The Watch

The Attack Chain

A multi-year zero-day exploitation campaign targeting Cisco SD-WAN devices has been exposed through coordinated disclosure from CISA and Five Eyes intelligence partners. The campaign, active since at least 2023, chains two vulnerabilities to achieve persistent root access:

The software downgrade technique is the critical innovation. Even organizations that patched CVE-2022-20775 years ago are vulnerable — the attacker rolls firmware back to a vulnerable version after bypassing authentication. This renders traditional patch management insufficient and maps to MITRE ATT&CK T1601.001 (Modify System Image).

Cross-Source Corroboration

Four independent intelligence sources confirm this threat. CISA issued an emergency directive. Five Eyes partners published joint threat-hunting guidance. Cisco described the actors as "highly sophisticated and disciplined" — language that signals nation-state attribution without naming the actor. VulnCheck's 2025 data provides macro context: of 40,000+ CVEs published, only ~1% were exploited in the wild, but network edge devices absorb disproportionate exploitation.

Officials explicitly declined attribution, but Five Eyes coordination, federal network targeting, multi-year persistence, and the "highly sophisticated" descriptor are consistent with Chinese APT groups (Volt Typhoon, Salt Typhoon) that have previously targeted U.S. networking infrastructure for pre-positioning.

Compounding Factor: Volt Typhoon Never Left

Dragos's 2026 Year in Review confirms that Volt Typhoon remains embedded in U.S. critical infrastructure despite the government's 2025 "mission accomplished" claims. A new access broker group called Sylvanite is conducting large-scale initial access operations targeting electricity, water, and oil/gas sectors across North America, Europe, the UK, and Guam — handing off access to groups including Volt Typhoon. Any critical infrastructure operator that relaxed monitoring based on 2025 government assurances now has a gap measured in months.

The Blast Radius

SD-WAN controllers manage traffic routing, encryption policies, and network segmentation across your entire WAN fabric. Admin access means an attacker can intercept traffic, modify routing, disable security policies, and move laterally across every connected site. Some compromised environments will require full system rebuilds — not just patching.

Three Simultaneous Attack Vectors

The developer pipeline is under coordinated, multi-vector attack. Three distinct campaigns are active simultaneously, each targeting a different link in the software supply chain:

1. SANDWORM_MODE: Self-Propagating NPM Worm

Socket's research team discovered 19 malicious npm packages forming a purpose-built worm targeting the AI-native development environment. The kill chain is sophisticated:

• Credential theft from Bitwarden, 1Password, LastPass browser extensions
• MCP server injection into Claude Code, Cursor, VS Code Continue, and Windsurf — embedding prompt injections that instruct AI assistants to exfiltrate SSH keys and AWS credentials during normal coding
• Polymorphic self-rewriting using local Ollama (deepseek-coder:6.7b) to defeat signature-based detection
• Dead switch that wipes the home directory if C2 connection is lost
• Propagation via stolen npm/GitHub tokens injecting dependencies into downstream repos

2. Claude Code RCE (CVE-2025-59536, CVE-2026-21852)

Three vulnerabilities in Anthropic's Claude Code enable remote code execution and API key exfiltration when developers open malicious repositories. The attack abuses Hooks, MCP server configurations, and environment variables embedded in cloned repos. No code execution required — just opening the project is sufficient. This fundamentally shifts the developer threat model from "don't run untrusted code" to "don't open untrusted projects."

3. Multi-OS Supply Chain via 'ambar-src'

A typosquatting npm package impersonating ember-source accumulated ~50,000 downloads in three days, deploying OS-specific malware via preinstall hooks: encrypted shellcode on Windows, Golang reverse SSH on Linux, and Apfell/MythicAgents on macOS — all using Yandex Cloud Functions for C2 evasion.

Converging Threat: Job-Themed Repository Lures

Microsoft flagged a parallel campaign using fake "technical assessment" GitHub repositories to deliver fileless multi-stage backdoors. Repos use repeatable naming conventions and retrieve loader scripts from remote infrastructure during build. This TTP is consistent with DPRK-linked threat actors (Lazarus Group). A separate malicious NuGet package named 'StripeApi' targets .NET developers in the financial sector.

AI is simultaneously the attack surface, the attack tool, and the target. The developer who sees their AI assistant working normally doesn't know it's silently stealing secrets via injected MCP server prompts.

