The Watch

What Happened

Operation Lightning — a multi-agency takedown spanning seven countries — dismantled SocksEscort, a residential proxy botnet that had operated undetected for 17 years. Law enforcement seized 34 domains, 23 servers, and froze $3.5 million in cryptocurrency. The botnet compromised approximately 369,000 IP addresses across 163 countries using AVRecon malware, generating $5.8 million in criminal revenue by selling residential proxy access to cybercriminals.

The C2 infrastructure is down. The malware on infected devices is not. Those routers are still compromised until someone reboots or patches them.

Why This Is Your Problem

Over 25% of infected routers were in the United States. More than 50% of the 280,000 victims identified since early 2025 were in the US and UK. Peak daily infection rates hit 15,000+ devices in January 2025. The statistical probability that none of your remote workers' home routers are in this pool is effectively zero for any organization with more than a few hundred employees.

The attack model targeted consumer-grade residential routers and IoT devices — exactly the equipment your remote workers use to tunnel into your corporate network via VPN. A compromised home router means an attacker-controlled network hop between your endpoint and your perimeter. Your EDR sees the endpoint; your NDR sees your network. Neither sees the router in between.

Immediate Hunting Guidance

Focus your threat hunt on three areas:

• SOCKS proxy traffic patterns on VPN ingress points — AVRecon converted infected routers into SOCKS proxies. Look for anomalous outbound connections from residential IP ranges to unexpected destinations.
• AVRecon IOCs as they're published from law enforcement disclosures. Cross-reference against your SIEM and NDR telemetry for the past 90 days minimum.
• Behavioral anomalies on residential VPN sessions — unusual session durations, off-hours connectivity, or traffic volume spikes from specific remote worker IPs.

Remediation Reality Check

You cannot remotely patch your employees' home routers. Your realistic options are:

1. Issue firmware update guidance to all remote employees — with specific instructions for major consumer router brands (Netgear, TP-Link, ASUS, Linksys). Make it simple enough to act on within 24 hours.
2. Recommend router reboots as an immediate interim measure — this may clear in-memory malware, though persistent variants require firmware updates.
3. Evaluate managed SD-WAN or SASE solutions that reduce dependence on consumer residential equipment for corporate traffic routing.
4. Increase monitoring sensitivity on VPN ingress for the next 90 days — successor botnets will emerge quickly given the proven $5.8M revenue model.

Three Converging Vectors

Four independent sources this week confirm that the AI agent attack surface has hit a critical inflection point. This isn't one story — it's three vectors converging simultaneously, and your security architecture likely addresses none of them.

Vector 1: Superhuman Offensive Capability at Commodity Pricing

GPT-5.4 achieves 75% on OSWorld-Verified for computer-use tasks, exceeding the 72.4% human baseline. It includes autonomous tool discovery ('tool search'), Python code execution, and a 1.05M-token context window — all available via API at $2.50 per million input tokens. An attacker can now feed it your external attack surface, let it autonomously find tools, execute reconnaissance, and iterate within a single API session. The barrier to AI-augmented offensive operations just dropped to a credit card.

Meanwhile, open-weights model GLM-5 delivers 88% of frontier performance at 18% of the cost — meaning less-resourced threat actors are approaching capability parity.

Vector 2: Agent Skills Are the New npm — With 2015-Era Security

Vercel's Skills.sh registry enables installable capabilities for AI coding agents — autonomous browser control, generative UI, frontend design — with no signature verification, no sandboxing, and no permission scoping. A malicious skill loaded into an agent's context can inject instructions to exfiltrate code, install backdoors, or modify build artifacts.

Compounding this: AGENTS.md (and CLAUDE.md) files auto-load into agent context at every session start. These are functionally equivalent to .bashrc or CI/CD configs — they execute with the agent's full permissions. A poisoned AGENTS.md in a forked repo or compromised dependency is a trivial, persistent injection point.

Agent skills are the new npm packages, and prompt injection is the new dependency confusion attack. The security model is 'trust reputable sources' — exactly what we said about npm before typosquatting campaigns.

Vector 3: Agents in Production Without Identity

Teleport's launch of an Agentic Identity Framework providing cryptographic identity for production agents confirms the problem is widespread enough to monetize. Organizations are deploying agents with shared service accounts or static API keys — no per-agent identity, no attribution, no behavioral monitoring. PropelAuth now lets agents configure entire authentication stacks via a single AI prompt through MCP Server integration, with no indication of security review gates.

Context Hub (chub), a tool feeding documentation to coding agents, gained 5,000+ GitHub stars in its first week with community-contributed docs exploding from under 100 to nearly 1,000 — largely unvetted. Meta acquired Moltbook, an agent-to-agent knowledge-sharing platform, with no established security model.

The Cross-Source Pattern

Every source describing agent capabilities simultaneously acknowledges security gaps but deprioritizes them. One author dismisses prompt injection risk because "I haven't experienced it." Another questions whether AI-generated code even needs type safety. An 8-level agentic maturity model pushes teams toward maximum agent autonomy with no security gates at level transitions. The industry is building the next supply chain crisis in real time, and the security community is watching it happen with full visibility.

Two Pillars, One Week

Your defensive posture depends on two categories of external support that are both weakening simultaneously: federal cyber defense coordination and vendor security reliability. Neither is making headlines as a cybersecurity story, which is exactly why it belongs in your briefing.

CISA Under Duress

The Department of Homeland Security remains the last federal agency locked in the government shutdown that began February 14. DHS employs roughly 260,000 people. While CISA's core cybersecurity operations are likely deemed essential, historical shutdown patterns show degraded advisory output, delayed vulnerability coordination, and slower incident response support. The TSA parallel is instructive: 305 employees have left in just 24 days of shutdown.

This is happening during a period of elevated geopolitical tension. Iran's new supreme leader Mojtaba Khamenei has publicly committed to continued strikes on US military bases, potential new fronts, and keeping the Strait of Hormuz closed. Separately, US-China tensions are at peak levels with a Trump China visit imminent. Both nations' APT groups historically escalate cyber operations during kinetic flashpoints.

The Federal CISO seat remains filled by an acting official (Mike Duffy), with no permanent appointment announced — signaling that federal cyber policy is in a holding pattern during the most active threat period of the year.

If your incident response playbooks reference CISA coordination, you need a tested backup channel to your sector ISAC and FBI Cyber Division field office — not during the next incident, but this week.

5,600 Vendor Layoffs: Block and Atlassian

Block eliminated 40% of its workforce (4,000 people). Atlassian cut approximately 1,600 (10%). These aren't just business headlines — they're third-party risk events if you use Jira, Confluence, Bitbucket, Square, Cash App, or Afterpay.

Mass offboarding at this scale creates compounding risks:

The pattern from prior vendor workforce disruptions is clear: security investment quietly erodes, patch cadence slows, and the people who monitored your data are no longer there.

Compensating Controls

Neither of these situations is within your control. Both require you to compensate defensively:

• Federal backup channels: Identify your sector ISAC and local FBI Cyber Division field office contacts. Test those channels now. Don't wait for an incident to discover they require onboarding paperwork.
• Vendor credential rotation: Proactively rotate all API keys, OAuth tokens, and webhooks connecting to Block and Atlassian products. Increase anomaly detection sensitivity on these integration points for 90 days.
• Request updated attestations: Ask both vendors for current SOC 2 reports or security attestation updates. Document the request and any delays — your auditors will ask about due diligence during vendor disruption events.