#post-exploitation

Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs

Oct 1, 2026 // 11:41

Threat actors have been observed exploiting a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway to drop web shells and attempt […]

Hackers run khunt post-exploitation toolkit from Oracle database

Aug 5, 2026 // 23:57

Hackers exploited a SQL injection vulnerability to install a post-exploitation toolkit directly inside an Oracle database that was used to breach a corporate network. The […]

Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry

Jul 24, 2026 // 13:31

Someone installed a popular AI assistant on a rented server, switched off the setting that makes it ask permission before running risky commands, and pointed […]

Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit

May 29, 2026 // 17:49

An unknown threat actor has been observed using a large language model (LLM) agent to conduct post-compromise actions after obtaining initial access following the exploitation […]