Dossier
unknown threat actor
Coverage of unknown threat actor in the Nexus archive.
- Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit
An unknown threat actor used an LLM agent for post-compromise actions after exploiting a publicly-accessible Marimo network via CVE-2026-39987, extracting cloud credentials from the compromised system.