Top Tweets for #cyberstrikeAI
#CyberStrikeAI Uses 44 #AI Agents to #Automate #Hacking Operations Against #Japan Targets
https://t.co/0diliWrYt8
#CyberStrikeAI is being used to automate attacks targeting Japanese organizations, from reconnaissance and exploitation to command-and-control. At least 19 organizations were subjected to vulnerability validation.
#AI #cyber
🚨 44 AI agents coordinating cyberattacks.
CyberStrikeAI is being used to automate attacks targeting Japanese organizations, from reconnaissance and exploitation to command-and-control.
At least 19 organizations were subjected to vulnerability validation.
Read: https://t.co/7b1xbXzDN3
An operator ran 44 AI agents through CyberStrikeAI to probe Japanese orgs - scanning to web shells, automated. https://t.co/KjsLBrv1cr #ThreatIntel #CyberStrikeAI #MCP #nmap
CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets https://t.co/MJ4JMcbqEr
#cyberstrikeAI #hacking #hacked #japan #cybersecurity #cyberattack #artificialintelligence
🐈⬛🤖 CYBERSTRIKEAI — AI-NATIVE CYBERSECURITY
An AI-powered cybersecurity workspace combining intelligent agents, automated workflows, knowledge retrieval and attack-chain analysis for authorized security operations. 🛡️⚡
💬 Comment “CYBERSTRIKE” for the tool!
#CyberStrikeAI #AISecurity #CyberSecurity #CyberTools #CyberKid
Update: the Chinese threat actor behind the #Hermes + #CyberStrikeAI + #SliverC2 exploitation node has shifted operations to a new server ( migrated ~19 Jun 2026).
Threat actor also hit https://t.co/qSps74HK46, an AI-API reseller selling Claude/GPT access. Found an endpoint wide open and pulled 775 upstream API-key IDs + their ban/rate-limit status + full traffic data(patched).
New infra IOCs:
203.88.119[.]53 — new primary host post-migration
137.220.144[.]253:12305 — Sliver Redirector (also ran its own independent exploit campaign vs 32 targets)
143.92.51.76[:]23175 — WireGuard/SOCKS5 exit node for scan traffic
207.180.56[.]150 — Operator's IP address
Domains:
1daynews[.]app/435736b425a677a8 — public-facing CVE-intel dashboard (14,643 CVEs tracked, 20 sources, live-updating)
aitoday[.]me — second service
Attribution:
SSH key artifact leaks username knaithe (knaithe@DESKTOP-IQA5FIU), retained across the migration. Telegram control bot (AAtttttttaccccckBot). Full China-nexus stack — FOFA / DeepSeek / GLM / dnslog[.]cn, internal agent notes all in Chinese.
Shodan username via api key: crc2
@malwrhunterteam @500mk500 @MichalKoczwara
![SansLimit3's tweet photo. Update: the Chinese threat actor behind the #Hermes + #CyberStrikeAI + #SliverC2 exploitation node has shifted operations to a new server ( migrated ~19 Jun 2026).
Threat actor also hit https://t.co/qSps74HK46, an AI-API reseller selling Claude/GPT access. Found an endpoint wide open and pulled 775 upstream API-key IDs + their ban/rate-limit status + full traffic data(patched).
New infra IOCs:
203.88.119[.]53 — new primary host post-migration
137.220.144[.]253:12305 — Sliver Redirector (also ran its own independent exploit campaign vs 32 targets)
143.92.51.76[:]23175 — WireGuard/SOCKS5 exit node for scan traffic
207.180.56[.]150 — Operator's IP address
Domains:
1daynews[.]app/435736b425a677a8 — public-facing CVE-intel dashboard (14,643 CVEs tracked, 20 sources, live-updating)
aitoday[.]me — second service
Attribution:
SSH key artifact leaks username knaithe (knaithe@DESKTOP-IQA5FIU), retained across the migration. Telegram control bot (AAtttttttaccccckBot). Full China-nexus stack — FOFA / DeepSeek / GLM / dnslog[.]cn, internal agent notes all in Chinese.
Shodan username via api key: crc2
@malwrhunterteam @500mk500 @MichalKoczwara](https://pbs.twimg.com/media/HOV8gQpXEAEXStL.png)
![SansLimit3's tweet photo. Update: the Chinese threat actor behind the #Hermes + #CyberStrikeAI + #SliverC2 exploitation node has shifted operations to a new server ( migrated ~19 Jun 2026).
