Attackers use the DCSync technique to impersonate domain controllers and harvest AD password hashes and Kerberos keys without directly compromising domain controllers, Trellix warns.
Per Trellix, threat actors increasingly abuse Active Directory replication via DCSync, using privileged credentials to invoke DRSGetNCChanges and retrieve NTLM password hashes and Kerberos key material without running code on domain controllers. Capturing the krbtgt account hash enables forging Golden Tickets for persistent, highly privileged domain access. Because malicious replication traffic mimics legitimate DRS/RPC activity, defenders should monitor Windows Security Event ID 4662, restrict replication permissions, and investigate replication requests from non-domain-controller systems.
GreyNoise and Blackpoint tracked an AI-assisted actor using OpenAI Codex and DeepSeek agents to exploit PaperCut flaws across 440+ instances in 48 countries.
A suspected Russian-speaking actor exploited the CVE-2026-81578 authentication bypass and CVE-2026-82078 RCE chain in PaperCut NG/MF, compromising at least 440 instances across 395 organizations in 48 countries, heavily targeting education in the US, UK, France, and elsewhere. The actor used hundreds of AI agents powered by OpenAI Codex and DeepSeek plus tools like Mimikatz, SharpHound, Certipy, Rubeus, and Impacket, reaching domain admin at 12 victims and full domain admin at a US high school within seven minutes. Post-exploitation included registry hive collection and Metasploit/Meterpreter payloads, with origin traced to IP 45.142.193.132.
A Russian-speaking actor used hundreds of AI agents to exploit PaperCut flaws, compromising 440 servers across 395 organizations in 48 countries.
GreyNoise's Global Observation Grid observed a Russian-speaking threat actor operating from IP 45.142.193.132 deploy hundreds of autonomous AI agents, built on OpenAI's Codex harness with a DeepSeek model, to exploit PaperCut NG/MF flaws CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (unsafe reflection RCE). At least 440 servers across 395 organizations in 48 countries were compromised; the US had 98 victims and educational institutions accounted for 204. The agents paired with Mimikatz, Certipy, Rubeus, and Impacket, escalated to domain admin in 12 of 440 cases, and executed DCSync to exfiltrate the full NTDS.DIT credential database.
Google/Mandiant profile Breeze Comet, a Brazil-based e-crime group executing fraudulent Pix and STR payment transactions at banks, retailers, and fintechs.
Google Threat Intelligence Group and Mandiant describe Breeze Comet (formerly UNC5669), a financially motivated threat actor active since September 2023 targeting Brazilian financial services, retail, and e-commerce. The group gains access via password spraying, vishing impersonating IT support to install RMM tools like AnyDesk, WhatsApp social engineering, and exploitation of vulnerable JBoss AS servers for web shell deployment. It uses compromised government websites as C2, deploys the Rust-based COBALTSPIN tunneler and multiple custom backdoors (LIGHTPAINT, MILDFROST, KICKPLATE, BOATBEAM), then clears logs after executing hundreds of fraudulent transactions through Pix, STR, and Boleto payment systems. At least one heist yielded tens of thousands of dollars, with infrastructure suggesting expansion toward Latin America and Africa.
Unit 42 attributes three espionage clusters targeting a Southeast Asian government to Stately Taurus, Alloy Taurus, and Gelsemium APTs.
Unit 42 investigated espionage attacks starting in late 2022 against multiple governmental entities in a Southeast Asian country, including critical infrastructure, public healthcare, financial administrators, and ministries. Analysis revealed three distinct clusters: CL-STA-0044 attributed to Stately Taurus (Mustang Panda), CL-STA-0045 to Alloy Taurus (GALLIUM), and CL-STA-0046 to Gelsemium. The first cluster used a ToneShell backdoor variant, ShadowPad, China Chopper web shells, Impacket, and credential dumping tools across roughly Q1 2021 to Q3 2023. All three operated with distinct tools, infrastructure, and long-term surveillance tradecraft consistent with APTs.
Microsoft reports China-linked ransomware group Storm-1175 switched from Medusa to a new C++ strain, StormEncryptor, likely exploiting N-able flaw CVE-2026-18577.
Microsoft Threat Intelligence reports that the financially motivated, China-linked group Storm-1175 began deploying a new ransomware strain called StormEncryptor on August 2, 2026, replacing its previous Medusa ransomware. StormEncryptor is written in C++, appends the .encrypted extension to files, and drops a !!!README_FIRST!!!.txt ransom note in each scanned directory. Microsoft assesses the group is likely exploiting CVE-2026-18577, an authentication bypass in N-able disclosed on August 2, 2026 and added to CISA's Known Exploited Vulnerabilities catalog the next day. Since 2023, Storm-1175 has exploited more than 16 vulnerabilities in products including Microsoft Exchange, Ivanti, ConnectWise ScreenConnect, JetBrains TeamCity, SimpleHelp, CrushFTP, and GoAnywhere MFT, often moving from initial access to data theft and ransomware deployment within days.
Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks
CVE-2026-82078 is an unsafe dynamic class loading flaw (unsafe reflection, CWE-470) in the database connection utilities of PaperCut NG and PaperCut MF: the software instantiates a database driver class based on a configurable driver name without validating it against an allowlist of approved drivers. An attacker who can manipulate system configuration parameters can point that setting at classes of their choosing, causing the server to execute arbitrary Java bytecode residing on the application classpath in the security context of the PaperCut server process. On its own the issue is rated 9.4 (Critical) with high privileges required, but when chained with the companion authentication bypass CVE-2026-81578 it yields unauthenticated remote code execution on the print-management server. All PaperCut NG and MF deployments are in scope; affected version ranges were not specified in the available data, so administrators should consult PaperCut's advisory for fixed versions. The flaw is confirmed exploited in the wild as a zero-day: it was added to CISA's KEV catalog on 2026-08-31, and public reporting describes an AI-orchestrated campaign that compromised PaperCut servers at roughly 395 organizations (~440 servers), with EPSS currently at 1.7% (76th percentile).
Missing Authentication for Critical Function in PaperCut NG/MF Web Interface
CVE-2026-81578 is an improper access control flaw (CWE-305) in the web management interface of PaperCut MF and PaperCut NG in which administrative requests from unauthenticated remote users trigger backend actions before access validation completes. An attacker can invoke administrative functions without logging in, allowing modification of certain system configurations. When chained with CVE-2026-82078 (unsafe dynamic class loading), the flaw has been used to achieve unauthenticated code execution. Any organization running PaperCut NG/MF, particularly servers whose web management interface is reachable from the internet or untrusted networks, is affected. The vulnerability was added to CISA KEV on 2026-08-31 and is being exploited in the wild as part of an AI-orchestrated campaign that compromised roughly 395–440 organizations.
Unauthenticated Arbitrary File Upload RCE in SmarterTools SmarterMail
SmarterTools SmarterMail contains an unrestricted file upload flaw (CWE-434, CVSS 10.0) that lets an unauthenticated attacker upload files of dangerous types over the network without any credentials or user interaction. Because the uploaded files can be written to any location on the mail server, an attacker can drop a file into an executable path and achieve remote code execution on the host, which is why the CVSS scope is changed with high confidentiality, integrity and availability impact. An attacker who lands this foothold gains control of the mail server, and CISA notes known ransomware use, with press coverage linking the wave of SmarterMail exploitation to groups such as Storm-1175 and Warlock. Any organization running an internet-facing SmarterMail server — typically hosting providers, MSPs and SMBs using it as a Windows mail platform — is exposed. Exploitation is active: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-01-26, EPSS puts the 30-day exploitation probability at 85.7% (100th percentile), and a public proof-of-concept exploit is available from watchTowr.
· SmarterTools SmarterMail Affected build range not enumerated in the source data; a vendor patch was available by the time of the CISA KEV listing (2026-01-26), so all unpatched SmarterM KEV ransomware PoC moderate
Authentication Bypass in CrushFTP File Transfer Servers (CVE-2025-31161)
CrushFTP contains an authentication bypass (CWE-305) in its handling of the HTTP authorization header, allowing crafted header values to grant access without valid credentials. A remote, unauthenticated attacker who can reach the server's HTTP/HTTPS interface can use this flaw to authenticate as any known or guessable account, such as the built-in crushadmin user. With administrative access, the attacker can typically achieve full compromise of the file-transfer server, including access to hosted files and user accounts. Any organization running CrushFTP is affected, with internet-exposed instances at the highest risk. The flaw is being actively exploited: it was added to CISA's KEV on 2025-04-07 with known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days.
Unauthenticated Admin Password Reset Bypass in SmarterTools SmarterMail
SmarterTools SmarterMail builds prior to 9511 contain an authentication bypass (CWE-288) in the password reset API: the force-reset-password endpoint accepts anonymous requests and, when targeting a system administrator account, never verifies the existing password or requires a reset token. An unauthenticated remote attacker simply submits a target administrator username and a new password, taking over the system administrator account with no privileges or user interaction required. Because SmarterMail's system administrator role can execute operating system commands through built-in management functionality, this escalation effectively yields SYSTEM/root-level access on the underlying mail server host, making it a path to full server and network compromise. All SmarterMail deployments running builds older than 9511 are affected, with roughly 6,000+ likely vulnerable servers observed exposed to the internet. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-01-26 with known ransomware use (including Storm-1175 and Warlock activity), and public PoCs exist from WatchTowr and Huntress.
