Cases › security breach › LR-2026-0613
AI-built PowerShell recon script used in an Active Directory enumeration intrusion
Preliminary Why: 1 report: Security Affairs · subject to change · 1 independent report
Status: action reported, no fix
No source states: loss or records, developer and model, agent tool, could do, deployer, industry.
Severity moderate: Test: data of others touched with a bounded scope stated. Fact: the victim's Active Directory user, computer, group, OU, subnet, trust and DNS data was dumped to CSV and zipped, on one compromised Windows Server.
A threat actor who had gained RDP access with pre-compromised credentials ran a custom PowerShell script, apparently built by prompting an AI model, to map a victim's Active Directory environment on a compromised Windows Server. The script enumerated users, computers, groups, trusts and subnets, saved the results as CSV files and zipped them into an archive. The attacker then deployed the legitimate s5cmd.exe tool and made a second pass with SharpShares.exe to hunt for additional data. Huntress recovered and reconstructed the script from PowerShell logging during an incident response investigation. Because the script was newly written, file signatures would not match, and Huntress's SIEM caught the activity through behavioral telemetry. The source describes the attack as a smash-and-grab playbook selectively augmented by AI rather than a novel technique.
What happened
What was done
Risks
Primary96 incidents
Rising: 24 vs 4.0 a week
Read from the sources; not yet reviewed by a person.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
ModelSafety training and refusal · Cyber and weapons safeguards · Abuse monitoring and account enforcement · Staged or restricted release · Dangerous-capability testing before release · Outside red-teaming · Content safety classifiers · Safeguards kept on in testing · Reasoning monitoring
Infrastructure / targetKnown flaws patched · Multi-factor sign-in and password policy · Network segmentation · Intrusion and endpoint detection · Backups and recovery · Phishing and fraud filters
Similar incidents
Evidence
No source states: what the AI was doing, what went wrong, what it reached or did, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.
Show the full account: 3 items from the primary sources
What happened, in order
- 2026-06-03 Huntress analyst recovered the recon script during an incident response investigation.
Not dated in the sources:
- Attacker gained RDP access, staged tools, ran the recon script within minutes, and about thirty minutes later deployed s5cmd.exe.
- A second pass with SharpShares.exe hunted for additional data repositories.
Show every field, with its source and grade
What happened
Impact
Notes on gaps
Not stated: the date the incident occurred, the date it was detected, and the date it was disclosed; the June 3, 2026 date is the date of the investigation, so no event dates were entered. The sources do not say which control allowed the pre-compromised credentials to be used, so no failed control is listed. No remediation by the victim is reported; the only remediation entry is advice quoted from Huntress. The Security Affairs article date of 2026-07-14 is not used as a disclosure date because the source does not state it as one.
LR-2026-0613 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON