CVE

CVE-2023-28434

View on NVD ↗

MinIO is vulnerable to privilege escalation on Linux/MacOS

Exploitation IoCs 17

Domain fastcdn[.]bar

Domain media[.]fastcdn[.]bar

Filename C:\Windows\Temp\wdiag2.exe

Filename c:\ProgramData\p1.ps1

Filename c:\programdata\svcmon32.exe

Filename c:\rwx\RogueWinRM.exe

Filename c:\windows\temp\svchosts.exe

Filename c:\windows\temp\svcmon32.exe

SHA-256 09e1da2afa1216ecc55648ec8e122d2a

SHA-256 0bbd08af95f877f1d568b03de2eb76b4

SHA-256 2770562d104391b92b42671c270079bb

SHA-256 29efd64dd3c7fe1e2b022b7ad73a1ba5

SHA-256 74f57b3e897a4960dcdd5b7e8a54f9df

SHA-256 805b9e4ae74c903787416800999b8418

SHA-256 d726a8b4886c636f76ca6d30ef6a6ff4

IP 104[.]234[.]26[.]163

IP 185[.]186[.]245[.]144

MITRE ATT&CK TTPs 24

Windows Command Shell

Defense Evasion

System Information Discovery

Account Manipulation

Ingress Tool Transfer

Command And Control

Credential Access

External Remote Services

Exploit Public-Facing Application

Exploitation for Client Execution

Exploitation of Remote Services

Lateral Movement

Browser Information Discovery

XSL Script Processing

Defense Evasion

Domain Trust Discovery

Group Policy Modification

Defense Evasion

Data Destruction

Adversary-in-the-Middle

Credential Access

Non-Standard Port

Command And Control

Encrypted Channel

Command And Control

Gather Victim Identity Information

Active Scanning

Plist File Modification

Defense Evasion

Source Articles

CyberStrikeAI in the wild: the use of AI in real-world attacks on organizations

Kaspersky discovered a real-world attack campaign leveraging an open-source AI-powered C2 framework called CyberStrikeAI, which uses a server-side LLM orchestrator to automate post-exploitation activities. The attacks targeted educational organizations in Africa and Latin America, achieving full domain compromise through automated reconnaissance, lateral movement, credential access, and data exfiltration. The implant, deployed after initial access via a compromised SQL Server, executes commands generated by the LLM, enabling rapid progression from initial foothold to domain dominance within 3–4 days. The campaign demonstrates the emerging use of AI to lower operator skill requirements while using known TTPs, making detection reliant on behavioral analysis rather than novel signatures.

securelist Nov 2, 2026