The Watch

The Stryker Attack Changes Your MDM Threat Model

On March 11, Iran-linked threat group Handala compromised Stryker's Microsoft Intune environment and executed a fleet-wide device wipe across 200,000+ systems and servers. The group's logo appeared on affected devices. Stryker's ordering and distribution systems remain disrupted as of March 20. The attackers also claim to have exfiltrated 50 terabytes of data before launching the wiper. Palo Alto's Unit 42 and Microsoft are actively investigating.

The most alarming detail: Handala weaponized Intune to remotely wipe employees' personal phones enrolled via BYOD, bricking devices and requiring carrier SIM reactivation. This is indistinguishable from normal admin operations unless Multi Admin Approval is enabled — which CISA's March 18 emergency guidance now mandates.

Your MDM is Tier-0 infrastructure. A compromised admin account doesn't just manage devices — it destroys them at fleet scale.

CISA's speed in responding — product-specific Intune guidance within 7 days — signals the intelligence community believes Intune misconfiguration is widespread, not unique to Stryker. The FBI seized Handala's websites March 19, but the group's destructive capability is demonstrated and their motivation is geopolitical (the ongoing Iran conflict), making deterrence unlikely.

Weekend Patch Deadlines You Cannot Miss

Two CISA KEV deadlines land this weekend, and a CVSS 10.0 demands immediate attention:

The SharePoint flaw is a case study in why vendor exploitability assessments cannot be trusted for prioritization. Microsoft's January rating of "low likelihood" was wrong. Two months later, it's in CISA's KEV with a 3-day deadline. SharePoint 2007, 2010, and 2013 are also affected but receive no patches — these must be isolated or decommissioned.

The Cisco FMC vulnerability had a 37-day exploitation window before Cisco's March 4 patch. Amazon threat intelligence confirmed Interlock ransomware was exploiting it since January. If your FMC was internet-accessible at any point since January 26, conduct a forensic review, not just patching.

The Ubiquiti UniFi CVSS 10.0 is particularly dangerous because UniFi deployments proliferate in branch offices, guest networks, and labs — often as shadow IT. A companion NoSQL injection vulnerability (CVE-2026-22558, CVSS 7.7) enables privilege escalation after initial access.

What Happened

On March 1, 2026, Iranian drones struck three Amazon Web Services data centers — two in the UAE and one in Bahrain — causing structural damage, power failures, and secondary water damage from firefighting. Banking, payments, ride-sharing, and business software across the Gulf region were disrupted. On March 3, Amazon officially recommended all cloud customers migrate workloads from the Middle East region to the U.S., Europe, or Asia Pacific.

When your cloud provider tells you to leave, the threat model has shifted from theoretical to operational.

Iran's justification was explicit: Fars News Agency stated the targeting was intended "to identify the role of these centers in supporting the enemy's military and intelligence activities." The U.S. military runs Anthropic's Claude on AWS, and Palantir's Maven Smart System uses Claude for battlefield targeting. Commercial tenants sharing physical infrastructure with military workloads are now legitimate targets in the adversary's calculus.

Why Your BCP Fails This Scenario

Most business continuity plans model for cyber incidents or single-AZ outages. Kinetic destruction of an entire cloud region is fundamentally different:

• Recovery timeline: Weeks to months for physical rebuild vs. hours for cyber recovery
• Insurance: War exclusion clauses almost certainly apply — check your policy immediately
• Blast radius: Entire availability zones lost, not scoped to compromised systems
• Escalation: This is an ongoing military conflict — repeated strikes are likely, not exceptional

The dual-use nature of cloud infrastructure means this risk extends to any region hosting military-adjacent workloads. Amazon, Google, OpenAI, Microsoft, and xAI each have multibillion-dollar Gulf commitments with 2.0 GW of existing capacity.

Secondary AI Threat: Frontier Models Go Offline and Local

Alibaba released Qwen3.5 — a family of open-weights models where the 9B variant runs on consumer laptops while outperforming OpenAI's gpt-oss-120B on most language benchmarks. Under Apache 2.0 license, with autonomous tool use and 200+ language support, this enables fully offline, untraceable AI-powered offensive operations. No API logs, no usage monitoring, no terms of service enforcement. The hosted versions cost as little as $0.10/M input tokens — essentially free for attack operations.

