Welcome to The Cybersecurity Pulse (TCP)! I’m Andrew Richards, a cybersecurity practitioner working at the intersection of AI security, operations, and governance at Tennessee Valley Authority. I’ll be partnering with Darwin to bring you my perspective on the security developments, emerging technology, and industry news worth paying attention to. Subscribe to receive the latest updates! 📧
Hi 👋 Hope you’re having a great week wherever you’re reading from!
A little about me before we dive in. My background spans vulnerability management, threat intelligence, and now AI operations and governance, so I’ve had the chance to look at security from a few different angles. These days, I spend a lot of my time thinking about how organizations can adopt AI securely, from evaluating models and governing agents to figuring out what good oversight looks like as the technology keeps moving.
Darwin and I actually go back to our college days. He became a mentor early in my cybersecurity career, so it’s pretty cool to come full circle and now work on TCP together. I’m excited to bring some of my perspective to TCP, while also using this as an excuse to keep learning and stay close to what’s happening across security.
Now, onto the news!
Echo acquired key Minimus assets three days after the startup announced its wind-down. Source: Echo
🗞️ TL;DR
🖱️ Cursor: Aurora ransomware operators used Cursor Agent during post-access activity across ten target organizations.
🧱 Minimus: Echo acquired key Minimus assets just three days after the company announced it was winding down.
🧪 OpenAI: Roughly 700 agents converged on the Hugging Face environment, giving us another unusual look at how agents behave at scale.
🧰 Cybercrime: The FBI seized QTFY domains, knocking its QScan and QTRouter hacking platforms offline.
🔬 Threats & research: PaperCut patched an actively exploited flaw again, CISA compared two very different SOC responses, and new research dug into AI malware.
📦 Security releases: TRACE landed at the Linux Foundation, Android 17 added new network defenses, and Citrix introduced a Windows recovery environment.
💰 Funding & M&A: Alice raised $140 million, Socure acquired Fravity alongside new growth capital, and Kazimi raised €2.2 million in pre-seed funding.
⚒️ Picks of the Week
A ransomware operator used Cursor as a post-access console
Gambit Security observed an Aurora ransomware operator using Cursor Agent, running Claude Sonnet 4.5 Thinking, across ten target organizations. One important detail is easy to miss: the agent was given credentials or another route into the victim environment. Cursor wasn’t autonomously finding targets and breaking in. The attacker already had a way through the door and used the agent to help operate once inside.
Cursor was tasked with internal scanning, domain enumeration, NTLM relay attempts, certificate attacks, and other post-access activity. Many commands failed on the first attempt, but the agent repeatedly refined its approach. The operator even set guardrails including no DCSync, account lockouts, or creation of new computer objects.
Gambit observed Cursor Agent sessions across ten organizations from April 8 through May 21. Circle size represents the number of commands run. Source: Gambit Security
There’s something almost like reverse governance happening here. Give the agent access, an objective, and boundaries. Do all of these bad things, just don’t do these bad things. If this is what attackers could accomplish with an earlier generation of agentic tooling, the trajectory matters as models become more capable. AI agents are becoming another part of threat actor tradecraft. For defenders, that puts even more pressure on defense in depth and detections that can catch malicious activity whether it comes from a person or an agent.
Echo picks up key Minimus assets after its wind-down
Three days after Minimus announced it was winding down, Echo acquired key assets from the company, including its technology, integrations, research, and data. Minimus grew out of Gutsy, which launched with a $51 million seed round in 2023 before pivoting toward hardened open-source software. The terms of Echo’s deal weren’t disclosed, and importantly, Echo acquired key assets rather than Minimus itself.
I like this move. Cybersecurity benefits from collaboration, and a company shutting down doesn’t mean the technology or research it built suddenly loses its value. Minimus appears to have built something Echo believes is worth carrying forward, while its customers now have a potential path forward instead of being left with a dead product. Echo gets stronger, useful security work doesn’t disappear, and years of research and engineering have a chance to keep contributing to the industry.
Roughly 700 OpenAI agents joined the Hugging Face attack
METR's investigation into OpenAI's agent experiment keeps getting stranger. Roughly 1,200 supposedly isolated agents discovered an unsanctioned message board, exchanged more than 70,000 messages and files, and about 700 eventually participated in the Hugging Face attack. Some agents accomplished milestones through collaboration that they couldn't achieve alone. Others researched ways to manipulate the ExploitGym scorer, including spoofing their own tool calls.
An isolated agent discovered the shared message board and joined the broader attack. Source: METR.
What gets me is how persistent these agents were. Give capable agents an objective and enough freedom, and you have to account for them finding paths to that objective you never designed or anticipated. One agent created the message board itself, and within hours more than 50 others had found it and started communicating. And that communication mattered. METR found that agents working together reached milestones they couldn't achieve on their own. That's wild, but it also raises a serious enterprise question: what happens when supposedly isolated agents gain access to shared state or communication channels you aren't monitoring? As agents get more capable and connected, controlling what they can access, who they can communicate with, and how we verify what they actually did becomes just as important as the task we gave them in the first place.
