The Watch

What Happened

APT28 (Forest Blizzard / GRU Unit 26165) exploited known vulnerabilities in TP-Link and MikroTik routers to build an 18,000+ device botnet spanning 120+ countries. The compromised routers had their DNS settings hijacked to redirect authentication traffic through attacker infrastructure, creating adversary-in-the-middle interception of Outlook Web Access login flows. The operation harvested passwords, OAuth tokens, and cloud credentials from 200+ victim organizations.

The critical defensive failure: OAuth token theft bypasses MFA entirely. Users completed legitimate Microsoft login flows, MFA challenges fired and were satisfied normally, and the attacker received a valid session token that required no further authentication. This isn't a vulnerability in MFA — it's MFA operating exactly as designed while the network layer beneath it was compromised.

The Disruption — and What Remains

Operation Masquerade — a coordinated effort by FBI, DOJ, Microsoft, and Lumen Black Lotus Labs — used court-authorized commands to reset DNS settings on affected U.S. routers. Botnet communications have steadily declined. However, non-U.S. routers remain compromised, creating residual risk for any organization with international operations or remote workers abroad.

If a user's traffic was routed through a compromised router, their M365 session tokens could have been captured without triggering any MFA challenge. Conditional Access policies that bind tokens to compliant devices are the backstop when network-layer trust is compromised.

Cross-Source Intelligence

This campaign converges with the device code phishing industrialization reported earlier this week. Both exploit OAuth token mechanics to bypass MFA, but via different vectors — device code phishing via social engineering, APT28 via network-layer DNS hijacking. The common thread: token security, not password security, is now the critical control plane. Multiple sources confirm that Continuous Access Evaluation (CAE) and device-bound tokens are the only reliable mitigations against both vectors simultaneously.

Separate Vector: UNC6783 Live-Chat Okta Phishing

Concurrent with the APT28 campaign, UNC6783 (Raccoon) is actively extorting dozens of major companies by social engineering employees through live chat into visiting fake Okta login pages. This bypasses email-based phishing controls entirely — the vector is human conversation, not a malicious link in an email. Helpdesk teams are the target, not end users.

Defense Playbook

The Vulnerability

Dgraph CVE-2026-34976 scores a perfect CVSS 10.0 — and there is no patch. The restoreTenant administrative mutation was accidentally omitted from the authentication middleware mapping, leaving it completely unauthenticated across all versions through v25.3.0. This isn't a complex exploit chain; it's an open door.

Four exploitation paths have been documented:

1. Database overwriting — malicious backup file injection replaces your data
2. Local file probing — error message information leakage reveals file system contents
3. SSRF — reach internal services from the Dgraph instance
4. Kubernetes service account token theft — reads /var/run/secrets/kubernetes.io/serviceaccount/token

This vulnerability pattern — an endpoint accidentally excluded from auth middleware — is disturbingly common in microservice architectures. Use this as a trigger to audit your own middleware mapping completeness.

The K8s Convergence

Unit 42 documents a 282% year-over-year increase in Kubernetes service account token theft, with IT sector organizations accounting for 78% of observed activity. The Dgraph K8s exploitation path feeds directly into this industrialized playbook. Two distinct threat vectors now converge on identical post-exploitation workflows:

When both nation-state and commodity actors adopt identical TTPs, that attack path has become industrialized. The K8s service account token at /var/run/secrets/kubernetes.io/serviceaccount/token is now a standardized post-exploitation target — the equivalent of lsass.exe dumping in the Windows world.

The Disclosure Gap Problem

A related vulnerability in OpenClaw (CVE-2026-33579, CVSS 8.1–9.8) highlights a systemic issue: patches dropped Sunday, but the CVE wasn't published until Tuesday — giving attackers a 2-day reverse-engineering window. Compounding this, 63% of 135,000 internet-exposed OpenClaw instances run without authentication. Your patch monitoring cannot rely solely on CVE databases; you need vendor release note monitoring as a parallel signal.

Defense Playbook

1. Dgraph (hours): Firewall all admin ports — 8080 HTTP, 9080 gRPC. There is no patch. Network isolation is your only mitigation. Audit your supply chain for vendor Dgraph usage.
2. K8s tokens (days): Migrate all clusters to projected volume tokens with audience restrictions and TTLs under 1 hour. Disable automountServiceAccountToken on pods that don't need API access. Audit CI/CD service accounts for overprivileged RBAC bindings.
3. Detection engineering: Alert on reads to /var/run/secrets/kubernetes.io/serviceaccount/token from non-standard processes. Monitor K8s API audit logs for token usage from unexpected source IPs.

Storm-1175: The Zero-Day Ransomware Machine

Storm-1175 (Chinese cybercrime) is deploying Meduza ransomware via simultaneous exploitation of zero-days in GoAnywhere MFT (CVE-2025-10035) and SmarterMail (CVE-2025-52691), plus rapidly weaponizing 14 additional CVEs post-disclosure. Their operational tempo is measured in hours from initial access to encryption. If either product is in your environment unpatched, assume compromise and investigate — don't just patch.

The Active Exploitation Cluster

Five critical-severity vulnerabilities are under active exploitation or have freshly published exploitation paths this week, independent of the Mythos/Glasswing disclosure cycle:

Why Flowise Demands Special Attention

Flowise CVE-2025-59528 is a CVSS 10.0 unauthenticated RCE on AI agent infrastructure that entered active exploitation this week — despite being patched last September. The exposure is shadow IT: Flowise is commonly deployed by developers as a low-code AI workflow tool outside security team visibility. Scan your entire environment — cloud, dev/test, shadow IT — and assume you have instances you don't know about.

Six months of exposure at maximum severity means you should assume compromise and investigate, not just patch.

The ActiveMQ Discovery Signal

CVE-2026-34197 in Apache ActiveMQ is an authenticated RCE affecting every version released in the past 13 years. The discovery context is significant: it was found by AI (Claude) in approximately 10 minutes. This is a concrete, production example of AI-accelerated vulnerability discovery generating real CVEs in real infrastructure. Inventory all ActiveMQ instances — including those embedded in larger application stacks — and patch.

The CUPS chain (CVE-2026-34980 + CVE-2026-34990) follows the same pattern: unauthenticated RCE as lp escalating to arbitrary root file overwrite, also discovered by automated AI agents. Print services remain one of the most neglected attack surfaces in enterprise environments.

Defense Playbook

1. Emergency discovery scan for Flowise across all environments — AI tools are deployed outside IT governance more than any other software category
2. Verify GoAnywhere MFT and SmarterMail patch status — if unpatched, initiate compromise assessment immediately
3. Patch ActiveMQ across all instances including embedded deployments; restrict management interfaces to internal networks
4. Audit CUPS exposure across Linux/Unix fleet; restrict port 631 to management networks; disable CUPS where printing isn't required