CuraSec

tag: Ai-Assisted-Attack · 2 items

Plan archived Russian Actor Uses Gemini CLI to Operate Dental Clinic Botnet
2026-07-20 · The Hacker News · source ↗ #ai-assisted-attack#botnet#threat-actor
  • Engineer — Learn: Demonstrates an emerging operational pattern where attackers use open-source AI CLIs to automate credential attacks and botnet management; no specific vulnerability to patch, but worth reviewing whether Gemini CLI or similar tools are present in CI/CD or developer environments and could be abused.
  • SOC/IR — Plan: The session log analysis reveals AI-assisted password cracking and botnet C2 as concrete TTPs; build or tune detections for anomalous use of AI CLI tools (Gemini CLI, others) in endpoint and network telemetry, particularly subprocess chains or outbound API calls from unexpected processes.
  • Leader — Learn: Illustrates that commodity AI tooling is lowering the operational bar for solo threat actors; useful context for AI usage policy discussions and future board briefings on AI-enabled threats, but no immediate organizational action required given the small scale and no named sector targeting.
Plan archived Attacker Uses AI-Generated PowerShell Script for AD Enumeration
2026-07-13 · The Hacker News · source ↗ #active-directory#powershell#ai-assisted-attack
  • Engineer — Learn: No vulnerability to patch here — this is a reconnaissance TTP story showing adversaries using AI-generated scripts for AD discovery. Useful context for understanding how attacker tooling is evolving, but no configuration or software change required today.
  • SOC/IR — Plan: The enumeration pattern — PowerShell querying DC, mapping users/computers/domains, exporting results to a directory, and generating AD_Report.html — is a detectable behavior signature; review PowerShell Script Block Logging coverage and build or tune a Sigma/KQL rule for this AD bulk-export pattern this quarter.
  • Leader — Learn: Demonstrates that AI tooling is lowering the skill floor for AD reconnaissance, a useful data point for board-level narratives about AI accelerating attacker capability; no immediate leadership action required.