Threat actor also hit https://t.co/qSps74HK46, an AI-API reseller selling Claude/GPT access. Found an endpoint wide open and pulled 775 upstream API-key IDs + their ban/rate-limit status + full traffic data(patched).
New infra IOCs:
203.88.119[.]53 — new primary host post-migration
137.220.144[.]253:12305 — Sliver Redirector (also ran its own independent exploit campaign vs 32 targets)
143.92.51.76[:]23175 — WireGuard/SOCKS5 exit node for scan traffic
207.180.56[.]150 — Operator's IP address
Domains:
1daynews[.]app/435736b425a677a8 — public-facing CVE-intel dashboard (14,643 CVEs tracked, 20 sources, live-updating)
aitoday[.]me — second service
Attribution:
SSH key artifact leaks username knaithe (knaithe@DESKTOP-IQA5FIU), retained across the migration. Telegram control bot (AAtttttttaccccckBot). Full China-nexus stack — FOFA / DeepSeek / GLM / dnslog[.]cn, internal agent notes all in Chinese.
Shodan username via api key: crc2
@malwrhunterteam @500mk500 @MichalKoczwara](https://pbs.twimg.com/media/HOV8ensXwAE-NvM.png)
![SansLimit3's tweet photo. Update: the Chinese threat actor behind the #Hermes + #CyberStrikeAI + #SliverC2 exploitation node has shifted operations to a new server ( migrated ~19 Jun 2026).
Threat actor also hit https://t.co/qSps74HK46, an AI-API reseller selling Claude/GPT access. Found an endpoint wide open and pulled 775 upstream API-key IDs + their ban/rate-limit status + full traffic data(patched).
New infra IOCs:
203.88.119[.]53 — new primary host post-migration
137.220.144[.]253:12305 — Sliver Redirector (also ran its own independent exploit campaign vs 32 targets)
143.92.51.76[:]23175 — WireGuard/SOCKS5 exit node for scan traffic
207.180.56[.]150 — Operator's IP address
Domains:
1daynews[.]app/435736b425a677a8 — public-facing CVE-intel dashboard (14,643 CVEs tracked, 20 sources, live-updating)
aitoday[.]me — second service
Attribution:
SSH key artifact leaks username knaithe (knaithe@DESKTOP-IQA5FIU), retained across the migration. Telegram control bot (AAtttttttaccccckBot). Full China-nexus stack — FOFA / DeepSeek / GLM / dnslog[.]cn, internal agent notes all in Chinese.
Shodan username via api key: crc2
@malwrhunterteam @500mk500 @MichalKoczwara](https://pbs.twimg.com/media/HOV8UQEWoAAqACO.png)
![SansLimit3's tweet photo. Update: the Chinese threat actor behind the #Hermes + #CyberStrikeAI + #SliverC2 exploitation node has shifted operations to a new server ( migrated ~19 Jun 2026).
Threat actor also hit https://t.co/qSps74HK46, an AI-API reseller selling Claude/GPT access. Found an endpoint wide open and pulled 775 upstream API-key IDs + their ban/rate-limit status + full traffic data(patched).
New infra IOCs:
203.88.119[.]53 — new primary host post-migration
137.220.144[.]253:12305 — Sliver Redirector (also ran its own independent exploit campaign vs 32 targets)
143.92.51.76[:]23175 — WireGuard/SOCKS5 exit node for scan traffic
207.180.56[.]150 — Operator's IP address
Domains:
1daynews[.]app/435736b425a677a8 — public-facing CVE-intel dashboard (14,643 CVEs tracked, 20 sources, live-updating)
aitoday[.]me — second service
Attribution:
SSH key artifact leaks username knaithe (knaithe@DESKTOP-IQA5FIU), retained across the migration. Telegram control bot (AAtttttttaccccckBot). Full China-nexus stack — FOFA / DeepSeek / GLM / dnslog[.]cn, internal agent notes all in Chinese.
Shodan username via api key: crc2
@malwrhunterteam @500mk500 @MichalKoczwara](https://pbs.twimg.com/media/HOVzmvdXAAA3XG5.jpg)
Exposed attacker infrastructure combining #Hermes Agent, #CyberStrikeAI, #SliverC2, and multiple LLMs used for automated CVE targeting, exploit validation, Telegram-based orchestration, and post-exploitation validation workflows.
