Project
Commercial penetration-testing framework whose Beacon payload gives post-exploitation control; widely abused by ransomware and other threat actors.
SOCRadar estimates broker CyberXero stole more than 628,000 records from four Ukrainian organizations with Claude Code and Cobalt Strike. The actor left a server open, and its logs show where the model's refusals held and where a fresh session got around them.
Reality
Two years of extradition work and a guilty plea produced a four-year sentence for one Conti developer, measured against a group that hit more than 1,000 organizations and reappeared under new names.
Perspective Coverage
5 publishersReality
Malbear Labs found PavokwiLoader resolves the 48 ntdll functions it uses by hash while importing 68 KERNEL32 functions it never calls. Static and import-based detection see nothing, so reading it means emulating the loader's own resolver.
Reality
Group-IB puts the Qilin affiliate cut at up to 80 percent, and KELA logged a change that routes victim payments through affiliate wallets first, which says more about the operation's incentives than its thin public tradecraft record does.
Reality
Insikt Group counted 215 actively exploited CVEs in six months, up 34% year on year, and describes attackers running them through remote access utilities, package registries and payment flows defenders already permit.
Reality
The Threat Hunter Team says the technique has hit government departments, technology firms and hotels since February 2026. In one case, the operators moved to node.exe only after their Cobalt Strike beacons kept getting blocked.
Reality
Blackpoint found the framework because its operators left it in open web directories. The plumbing is what matters: tasking and results ride encrypted connections to a managed database, and a fake hostfxr.dll starts the agent.
Reality