[specterops]

August 9, 2026

• SpecterOps details turning WSUS into a "backdoor factory." When the WSUS database (SUSDB) runs on a separate SQL Server, an attacker can coerce NTLM auth from the WSUS computer account (e.g., PetitPotam) and relay it to SQL — often landing a session that has EXECUTE on stored procedures like spImportUpdate and spSaveXMLFragment, enough to craft malicious "bundled" updates (SpecterOps). · Vulnerabilities & Exploits

in AI Agents' Black Hat Reckoning Goes Public

July 16, 2026

• SpecterOps detailed "There and Back Again," a technique to escalate Active Directory privileges by coercing outbound NTLM authentication through cloud relays over WebDAV — enabling identity takeover even when SMB egress is blocked. Mitigation centers on enforcing LDAP signing/channel binding and restricting outbound SMB. SpecterOps · Offensive Tradecraft

in Relay Chains, Bind-Link Blindspots, and a Wave of Live Zero-Days