Opendir:
142.171.160[.]137:8888
VULN-MONITOR:
142.171.149[.169:8001 - Real-time 1day/0day RCE tracking across 18 sources🤔
CyberStrikeAI Server: 100.81.245[.29:8080
Chain:
FOFA/Shodan recon → AI-assisted target filtering → CVE/PoC enrichment → custom scanner & exploit generation → exploit validation → WebSocket/shell access → post-exploitation environment validation → Telegram-pushed operations.
Targeted CVEs:
CVE-2026-0300 (Palo Alto PAN-OS)
CVE-2024-21762 (FortiOS/FortiProxy SSL-VPN)
CVE-2026-33017 (Langflow)
CVE-2026-21858 (n8n)
CVE-2026-3055 (Citrix ADC/NetScaler)
CVE-2026-34486 (Apache Tomcat)
CVE-2026-25253 (OpenClaw/Moltbot/Clawdbot)
@malwrhunterteam @500mk500 @1ZRR4H @MichalKoczwara
![SansLimit3's tweet photo. Exposed attacker infrastructure combining #Hermes Agent, #CyberStrikeAI, #SliverC2, and multiple LLMs used for automated CVE targeting, exploit validation, Telegram-based orchestration, and post-exploitation validation workflows.
Opendir:
142.171.160[.]137:8888
VULN-MONITOR:
142.171.149[.169:8001 - Real-time 1day/0day RCE tracking across 18 sources🤔
CyberStrikeAI Server: 100.81.245[.29:8080
Chain:
FOFA/Shodan recon → AI-assisted target filtering → CVE/PoC enrichment → custom scanner & exploit generation → exploit validation → WebSocket/shell access → post-exploitation environment validation → Telegram-pushed operations.
Targeted CVEs:
CVE-2026-0300 (Palo Alto PAN-OS)
CVE-2024-21762 (FortiOS/FortiProxy SSL-VPN)
CVE-2026-33017 (Langflow)
CVE-2026-21858 (n8n)
CVE-2026-3055 (Citrix ADC/NetScaler)
CVE-2026-34486 (Apache Tomcat)
CVE-2026-25253 (OpenClaw/Moltbot/Clawdbot)
@malwrhunterteam @500mk500 @1ZRR4H @MichalKoczwara](https://pbs.twimg.com/media/HIDtdKeXwAARAWG.png)
![SansLimit3's tweet photo. Exposed attacker infrastructure combining #Hermes Agent, #CyberStrikeAI, #SliverC2, and multiple LLMs used for automated CVE targeting, exploit validation, Telegram-based orchestration, and post-exploitation validation workflows.
Opendir:
142.171.160[.]137:8888
VULN-MONITOR:
142.171.149[.169:8001 - Real-time 1day/0day RCE tracking across 18 sources🤔
CyberStrikeAI Server: 100.81.245[.29:8080
Chain:
FOFA/Shodan recon → AI-assisted target filtering → CVE/PoC enrichment → custom scanner & exploit generation → exploit validation → WebSocket/shell access → post-exploitation environment validation → Telegram-pushed operations.
Targeted CVEs:
CVE-2026-0300 (Palo Alto PAN-OS)
CVE-2024-21762 (FortiOS/FortiProxy SSL-VPN)
CVE-2026-33017 (Langflow)
CVE-2026-21858 (n8n)
CVE-2026-3055 (Citrix ADC/NetScaler)
CVE-2026-34486 (Apache Tomcat)
CVE-2026-25253 (OpenClaw/Moltbot/Clawdbot)
@malwrhunterteam @500mk500 @1ZRR4H @MichalKoczwara](https://pbs.twimg.com/media/HIDsnlnXkAA-sG8.jpg)
![SansLimit3's tweet photo. Exposed attacker infrastructure combining #Hermes Agent, #CyberStrikeAI, #SliverC2, and multiple LLMs used for automated CVE targeting, exploit validation, Telegram-based orchestration, and post-exploitation validation workflows.
Opendir:
142.171.160[.]137:8888
VULN-MONITOR:
142.171.149[.169:8001 - Real-time 1day/0day RCE tracking across 18 sources🤔
CyberStrikeAI Server: 100.81.245[.29:8080
Chain:
FOFA/Shodan recon → AI-assisted target filtering → CVE/PoC enrichment → custom scanner & exploit generation → exploit validation → WebSocket/shell access → post-exploitation environment validation → Telegram-pushed operations.
