Security & Threat Intelligence

The Watch

The Signal

CVE-2026-20230 in Cisco Unified Communications Manager

Patched, then exploited in the wild weeks later. Separately, the Mistic initial-access backdoor has been feeding ransomware affiliates across multiple sectors since April 2026. Unpatched UCM clusters and environments without an active Mistic hunt sit on both on-ramps.

In Play

  1. Two Active Ransomware On-Ramps: Cisco UCM + Mistic Backdoor

    CVE-2026-20230 in Cisco Unified CM is being weaponized — unauth SSRF chains to file write and root on chronically under-monitored voice infrastructure integrated with AD. Simultaneously, Mistic backdoor has operated since April 2026 as an initial-access broker selling footholds to ransomware affiliates across multiple sectors.

    Ask Clarity
  2. Industrial-Scale Model Extraction Is Now a Production TTP

    Anthropic alleges Alibaba operated 25,000 fake accounts to issue 28.8M queries against Claude in the first publicly documented industrial-scale model-extraction campaign. Per-account rate limits are useless against this distribution. Any org serving an AI model via API needs cross-account behavioral analytics and output watermarking deployed now.

    Ask Clarity
  3. Three New Agentic AI Attack Surfaces Shipping This Week

    Microsoft Copilot Skills turns Excel into a shareable prompt-injection vector org-wide. Gemini 3.5 Flash ships native computer-use to every API key holder with zero setup. OpenAI Codex mobile pairs phones to dev workstations as a new identity-binding surface. None ship with governance; all will be running in your environment by month-end.

    Ask Clarity
  4. GDPR Year 10 Pivots Enforcement to AI Systems

    GDPR enforcement is shifting from breach notification and cookie banners toward AI training data provenance, inference-time personal data leakage, and Article 22 automated decision-making. Two independent sources confirm this pivot. DPIAs built in 2018-2020 do not cover model training corpora or LLM output containing memorized PII.

    Ask Clarity
  5. Third-Party Risk Model Breaks Against AI-Native Micro-Vendors

    Robotics/physical-AI hit $16B across ~500 deals in Q1 2026 (4.5x value vs 2021-2025). AI-native firms run structurally smaller — solopreneurs crossing $5M revenue tripled from 2023-2025. These vendors cannot staff dedicated AppSec or GRC. Your SOC 2-based third-party risk program was built for 200+ person vendors and will fail against this wave.

    Ask Clarity

Deep Dives

Cisco UCM + Mistic Backdoor: Two Ransomware On-Ramps Active Right Now

The Convergence

Two active threats, same endgame: ransomware deployment in your environment, entering at different points in the kill chain. CVE-2026-20230 in Cisco Unified Communications Manager is an unauthenticated SSRF chaining to arbitrary file write and root-level access. Cisco shipped the patch. Exploitation began weeks after and continues. Separately, the Mistic backdoor has been operating since April 2026 as a purpose-built initial-access broker, selling footholds to ransomware affiliates across multiple sectors.

Attackers are still winning with the same old gaps. Frontier AI models are not driving new TTPs yet — patch velocity and identity hygiene remain the deciding variables.

Why UCM Is Worse Than You Think

Unified Communications boxes are chronically under-monitored. They sit in voice VLANs that SOC teams rarely instrument. They integrate with Active Directory. They hold call recordings and voicemail containing regulated data. A root foothold on UCM is functionally a foothold on the identity plane.

The path: unauthenticated SSRF over the network, then file write under tomcat/webapps, then web shell or new admin account, then AD credential harvest, then lateral movement. Maps to MITRE ATT&CK T1190 (Exploit Public-Facing App) and T1068 (Privilege Escalation).

Mistic: The Dwell-Time Window Is Shrinking

Mistic is the initial-access broker model maturing further: custom malware, multi-sector deployment, clean handoffs to ransomware affiliates. The window between initial compromise and encryption is compressing. If your SOC's mean time to detect is measured in weeks, you are outside the survivable envelope.


Contradiction Worth Noting

Wednesday's briefing cited vendor telemetry confirming AI-assisted attack scaling. Today's intelligence states frontier AI models, including Mythos, are not yet changing attacker TTPs. Exploitation is still driven by unpatched CVEs and known gaps. Read together: AI may be scaling volume without changing technique. Redirecting budget to AI-defense SKUs while UCM sits unpatched is the wrong trade.


Hunt Guidance

Indicator TypeCVE-2026-20230Mistic Backdoor
Log SourceUCM HTTP access logs, tomcat file systemEDR telemetry, network flow
Key PatternSSRF-shaped requests, unexpected file writes under webapps/Persistence mechanisms, beacon cadence, lateral movement
Pivot IndicatorNew admin accounts, outbound to non-Cisco infraHand-off signatures to affiliate tooling
Time HorizonPull 30 days of logs minimumSweep all endpoints, document negatives

What to do

  1. Verify CVE-2026-20230 patch status across 100% of Cisco UCM instances today — if unpatched, treat as assume-breach and engage IR

  2. Pull 30 days of UCM HTTP logs and search for SSRF patterns, unexpected tomcat/webapps file writes, new local accounts, and outbound connections to non-Cisco infrastructure by end of week

  3. Deploy Mistic IOC and behavioral detection queries in SIEM/EDR within 48 hours — persistence mechanisms, beacon cadence, lateral movement signatures

  4. Re-baseline patch SLAs for identity-adjacent appliances (UCM, VPN, SSO, edge mail) to sub-7-day critical CVE remediation by end of quarter

Model Extraction Goes Industrial: 28.8M Queries, 25K Accounts, and Your API Threat Model

The Anthropic-Alibaba Case

Anthropic has accused Alibaba of running 25,000 fake accounts to issue 28.8 million queries against Claude. It is the first publicly documented industrial-scale model extraction campaign. The technique maps to MITRE ATLAS AML.T0024 (Exfiltration via ML Inference API) and AML.T0044 (Full ML Model Access). The technique is not new. What is new is the operational discipline. Twenty-five thousand accounts is a procurement, identity-farming, and orchestration operation.

