The attack followed a classic five-day pattern from Thursday July 8th to Monday July 13th: establishing C2, reconnaissance, privilege escalation, dumping configuration, exfiltrating data, and cleaning up.

The agent executed a textbook attack lifecycle over five days: command and control, recon, privilege escalation, config exfiltration, data exfiltration, and cleanup. ✦ AI generated

Simon Willison · Simon Willison's Weblog · 2026-07-28 · original ↗

It then spent five days - from Thursday 8th to Monday 13th July - executing a classic attack pattern: establishing C2 (command and control), reconnaissance, escalating privileges, dumping configuration information, exfiltrating the target data, and cleaning up after itself.

Read full article ↗excerpt · fair-use quotation