Targeted CVEs:
CVE-2026-0300 (Palo Alto PAN-OS)
CVE-2024-21762 (FortiOS/FortiProxy SSL-VPN)
CVE-2026-33017 (Langflow)
CVE-2026-21858 (n8n)
CVE-2026-3055 (Citrix ADC/NetScaler)
CVE-2026-34486 (Apache Tomcat)
CVE-2026-25253 (OpenClaw/Moltbot/Clawdbot)
@malwrhunterteam @500mk500 @1ZRR4H @MichalKoczwara](https://pbs.twimg.com/media/HIDsgzbXkAAkbwj.png)
Exposed attacker infrastructure combining #Hermes Agent, #CyberStrikeAI, #SliverC2, and multiple LLMs used for automated CVE targeting, exploit validation, Telegram-based orchestration, and post-exploitation validation workflows.
Opendir:
142.171.160[.]137:8888
VULN-MONITOR:
142.171.149[.169:8001 - Real-time 1day/0day RCE tracking across 18 sources🤔
CyberStrikeAI Server: 100.81.245[.29:8080
Chain:
FOFA/Shodan recon → AI-assisted target filtering → CVE/PoC enrichment → custom scanner & exploit generation → exploit validation → WebSocket/shell access → post-exploitation environment validation → Telegram-pushed operations.
Targeted CVEs:
CVE-2026-0300 (Palo Alto PAN-OS)
CVE-2024-21762 (FortiOS/FortiProxy SSL-VPN)
CVE-2026-33017 (Langflow)
CVE-2026-21858 (n8n)
CVE-2026-3055 (Citrix ADC/NetScaler)
CVE-2026-34486 (Apache Tomcat)
CVE-2026-25253 (OpenClaw/Moltbot/Clawdbot)
@malwrhunterteam @500mk500 @1ZRR4H @MichalKoczwara
🤖 #CyberStrikeAI: IA nativa + 100+ herramientas para auditorías de ciberseguridad automatizadas 🚀 Descubre vulnerabilidades complejas con flujos inteligentes y trazabilidad total. ¡Eleva tu Red Team! #ai #mcp #ctftools #aiagents #pentestingtools #aipenetrationtesting #aihacking
⚠️ 600+ FortiGate devices breached in an AI-assisted campaign.
Team Cymru traced it to #CyberStrikeAI, an open-source Go tool bundling 100+ security utilities, run from 21 IPs across Asia and beyond.
The maintainer shows ties to #China’s vulnerability ecosystem.
🔗 Details → https://t.co/v82vlfdTlE
كشفت تقارير استخبارات التهديدات الصادرة في أوائل مارس 2026 عن تفاصيل حملة اختراق واسعة النطاق استهدفت مئات المؤسسات حول العالم باستخدام أدوات ذكاء اصطناعي متطورة.
📌 للتفاصيل الكاملة:
🔗 https://t.co/tCv5pexwGx
#CyberStrikeAI #AWS #Fortinet #AI_Hacking #ThreatIntel
Last Seen Hashtags on Sotwe
CaughtOnCamera
Seen from Greece
BBC
minichatt()********************************
Seen from Turkey
minichat(***************************************************************************************************************) filter:videos
Seen from Spain
awekpadu
Seen from Malaysia
teencreampie
Seen from Spain
asian #tgirl
Seen from Turkey
คอลเสียวฟรี
Seen from Thailand
acnoctem
Seen from Switzerland
heleners
Seen from Italy
Trends for you
Most Popular Users
Elon Musk 
@elonmusk
241.5M followers
Barack Obama
@barackobama
118.8M followers
Cristiano Ronaldo
@cristiano
114.5M followers
Donald J. Trump
@realdonaldtrump
111.9M followers
Narendra Modi
@narendramodi
107.1M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.3M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
90M followers
Taylor Swift
@taylorswift13
84M followers
Lady Gaga
@ladygaga
75.5M followers
Virat Kohli
@imvkohli
73.5M followers
Kim Kardashian
@kimkardashian
70.9M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
66.5M followers
Bill Gates
@billgates
65.2M followers
Selena Gomez
@selenagomez
63.1M followers
The Ellen Show
@theellenshow
62.2M followers
CNN
@cnn
61.7M followers
X
@x
60.7M followers