The Watch

A New Category of Cloud Risk

For the first time in the cloud era, a nation-state military has physically struck commercial cloud infrastructure and publicly promised more. Iran's IRGC has already hit AWS and Microsoft Azure facilities in the Middle East and announced imminent expansion to 18 named US tech companies — including Google, Oracle, Apple, Meta, and Nvidia — with strikes potentially beginning April 2.

The IRGC's statement is unambiguous: "For every assassination, an American company will be destroyed." This isn't a cyber threat advisory. This is a declared military doctrine targeting civilian technology infrastructure.

Physical destruction of cloud regions has longer recovery timelines than ransomware — and with a 30% transformer supply deficit and 80% import dependency, damaged infrastructure may take months to rebuild.

Cyber Operations Supporting Kinetic Targeting

This isn't just bombs. Check Point researchers identified Gray Sandstorm conducting multi-wave M365 password spray campaigns across March 2026, targeting Israeli and UAE municipalities — the same municipalities later hit by Iranian drone and missile strikes. The assessment: these operations support Bombing Damage Assessment (BDA). Targeted sectors include satellite, aviation, energy, and maritime.

The integration of cyber reconnaissance with kinetic strike planning represents a doctrinal evolution that most enterprise threat models don't account for. Your M365 logs may contain pre-strike indicators.

Immediate BCP Implications

Most enterprise BCP plans model regional outages as natural disaster scenarios. The distinction matters: targeted strikes can be repeated, escalated, and directed at specific providers. A 30-day regional outage from physical attack is a fundamentally different scenario than a multi-hour cloud service degradation. Validate your RTO/RPO assumptions against this reality.

The Predictive Advantage

The IRGC's retaliatory doctrine gives defenders something rare: a predictive trigger. US-Iran escalation events (assassinations, sanctions, military strikes) can be monitored as leading indicators for infrastructure targeting. Build an OSINT-driven tripwire that auto-elevates your SOC posture when geopolitical triggers fire.

The AI Toolchain's First Tier-1 Supply Chain Attack

TeamPCP compromised LiteLLM, the most popular open-source LLM proxy with 97 million monthly PyPI installs. LiteLLM sits in the data path between applications and model APIs — meaning the compromised version had access to everything flowing through it. The backdoor was live for three hours before quarantine, but the three-stage attack architecture shows this was not opportunistic.

The Attack Chain

1. Stage 1 — Credential Harvesting: Targeted SSH keys, AWS/GCP/Azure credentials, Kubernetes configs, crypto wallets, and LLM API keys — essentially every secret that matters in a modern cloud-native AI stack
2. Stage 2 — Kubernetes Lateral Movement: Used harvested K8s configs to move laterally across cluster infrastructure
3. Stage 3 — Systemd Persistence: Installed a persistent backdoor that survives reboots on Linux systems

Mercor has confirmed a resulting breach: 939GB of source code and 4TB total data exfiltrated, reportedly via TailScale VPN compromise. Lapsus$ is now claiming secondary access to the stolen data, adding a data brokering dimension — expect public dumps or extortion attempts in coming weeks.

LiteLLM processed your prompts, API keys, and model responses. If it was in your stack during the compromise window, treat every credential it touched as burned.

The Delve Connection

LiteLLM subsequently dropped Delve for Vanta as its compliance certification provider. This is significant because Delve — a YC-backed compliance startup — is separately alleged to have generated 494 fraudulent SOC 2 audit reports with fabricated evidence and pre-written conclusions. If any vendor in your supply chain holds a Delve-issued SOC 2 report, that attestation may be worthless. The LiteLLM-Delve connection suggests their prior compliance posture was inadequate to detect or prevent the compromise.

Why This Is Different From Axios

While the Axios npm compromise (covered yesterday) affected the broadest possible JavaScript surface, LiteLLM's compromise is more dangerous per affected system. LiteLLM is a credential proxy — it doesn't just run on your machine, it routes your most sensitive API keys and business data to external providers. A compromised Axios deployment gives attackers a foothold. A compromised LiteLLM deployment gives attackers your entire AI infrastructure credential set.

The Patch-to-Exploitation Window Is Collapsing

Three separate critical vulnerabilities are under active exploitation simultaneously, each hitting a different part of enterprise infrastructure. Together they illustrate a trend that should reshape your patching SLAs: the gap between patch availability and weaponized exploitation is now measured in days to weeks, not months.

Fortinet EMS: CVE-2026-21643 — Patched February, Exploited Now

A SQL injection vulnerability in Fortinet's Endpoint Management Server allows unauthenticated server takeover via malcrafted HTTP requests. The patch has been available since February 2026, but active exploitation didn't begin until late March — a longer fuse, but the impact is severe. Fortinet EMS manages your endpoint fleet; compromising it gives attackers control over your device management infrastructure.

If any EMS server is still unpatched, restrict web interface access to management VLANs immediately while scheduling emergency maintenance.

Magento PolyShell: Mass Exploitation at Scale

The PolyShell vulnerability enables unauthenticated web shell upload on Magento storefronts. Mass exploitation is underway at hundreds of stores per hour. The vulnerability went from disclosure to mass exploitation in under two weeks. Any Magento instance unpatched since mid-March should be treated as compromised — engage IR and check for card skimmer injection.

TrueConf CVE-2026-3502: Zero-Day With No Patch

A Chinese-nexus APT is exploiting a zero-day in TrueConf Server to push malicious updates to all connected clients from compromised on-prem servers. This is the highest-risk of the three because no patch exists. TrueConf's server-to-client trust model means a single compromised server can distribute malware across the entire deployment.

AI-Accelerated Exploitation Compresses Your Window Further

Adding urgency: researchers gave Claude a FreeBSD security advisory for CVE-2026-4747, and it produced two working remote kernel exploits in approximately 4 hours — both succeeding on first attempt. The exploit chain included multi-packet shellcode delivery, ROP construction, and clean kernel-to-userland process spawning yielding a root reverse shell. This capability demonstration means your patching SLA for remotely exploitable CVEs should be measured in hours, not weeks.

When an AI can weaponize a CVE in 4 hours, a 15-day patching SLA for critical remote vulnerabilities is a 14-day, 20-hour window where you're defenseless.