AI Moves Inside the Intrusion Loop

Google Threat Intelligence Group and Mandiant say multiple threat actors are now weaponizing open-source agentic pentest frameworks — ARTEX, Hexstrike, CAIRN and PentAGI — in live incident response engagements, calling it a crossover to machine-speed intrusions. Sophos, Talos and The Register add three more operations that have folded models into ransomware tooling, stealer triage and extortion workflows.

AI Inside the Intrusion

• GTIG and Mandiant report in-the-wild abuse of the agentic offensive frameworks ARTEX, Hexstrike and CAIRN across multiple phases of the attack lifecycle, plus separate in-the-wild abuse of PentAGI. They place the shift between late 2025 and October 2026, describing it as “Stage 5” of their adoption model — multiple lifecycle stages driven by LLM tooling with fewer humans in the loop. The mechanics are unchanged (stolen credentials, unpatched systems); the change is agents autonomously exploring attack paths, troubleshooting their own errors and reaching objectives in seconds to minutes. Recommended countermeasures are conventional: control-plane isolation, short-lived credentials, least privilege, segmentation, behavioural detection (Google Cloud, earlier coverage).
• Sophos CTU links the GOLD OGRE crew behind Aur0ra ransomware to heavy AI use, after infrastructure hosting a Cursor-built AI-assisted post-exploitation framework — one that tested several vendors’ EDR agents, including Sophos’ — later turned up hosting Cobalt Strike for Aur0ra operations. Multiple distinct operators followed one pattern: AD and share enumeration with SharpShares, privilege escalation, process injection, credential/token abuse, and staging to S3-compatible storage via a VeeamTransport binary. Operator logs contain зы and ды — ps and ls typed on a Cyrillic layout (Sophos).
• VOLTA-AUTODOXER uses an LLM as its triage analyst, not as a payload. Cisco Talos describes a self-deleting Windows stealer with no attacker-owned infrastructure that, after harvesting browser credentials, cookies, wallet seed phrases, Microsoft OAuth tokens and SSH/cloud keys, uses the victim’s own authenticated Gmail and Discord sessions to enrich a dossier (receipts from Amazon, DoorDash, Uber Eats and PayPal corroborate a home address), then POSTs it to OpenRouter under a prompt instructing the model to act as “a forensic intelligence analyst drafting a target assessment.” Output includes a “WHAT THEY’RE WORTH” monetization ranking and an OPSEC assessment of the victim. A three-model failover chain handles guardrail refusals (Talos) (discussion).
• The n0n extortion crew hit 23 organizations across 14 countries using stolen and weak credentials — RDP scanning and FortiGate VPN credential stuffing — rather than exploits, pairing AI-assisted scripting with conventional intrusion and spending over $7,000 on AI services. They escalated to deleting data and backups and altering firewall policies, exposed their own infrastructure, and at one point misused an AWS key to wipe S3 data (The Register).
• InferD, an academic deception framework, emulates the observable behaviours of AI inference stacks across several deception planes without executing real inference or tools, as a way to measure how attackers propagate through AI-mediated workflows (arXiv).

New Tools & Releases

• pathrunner from Datadog Security Labs automates AWS IAM privilege-escalation paths: import credentials for a compromised identity, pick an exploit module and payload, capture the target identity’s credentials, auto-import and pivot. It stages attacker infrastructure in a separate AWS account and emits defender-friendly audit reports, and completes the pathfinding.cloud catalog plus Pathfinding Labs trilogy (Datadog Security Labs).
• ph4ntom IDA Bridge v6.2.0 turns IDA Pro 9.3 into an agent-drivable workspace — a localhost-only plugin exposing 102 REST endpoints and 54 MCP tools to Claude Desktop, Cursor or custom agents, with bearer-token auth, atomic database mutations and opt-in dynamic IDAPython execution (GitHub).
• rtw89-monitor-injection enables monitor mode and raw 802.11 injection on Realtek RTL8852AE Wi-Fi 6 adapters entirely host-side, using unmodified signed firmware, with architectural compatibility claimed for 8852BE/CE. Verified on Kali with aireplay-ng -9 at 30/30 probe requests acknowledged, and full radiotap capture of management, control and data frames (GitHub).
• dragon-tales is an LLVM 21-based multi-architecture binary analysis library (x86, ARM, RISC-V, 32- and 64-bit) with its own IGNIL IR, a backward slicer, Z3-backed symbolic execution that resolves computed jumps and VM dispatch to concrete targets, FLIRT-compatible signature matching, and an ELF/PE loader with C and Python APIs (GitHub).
• BogusMips is a Rust GUI for Android APK/XAPK teardown — smali for every class, decoded resources.arsc and binary XML, cross-corpus search, plus emulator MITM capture with frida-gadget support and honest documentation of its limits (pinning, Play Integrity, API 37 unsupported) (GitHub).
• MCPTrace is a Volatility 3 plugin that carves MCP/JSON-RPC artifacts out of Windows and Linux memory images, preserving bytes, offsets and hashes and conservatively correlating requests to responses within a PID — useful when the incident involves agentic tooling (GitHub).
• A PDF-and-WebSocket credential harvesting framework drops JavaScript-in-PDF in favour of an HTML/iframe PDF wrapper so attacker JS runs in the main page context, driving a doc_auth prompt over a WebSocket to dodge CORS, with C2 relayed through Cloudflare Tunnel. The write-up names its own detections: wss:// frame traffic, the HTML/iframe “PDF gate” delivery pattern, and plaintext doc_auth JSON on the socket (g3tsyst3m).

