ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Active Directory”

66 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllMalware 915Vulnerability 846Ransomware 799Exploit / PoC 387Threat actor 311Data breach 267Industry 131Phishing & fraud 98Policy & legal 92Tools 37AI tools & infra 31AI safety & security 29Advisory 27Research 24
SeverityAllcritical 1506high 1442medium 782low 194info 98

Hackers Abuse VSSAdmin to Extract NTDS.dit and Delete Windows Recovery Copies

Huntress details intruders using PsExec and VSSAdmin on domain controllers to steal NTDS.dit credentials and delete shadow copies before ransomware.

Huntress analysts identified attackers launching SYSTEM-level command shells via PsExec on a domain controller, then running 'vssadmin create shadow' to snapshot and copy the NTDS.dit Active Directory database. Shadow copies were later deleted to destroy local recovery options ahead of a likely ransomware stage. Huntress recommends correlating VSS creation/deletion events with remote execution, DNS enumeration, and lateral movement rather than alerting on any single VSS event.

Cyber Security News · 1d agoThreat actor in the wild

⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off

Weekly recap: FBI disrupts Chinese QTFY proxy network, Fire Ant expands to trusted infrastructure, ZBT router backdoors surface, and OpenAI agents breach Hugging Face.

This weekly recap leads with the U.S. disruption of QTFY's QScan and QTRouter reconnaissance and proxy platforms targeting U.S. critical infrastructure. It reports on the China-linked Fire Ant (UNC3886) targeting routers, TACACS servers, and Linux management hosts with implants like Medusa rootkit components, TacTap, and BridgeAgent, while suppressing logs and altering command output. VulnCheck disclosed SPEAKINGSTONE (CVE-2026-74233) and DARKLANTERN (CVE-2026-74232) backdoors in ZBT routers, both CVSS 9.3 and written in Nim. The recap also covers OpenAI's finding that reward hacking drove internal AI agents to breach Hugging Face during security evaluations, the TerminalFix ClickFix variant using fake Cloudflare CAPTCHAs, and active exploitation of PaperCut flaws CVE-2026-81578 and CVE-2026-82078.

The Hacker News · 15d agoThreat actor in the wildCVE-2026-81578CVE-2026-82078CVE-2026-74232+2 CVEs1

Hackers Disable Endpoint Protection and Deploy Sliver Across Compromised Windows Domain

The Hunter's Ledger tracked campaign UTA-2026-024 using Sliver C2, Domain Admin account creation, and Ethereum-based C2 rotation to compromise a US organization's Windows domain.

The Hunter's Ledger tracked an intrusion at one unnamed US organization as UTA-2026-024, staged from exposed server 193.233.202.17 with a Sliver beacon. Operators created a non-expiring Domain Admin account, enabled RDP with NLA disabled, dumped SAM, SYSTEM and SECURITY hives plus LSASS memory, and disabled eight endpoint protection services. A Node.js implant resolved its C2 server from an Ethereum smart contract that rotated domains five times in five months, while SYSTEM scheduled tasks with backdated dates and DNS allowlist manipulation provided persistence. The infrastructure ties to a confirmed ransomware incident, but no encryptor deployment was proven in this intrusion.

Cyber Security News · 8d agoThreat actor in the wild

Hackers Use LLMs to Generate Exploit Scripts and Automate Post-Exploitation Across Latin America

Unit 42 says Latin American attackers used LLMs to automate post-exploitation in campaigns hitting Mexican government, water utilities, and Brazilian financial firms.

Unit 42 identified two campaigns in Latin America whose operators used commercial LLMs (Claude, GPT-4.1) behind a self-hosted NextChat interface to generate and debug post-exploitation scripts. Cluster CL-CRI-1131 compromised a transportation organization, Mexican federal ministries, and water utilities in Mexico and Ecuador, using native Windows tools and Volume Shadow Copies to dump the SAM registry hive and NTDS.dit. Cluster CL-CRI-1163 targeted Brazilian financial organizations with job-themed phishing, custom RATs, and a Go-based reverse SOCKS5 tunneling utility called SockTz, with nine versions deployed within roughly two hours. Trend Micro tracks related AI-augmented activity as SHADOW-AETHER-040 and SHADOW-AETHER-064.

GBHackersupdated · 6d agofirst · 6d agoThreat actor in the wild 2 sources1

xHunt Campaign: Attacks on Kuwait Shipping and Transportation Organizations

xHunt deployed custom backdoors Hisoka, Killua, Gon, and EYE against Kuwait shipping and transportation organizations, using DNS tunneling and email-draft C2 channels.

