Ankura CTIX FLASH Update – July 15, 2026

Malware Activity

AI-Assisted Threat Actors Accelerate Active Directory and Cloud Attacks

Cybersecurity researchers have documented separate intrusions demonstrating how threat actors are increasingly using artificial intelligence as a force multiplier to accelerate established attack techniques rather than develop entirely novel capabilities. In an early June 2026 incident, an unknown attacker used pre-compromised credentials to establish RDP access to a domain-joined Windows Server and deployed an apparently AI-generated, or “vibe-coded,” PowerShell script to aggressively enumerate the Active Directory environment, collecting information on domain controllers, users, computers, groups, organizational units, and trusts before generating an HTML inventory report. The actor later used the legitimate s5cmd utility and SharpShares to identify accessible data repositories, staged the collected information in CSV files, archived it, and exfiltrated the data to a remote server. Huntress