.
83
CyberXero Combines Claude Code, PentAGI and Cobalt Strike in AI-Augmented Cyberattacks
CyberXero used Claude Code, PentAGI and Cobalt Strike to breach sites and steal Ukrainian data.
82
Russian-Speaking CyberXero Uses AI Agent Swarm to Attack Ukrainian Energy Infrastructure
CyberXero used WordPress exploits and Claude agents against Ukrainian energy targets, stealing hundreds of thousands of records.
84
Multi-View Fusion for Encrypted C2 Detection: A Leakage-Controlled Measurement Study of Evaluation Pitfalls
A leakage-controlled study of Cobalt Strike TLS flows finds fusion gains are tiny and evaluation pitfalls dwarf real detection effects.
46
When Agents Look Like Beacons: NIDS Evasion by Model Context Protocol Traffic
Research shows Model Context Protocol agent traffic structurally resembles C2 beaconing and evades Suricata signatures and RITA behavioral scoring in testbeds.
42
Conti ransomware crew member sentenced to four years in prison
Ukrainian national Oleksii Lytvynenko sentenced to four years in the US for his role in Conti ransomware attacks on at least 12 companies.
45
H1 2026 Malware Vulnerability Trends
Recorded Future's H1 2026 report finds 215 actively exploited CVEs, RAT dominance, NFC payment fraud, and AI-augmented but not autonomous tradecraft.
78
Threat Assessment: Egregor Ransomware
Unit 42 assesses Egregor ransomware, a Sekhmet variant likely run by former Maze affiliates using Qakbot, IcedID, and Ursnif for initial access.
55
Another Apache Log4j Vulnerability Is Actively Exploited in the Wild (CVE-2021
Apache Log4j 2 RCE CVE-2021-44228 is actively exploited via crafted JNDI lookups; Palo Alto Unit 42 urges upgrading to Log4j 2.17.1.
92
Related CVEs
by mentions- CVE-2026-025795%7.8Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway
- CVE-2026-4815<1%8.7A SQL Injection vulnerability has been found in Support Board v3.7.7
- CVE-2021-44228100%10.0JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell)
- CVE-2021-45046100%9.0Remote Code Execution in Apache Log4j2 via Incomplete Log4Shell Fix
- CVE-2023-2753281%7.5Missing Authentication in Veeam Backup & Replication Exposes Stored Credentials
- CVE-2017-564590%9.8In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially…
- CVE-2019-1757169%9.8Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code…
- CVE-2021-4483298%6.6Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when…
- CVE-2021-45105100%5.9Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups
Appears with
- Palo Alto Networksvendor · 5
- Anthropicvendor · 4
- Unit 42organization · 3
- Prisma Accessproduct · 3
- PAN-OSproduct · 3
- GlobalProtectproduct · 3
- ReliaQuestorganization · 3
- Settrathreat actor · 3
- Palo Alto Networksorganization · 3
- Qilinthreat actor · 3
- Kharkiv district heating providervictim · 2
- GOLD OGREthreat actor · 2
- CloudSEKorganization · 2
- WSOmalware · 2
- Sophosorganization · 2
- Cursorvendor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.