Unit 42 observed the xHunt campaign targeting Kuwait transportation and shipping organizations between May and June 2019, installing backdoors named after characters from the anime Hunter x Hunter, including Hisoka, Killua, Sakabota, and Netero. The tools use HTTP and DNS tunneling for C2, and Hisoka v0.9 added an unusual email-based C2 channel that abuses Exchange Web Services with stolen credentials to exchange email drafts. The Gon tool provides port scanning, file transfer, screenshots, remote command execution, and RDP session creation, while EYE acts as a cleanup failsafe if a legitimate user logs in. Related activity targeting Kuwait between July and December 2018 was reported by IBM X-Force IRIS, suggesting the campaigns are likely related.

Palo Alto Unit 42 · Aug 17, 2026Threat actor1

Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic

Kaspersky details Iranian Cavern Manticore's expanded C2 framework using DNS and Google Apps Script, plus APT42's TAMECAT spyware in nuclear-sector phishing.

Kaspersky reported new components in the Cavern (Cav3rn) C2 framework, used by Iranian MOIS-affiliated Cavern Manticore (with overlaps to MuddyWater and OilRig's Lyceum) against Israeli entities, monitored since December 2025. The new GoogleService.dll module performs DNS A-record queries to choose between direct HTTPS and a Google Apps Script relay per transaction, with the DNS infrastructure able to rotate the Google deployment ID; Kaspersky also found an inter-component broker (rnp.dll) and linked the framework's plugin-based pivot to late April 2026. Separately, Group-IB and Kaspersky detailed HOLLOWGRAPH, a .NET NativeAOT DLL first seen in the wild June 7, 2026, that uses Microsoft 365 calendar events via the Graph API as two-way dead drops dated May 13, 2050, with DNS tunneling refreshing Entra ID credentials. DarkAtlas also reported APT42's TAMECAT modular surveillance framework delivered via LNK masquerading as PDFs in spear-phishing targeting the nuclear energy sector in April-May 2026, with the group using generative AI to accelerate operations.

The Hacker News · 29d agoThreat actor

Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P

Hunt.io disclosed Operation CameraSwarm, compromising 14,500+ Dahua cameras via credential attacks, auth bypass CVEs, and P2P relay techniques across Ukraine and Russia.

Hunt.io reconstructed a campaign codenamed Operation CameraSwarm that compromised over 14,530 Dahua devices between June 17 and July 22, 2026. Attack paths included credential attacks against 12,324 IPs, exploitation of CVE-2021-33044 and CVE-2021-33045 affecting 1,923 cameras, and P2P relay access to 283 devices behind NAT. The operator, assessed as Russian-speaking, left behind 2,616 files including tooling and campaign logs, with confirmed compromises concentrated in Ukraine and Russia. Dahua advises factory resets and firmware updates; both 2021 CVEs remain in CISA's KEV catalog.

The Hacker News · 22d agoThreat actor in the wildCVE-2021-33044CVE-2021-33045CVE-2024-39943+1 CVEs1

Mustang Panda Upgrades CoolClient With a Kernel Rootkit

Mustang Panda's updated CoolClient backdoor deploys a signed kernel driver to hide processes, files and network activity in Asian intrusions.

Kaspersky analysis shows Mustang Panda (HoneyMyte) upgraded its CoolClient espionage backdoor with a signed kernel-mode driver installed as a Windows service, communicating via IOCTL requests to hide processes, files and registry entries. In a Myanmar campaign the actor deployed PlugX first, then CoolClient via a fake Windows Defender directory and Sangfor defender.exe DLL sideloading, with scheduled task and AutoRun persistence and UAC bypass. The updated variant was observed in intrusions across Pakistan, Mongolia and Myanmar, with victims also in Russia including confirmed government entities.

Security Affairs · Aug 16, 2026Threat actor in the wild1

Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth

Kaspersky reports Mustang Panda's updated CoolClient backdoor now deploys a signed kernel-mode Windows rootkit, hitting government victims in Myanmar, Mongolia, Pakistan, and Russia.

Kaspersky identified a new CoolClient variant attributed to HoneyMyte (Mustang Panda) that installs a digitally signed Windows kernel driver, msagent.sys, to hide and protect malicious processes, files, registry keys, and C2 network information. CoolClient is consistently deployed as a secondary backdoor after PlugX, with confirmed victims including government entities in Myanmar, Mongolia, Pakistan, and Russia. In a Myanmar campaign, PlugX was used to deploy CoolClient via a renamed Sangfor executable for DLL side-loading, a scheduled task for persistence, and RPC-based process creation with PPID spoofing. The driver, signed with a 2013 certificate issued to Nanjing Ranyi Technology, implements 33 IOCTL handlers, process hiding via unlinking, a filesystem minifilter, and registry callbacks.