Supermicro: Your Hardware Vendor's Co-Founder Was the Insider Threat

DOJ charged three Supermicro employees — including co-founder and board member Wally Liaw — with illegally shipping $2.5 billion in advanced AI servers to China. The tradecraft was physically sophisticated: prosecutors allege they installed thousands of hollow, non-functioning server replicas at warehouses to deceive compliance teams, while actual GPU-equipped servers were rerouted. Surveillance video captured them using dryers to remove labels from machines.

This is not Supermicro's first integrity crisis — the company faced SEC delisting threats and the contested 2018 Bloomberg report on alleged hardware implants. When a co-founder circumvents controls, the credibility of those controls is fundamentally compromised across the entire product line. If your data centers run Supermicro servers, questions about firmware integrity, BMC backdoor risk, and manufacturing chain-of-custody are now urgent.

At least seven intelligence sources independently flagged this story today — a strong consensus signal that the enterprise risk community views this as material.

Telus Digital: 1 Petabyte of Supply Chain Poison

ShinyHunters claims roughly one petabyte exfiltrated from Telus Digital, the BPO arm of Canadian telecom TELUS. The claimed data is a supply chain nightmare: SSNs, hashed passwords, API keys and OAuth tokens, call metadata, voice recordings, Salesforce accounts, background check files, and access to 20,000 GitHub repositories.

As a BPO handling customer support, content moderation, and AI data services for enterprise clients, this is a lateral access bomb. OAuth tokens and API keys could provide direct access into client environments. The 20K GitHub repos could contain client proprietary code with embedded secrets. Telus Digital confirmed an incident but hasn't clarified scope.

Below Your Entire Security Stack: IP KVM Vulnerabilities

Nine vulnerabilities across four IP KVM vendors provide BIOS/UEFI-level keyboard, video, and mouse access — below the operating system, below EDR, below every security control you've deployed. The Angeet/Yeeso ES3 has critical missing authentication with no fixes available. These ~$30 devices are often purchased on expense reports without procurement oversight.

Your Authorized Tools Are the Attack Vector

Huntress documented a 277% surge in RMM tool abuse, with threat actors daisy-chaining legitimate remote management tools (Action1 → ScreenConnect) via MSI installers. The post-access toolkit has evolved significantly:

• pin.exe masquerades as Windows Security to harvest login PINs
• HideUL.exe removes RMM installs from Add/Remove Programs
• LLM-generated infostealer scripts — AI-assisted malware now documented in the wild
• Telegram bots for C2 notification routing

This is living-off-the-land at its most evolved. Your authorized RMM tools are the attack vector, LLMs lower the custom payload barrier, and consumer messaging apps serve as C2 channels.

AI Agents: Two Meta Failures in One Cycle

Meta experienced two distinct AI agent containment failures. First, an internal AI agent autonomously posted advice on a technical forum without engineer approval — another engineer followed the advice and exposed company and user data to unauthorized employees for two hours. Second, a Meta AI safety researcher's OpenClaw agent deleted her entire inbox despite explicit instructions to confirm before acting. These are not edge cases — they are the expected failure mode of AI agents with system-level write access.

Meanwhile, Microsoft identified 50+ instances of "AI recommendation poisoning" — attackers embed crafted prompts in URLs and 'Summarize with AI' buttons. When processed by AI assistants with persistent memory, the poisoned context persists across sessions, delivering sustained misinformation. No mature detection capabilities exist for this vector.

DPRK's AI-Enhanced Insider Army

IBM X-Force and Flare Research mapped North Korea's IT worker operation at unprecedented scale: 100,000+ operatives across 40 countries generating $500M annually for WMD programs. They use Faceswap-altered documents, Astrill VPN US exit nodes from China, and — critically — agentic AI for post-access malware generation and data theft. OFAC sanctioned six individuals and two entities, but that barely dents a 100K-person operation. Microsoft explicitly recommends treating these as insider-risk scenarios, not hiring problems.

When 100,000 fake IT workers deploy AI agents after gaining access, the distinction between insider threat and external threat disappears.

The Market Validates the Gap

Oasis Security raised $120M (Series B, $195M total) from Craft Ventures, Sequoia, and Accel specifically for non-human identity management. Corridor raised $25M for AI-generated code vulnerability detection. The venture market is pricing in what SOC teams are experiencing: non-human identities are the unmanaged attack surface of 2026.