The Cline Precedent

Cline's Claude-powered Issue Triage workflow was compromised via prompt injection in GitHub Actions. A threat actor stole the researcher's own PoC from a test repository and used it to attack Cline directly, obtaining VS Code Marketplace publication credentials. This establishes a new pattern: threat actors are actively monitoring security researchers' public work to weaponize findings in real-time.

The Convergence

In a single week, the AI industry crossed an inflection point that most security programs aren't equipped to handle. Perplexity Computer launched as a "general-purpose digital worker" that operates GUIs and claims to run for hours or months. Claude Cowork added scheduled tasks with a plugin architecture across engineering, design, and operations. Cursor Cloud Agents got dedicated VMs with full dev environments, shipping merge-ready PRs to GitHub via Slack. Anthropic acquired Vercept to enhance Claude's computer-use capabilities. And 21,000 OpenClaw AI agent instances connected to Slack, Gmail, and Google Drive in just two weeks — with RCE vulnerabilities and leaked OAuth tokens — while most security teams had zero visibility.

Why This Is Different From Traditional Shadow IT

Computer-use AI agents break every assumption in your current security model:

The SaaS Vendor Response Complicates Things

Enterprise SaaS vendors are reacting defensively. Workday's CEO called third-party AI agent providers "parasites" and announced plans to restrict data access. HubSpot declared it will "monitor, meter, and monetize" all AI agent access. Google suspended accounts using OpenClaw. These vendor policy changes are effectively unannounced changes to your data flow architecture that your security team may not be consulted on — integrations could break, data could reroute, and monitoring gaps could emerge.

A months-long autonomous agent session means credential rotation policies don't apply, behavioral baselines are invalid, and attributing actions to a responsible human becomes nearly impossible — creating compliance gaps across SOC 2, GDPR, and HIPAA.

The Systemic Trust-Boundary Failure

The SilentBridge vulnerability family in Meta's Manus AI (CVSS 9.8) demonstrated that this isn't a vendor-specific bug — it's an architectural class of vulnerability. Researchers achieved Gmail data exfiltration, reverse shell with passwordless sudo escalation, and cross-tenant media access simply by having the agent "summarize this page" containing hidden instructions. Any agentic AI platform that processes untrusted content while holding privileged access is exposed.

CISA KEV: Patch or Perish

Two actively exploited vulnerabilities hit CISA's Known Exploited Vulnerabilities catalog this week, triggering mandatory patching under BOD 22-01:

Dell RecoverPoint's hardcoded credentials are particularly dangerous because backup infrastructure is a ransomware operator's primary target — compromising backup systems eliminates recovery options. Roundcube has been a repeated target of state-sponsored espionage groups including APT28 and Winter Vivern.

The CVSS 10.0 Cluster

Six maximum-severity vulnerabilities dropped in a single week — an extraordinary concentration:

• CVE-2026-27211 (Cloud Hypervisor): Guest-to-host file exfiltration via virtio-block — a multi-tenant cloud isolation failure
• CVE-2025-12107 (WSO2 Identity Server 5.11.0): Velocity template injection in your authentication infrastructure
• Dell RecoverPoint, plus three others across enterprise software

SolarWinds Serv-U: Complete Compromise Chain

Four new critical CVEs (CVE-2025-40538 through 40541) in SolarWinds Serv-U enable unauthenticated admin account creation followed by domain admin code execution. Given SolarWinds' history as a nation-state target, this is an especially high-priority patch. Multiple sources independently flagged this as critical.

Sandworm Expands Wiper Operations to NATO

ESET Research and CERT Polska attributed DynoWiper — deployed against Polish energy companies in late December 2025 — to infrastructure consistent with Russian APT Sandworm (GRU Unit 74455). This geographic expansion from Ukraine to Poland is a strategic escalation. DynoWiper is a simple 32-bit Windows executable with no packing, meaning signature-based detection is viable if you have the IOCs.

AI-Powered Mass Exploitation: 600+ FortiGates, Zero CVEs

A Russian-speaking actor used commercial AI toolkits to compromise over 600 FortiGate firewalls starting January 11, 2026 — without exploiting a single vulnerability. The attack vector: exposed management ports, weak passwords, no MFA. AWS's security team reported the campaign. This is a paradigm shift in threat economics: the barrier to mass exploitation just dropped to near zero for any actor willing to pay for commercial AI tools.

AI just made finding kernel 0-days cheaper than a nice dinner — researchers found 100 exploitable kernel LPE bugs across AMD, Intel, NVIDIA, Dell, Lenovo, and IBM drivers for $600 total, and only Fujitsu has patched.