CyberStrikeAI agents used in Windows domain takeovers
Securelist says education networks in Africa and Latin America were taken from SQL Server to domain admin in days.
2
Stories per day · 30 days
Relatedactive-directory1ad-cs1cyberstrikeai1domain-takeover1education1kerberoasting1microsoft-teams1mimikatz1quick-assist1social-engineering1
15 stories, newest first · one card per story
Stories tagged #dcsync
Fake Teams IT help desk sessions abused AD CS for domain access
Two Microsoft-disclosed intrusions used Quick Assist plus ESC1 or ESC8, then DCSync and Rclone in one case.
2
FBI Warns Chinese Hackers Use Automated Tools and Botnets to Steal Sensitive Data
FBI and partners warn China-linked Integrity Technology Group uses scanning, botnets, and hands-on access to steal data.
NightEagle Uses BlueKeep and DCSync to Move Toward Active Directory Domain Controllers
NightEagle espionage group used GhostContainer, BlueKeep exploitation, and DCSync attempts to compromise Russian organizations and target Active Directory controllers.
3
NightEagle Hackers Abuse Microsoft Dev Tunnels and GhostContainer to Breach Russian Companies
NightEagle (APT-Q-95) breached Russian firms using stolen VPN credentials, a GhostContainer Exchange backdoor, Dev Tunnels abuse, and DCSync.
NightEagle Hackers Target Russian Companies Using GhostContainer Backdoor
Kaspersky links NightEagle (APT-Q-95) intrusions in Russia to stolen VPN credentials, the GhostContainer Exchange backdoor, BlueKeep exploitation, and covert tunneling for espionage.
NightEagle targets Russian companies
Kaspersky links NightEagle (APT-Q-95) attacks on Russian firms to compromised VPN credentials, a GhostContainer Exchange backdoor, RDP tunneling, BlueKeep exploitation, and DCSync.
CISA Warns Hackers Exploit 17 Active Directory Techniques to Gain Control of Enterprise Networks
CISA and Five Eyes agencies issued joint guidance detailing 17 Active Directory attack techniques like Kerberoasting and DCSync, with hardening and detection advice.
3
AI-powered attack exploited PaperCut flaws to hack 395 organizations
AI-driven campaign exploited PaperCut flaws CVE-2026-81578 and CVE-2026-82078, compromising 440 servers at 395 organizations in 48 countries.
4
Hackers Steal Active Directory Password Hashes Without Attacking Domain Controllers Directly
Attackers use the DCSync technique to impersonate domain controllers and harvest AD password hashes and Kerberos keys without directly compromising domain controllers, Trellix warns.
3
Hackers Pose as Domain Controllers to Steal Active Directory Password Hashes
Attackers abuse Active Directory replication (DCSync) via the DRSUAPI protocol to steal password hashes and forge Golden Tickets for persistent domain compromise.
5
Hackers Deploy Hundreds of AI Agents to Compromise 440 PaperCut Servers
AI-agent campaign exploited PaperCut CVE-2026-81578 and CVE-2026-82078, compromising 440 servers at 395 organizations and reaching Domain Admin in 12.
2
Hackers Use Hundreds of AI Agents to Exploit PaperCut Flaws and Compromise 440 Servers Worldwide
A Russian-speaking actor used hundreds of AI agents to exploit PaperCut flaws, compromising 440 servers across 395 organizations in 48 countries.
5
Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF
AI-orchestrated campaign exploited PaperCut NG/MF RCE (CVE-2026-81578/82078), compromising 440+ instances at 395 organizations in 48 countries.
4
CISA Red Team Fully Compromised Two Critical Infrastructure Orgs
CISA red teams achieved full domain and cloud compromise at two critical infrastructure orgs; one SOC never detected the intrusion.