A threat actor recently utilized an AI-generated PowerShell script to conduct reconnaissance within a compromised Active Directory environment. The intrusion began after the attacker gained access to a domain-joined Windows Server via Remote Desktop Protocol using previously stolen credentials. Once inside, the intruder staged tools in the ProgramData directory and executed a script designed to map users, groups, and domain controllers. Source
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
