Cato CTRL is the threat intelligence team at @CatoNetworks. Follow for the latest insights and threat research.
Joined March 2025
- Tweets128
- Following5
- Followers148
- Likes27
📷 Cato CTRL threat alert: our MDR team has detected new SilverFox infrastructure to deliver ValleyRAT Via DLL-Side Loading.
#ValleyRAT #SilverFox #APT
Hashes:
0194794fbd0571ddebfac7de79a8ae81d42810cd73cdf1ab0276e22b103ad99b
daf44bcab4e08e1e1c58ac2000be3606f8dd6c6dc290a6f91cb18ff580c27581
0e9eac3b122c54db9a6e460771340a62556b5213747d2d18706b693f638af859
0f33af2328424e33ceb243d5a930306685a00de564294297150eb69d34085865
11d7ca0f3d1b073cb9ef6523c6c3ee315d73ce502dc3df31297256c2540d9fb5
13b89593151baae6d2502f1ee6b269ce75f48e144027207d3a1b8f5ee383fa4c
Cato CTRL threat alert: our MDR team has detected new IP to Deliver RAT via ChatGPT Custom GPTs.
IP:
167[.]148[.]201[.]15
#RomulusPanel #Clickfix #FakeGPT
📷 Cato CTRL threat alert: our MDR team has detected new JSCeal Stealer C2 domains.
CTRL Blog as reference:
catonetworks.com/blog/cato-c…
Domains:
kingdomspet[.]com
quickmeals[.]name
viewquendora[.]com
brimoralab[.]net
hubulmora[.]info
nextcenterlogic[.]com
greenthicket[.]org
fieldopensgroup[.]com
litemorixhubs[.]info
quietwoods[.]org
domentispace[.]net
yorvexspace[.]com
livingofspace[.]com
dailychores[.]name
Hash:
d5ebce0854a7fa3f00cfbcc85fbf26d0fb5fe7ddedba10eb1adb9f64e32ef9b3
Cato CTRL retweeted
AI isn’t reinventing the attack. It’s compressing the timeline. That’s the biggest takeaway from our latest research.
Cato researchers evaluated six attack scenarios using OpenAI’s GPT-5.5 and GPT-5.5-Cyber models in a controlled Active Directory lab environment.
The fastest successful execution demonstrated an end-to-end attack chain — from initial access to Domain Administrator privileges — in as little as 40 minutes.
Cato CTRL retweeted
In @TheHackersNews: DuneSlide began with zero-click prompt injection. In Cursor IDE, it became a path to critical RCE.
The news outlet covered Cato AI Labs and Itay Ravia’s DuneSlide research: two critical RCE vulnerabilities in Cursor IDE, the AI-powered development environment Cursor says is used by over half the Fortune 500.
Cato CTRL retweeted
Cato AI Labs has discovered DuneSlide: two critical RCE vulnerabilities in Cursor IDE. This is what happens when prompt injection becomes an entry point to classical vulnerability exploitation: sandbox escape, arbitrary file write, and unsandboxed RCE. The attack can be triggered by attacker-controlled content from an untrusted source.
bit.ly/4460tr4
Cato AI Labs has discovered DuneSlide: two critical RCE vulnerabilities in Cursor IDE. This is what happens when prompt injection becomes an entry point to classical vulnerability exploitation: sandbox escape, arbitrary file write, and unsandboxed RCE. The attack can be triggered by attacker-controlled content from an untrusted source.
bit.ly/4v8Sa8V
Self-improving AI agents like Hermes Agent are moving from experimentation into enterprise workflows. But when AI can learn, remember, use tools, and access third-party services, governance becomes essential. In our latest Cato CTRL Insights blog, we explore Hermes Agent adoption signals, attack surface considerations, and how Cato helps identify and govern this emerging agentic AI risk. bit.ly/4xC9fuk
ShinyHunters has survived 3 forum seizures, 5 arrests & the conviction of its founder - and it's still active in 2026. The real story? It's no longer just a group. It's a brand - one that adapts faster than law enforcement can respond. New Cato CTRL™ threat actor profile bit.ly/4eu1cqN
📷 Cato CTRL threat alert: our MDR team has detected new malicious domains being used to download Vidar Stealer via Powershell.
Hashes:
320e383e99b4cd5bce3a8ec68be2cbe40a8f81023cb88bf9c10f319e47e3c25c
7d92023a249aab3f0e61604f40f859e94f30352903e171799db1bc95e927d34a
cde93f23f16355b7786f5de405f864d0f4f201a6aa6ebca619f12b2363142041
ff8a1de4560df470e86d171e4860257cb1da2099d2ddebd40f09e8f00c5cf25a
926df4a5ba3daac4a5abd0a004e98dac77f93e98fb7a898cde14a0bf7d6ff1af
841a74ffb630257184c698a40d60f5024da6e8d3dd99e15f08c7e74ce9eca3db
85d5cdcabb890f1fa374ea2b0ed869e2327359c24e84c75d0efaee29c6ee4e43
6f1d7cb6b3001bf351c33c7e65a6924c624512ced093a0a45f03424a8f07130b
5a8c3231262b5bae26f49af31022fea964f34e922a6dc772057d9ca826fb41e5
New threat research: Cato CTRL. 339 commands. 33 days. 4 French victims. Cato CTRL captured a threat actor’s operation from compromise to credential theft to persistence that survived a C2 takedown. If you think taking down the C2 means remediation, this will change your playbook. bit.ly/3Ss3L57
Zero-days are becoming industrial. What separates the US and China isn’t talent or even frontier AI algorithms. It’s structure: how each side can collect, route, and reuse zero-days. In a cyber arms race, the pipeline is the weapon. Read the brief to learn why. bit.ly/3S3ArSg
🚨 Cato MDR Alert: We’ve detected a malicious IP address being used to download Quasar RAT, MeshAgent, and Defender Control via cURL.
Key IoCs, URLs and hashes in the thread below. 🧵👇
#ThreatIntel #QuasarRAT #MeshAgent #DefenderControl
🚨 Cato CTRL threat alert: our MDR team has detected new malicious IP address being used to download #MeshAgent and #DefenderControl via Powershell.
