Cybersecurity articles tagged #Post Exploitation on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/khunt-toolkit-leverages-sqli-in-oracle-for-system-accesshttps://runtimerebel.com/blog/khunt-toolkit-leverages-sqli-in-oracle-for-system-accessAttackers exploit SQL injection in a public-facing web app to compile the khunt toolkit within Oracle, achieving SYSTEM-level access on Windows servers.Thu, 06 Aug 2026 10:29:03 GMTSQL InjectionPost ExploitationWindowsOracle DatabaseKhunthttps://runtimerebel.com/blog/cve-2025-68686-fortinet-fortios-patch-bypass-for-post-exploit-persistencehttps://runtimerebel.com/blog/cve-2025-68686-fortinet-fortios-patch-bypass-for-post-exploit-persistenceCISA warns of active exploitation of CVE-2025-68686 in Fortinet FortiOS, allowing attackers to bypass a patch for post-exploit persistence and expose sensitive data.Fri, 31 Jul 2026 10:43:21 GMTCVE-2025-68686FortinetFortiosInformation ExposurePatch BypassPost ExploitationCISA KEVCWE-200https://runtimerebel.com/blog/post-exploitation-tactics-persistence-and-lateral-movement-analysishttps://runtimerebel.com/blog/post-exploitation-tactics-persistence-and-lateral-movement-analysisAnalyze how threat actors establish persistence, disable security software, and move laterally after initial network access to ensure long-term compromise.Thu, 30 Jul 2026 14:07:01 GMTPost ExploitationPersistence MechanismsIncident ResponseLateral MovementHuntresshttps://runtimerebel.com/blog/hermes-ai-agent-automates-post-exploitation-against-thai-ministryhttps://runtimerebel.com/blog/hermes-ai-agent-automates-post-exploitation-against-thai-ministryHermes AI agent automates post-exploitation during alleged breach of Thai Ministry of Finance. Learn TTPs, impact, and mitigation for AI-driven threats.Fri, 24 Jul 2026 21:05:58 GMTHermes AIAI AutomationPost ExploitationThai Ministry of FinanceGovernment Targethttps://runtimerebel.com/blog/cve-2026-39987-attackers-use-llm-agents-for-post-exploitationhttps://runtimerebel.com/blog/cve-2026-39987-attackers-use-llm-agents-for-post-exploitationDiscover how threat actors are leveraging LLM agents to automate post-exploitation tasks after compromising Marimo notebooks via CVE-2026-39987.Fri, 29 May 2026 17:18:30 GMTCVE-2026-39987MarimoLLM AgentPost ExploitationCloud Securityhttps://runtimerebel.com/blog/roadk1ll-websocket-implant-new-threat-for-stealthy-lateral-movementhttps://runtimerebel.com/blog/roadk1ll-websocket-implant-new-threat-for-stealthy-lateral-movementAnalysis of the new RoadK1ll WebSocket implant, detailing its capabilities for lateral movement on compromised networks and offering detection and mitigation strategies.Tue, 31 Mar 2026 00:40:12 GMTRoadK1llWebSocketLateral MovementPost ExploitationImplanthttps://runtimerebel.com/blog/ransomware-ttps-shift-from-cobalt-strike-to-native-tools-data-theft-surgeshttps://runtimerebel.com/blog/ransomware-ttps-shift-from-cobalt-strike-to-native-tools-data-theft-surgesRansomware actors are abandoning Cobalt Strike for native Windows tools as payment rates decline, leading to a significant surge in data theft.Wed, 18 Mar 2026 00:37:35 GMTRansomwareTTPsCobalt StrikeData TheftNative Windows ToolsPost Exploitationhttps://runtimerebel.com/blog/warlock-ransomware-byovd-techniques-and-post-exploitation-analysishttps://runtimerebel.com/blog/warlock-ransomware-byovd-techniques-and-post-exploitation-analysisThe Warlock ransomware group has evolved its tactics, utilizing BYOVD techniques and stealthy cross-network activity to bypass EDR and security controls.Tue, 17 Mar 2026 16:31:42 GMTWarlock RansomwareBYOVDEDR EvasionLateral MovementPost Exploitation