Researchers uncovered two previously unknown endpoints with older Cortex XDR agents that used to test an AV/EDR bypass tool were compromised, granting unauthorized access. The threat actor utilized a bypass tool, likely purchased from cybercrime forums, to compromise the system.

Source: GBHackers