Malware

Rubeus

Rubeus is a C# toolset for raw Kerberos interaction and abuses.

Indicators of Compromise 4

Domain netlas[.]io GitHub Repo AionUi GitHub Repo Hindsight IP 45[.]142[.]193[.]132

MITRE ATT&CK TTPs 15

T1059
Command and Scripting Interpreter
Execution
 T1069
Permission Groups Discovery
Discovery
 T1078
Valid Accounts
Defense Evasion
 T1083
File and Directory Discovery
Discovery
 T1087
Account Discovery
Discovery
 T1098
Account Manipulation
Persistence
 T1133
External Remote Services
Persistence
 T1190
Exploit Public-Facing Application
Initial Access
 T1203
Exploitation for Client Execution
Execution
 T1210
Exploitation of Remote Services
Lateral Movement
 T1217
Browser Information Discovery
Discovery
 T1219
Remote Access Software
Command And Control
 T1557
Adversary-in-the-Middle
Credential Access
 T1566
Phishing
Initial Access
 T1588
Obtain Capabilities
Resource Development

Source Articles

PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances
A suspected Russian-speaking threat actor has exploited CVE-2026-81578 and CVE-2026-82078, a vulnerability chain in PaperCut NG/MF involving authentication bypass and remote code execution, to compromise at least 440 instances across 395 organizations in 48 countries. The attacker used AI agents powered by OpenAI Codex and DeepSeek, along with offensive tools like Mimikatz and Impacket, to automate exploitation and post-compromise activities including credential harvesting and domain reconnaissance. The campaign targeted primarily the education sector and demonstrated rapid lateral movement, with some attacks achieving domain administrator access in under seven minutes. The actor’s ultimate objectives remain unclear, though activity suggests potential initial access brokering or preparation for follow-on attacks such as data theft or ransomware.
hacker-news ·23h ago