CyberStrikeAI agents used in Windows domain takeovers
Securelist says education networks in Africa and Latin America were taken from SQL Server to domain admin in days.
74
Organization
Securelist
- Mentions · 7d1
- Mentions · 30d2
- All mentions4
- First seenSep 17, 2026
- Last mentioned15h ago
Timeline
4 articles · newest firstBlackX bootkit uses Baton Drop to bypass Secure Boot
Securelist says infected diplomatic systems had Windows updates but not the certificate revocation that blocks CVE-2022-21894.
74
Hackers Poison Movie Torrents With MovieReaper Malware That Uses Solana for C2
Poisoned movie torrents deliver MovieReaper malware using Solana blockchain for resilient C2, infecting several hundred victims across multiple continents.
55
NightEagle Hackers Abuse Microsoft Dev Tunnels and GhostContainer to Breach Russian Companies
NightEagle (APT-Q-95) breached Russian firms using stolen VPN credentials, a GhostContainer Exchange backdoor, Dev Tunnels abuse, and DCSync.
74
Related CVEs
by mentions- CVE-2019-0708100%9.8Unauthenticated RCE in Microsoft Remote Desktop Services (BlueKeep)
- CVE-2020-0688100%8.8RCE in Microsoft Exchange Server from Shared Install-Time Validation Keys
- CVE-2022-218947%4.4Secure Boot Security Feature Bypass Vulnerability
Appears with
- Microsoftvendor · 3
- Kasperskyvendor · 2
- Windowsproduct · 2
- Microsoft Exchangeproduct · 1
- BlackLotusmalware · 1
- GhostContainermalware · 1
- SQL Serverproduct · 1
- NightEaglethreat actor · 1
- CyberStrikeAImalware · 1
- BlackXmalware · 1
- MovieReaperproduct · 1
- OxiDLLRunnermalware · 1
- Mimikatzmalware · 1
- APT-Q-95threat actor · 1
- APT41threat actor · 1
- MovieReapermalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.