CyberStrikeAI agents used in Windows domain takeovers
Securelist says education networks in Africa and Latin America were taken from SQL Server to domain admin in days.
2
Stories per day · 30 days
Relatedlateral-movement2active-directory1ai-agents1artex1cyberstrikeai1dcsync1domain-takeover1education1email-bombing1microsoft-teams1mimikatz1ndr1network-detection1quick-assist1soc1social-engineering1
5 stories, newest first · one card per story
Stories tagged #kerberoasting
Hackers Use ARTEX AI Agents to Automate Active Directory Attacks
Google and Mandiant report ARTEX used since late August 2026 in attacks across multiple sectors including government and tech.
1
Email bombing and external Teams chats used for remote access
Arctic Wolf reports the pattern in more than 400 incidents, with Quick Assist most often used before credential theft.
1
Attackers hide routine activity in the gaps between SOC alerts
The explainer says LDAP, Kerberos, SMB, and slow HTTPS or DNS transfer can look like ordinary business traffic.
CISA Warns Hackers Exploit 17 Active Directory Techniques to Gain Control of Enterprise Networks
CISA and Five Eyes agencies issued joint guidance detailing 17 Active Directory attack techniques like Kerberoasting and DCSync, with hardening and detection advice.
3