Recon

Reported Context (2)

and control (C2) server hosting an automated reconnaissance and credential management framework dubbed “Recon.” GTIG described the host as providing “a live, production frontend dashboard designed to organize, Datadog Tracks AI-Assisted Credential-Harvesting Platforms and AWS Abuse
and Control (C2) server hosting an automated reconnaissance and credential management framework dubbed "Recon." Initial directory listings exposed specialized agentic configuration and knowledge files—including Google Reports Threat Actors Using AI for Automated Attacks and Credential Theft

CVE (5)

Malware (7)

Threat Actors (17)

MITRE ATT&CK (7)

Vendors (9)

Products (26)

Tools (8)

Industries (7)

Countries (6)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.