The Watch

What Happened

Ctrl-Alt-Intel's open-directory pull reconstructs a Qilin RaaS affiliate edge-exploitation campaign running since August 2025. The count is specific: 1,929 exploit invocations against 918 unique WatchGuard Firebox IPs. Primary vector is CVE-2025-9242, an IKE exploit on UDP/500. The same toolkit carries POCs for CVE-2025-14733, CVE-2025-40554 (SolarWinds), CVE-2025-59718 (FortiOS), CVE-2025-60021 (Apache bRPC), and two CVEs dated 2026.

The Kill Chain

1. Initial access: IKE exploitation on UDP/500 against unpatched WatchGuard appliances.
2. Callback: Anomalous outbound on TCP/2007, trivially greppable in NetFlow if anyone is collecting it.
3. Pivot: A renamed Chisel binary (fos) opens a reverse SOCKS tunnel.
4. C2: Sliver beacons to 31.57.147.229, 31.57.38.155, 23.27.140.108, 23.27.143.170.
5. Payload: ChaCha20 ransomware binaries named per victim (kruss, qusar, tron, sssd) hitting Linux, ESXi, and Nutanix AHV.

Why Edge Appliances Keep Losing

WatchGuard was chosen because it is a telemetry desert. No AV or EDR stack, syslog minimal by default, NetFlow rarely collected at the device level. The affiliate is not picking the worst vulnerability. It is picking the least-observed perimeter. We have seen this movie before: Fortinet in 2023, Ivanti in 2024, WatchGuard across 2025-26. Same logic each time.

Concurrent Threat: EvilTokens

In the same cycle, EvilTokens compromised 340+ organizations with zero malware by bypassing MFA through AI-assisted token theft. Push-notification MFA is a demonstrably degrading control for privileged identities. FIDO2 and passkeys are the replacement, not an upgrade.

The adversary picks the quietest perimeter, not the softest one. WatchGuard was quiet.

Immediate Containment

Separately, the Beamed DDoS crew (313 Team) hit Ubuntu and Canonical infrastructure at 3.5 Tbps for 20+ hours, blocking security update APIs during the window. Patch SLAs now inherit the DDoS posture of the upstream mirror. Identify alternates for critical OS repos before the next outage, because the next outage is the point.

The Attack Wave

TeamPCP compromised four SAP npm packages carrying 572,000 weekly downloads, plus the Intercom SDK and the Lightning deep-learning framework. It sits alongside the Axios compromise (57M weekly downloads, 84K dependents) and the s1ngularity and Shai-Hulud waves. The mechanism is the same in every case: semver-range exploitation, where ^ and ~ ranges auto-resolve to a freshly poisoned version.

Axios and s1ngularity were both detected within 3-4 hours of malicious publication. A 12-hour cooldown would have blocked both. A 7-day cooldown would have blocked every wave listed above.

The Defensive Shift

For the first time, dependency cooldowns are native to all three major package managers:

The control exists. It requires configuration, not procurement. The setting ships off by default.

MCP: The Next npm

The Model Context Protocol ecosystem now hosts 10,000+ public servers. The first named supply-chain compromise landed in September 2025: a malicious Postmark-MCP npm package that BCC'd every outgoing email to an attacker-controlled address. The MCP auth spec is still churning, which means today's deployments will have broken trust assumptions within months.

MCP servers are functionally privileged browser extensions with network egress. They hold OAuth tokens, API keys, and cloud credentials. Most organizations have no inventory of them. Teleport now lists MCP as a protected resource category alongside Kubernetes and databases, which is the signal that MCP has crossed from experimental to production attack surface.

A 7-day dependency cooldown would have blocked every major npm supply-chain attack in 2025-2026. The setting exists natively in all three package managers. Configure it today.

Self-Modifying Agents: The Next Layer

jcode's 'self-dev mode' lets agents rewrite their own source code at runtime. That breaks the assumptions underneath SAST, code signing, and change management. Most AUPs do not yet name this capability as prohibited. They should.

