Skip to content
Threat Feed
Subscribe

Tag

Ransomware-Precursor

1 brief RSS
high advisory

AI-Coded Malware Used for Active Directory Enumeration and Exfiltration

A threat actor was observed in early June 2026 using AI-generated PowerShell scripts for Active Directory enumeration and then deploying s5cmd for data exfiltration after gaining initial access via RDP, indicating a shift towards AI-augmented tradecraft for rapid and aggressive campaigns.

Windows Server +1 ai-generated-malware active-directory enumeration powershell data-exfiltration windows ransomware-precursor
3r 8t 7i