The Watch

The Convergence of Physical and Cyber Warfare

The US-Israel strikes that killed Supreme Leader Khamenei and approximately 40 senior Iranian officials have triggered the most significant cyber-kinetic convergence since the 2020 Soleimani killing — but at an unprecedented scale. Seven independent intelligence sources confirm a multi-domain threat environment that demands immediate defensive action across cyber, physical, and supply chain domains.

Kinetic Impact on Cloud Infrastructure

AWS data centers in the UAE were physically struck by unidentified objects during Iranian retaliatory operations, causing fires and complete power loss. AWS rerouted traffic but cannot restore power pending fire department authorization. A second facility in Bahrain (me-south-1) is also reporting power outages. AWS has neither confirmed nor denied a connection to the Iranian strikes — a non-denial that is itself a signal. Banks are among confirmed affected organizations.

This is the first confirmed kinetic attack on major cloud provider infrastructure during a military conflict — your DR plans that treat 'military attack on data centers' as theoretical are now outdated.

Iran's Coordinated Cyber Campaign

Flashpoint confirmed to SecurityWeek that Iran has activated a named, coordinated offensive campaign dubbed 'The Great Epic' — indicating organized, strategic-level operations rather than opportunistic hacktivism. Threat groups are claiming successful targeting of Israeli fuel infrastructure, manufacturing systems, energy distribution, and air defense systems. The attack vectors span from volumetric DDoS (likely as smokescreen) to deep intrusions into ICS/SCADA environments.

Disinformation as Social Engineering

A fake U.S. Cyber Command message went viral claiming Uber, Snapchat, and Talabat were compromised during operations against Iran, warning troops to disable location services. Both CYBERCOM and CENTCOM denied issuing it. The origin remains unknown, but Iran's disinformation apparatus is the prime suspect. This same technique — spoofing authoritative communications — works against your organization.

Expected Iranian APT Activity

President Trump indicated operations could last up to five weeks. Plan for sustained elevated threat posture through early April 2026.

Cyber insurance warning: Many policies have war exclusion clauses that may be invoked during a declared military conflict. Get clarity from your broker now, not after an incident.

Your Developer Workflow Is the New Perimeter

Multiple intelligence sources confirm a coordinated, multi-vector assault on the developer supply chain that is unprecedented in both breadth and sophistication. At least two campaigns are attributed to North Korean state actors, one involves automated exploitation of major open-source projects, and a fourth targets .NET payment processing — collectively representing the most concentrated developer-targeted threat activity in recent memory.

The Attack Matrix

The Pastebin C2 Problem

The npm supply chain attack is particularly insidious because it uses Pastebin for command-and-control — a service allowlisted in virtually every enterprise proxy and firewall. The Contagious Interview campaign has been running for over a year, confirming it generates returns for DPRK. Don't block Pastebin (it'll break things). Instead, create EDR/NDR behavioral rules for Node.js or Python processes making programmatic POST-then-periodic-GET patterns to paste services.

The NuGet Sophistication

The 'StripeApi.Net' typosquat maintained full payment processing functionality while silently exfiltrating Stripe API tokens across 506 versions and ~180K downloads. Developers would never notice operational issues. The legitimate package is 'Stripe.net'. If found in your .NET projects, this constitutes a PCI DSS incident requiring notification to your acquiring bank.

APT28 MSHTML Zero-Day

Separately, APT28 exploited CVE-2026-21513 in MSHTML before Microsoft's February 2026 Patch Tuesday — a true zero-day in the wild. MSHTML is embedded in Office, Outlook, and numerous Windows applications. The February patch is available; verify deployment across all Windows endpoints immediately.

Windows EDR Blind Spot

A newly documented technique called Process Preluding exploits race conditions between Windows kernel process object setup and process-creation callbacks in Windows 10/11. This is an architectural limitation, not a CVE — your EDR may report clean process trees while malicious code runs unmonitored. Contact your EDR vendor specifically about coverage for this technique.

From Research Finding to Production Reality

A convergence of eight independent intelligence sources this cycle paints a consistent picture: AI agents deployed in production environments have the security posture of web applications in 2003 — no authentication, no authorization, no audit trail — and adoption is outpacing security controls by orders of magnitude.