What Changed This Week

The NSA and four Five Eyes partners issued joint guidance reclassifying agentic AI as a frontline cybersecurity issue. The document names five risk areas: excessive privileges, misconfiguration, unpredictable behavior, cascading agent-network failures, and weak auditability. It maps each to existing frameworks. Zero trust, least privilege, defense-in-depth. The operational read is narrower than the press framing. Auditors can now hold organizations to controls already committed to under SOC 2, FedRAMP, or ISO. Agent deployments that violate those commitments are existing control failures, not future ones.

In the same window, OWASP's LLM Top 10 ranked prompt injection at #1. Work from Google Spotlight, OpenAI, and DeepMind's CaMeL framework converges on a five-layer defense architecture. Most production agents implement one of the five.

The 5-Layer Defense Baseline

CaMeL cleared the AgentDojo benchmark by enforcing a split: the planner sees untrusted data but has no tool access, and the executor has tools but never directly consumes untrusted input. Most production agents still rely on a system prompt alone. That is the single behavioral layer OWASP just labeled the #1 threat vector.

Cross-Source Pattern

Seven sources this cycle flag the same gap independently. Agents authenticate, call APIs, and chain decisions under delegated credentials, and no SOC has detection coverage for the agent-call graph. The Five Eyes guidance, the OWASP ranking, the Pentagon's classified deployments, PwC's agentic MSSP launch, and Kaseya's autonomous IT platform all landed the same week. The capability shipped. The controls did not.

Five Eyes has moved agentic AI into compliance-grade territory. Machine identity and human-in-the-loop approvals are now on the audit checklist, and most estates are not yet wired for either.

The 12-24 Month Window

Coordinated multinational guidance on emerging tech has historically preceded binding regulation by 12 to 24 months. Organizations that build agent inventories, issue cryptographic agent identities via SPIFFE/SPIRE, and implement HITL gates in that window do it as engineering choices. Organizations that wait do it as audit findings under deadline pressure. Last week's take flagged machine identity as the boring control that becomes the expensive one. This guidance is the deadline arriving early.

Oracle: Textbook Insider-Threat Ignition

Oracle cut up to 30,000 workers to fund a $300B cloud commitment to OpenAI. Per reporting, outgoing employees were required to document their workflows to train the internal AI meant to replace them. Older workers were pushed out ahead of RSU vesting, which removed hundreds of thousands in owed compensation. H-1B holders landed on a 60-day visa clock. Over 600 of the affected have organized.

Every ingredient of the textbook insider case is present: financial injury, perceived injustice, compelled knowledge transfer, compressed timeline. If Oracle sits anywhere in the stack. OCI, NetSuite, Fusion, Cerner, PeopleSoft. Third-party risk posture should be re-scored for the next 6-12 months. Exposure lives in privileged support pathways, shared service credentials, and Oracle-hosted data stores.

Trellix: Security Vendor Source Code Breach

Trellix disclosed unauthorized access to a portion of its source code repository. The company states the release pipeline was not compromised. That is a claim to verify, not a fact to accept. A security vendor's code in adversary hands is an asymmetric vulnerability-discovery lever against every deployed customer. Same category as SolarWinds, Okta, LastPass: the security vendor becomes the supply-chain weakness.

Healthcare Pixels: 20 State Exchanges, 7M Enrollees

Bloomberg confirmed that nearly all 20 U.S. state-run ACA marketplaces transmitted applicant data to Google, LinkedIn, Meta, Snap, and TikTok through standard marketing pixels. Observed fields:

• New York: whether the applicant has incarcerated family members
• Washington D.C.: partially masked race data, emails, phone numbers → TikTok
• Virginia: ZIP codes → Meta

Affected population: 7+ million enrollees. The mechanism is not a zero-day. It is default pixel configuration on authenticated routes. Marketing ships the tags through Google Tag Manager and security never sees the deploy. This is the 2022 hospital Meta-Pixel episode run back at government scale.

A vendor that has lost control of its own source code is a vendor whose access reviews deserve a second pass this quarter, not next.

Convergence Point

The three incidents share one pattern: configuration velocity outpacing governance. Oracle's replacement-training documentation manufactures the exfiltration corpus. Trellix's source exposure enables downstream exploitation. The ACA pixels auto-capture because no one blocked GTM on authenticated flows. The fix in each case is inventory and boundary enforcement. Not new tooling.