Model extraction is now an active TTP against any LLM served via API. Per-account rate limits are not a control against it.

Why Traditional Controls Fail

Per-account rate limits are the default defensive measure. Against distributed extraction they are mathematically useless. 28.8M queries across 25K accounts works out to roughly 1,152 queries per account, which sits inside normal individual usage. IP and ASN reputation catches some of it. Residential proxies handle the rest.

Controls That Actually Work

ControlEffectiveness vs SwarmImplementation Lift
Account-creation cohort analysisHigh — sockpuppets share creation patternsMedium
Query embedding-similarity clusteringHigh — extraction queries cluster tightlyMedium-High
Output watermarking / canary responsesHigh — detective + attributiveHigh
Cross-account behavioral analyticsHigh — detects coordinated patternsMedium

Who Needs to Act

For anyone who operates an LLM API, internal or external: the defensive posture that works here is cross-account behavioral analytics. Cluster queries by embedding similarity, source ASN, account-creation cohort, and payment instrument reuse. The reference model is credential-stuffing defense. The per-account view is the wrong unit of analysis.

For anyone who consumes LLM APIs: the case validates the risk that a vendor's model weights can be extracted and replicated. That belongs in the vendor concentration risk assessment, particularly where competitive advantage rests on a specific model's capabilities.

What to do

  1. Deploy cross-account behavioral analytics on any LLM/API product you operate — cluster by embedding similarity, ASN, and account-creation cohort — within 30 days

  2. Add canary responses and output watermarking to high-value model endpoints this quarter

  3. Brief product security team on MITRE ATLAS AML.T0024 and AML.T0044 with Anthropic case as reference scenario this week

Copilot Skills, Codex Mobile, Gemini Computer-Use: Governance Must Precede Adoption

Three Launches, Three Distinct Attack Surfaces

This week's AI launches read as feature announcements. They are attack-surface expansion that no CVE will capture. Three products, three threat models. The controls do not transfer.

Microsoft Copilot Skills for Excel

Excel now supports reusable, shareable, org-wide prompt workflows called Skills. Persistent named prompt chains. Any user can author one and share it like a template. The failure mode: a popular shared skill carrying a prompt injection executes across every workbook in the tenant. Finance skills touching sensitive data are the obvious target. The feature ships without native review or approval workflow.

Gemini 3.5 Flash — Native Computer-Use

Google's base model can now drive browser, mobile, and desktop GUIs. No agent framework. No extra setup. Any developer with an API key gets GUI automation. EDR, CASB, and UEBA are tuned to human behavior. Agentic clicks at non-human cadence bypass DLP rules that assume human pace. The identity on the wire is the developer's, not the agent's.

OpenAI Codex on Mobile

Codex is GA on iOS and Android with device pairing between phone and developer workstation. The phone becomes a control plane for a coding agent. The pairing flow may not traverse the corporate IdP. Scope and revocation semantics are undocumented. A stolen or jailbroken phone is a path to repo write access.


Cross-Source Pattern: MCP Servers Are the Unaudited Dependency

Three independent sources this week flagged MCP (Model Context Protocol) servers as a proliferating, under-secured integration layer. OpenRouter MCP, Firecrawl MCP, and marketing AEO tooling all route data to LLMs through MCP. These servers are not in any SBOM today. They carry unauthenticated tool calls, over-scoped credentials, and prompt-injection exposure via tool output. The supply-chain blind spot is the part nobody has inventoried yet.

None of these come with a CVE. All of them will be running in your environment by month-end whether you authorize them or not.

What to do

  1. Draft Copilot Skills governance policy before broad Excel rollout this week — require approval workflow, DLP scanning of skill prompts, and org-wide allowlist for finance skills

  2. Issue developer policy requiring MDM-enrolled devices for Codex mobile pairing, scoped to non-production repos by default, within 2 weeks

  3. Run a red-team tabletop on rogue computer-use agent (Gemini 3.5 Flash) against your SaaS estate this month

  4. Add all MCP server deployments to TPRM and SBOM tracking this quarter — pin versions, require auth, log all requests

The bottom line

Two ransomware on-ramps are active right now — CVE-2026-20230 giving root on your Cisco UCM and Mistic backdoor selling footholds to affiliates since April — while the Anthropic-Alibaba case proves model extraction at 28.8M queries is a production TTP, not a paper threat. Patch UCM today, hunt for Mistic this week, and get governance ahead of the three agentic AI launches (Copilot Skills, Codex Mobile, Gemini computer-use) that will be running in your environment by month-end without a CVE to trigger your existing processes.