Symantec's Threat Hunter Team used an AI honeypot to capture the full instruction set of a malicious autonomous AI agent in summer 2026. The agent is designed to run up to 100,000 malicious actions without human approval: scanning for targets, exploiting vulnerabilities, stealing credentials, deploying cryptocurrency miners and reinfectin…
Recorded Future's Insikt Group tracks the actor behind the October 2026 AI-assisted intrusions into South Korean financial institutions as TAG-217. The group was testing infrastructure and assembling attack tools as early as August 2026, weeks before the campaign became public. South Korea's Financial Services Commission (FSC) disclosed t…
Recorded Future's Insikt Group (report of October 16) tracks a suspected Chinese-speaking actor, TAG-217, linked to attacks on South Korean financial institutions. The actor used Claude Code, DeepSeek, Grok and Zhipu AI alongside ARTEX, an open-source Chinese-language AI penetration testing framework. Public reporting cited in the investi…
A multinational advisory (CISA, NSA, FBI, AIVD, MIVD, NCSC-UK and others) warns that the Russian state-supported APT LAUNDRY BEAR (aka Void Blizzard, TA488) has compromised Western government, defense industrial base and NGO organizations running Zimbra Collaboration Suite (ZCS) since at least July 2025. The campaign uses a view-based XSS…