The Watch

The Threat

CVE-2026-22769 is a hardcoded admin credential in Dell RecoverPoint's Apache Tomcat configuration, located at /home/kos/tomcat9/tomcat-users.xml. It enables unauthenticated WAR file deployment via /manager/text/deploy, yielding root-level code execution. The CVSS 10.0 score is earned: no authentication required, no user interaction, complete system compromise.

Mandiant and Google's GTIG documented active exploitation by UNC6201, who deploy the GRIMBOLT backdoor — a successor to BRICKSTORM compiled with native AOT to strip CIL metadata, making reverse engineering significantly harder. Post-exploitation is sophisticated: persistence via hijacking convert_hosts.sh (executed at boot via rc.local), lateral movement through Ghost NICs (phantom virtual network interfaces on VMs), and iptables-based Single Packet Authorization on compromised vCenter appliances.

Once UNC6201 is in your disaster recovery infrastructure, they pivot silently through your entire VMware environment — and your EDR won't see it coming on port 9389 either.

The Compounding EDR Blind Spot

Simultaneously, ADWSDomainDump — a publicly available tool — enumerates Active Directory via ADWS (port 9389) instead of LDAP, bypassing both Microsoft Defender for Endpoint and CrowdStrike Falcon. Any attacker with domain credentials can silently map your entire AD topology. This means even if you detect GRIMBOLT's initial foothold, the attacker's reconnaissance phase may be invisible to your two most common EDR platforms.

Why This Matters More Than a Typical CVE

Disaster recovery infrastructure is the last line of defense in a ransomware scenario. If UNC6201 compromises your RecoverPoint environment, they own your backups. Combined with the ADWS blind spot, an attacker can map your AD, compromise your DR, and establish persistent C2 — all while your EDR reports clean.

Password Manager Zero-Knowledge Claims: Empirically Shattered

ETH Zurich's Applied Cryptography Group demonstrated 25 attacks across Bitwarden (12), LastPass (7), and Dashlane (6) — products collectively serving approximately 60 million users. The attacks break the "zero-knowledge encryption" guarantee using only lightweight server-impersonation tooling, not significant computational resources. Root cause: feature-bloat complexity and reliance on 1990s-era cryptographic primitives. Attack severity ranges from targeted vault integrity violations to full organizational vault compromise.

Full findings will be published at USENIX Security 2026 — expect weaponized tooling to follow shortly after.

Real-Time Deepfakes Now Defeat Video Call Verification

Tavus launched Phoenix-4, a real-time human rendering model generating AI avatars with full facial expressions, 10+ emotional states, contextual reactions, and per-pixel face generation at 40 FPS HD quality. This isn't a pre-recorded deepfake — it's a live, interactive avatar that responds emotionally in real-time. Multiple intelligence sources confirm the convergence: Google's Lyria 3 generates audio indistinguishable from real content, OpenAI's Sora produces convincing video, and Phoenix-4 handles live interaction.

If your identity verification still treats a live video call as proof of identity, Tavus Phoenix-4 just made that assumption a vulnerability.

ShinyHunters: 15 Breaches via SSO Abuse in 7 Weeks

ShinyHunters claimed theft of 1.7 million CarGurus corporate records with a February 20 extortion deadline. This group has conducted 15 alleged breaches in 2026 alone, targeting financial firms, retail brands, and dating platforms. Their primary TTPs: social engineering and SSO abuse — not sophisticated zero-days, but high-volume identity-based attacks exploiting misconfigured federation and weak MFA.

The Convergence

Seven independent intelligence sources this cycle document the same pattern from different angles: AI agents are gaining execution authority faster than security frameworks can govern them. This isn't a single product launch — it's an industry-wide architectural shift with compounding security implications.

Financial Execution Authority

In fintech alone: Oracle is deploying 130 specialized AI agents for financial institutions by May, Ramp processes 100K expenses daily via AI (with a 1% error rate = 1,000 potential control failures/day), Klarna's chatbot replaced 800 human agents, and Visa and Mastercard are piloting agentic payments where AI agents autonomously initiate and approve transactions. Each represents a non-human identity with financial execution authority that traditional IAM was never designed to govern.

Self-Replicating Autonomous Agents

A developer has deployed 'The Automaton' — an autonomous AI system that earns cryptocurrency onchain, pays for its own infrastructure via the x402 payment protocol, and spawns child agents that replicate the same capabilities. The capability gap between "earns onchain and pays for hosting" and "autonomously procures attack infrastructure" is trivially small. This decouples attack infrastructure from human operators, breaking traditional assumptions about disrupting adversary funding and attribution.

CI/CD Pipeline Infiltration

GitHub Agentic Workflows (technical preview) allows AI coding agents to execute in GitHub Actions based on plain Markdown instructions. This creates prompt injection vectors via Markdown, agent autonomy without mandatory human review gates, and a new supply chain attack surface mapped to MITRE ATT&CK T1195.002.

The Authorization Gap

Traditional policy engines like AWS Cedar evaluate access based on predefined attributes and rules. But AI agents operate with delegated permissions, shifting context, and complex relationship graphs that change in real-time. Relationship-based access control (ReBAC) systems like SpiceDB and Google Zanzibar are architecturally necessary — static RBAC/ABAC cannot model dynamic agent-to-data relationships.

If your AI agents are authorized by the same static policies you wrote for human users, you're building a privilege escalation vulnerability into your architecture — and the agents will find it before your red team does.

Shadow API Exposure via MCP

Agoda's API Agent demonstrates a concerning pattern: zero-code transformation of any internal REST or GraphQL API into an MCP endpoint accessible by AI agents. Anthropic's Claude Sonnet 4.6 now supports 1M token context windows with improved MCP connectors — a single misconfigured connection could ingest an entire financial model or customer database in one pass. This is available on the free tier.

Situation

Three independent sources confirm the Pentagon is massing the largest airpower deployment in the Middle East in over two decades, including the USS Abraham Lincoln Carrier Strike Group. Officials told the New York Times that strikes on Iran could come as soon as this weekend. This follows a US strike on Iran's nuclear program in June 2025. Diplomatic talks in Geneva produced what the White House called "a little bit of progress" — which, in diplomatic language, means almost none.

Historical Cyber Correlation

Iranian state-sponsored groups have a well-documented pattern of escalating cyber operations during military tensions with the US. The threat actors to prioritize:

Key MITRE ATT&CK techniques to prioritize: T1078 (Valid Accounts), T1190 (Exploit Public-Facing Application), T1485 (Data Destruction), T1071 (Application Layer Protocol for C2), and T1059.001 (PowerShell). Iranian actors have historically targeted VPN appliances and edge devices — unpatched Fortinet, Pulse Secure, or Citrix in your perimeter elevates your exposure significantly.

When the largest US military buildup since 2003 is pointed at Iran, your SOC should already be hunting for APT33 and APT34 indicators — not waiting for the first CISA emergency directive.

Note: The geopolitical intelligence comes from general news sources, not dedicated threat intelligence feeds. Validate against CISA's Iran Cyber Threat Overview and your commercial threat intel providers for technical indicators.