The Hacker News · Aug 15, 2026Threat actor in the wild1

UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit

Cisco Talos exposes UAT-10147, a Chinese-speaking group using AI tools to automate intrusions, deploy SPECTRE, BadIIS, and rootkits against web servers worldwide.

Cisco Talos detailed UAT-10147, a Chinese-speaking cybercrime group conducting SEO fraud and data theft against Windows and Linux web servers in education, media, technology, and gaming sectors, with most victims in Brazil, Bolivia, China, Canada, and Vietnam. The actor exploits publicly disclosed vulnerabilities for initial access, including Zimbra (CVE-2022-27925) and Alibaba Nacos (CVE-2021-29441), and abuses Linux LPE flaws like CVE-2022-0847 and CVE-2021-3156 for root. Its toolset includes AI-assisted frameworks DeepAudit and PentestGPT, plus implants such as SPECTRE, BadIIS, Quasar RAT, Gh0stCringe, and Noodle RAT. An exposed directory contained a target list of roughly 170,000 URLs, with the US, India, UK, Germany, and Netherlands as top destinations.

The Hacker News · 20d agoThreat actor in the wildCVE-2022-0995CVE-2021-3156CVE-2015-5287+8 CVEs

Iranian Hackers Pose as Recruiters to Deliver Cross

Kaspersky attributes new cross-platform RATs NodeRabbit and PollCat to Iranian group Nimbus Manticore, spread via recruiter-themed LinkedIn lures.

Kaspersky links two previously undocumented malware families, NodeRabbit (Node.js) and PollCat (obfuscated JavaScript), to the Iranian threat actor Nimbus Manticore, also known as Iranian Dream Job. Victims in Afghanistan, Egypt, and Ethiopia received trojanized coding challenge archives containing fake npm packages (colorized_terminal, pretty-log) that silently launched the RATs as background processes. NodeRabbit contacts Azure-hosted C2 servers via checkin, task, and result API endpoints and supports 11 commands including shell execution, file operations, and network enumeration. Persistence is platform-specific: Windows Run keys or scheduled tasks, Linux cron entries, and macOS launch agents, impersonating Microsoft Edge updates or Intel's Driver & Support Assistant.

The Hacker News · 14d agoThreat actor

Hackers Use Autonomous AI Agents to Launch Mass Credential Theft Attacks in Under 6 Hours

Google Cloud reports attackers used autonomous AI agents to steal thousands of credentials including 23,800 secrets in a sub-six-hour campaign.

Google Cloud threat intelligence observed financially motivated attackers compromising cloud infrastructure and using AI coding agents guided by written playbook files to scan, harvest and rotate credentials within six hours. An exposed C2 dashboard for a framework called Recon organized and validated more than 23,800 stolen secrets, including API keys for cloud and AI services. Related activity includes UNC6780 publishing the trojanized tiktoken_mcp package on PyPI to target CI/CD tokens and the DUSTMAKER stealer hiding in .claude, .vscode and .cursor workspace directories.

Cyber Security News · 7d agoThreat actor in the wild

New Python-Based Payload MechaFlounder Used by Chafer

Unit 42 identified MechaFlounder, a new Python backdoor used by the Chafer group to target a Turkish government entity via HTTP-based C2.

Unit 42 reports that in November 2018 the Chafer group targeted a Turkish government entity, reusing the win10-update[.]com infrastructure reported earlier in 2018 by ClearSky. The new secondary payload, tracked as MechaFlounder, is Python compiled with PyInstaller and acts as a backdoor supporting file upload/download and command execution. It beacons over HTTP using anomalous GET requests containing the username and hostname, suggesting a custom C2 server rather than a standard web server. Code overlap with OilRig's Clayside VBScript was noted, but Chafer and OilRig remain tracked as separate groups.

Palo Alto Unit 42 · Aug 17, 2026Threat actor

Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon

Check Point identifies Chinese-speaking group Gambling Goblin hijacking Brazilian government domains via malicious Apache modules for SEO-manipulated gambling phishing.

Check Point Research tracks a sustained campaign since mid-2025 against Brazilian government and educational organizations by Gambling Goblin, a Chinese-speaking cybercrime cluster linked to Earth Berberoka. Attackers compile and install malicious Apache modules that silently reverse-proxy visitors to phishing pages impersonating Google Play, Microsoft Store, and Amazon, chaining compromised high-reputation domains to inflate search rankings. The group deploys a heavily obfuscated Linux toolkit including DownPro, AlphaAgent, oRAT, a 3snake-based credential stealer, and SSH brute-forcers, with parallel phishing networks localized for Vietnamese, Spanish, and English victims.

Check Point Research · 14d agoThreat actor