3 casos · pág. 1/1
Sekoia observed an attacker interacting with an exposed Flowise AI orchestration honeypot (emulating version 2.2.8) in late August 2026. The operator enumerated chatflows and stored credentials, tried to create a rogue workflow, and used prompt injection to turn the agent into an offensive analysis assistant. Sekoia assesses the activity …
Group-IB research describes a widespread campaign by an operator tracked as k0t that targets FortiGate, FortiWeb and Palo Alto GlobalProtect appliances to steal credentials, persist and exfiltrate corporate data. More than 70,000 exposed credentials were identified across network-device records, LDAP dumps and other artifacts. Many FortiG…
SOCRadar's Threat Research Unit (STRU) found open directories on 45.227.254.43 in late September 2026. They led to six more adversary servers tied to INC Ransom and The Gentlemen affiliates. The servers held 8,257 AI messages across 133 sessions, source code, stolen credentials, victim workspaces and 46 victim-specific INC encryptor build…
