The operation was documented because its working directory was browsable — the third one this month
2026-10-13Security
SOCRadar tracked a Russian-speaking access broker running Cobalt Strike alongside an AI orchestration layer against Ukrainian infrastructure and WordPress sites worldwide. The research exists because the operator left a directory listing open, including the AI session logs.