Hackers Use AI Agents and GodPotato Exploit to Gain Windows SYSTEM Privileges

Researchers report an intrusion in which attackers leveraged an unauthenticated Cairn job-submission endpoint in an Apache Tomcat/Spring Batch application to run JavaScript via Nashorn, exfiltrate plaintext SQL Server credentials, enable xp_cmdshell, and escalate to SYSTEM using PrintSpoofer and GodPotato; the campaign used an application-level command channel (no web shell), transferred binaries in base64 fragments, and left multiple IOCs (IP addresses, file paths, temporary binaries), with recommendations to secure management endpoints, protect secrets, and retain correlated telemetry.