grep -rl "active-directory" ./articles
GreyNoise watched a likely Russian-speaking operator point hundreds of AI agents at PaperCut and compromise 440 instances across 395 organisations. The operator's exclusion list held only partly: 18 victims sit in countries the agents were told to skip, every one of them from the back half of the list.
Aurora used the AI coding assistant Cursor to plan intrusions in Russian — AD CS exploitation, NTLM relay, domain enumeration — while instructing it to exclude CIS address ranges and domains. More than 20 organisations across nine countries between April and July. Also: Cursor is made by Anysphere, not SpaceX, whatever you are about to read elsewhere.
Advisory AA26-237A describes simultaneous red team assessments using similar tradecraft against a government services body and a water utility. Both were compromised at the domain level. One detected each phishing payload as it executed and isolated the machines within 2 to 20 minutes. The other saw nothing, and the red team read its security team's email to check.
The technique needs SYSTEM on the ADFS host and touches neither LSASS nor the running service. It works because manual certificate rotation leaves the database pointing at a ghost while the real key sits in the machine DPAPI store.