Attackers use CyberStrikeAI to direct intrusions at schools
Kaspersky says a human operator used an LLM on the C2 server to pick tools while Go beacons ran commands on compromised hosts.
3
Stories per day · 30 days
2 RSS
Relatedcommand-and-control1cyberstrikeai1education1eternalblue1kaspersky1legacy-systems1nik-c21openai1post-exploitation1ransomware1red-team1windows-71
12 stories, newest first · one card per story
Stories tagged #credential-dumping
Talos details NIK C2, an AI-enabled Windows implant seen live
Operators can dump credentials, log keystrokes, call OpenAI from the host, and deploy screen-lock ransomware.
7
Pen test: domain-joined Windows 7 server yielded domain admin via EternalBlue
A leetspeak insult password was a real domain admin credential; the outdated domain-joined machine, not a weak password, was the entry point.
1
Hackers Turned a Microsoft SQL Server Into a Command and Data Exfiltration Channel
Attackers abused a Viva Aerobus SQL Server to run commands and steal files, then exposed tools and data online.
5
Exposed Hacker Server Reveals Toolkit Used in Viva Aerobus-Linked Intrusion
ThreatMon exposed an unauthenticated attacker staging server revealing MSSQL intrusion tooling and stolen data linked to a Viva Aerobus environment.
4
Local AI Model Modifies Windows Credential Dumper to Bypass EDR Detection
A local uncensored Qwen model revised an LSASS dumper until two lab EDRs no longer detected it.
3
Uncensored Local AI Model Bypasses EDR to Dump Windows LSASS Credentials
An uncensored local Qwen derivative generated an LSASS dumper that evaded two EDRs in lab tests.
2
Microsoft Finds Ransomware Group Using Same Attack Blueprint Across Multiple Malware Families
Microsoft says affiliate Storm-2570 reused one playbook across Qilin, DragonForce, Anubis, and BERT.
2
Hackers Steal NTDS.dit to Dump Active Directory Password Hashes and Forge Golden Tickets
Trellix details how attackers dump the NTDS.dit Active Directory database via shadow copies to harvest NTLM hashes and forge persistent Golden Tickets.
4
Hackers Turn Windows Shadow Copies Into a Tool for Credential Theft and Ransomware
Attackers abuse Windows VSS shadow copies to delete recovery points before ransomware and to extract NTDS.dit/SAM credentials, demanding context-aware detection.
5
Credential Theft: How Attackers Steal & Use Stolen Credentials
Huntress explains how attackers steal credentials through phishing, AitM, infostealers, and dumping, then use them for lateral movement, BEC, and ransomware.
Hackers Deploy Hundreds of AI Agents to Compromise 440 PaperCut Servers
AI-agent campaign exploited PaperCut CVE-2026-81578 and CVE-2026-82078, compromising 440 servers at 395 organizations and reaching Domain Admin in 12.
2