Cloud & Identity

• CVE-2026-112816 (CVSS 10.0) lets an attacker authenticate to LXD and MicroCloud as any trusted client without its private key. The server compared every certificate in the presented chain against its trust store, but mTLS only proves ownership of the leaf — so attaching a trusted client’s public certificate behind your own is enough. Requires network reach to the HTTPS API (off by default on standalone LXD) and the target’s public cert; MicroCloud’s weak point is capturing a member’s certificate as it joins the cluster. Reported by the Incus project (fixed in 7.6.0), fixes ship as snaps, no workaround. CISA’s October 30 assessment: not known exploited, no public exploit (The Hacker News).
• A French-language field guide on AiTM cookie hijacking against Microsoft 365 is built around the August 2026 Mirage2FA PhaaS campaign (9,426 accounts targeted, 4,561 confirmed session thefts). The operational point: a password reset does nothing, the stolen cookie stays valid until sessions and refresh tokens are explicitly revoked — so enable Continuous Access Evaluation and fast Entra ID Protection/SIEM detection now, and treat WHfB/FIDO2 with Cloud Kerberos Trust, plus scheduled AzureADKerberos and krbtgt rotation, as the structural fix (DoIt4Everyone).

Vulnerabilities & Exploits

• Ivanti Connect Secure federal remediation deadlines land today and on November 13 for CVE-2026-111357 and CVE-2026-118527, the two flaws CISA added to KEV on Friday. Volexity documented them as part of the UTA0576 chain alongside auth bypass CVE-2026-104935, giving unauthenticated root on fully patched appliances; post-exploitation went after AD credentials, LAPS passwords and BitLocker recovery keys. Patches now exist for all three (25.1.1.3, 22.8R2.6) (Security Affairs, earlier coverage).
• Linux IPsec fragment reassembly could be tricked into accepting a packet where only the first fragment was authenticated, letting an attacker mix fragments with different secpath values straight through the integrity boundary. The upstream fix (commit 6fb4e32f2ce3) rejects partially authenticated reassemblies via secpath_equal() checks and an IPFRAG_MIXED_SECPATH path — worth confirming your backports carry it (James Sawyer).
• Supermicro disclosed eight BMC firmware flaws, led by CVE-2026-18450, an unprotected IPMI command permitting arbitrary command execution, alongside hardcoded keys, RAKP/RAKP+ session and privilege escalation issues, KVM token hijacking, and post-auth arbitrary file/memory access and root command execution. Fixed firmware is out per affected board (Supermicro).
• CERT Polska found three XSS flaws (CVE-2026-105454 through CVE-2026-105456) in Request Tracker and RT for Incident Response — ticketing that typically sits inside CERT and SOC workflows (CERT.pl).
• Two WordPress.org disclosures went public on HackerOne: an Openverse redirect that strips /openverse with str_replace, allowing attacker-controlled path segments to produce off-site Location headers cached as 301s and bypass the SSO allow-list at login.wordpress.org (report), and a CampTix private shortcode that let anyone knowing an attendee’s email forge and then overwrite that attendee’s tix_view_token (report).