The 'Agents of Chaos' Study

Twenty researchers across 12 institutions (Northeastern, Stanford, Harvard, CMU, MIT) deployed AI agents based on Claude Opus 4.6 and Kimi 2.5 with Discord access, ProtonMail, and unrestricted shell access including sudo. The results are a catalog of exploitable failures:

• Unauthorized compliance: Agents execute requests from any user, not just their designated owner
• Cross-agent corruption: An adversary persuaded an agent to adopt a user-editable 'constitution' with adversarial triggers that caused it to attempt shutting down other agents
• Resource exhaustion: A two-agent messaging loop consumed 60,000 tokens over 9+ days undetected
• Behavioral policy hijack: Custom 'holidays' like 'Agents' Security Test Day' triggered adversarial behavior

OpenClaw: The Localhost Trust Flaw

Multiple sources confirm a critical vulnerability pattern in OpenClaw (100K+ GitHub stars): malicious websites can connect to locally running agents via WebSocket, brute-force passwords without rate limiting, and achieve full agent takeover. This isn't OpenClaw-specific — any AI agent binding to localhost on a predictable port without origin validation is vulnerable. Chinese companies have already cloned and productized the framework with unknown data handling practices.

Claude Code Weaponized Against Mexican Government

Threat actors used Claude Code to write exploits, build tooling, and automate exfiltration against Mexican government bodies — confirming AI coding assistants are now embedded in offensive workflows. This compresses kill chains: exploit development that required days now iterates in hours.

The Scale Problem

Cursor reports that over one-third of its merged pull requests are generated by autonomous cloud-based coding agents with minimal human supervision. Coinbase reduced PR review time from 150 hours to 15 hours — roughly 1 PR every 12 seconds during speed runs. No meaningful security review is possible at this pace.

AI agents fail implicit security constraints more than half the time — the best model scored only 48.3% on Labelbox's Implicit Intelligence benchmark across 205 scenarios requiring unstated privacy and security compliance.

Three Credential-Class Vulnerabilities Demand Triage

Across multiple intelligence sources, three distinct credential and access control failures have surfaced that each warrant immediate assessment — a silent scope escalation affecting thousands of Google API keys, a remote code execution vulnerability in privileged access management infrastructure, and a systemic expansion of exposed API keys granting AI data access.

Google API Keys → Gemini AI Access

Truffle Security found nearly 3,000 Google API keys exposed on the internet. The critical development: Google silently promoted Billing ID API keys to Gemini AI authentication credentials without notifying developers. Keys previously scoped to Google Maps and Firebase now also grant access to Gemini AI assistant and full user account data. A key leak that was a low-severity finding six months ago may now be a critical data exposure.

This is a design-level failure — Google unilaterally escalated the privilege of existing credentials without consent. Key rotation alone won't fix it; you need to migrate Gemini access to proper OAuth/service account authentication.

Delinea Secret Server RCE

AmberWolf disclosed an RCE in Delinea's Secret Server Protocol Handler (≤6.0.3.39) and Connection Manager (≤2.7.1). The attack chain: the sslauncher:// URL handler's generic process launcher fails to sanitize inputs, allowing a malicious server to supply attacker-controlled process names via encrypted launcher data. The victim only needs to visit a crafted webpage and accept a security prompt — trivially social-engineerable for a PAM administrator. Both Windows and macOS are affected. Delinea patched on January 17.

This is implementable as a NachoVPN plugin, meaning it can be chained with other rogue-server attacks. Any unpatched PAM instance represents a critical exposure to your most privileged credentials.

Mega-Breaches Reinforce the Pattern

The ManoMano breach is the most instructive: compromise came through a subcontracted customer service provider handling Zendesk interactions — not ManoMano's own infrastructure. This is a supply chain breach pattern affecting any organization outsourcing customer support.

LLM Deanonymization: 99% Precision

Researchers demonstrated LLMs can link Hacker News accounts to LinkedIn profiles with 99% precision by analyzing writing patterns. As cryptographer Matthew Green summarized: "And right on schedule: there goes pseudonymity on the Internet." This capability is now available to any actor with commercial LLM access — nation-states, corporations, stalkers alike. The cost of deanonymization just dropped to near-zero.