· SmarterTools SmarterMail All versions prior to build 9511 KEV ransomware PoC ×2moderate
Authenticated Deserialization RCE in Microsoft Exchange Server (CVE-2023-21529)
CVE-2023-21529 is a deserialization-of-untrusted-data flaw (CWE-502) in on-premises Microsoft Exchange Server that allows remote code execution. Per its CVSS vector, an attacker with valid low-privileged credentials (PR:L) sends crafted untrusted serialized data to the server over the network, requiring no user interaction. Successful exploitation yields code execution on the Exchange server, exposing mail stores and providing a foothold for lateral movement, and related coverage ties it to the fast-moving Storm-1175 ransomware operation, with ransomware use listed as known in CISA's KEV entry. Organizations running self-hosted Exchange Server are in scope; the source data does not list specific affected builds, but the fix shipped in Microsoft's February 2023 Patch Tuesday updates. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-04-13, EPSS estimates a 62.1% probability of exploitation within 30 days (99th percentile), and no public proof-of-concept is known.
Path Traversal RCE in ConnectWise ScreenConnect (CVE-2024-1708)
ConnectWise ScreenConnect 23.9.7 and prior contain a path-traversal flaw (CWE-22, rated 8.4 high) that can allow an attacker to execute remote code or access confidential data and critical systems. Public analysis (Huntress) shows it is triggered by manipulating directory paths in the product's administrative setup wizard, and that it is typically chained with a companion authentication-bypass flaw (CVE-2024-1709) disclosed at the same time to achieve unauthenticated remote code execution on the ScreenConnect server. An attacker who compromises a ScreenConnect server gains control of the remote-access platform itself and can pivot to every endpoint that server manages, making it an efficient foothold for ransomware. Any organization running ScreenConnect 23.9.7 or earlier is affected, most commonly MSPs and IT teams that use the tool to manage client and internal machines. The flaw is being actively exploited in the wild: it is listed in CISA's Known Exploited Vulnerabilities catalog with known ransomware use, EPSS puts the 30-day exploitation probability at 95.5% (100th percentile), and recent reporting ties fast-moving exploitation to the Storm-1175 activity cluster, which drops Medusa ransomware.
· ConnectWise ScreenConnect 23.9.7 and prior KEV ransomware PoC large
Privilege Escalation in Microsoft Active Directory Domain Services
CVE-2021-42287 is an elevation-of-privilege vulnerability in Microsoft Active Directory Domain Services (AD DS) affecting multiple supported Windows Server releases. An attacker with any low-privileged domain account can trigger it — commonly in combination with the related sAMAccountName spoofing flaw CVE-2021-42278 — by manipulating account name attributes so the Kerberos Key Distribution Center issues tickets that grant rights normally reserved for domain controllers. The result is escalation from a standard user to domain administrator, giving the attacker full control over the Windows domain, a capability that is directly useful for ransomware deployment and data theft. Any organization running Active Directory on the affected Windows Server versions is exposed, which amounts to essentially every enterprise Windows network. The flaw is actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-04-11 with known ransomware use, and EPSS assigns it a 77.2% probability of exploitation within 30 days.
· microsoft windows server 2004 windows server 2004 · microsoft windows server 2008 windows server 2008 KEV ransomwaremass
Unauthenticated Path Traversal File Download in SimpleHelp 5.5.7 and Earlier
CVE-2024-57727 consists of multiple path traversal vulnerabilities (CWE-22) in SimpleHelp remote support/remote access software that affect versions 5.5.7 and earlier. Because affected request handlers do not properly validate file paths, an unauthenticated remote attacker can send crafted HTTP requests to traverse directories and download arbitrary files from the SimpleHelp server host. The attacker gains access to sensitive server configuration files containing secrets and hashed user passwords, which can support follow-on attacks such as offline password cracking and deeper compromise; ransomware operators have chained SimpleHelp flaws in double-extortion attacks, including against an MSP and its downstream customers. Any organization running SimpleHelp is affected, particularly internet-facing deployments and MSPs that use the product for remote support and access. Exploitation is confirmed in the wild: CISA added the flaw to the KEV on 2025-02-13 with known ransomware use, EPSS assigns a 95.2% probability of exploitation within 30 days, and reporting links exploitation to campaigns such as a DragonForce operator targeting an MSP and its customers and Storm-1175 ransomware activity.
· SimpleHelp (remote support/remote access software) 5.5.7 and all earlier versions KEV ransomwaremoderate
Path Traversal in JetBrains TeamCity Allows Limited Admin Actions
JetBrains TeamCity, a widely used continuous integration/continuous delivery (CI/CD) server, contains a relative path traversal vulnerability (CWE-23) in which the application fails to properly neutralize traversal sequences in file paths. An attacker who can reach the vulnerable component can supply crafted relative paths that escape the intended directory, gaining the ability to perform limited administrative actions on the TeamCity server. Any organization running an affected JetBrains TeamCity deployment, especially instances exposed to the internet or reachable by untrusted users, is potentially affected. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2026-04-20 with known ransomware use, and the EPSS model assigns it a 100% probability of exploitation within the next 30 days. No public proof-of-concept is known, but the KEV listing confirms active exploitation in the wild per CISA.
· JetBrains TeamCity Affected as listed by CISA; the source data provides no specific affected version ranges, so verify exact affected and patched versions in JetBrains' security b KEV ransomware PoC large
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.