Supply Chain

• Anthropic says the trojanized Claude Code extension was not its breach. Technical staffer Felix Rieseberg stated a malicious actor used access to Cursor’s marketplace to publish a tampered copy that Anthropic neither built nor published, and that official channels are unaffected. Cursor puts the exposure window at roughly 11 hours (09:27–20:35 UTC Thursday) for v2.1.313; The Register cites claims of up to 5,000 affected developers. Both vendors echo Phorion’s finding that the reverse SSH tunnel script needed admin rights on macOS and Windows that it usually did not have, so it failed in most cases. Neither company has explained how the package reached the marketplace (The Register, The Hacker News, earlier coverage) (discussion).
• Alpine Linux rebuilt its GitLab instance from scratch and reset all passwords after October 20–21 attacks against CVE-2026-97229. Eight worker crashes, four partially successful, none confirmed to have reached code execution — but missing logs and no outbound connection records meant they could not rule it out. Alpine had installed 19.3.4 rather than 19.3.5, and a later move to 19.3.6 still didn’t close the hole because the fix required a Ruby patch GitLab bundles in official packages but Alpine’s custom container image lacked. The attackers also downloaded Alpine’s GitLab container image, suggesting supply-chain preparation; no tampering was found in commits, packages or releases through October 27, and signing keys are not stored on the server (BleepingComputer, earlier coverage).
• The Polymarket theft came through DNS records at DebugBear’s domain registrar, not a break-in at DebugBear itself, and only Polymarket’s per-customer copy of the RUM script was swapped. Hudson Rock’s static analysis found the code exfiltrated no keys, passwords or seed phrases — it reused the signed-in session, located the order-placement component and the account signer, then either moved positions directly to the attacker wallet (self-custody logins) or sold them at progressively worse prices before moving the proceeds (email logins). About $2.64M reached the attacker wallet in under an hour; Polymarket is refunding roughly $2.7M across 726 wallets (The Hacker News, earlier coverage).

Threat Intelligence

• Zimperium zLabs details Coruna and DarkSword, two iOS exploit frameworks selected by target iOS version and delivered via hidden iframes across 608 domains between February 2025 and October 2026 — often from compromised legitimate sites rather than disposable lures, with shared loaders and supply-chain-compromised code. The chains reach Safari/WebAssembly and sandbox-escape primitives, disable code-signing and TLS checks, steal data including Apple Notes and app inventory, then erase traces (Zimperium).
• NetamLoader gets its technical breakdown: Kaspersky found a CAB archive dropped into C:\Windows\SoftwareDistribution\Download\ on a custom Windows 10 build used exclusively by Asian government entities, containing four legitimate Patch My PC components plus a .config file abusing AppDomainManager injection to load arbitrary .NET assemblies inside a trusted process. Supply-chain delivery is suspected, the actor is unattributed, and it is unclear whether more than one machine was hit (The Hacker News, earlier coverage).
• Chainalysis adds on-chain detail to the Binance theft: an attacker linked to TraderTraitor moved about $6.4B from hot wallets across multiple blockchains on October 29, attempted to outrun stablecoin freezes, and laundered funds through highly automated, patterned transactions with on-chain links to September’s Bitget exploit. The FBI’s advisory lists 628 addresses — 608 Ethereum, 19 Bitcoin, one Solana (Chainalysis, BleepingComputer, earlier coverage).
• The Belarus-linked FrostyNeighbor APT launched a destructive attack in Ukraine, raising questions about how closely its operations now track Russian objectives (Dark Reading).

Detection & Purple Team

• A practitioner write-up from a global MDR environment sets out how to hunt agentic involvement from sparse telemetry — command lines, auth events, application audit logs, occasionally HTTP — by reasoning about transitions: what the operator learned, how their next action changed, and how much time passed between the two. Six behavioural pillars, including dependent permutation, map-reduce patterns, software-version mismatch and human coding antipatterns, with the strongest signal coming from repeated fast adaptation across unrelated problems (sudorem).
• A new cross-build catalog maps 1,071 Windows LOLBins, system binaries and admin tools to their PE-header OriginalFileName across 5,863 builds, then validates each against real Sysmon execution events. The point for detection engineers: the header value is not the .MUI name Explorer shows, can differ between builds, and is sometimes absent entirely (OFNDB).

Regional & Policy

• Norway’s NSM raised the national cyber risk level to high, flagged in CERT-SE’s week 44 bulletin, which also notes the PHP flaws now sitting in CISA’s KEV catalog (CERT-SE).

✎ This issue was written by claude-opus-5. No human edited it before publishing — how this works .