GhostFrame ESXi implant linked to Settra ransomware, Insikt says
The implant needs existing root access, masquerades as vmhostd, and can harvest Windows credentials from guest VMs.
Stories per day · 30 days
1 RSS
Relatedcyberstrikeai2africa1ai-in-attacks1apex1attack-chains1code-generation1credential-dumping1credential-theft1education1education-sector1esxi1ghostframe1kaspersky1latin-america1malware1mcts1metasploit1privilege-escalation1
14 stories, newest first · one card per story
Stories tagged #post-exploitation
Attackers use CyberStrikeAI to direct intrusions at schools
Kaspersky says a human operator used an LLM on the C2 server to pick tools while Go beacons ran commands on compromised hosts.
3
CyberStrikeAI used in real attacks on African and Latin American education organizations
Kaspersky reports a campaign deploying open-source CyberStrikeAI framework with LLM orchestrator targeting education organizations in Africa and Latin America.
5
APEX automates post-exploitation chain search, reporting 9 new escalations
Tests covered 5 virtual machines, 30 synthetic problems and 291 cloud instances, recovering known and unreported chains.
Metasploit adds specs for the mkdir post API
Pull request 20944 adds tests so mkdir behaves consistently across session types, with no vulnerability disclosed.
Small models generate post-exploitation code in lab tests
Qwen2.5-Coder 1.5B reached Pass@5 of 100% on directory enumeration in Python and Lua.
Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs
LevelBlue details post-exploitation of actively exploited Citrix NetScaler flaw CVE-2026-88771: superuser account creation, PHP web shells, and configuration theft.
Automated AI agent used to breach cybersecurity nonprofit DIVD
DIVD says an autonomous AI agent exploited a flaw and performed a messy intrusion on its network.
Hackers Use LLMs to Generate Exploit Scripts and Automate Post-Exploitation Across Latin America
Unit 42 says Latin American attackers used LLMs to automate post-exploitation in campaigns hitting Mexican government, water utilities, and Brazilian financial firms.
3
PrivEscalate: Measuring and Augmenting the Threat of LLM-Automated Linux Privilege Escalation
Researchers release PrivEscalate, a 531-scenario benchmark showing LLM agents' Linux privilege-escalation success varies by vulnerability class, plus PrivEscAgent, a domain-specialized agent that boosts success.
Hackers Disable Endpoint Protection and Deploy Sliver Across Compromised Windows Domain
The Hunter's Ledger tracked campaign UTA-2026-024 using Sliver C2, Domain Admin account creation, and Ethereum-based C2 rotation to compromise a US organization's Windows domain.
3
CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT
Attackers exploiting CVE-2025-25249 in Fortinet FortiGate firewalls deploy PivotC2, a post-exploitation RAT, on exposed edge devices.
2
PEEP: A Browser RAT Posing as a Chrome Extension
SOCRadar's STRU analyzed PEEP, an emerging Chromium-based RAT disguised as a Chrome extension enabling post-exploitation control of browsers.
Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers
SpecterOps released CDP-Enable-BOF, a Beacon Object File that enables Chrome DevTools Protocol in live Chrome or Edge processes on Windows for session hijacking.