TL;DR Kaspersky researchers discovered a new wave of network intrusions driven by the CyberStrikeAI framework. During these intrusions, threat actors used language models to automate post-exploitation tasks on compromised networks. Consequently, the CyberStrikeAI framework attacks moved from initial database access to full domain administrative control in just a few days. What Happened in the Attacks Kaspersky analysts identified live intrusions targeting educational organizations in Africa and Latin America.

Nelsar lanzó Axia, interfaz web y API REST gratis para Active Directory, Samba AD y OpenLDAP, con roles granulares y protección contra escalada de privilegios.

At a glance Actor Unattributed human operators Activity Teams help desk impersonation, Quick Assist remote access, and AD CS certificate abuse Targets Users and Active Directory environments at two organizations Scale In one case, 19 users targeted and certificates issued for 11 privileged accounts Status No law-enforcement action reported TL;DR Microsoft Threat Intelligence investigated two intrusions that began with fake IT staff calling users on Microsoft Teams.

Samba, FreeIPA, Univention Corporate Server y Zentyal ofrecen distintas formas de gestionar identidades y equipos sin depender de Active Directory.

TL;DR Security researchers uncovered an espionage campaign that used a custom PHP2Shell exploit to gain root access on 25 firewall servers across the Pacific region. By pairing this PHP2Shell exploit Fragnesia privilege escalation chain into a single unauthenticated request, the attacker breached a U.S. government-affiliated network. From there, the intruder pivoted to an internal management server and extracted Active Directory credentials.