Skip to content
Threat Feed
Subscribe

Product

Windows Server

6 briefs RSS
high threat

GOLD OGRE: AI-Assisted Intrusion and Aur0ra Ransomware Operations

The GOLD OGRE threat group leverages agentic AI frameworks, including Cursor AI and LLMs, to automate post-exploitation tasks, evade EDR, and conduct Aur0ra ransomware attacks.

Active Directory +1 GOLD OGRE ransomware ai-assisted gold-ogre aur0ra cobalt-strike exfiltration
3t 3i
critical threat

Active Exploitation of Google Chromium V8 Type Confusion Vulnerability

A type confusion vulnerability in the Google Chromium V8 engine is being actively exploited in the wild, allowing remote attackers to achieve arbitrary code execution within the sandbox environment via crafted HTML pages.

exploited Chromium V8 +8 vulnerability chromium browser-security
1t 2c updated
high advisory

AI-Coded Malware Used for Active Directory Enumeration and Exfiltration

A threat actor was observed in early June 2026 using AI-generated PowerShell scripts for Active Directory enumeration and then deploying s5cmd for data exfiltration after gaining initial access via RDP, indicating a shift towards AI-augmented tradecraft for rapid and aggressive campaigns.

Windows Server +1 ai-generated-malware active-directory enumeration powershell data-exfiltration windows ransomware-precursor
3r 8t 7i
high advisory

Suspicious Domain Managed Service Account Creation by Unusual User

Detection of a Domain Managed Service Account (DMSA) creation event by a user that typically does not perform this administrative task, potentially indicating privilege escalation or account compromise.

Windows Server +1 privilege-escalation active-directory dmsa
2r 1t
medium advisory

Creation of New DMSA Service Account Potentially Exploiting BadSuccessor Vulnerability

The creation of a new Delegated Managed Service Account (DMSA) within specific Organizational Units (OUs) using the New-ADServiceAccount cmdlet is indicative of potential BadSuccessor privilege escalation attempts in Windows Server 2025 Active Directory environments.

Windows Server +1 privilege-escalation active-directory bad-successor dmsa
2r 2t
high advisory

Abuse of dnscmd.exe to Modify DNS ServerLevelPluginDLL

Attackers can use dnscmd.exe with administrative privileges to configure the Microsoft DNS ServerLevelPluginDll setting, allowing them to load arbitrary DLLs and execute code within the DNS service context for persistence and privilege escalation.

Splunk Enterprise +3 persistence privilege-escalation windows
2r 1t