GOLD OGRE used Cursor agents to reach domain admin for Aur0ra
Sophos says three networks where agents gained domain management later appeared on the Aur0ra leak site.
Stories per day · 30 days
2 RSS
10 stories, newest first · one card per story
Stories tagged #cobalt-strike
CyberXero Used 51 AI Agents to Steal 628,000 Ukrainian Records
Russian-speaking initial access broker CyberXero ran 51 Claude Code AI agents to steal 628,000 Ukrainian records, per SOCRadar.
6
CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records
Russian-speaking broker 'CyberXero' used Claude Code agents and Cobalt Strike to steal 628,000+ Ukrainian records via WordPress and critical infrastructure attacks.
Russian-Speaking CyberXero Uses AI Agent Swarm to Attack Ukrainian Energy Infrastructure
CyberXero used WordPress exploits and Claude agents against Ukrainian energy targets, stealing hundreds of thousands of records.
Multi-View Fusion for Encrypted C2 Detection: A Leakage-Controlled Measurement Study of Evaluation Pitfalls
A leakage-controlled study of Cobalt Strike TLS flows finds fusion gains are tiny and evaluation pitfalls dwarf real detection effects.
When Agents Look Like Beacons: NIDS Evasion by Model Context Protocol Traffic
Research shows Model Context Protocol agent traffic structurally resembles C2 beaconing and evades Suricata signatures and RITA behavioral scoring in testbeds.
Conti Hacker Who Built Malware and Attacked Victims Gets Four-Year Sentence
Ukrainian lawyer and Conti malware developer Oleksii Lytvynenko was sentenced to four years in U.S. prison for wire fraud conspiracy tied to Conti ransomware.
1
Ukrainian lawyer's second career as a Conti coder earns him 4 years behind bars
Ukrainian lawyer turned Conti malware coder sentenced to four years in US prison, ordered to forfeit $25,042 in Bitcoin.
2
H1 2026 Malware Vulnerability Trends
Recorded Future's H1 2026 report finds 215 actively exploited CVEs, RAT dominance, NFC payment fraud, and AI-augmented but not autonomous tradecraft.
9
Threat Assessment: Egregor Ransomware
Unit 42 assesses Egregor ransomware, a Sekhmet variant likely run by former Maze affiliates using Qakbot, IcedID, and Ursnif for initial access.
3