GreyNoise and Blackpoint Cyber trace the new PaperCut auth-bypass chain to one scanning address running AI agents against schools, which turns an unpatched print server from a maintenance ticket into a credential incident.
Perspective Coverage
6 publishers
- Builder
- Builder 31%
- Operator
- Operator 57%
- Investor
- Investor 12%
Reality
- Evidence62
- Adoption38
- Hype gap+20
- Incentives40
- Confidence66
A quantised 27B on one 16GB GPU audited a home Splunk and Sysmon install with nothing leaving the host. Its first repair attempt ran the 128K context window dry. A halt rule in the system prompt got it under control.
Reality
- Evidence38
- Adoption9
- Hype gap+22
- Incentives32
- Confidence44
Sophos CTU reviewed 15 intrusions by GOLD SHERWOOD affiliates and found the same route each time: a working credential on a Fortinet SSL VPN with no MFA, then RDP into domain controllers within hours.
Reality
- Evidence64
- Adoption76
- Hype gap+12
- Incentives70
- Confidence58
ASEC says the North Korean group now installs Chrome Remote Desktop after AppleSeed lands, while its older VNC and RDP Wrapper activity keeps turning up in logs.
Publishers:asec.ahnlab.com
Reality
- Evidence62
- Adoption44
- Hype gap+8
- Incentives55
- Confidence58
Picus says its 338-million-simulation dataset shows prevention recovering. The same dataset shows one credential-dumping tool blocked 94% of the time by one route and 3% by another.
Reality
- Evidence32
- Adoption24
- Hype gap+32
- Incentives86
- Confidence38