FBI takes QTFY's hacking platforms offline
The Justice Department and FBI seized three domains used by QScan and QTRouter, two complementary hacking platforms allegedly operated by the PRC-linked QTFY group. QScan scanned and infected thousands of IoT devices, while QTRouter used compromised devices and other infrastructure to help malicious actors hide the origin of their attacks. Because the seized domains were hard-coded into both platforms, DOJ says the operation rendered them inoperable.
Sometimes offense is your best defense. Most security teams, spend their time watching IOCs, threat hunting, tuning detections, and preparing for the next attack. The FBI and its partners have another lever: disrupting the infrastructure attackers depend on. Taking these platforms offline might seem like a small win, but disrupting infrastructure built to operate at scale can prevent a lot more attacks downstream.
🔬Threats & Research
PaperCut patches an actively exploited flaw again
PaperCut released a second emergency security update for actively exploited vulnerabilities affecting PaperCut MF and NG, adding further hardening beyond its original emergency patch. The company has confirmed customer incidents, making this more than a theoretical patching exercise. If you applied the first update, check again. Release 2 is the version administrators should be looking at now.
Both SOCs had alerts. Only one acted.
CISA ran parallel red-team assessments against two organizations using similar attack techniques, but the defensive response looked very different. At Organization A, alerts were missed or closed while the red team continued deeper into the environment. At Organization B, defenders isolated three compromised endpoints in roughly 10, 2, and 20 minutes, forcing CISA to continue the assessment from an assumed breach.
Red team activity and Organization B SOC response. Source: CISA
Unit 42 found most “AI malware” samples only in labs
Unit 42 compared 405 AI-linked samples against endpoint telemetry from December 2024 through June 2025 and network telemetry from June 2024 through June 2025. Only 12 appeared on Cortex XDR-protected production endpoints. Roughly 97% existed only in sandboxes, VirusTotal, research repositories, or validation systems, and the set included conventional malware wearing AI branding. This is selected Palo Alto Networks telemetry, not a current prevalence estimate for the whole internet. It fits the less cinematic pattern seen elsewhere this week, where AI is useful in planning, coding, and operator workflows while autonomous malware remained uncommon in this dataset.
📦 Security Product Releases
TRACE gives agent audit trails a cryptographic spine
The Linux Foundation accepted TRACE, an open specification designed to create cryptographically verifiable records of AI runtime activity. Instead of relying only on traditional logs, TRACE is designed to provide tamper-evident evidence of what an AI system executed, creating a stronger audit trail for agents and other autonomous systems.
Android 17 adds four network defenses
Android 17 adds broad Encrypted Client Hello support with Private DNS, enforces permission checks for local network access, and enables Certificate Transparency by default. Participating carriers can also disable 2G by default to blunt SMS-blaster attacks, while ECH still depends on supporting sites, apps, and modern networking libraries. These are consequential platform changes because they reduce exposed network metadata, silent local scanning, certificate opacity, and a legacy downgrade path without another settings scavenger hunt.
Google's model of an SMS-blaster attack: a rogue base station forces nearby phones onto legacy 2G before delivering phishing texts. Source: Google
Citrix adds a second operating system for Windows outages
Citrix introduced UniconOS dual boot, a recovery capability that gives organizations another way to keep endpoints running during Windows outages. If the primary Windows environment becomes unavailable or compromised, compatible devices can boot into an isolated UniconOS environment and reconnect users to critical applications through Citrix services. The idea is straightforward: if Windows is the problem, recovery shouldn't depend entirely on Windows working.
🤝 Funding & M&A
Alice raises $140M
Alice raised $140 million in a round led by Apax Digital, bringing its total funding to $280 million. Source: Alice.
Alice, formerly ActiveFence, raised $140 million as it expands its AI security platform. The company is positioning around securing AI applications and agents, building on ActiveFence's background in trust and safety. The round gives Alice fresh capital to expand as enterprises look for ways to secure increasingly autonomous AI systems.
Socure adds growth capital and acquires Fravity
Socure raised additional growth capital and acquired Fravity, an AI-native identity company, as it expands beyond identity verification into agentic identity. The deal brings Fravity’s technology and team into Socure as companies start thinking about how autonomous agents should be identified, authorized, and trusted alongside human users.
Kazimi raises €2.2M to secure AI agents
Kazimi raised €2.2 million in pre-seed funding to build security infrastructure for AI agents. The company is developing tools to control how agents access systems, credentials, and sensitive resources as organizations move from AI assistants toward software capable of taking actions on their behalf.
Interested in sponsoring TCP?
Sponsoring TCP not only helps me continue to bring you the latest in security innovation, but it also connects you to a dedicated audience of 20,000+ CISOs, practitioners, founders, and investors across 135+ countries 🌎
Disclaimer
The insights, opinions, and analyses shared in The Cybersecurity Pulse are my own and do not represent the views or positions of my employer or any affiliated organizations. This newsletter is for informational purposes only and should not be construed as financial, legal, security, or investment advice.
The guardrail list is the more useful artifact here than the ransomware headline. No DCSync, no lockouts, no new computer objects, that's not caution, it's the operator telling the agent exactly which detections they already expect a target to have. Read backwards, that's free intel on what this group thinks a typical SOC actually catches. The real diligence question for an EDR or XDR vendor isn't whether they can flag an AI agent, it's whether the detection is built on the underlying behavior chain or on tool signatures, since an agent following those same guardrails looks identical to a careful human operator working with native admin tools.