White House network used as residential proxy exit spot
Devices on the White House network appear to be serving as residential proxy exit nodes, raising risks of lateral movement into internal systems via potentially vulnerable SDKs.
2
Stories per day · 30 days
2 RSS
Relatedssh3tailscale3headscale2kerberoasting2privilege-escalation2active-directory1ai-agents1ai-attack1ai-framework1artex1cloud-infrastructure1enterprise-security1infatica1ndr1network-detection1residential-proxy1sdk1soc1
11 stories, newest first · one card per story
Stories tagged #lateral-movement
ARTEX AI automates enterprise attacks at machine speed
ARTEX AI framework uses multiple agents to automate reconnaissance, privilege escalation, and data exfiltration against enterprise networks.
1
Hackers Use ARTEX AI Agents to Automate Active Directory Attacks
Google and Mandiant report ARTEX used since late August 2026 in attacks across multiple sectors including government and tech.
1
Tailscale patches SSH flaws enabling lateral movement inside tailnets
Fixes shipped in Tailscale v1.104.4; abuse still requires a device the tailnet policy already allows to use SSH.
Attackers hide routine activity in the gaps between SOC alerts
The explainer says LDAP, Kerberos, SMB, and slow HTTPS or DNS transfer can look like ordinary business traffic.
Tailscale SSH flaws can yield root on connected servers
Lab tests on Tailscale 1.104.2 and headscale 0.29.5 showed root via privileged socket forwarding; no fixes yet.
Researcher reports Tailscale SSH flaws that can yield root across servers
Eleven unconfirmed findings in tailscale 1.104.2 and headscale 0.29.5 have no CVE, bulletin, or fix.
Safety Graph: When Safety Responses Become Attack Surfaces in Cyber-Physical Systems
Researchers introduce Safety Graph to model how ICS safety responses create new IT-OT lateral-movement paths.
Network Segmentation Failures Are Expanding the Corporate Attack Surface
Forescout finds nearly half of OT and medical segments also hold IT or IoT, widening lateral movement.
1
Impersonating IT support: how threat actors turn a remote session into enterprise-wide access
Microsoft details Teams IT-support impersonation campaigns deploying Node.js implants, AD reconnaissance, and WinRM lateral movement toward domain controllers.
5
Endpoint Blind Spots: The 5 Places Ransomware Hides Before It Detonates
Cyble outlines five endpoint blind spots where ransomware operators stage access, steal credentials, and move laterally before detonating.