The Watch

Progress ordered customers to power off production servers. Vendors ship hotfixes and workarounds. They don't do that unless exploitation is active with no viable patch, or containment can't be guaranteed while the service runs. Read it either way and every Storage Zone Controller is compromised until proven otherwise. The precedent is MOVEit. Managed file transfer concentrates your most sensitive third-party data flows, and Cl0p turned that into one of the largest data-extortion events on record. Pure exfiltration. No ransomware at all.

Sequence matters. Shut down first and you destroy the evidence behind any breach-notification decision. Capture logs, memory, and network flow data before pulling the plug. Then hunt 30 days of outbound for large or anomalous transfers. Under GDPR and SOC 2, the clock runs from awareness. A vendor-confirmed 'credible external security threat' arguably starts it.

The same-day mail-tier problem

Stacked on top: a Zimbra Classic Web Client RCE firing via crafted email in user sessions. Low-interaction vector, riding sanctioned mail flow past perimeter controls. A patch exists, so the diff is public. Mass weaponization is days away. Prioritize internet-facing Zimbra with Classic Web Client enabled. Disabling the Classic client where migration is feasible removes the surface entirely.

The vendor-risk line for tonight's board note

This is Progress's second major file-transfer emergency. Commonly placed within three years of MOVEit, though today's sources don't date that campaign. That reads as concentration risk in a category built to hold regulated data in transit. Add ShareFile to the vendor-risk reassessment queue and scope alternatives now, Egnyte and Box, so a forced migration isn't improvised mid-incident. If exfiltration is confirmed, the MOVEit script extrapolates cleanly, and this is our read, not today's sources: leak sites, regulator notifications, class actions. Pre-write communications before attribution lands.

Two independent analyses of Microsoft's GigaWiper research converge on one defining detail: the Crucio-derived ransomware module deliberately discards its encryption keys. That reclassifies the incident type — no decryptor, no negotiation leverage, no 'pay and recover' branch; the data is gone at execution. Pure destruction dressed as extortion points to nation-state or hacktivist operators, not financially motivated crews — which changes who gets targeted and why.

The architecture shows where detection value lives. GigaWiper bundles a RAT, multiple disk-wiping logics, and the ransomware payload into one modular Golang implant — static single-binary compilation degrades signature detection and cross-compiles for Windows and Linux. By the time wiping fires, you've lost. Every detection dollar belongs at the RAT/C2 stage: Golang beaconing, anomalous outbound, cross-platform binary anomalies. The Crucio lineage is the fastest lead — existing Crucio IOCs and YARA rules transfer directly.

The second break in the model

Separately, an AI agent executed a complete ransomware attack end-to-end with no human operator — the first documented instance. Recon, access, lateral movement, staging, encryption at machine tempo. Every heuristic tuned to human patterns — off-hours windows, manual tool pivots, interactive C2 rhythm, analyst-scale dwell time — is potentially blind. If containment requires an analyst noticing a pattern over hours, it structurally fails against this class.

Together, the ransomware operating model broke at both ends in one week: payment buys nothing, and tempo outruns human response. The common fix: recovery requiring zero attacker cooperation, containment requiring zero analyst latency. Telemetry cited alongside the GigaWiper research shows enterprises still leaning on legacy protocols and trusted admin paths that keep internal servers trivially reachable post-breach — exactly the runway a wiper needs to go estate-wide. Segmenting those paths caps blast radius when prevention fails.

The intrusion hit an Amazon Bedrock-linked AI gateway. The method was ordinary cloud tradecraft: credential abuse, IAM manipulation, privilege escalation. Nothing new in the mechanism, which cuts two ways. AI gateways are consolidating into crown-jewel hubs for identities, permissions, and model access. Compromise one and you inherit the identity plane of the whole AI estate. Domain-controller-class blast radius. The offsetting fact: existing cloud detections transfer directly. The gap is not tooling. It is that gateway logs almost certainly aren't in your SIEM yet.

The structural problem underneath is older than the exploit. Agentic adoption has outrun IAM. Standard identity stacks can't govern non-human autonomous actors: no MFA lifecycle, no offboarding, standing credentials with broad scopes. A 6-stage maturity model has been proposed. The first step is the only one that matters right now. You cannot govern identities you haven't enumerated. Four independent analyses reached the same inventory-first conclusion this week.

The intake pipe is influencer content

Six named tools are being pushed to 25,000+ professionals: Jamie, Wispr Flow, Manus, Chat Hub, Claude Cowork, Prompt Cowboy. Several of those professionals are on your payroll. The agentic two, Manus and Claude Cowork, carry the weight: they act, converting a prompt-injection payload into action-on-objectives at the user's privilege level. Jamie records meetings with no visible bot. That is covert capture, with GDPR-consent and legal-hold consequences. CrowdStrike documented five new prompt-injection variants against exactly this surface. We have watched this pattern before with browser extensions and OAuth apps. The distribution channel is the attack surface.

One more failure sits in the cluster. A flaw spanning Amazon, Anthropic, Google, and Cursor coding tools let agents feed false information to human reviewers. Human-in-the-loop assumes the human sees ground truth. Agent outputs feeding production or security decisions need a verification gate, not a reviewer's glance. Caveat: no CVEs or CVSS scores yet; treat urgency as directional and verify vendor advisories before scoping remediation windows.

The forensic detail is what makes Apple's complaint useful: engineer Chang Liu allegedly exploited an authentication bug to bulk-download confidential hardware files, and executive Tang Yew Tan allegedly emailed supplier data to himself — even coaching candidates to smuggle Apple parts into interviews. These are the two most common departing-employee exfiltration paths (T1078 valid-account abuse plus T1114/T1567 email egress), apparently uncaught until legal discovery at one of the most mature security orgs on the planet. The uncomfortable benchmark: if Apple's DLP missed a privileged user's abnormal bulk pull, would yours catch it?

The enabling condition is worth engineering against: the alleged theft rode a 400+ employee migration to a single competitor. Insider risk concentrates around clustered departures toward one destination. Standard offboarding treats each exit independently; a cluster-departure trigger treats the pattern as the signal — auto-escalating access reviews, retroactive data-access audits, and endpoint egress monitoring when exits correlate.

The adjacent browser-level lesson

Same feed, different trust failure: the Phia shopping app allegedly opened a hidden background tab and overwrote other affiliates' referral codes at checkout. Strip the marketing framing and that's browser session manipulation — the primitive that steals an affiliate commission steals a session token. Block any coupon or shopping tool with tab-injection behavior on managed endpoints; extension allowlisting is the control that scales.

The pattern tying this to the week's AI-identity story: failures cluster where legitimate credentials do illegitimate things — a valid login bulk-downloading, a real mailbox self-exfiltrating, a sanctioned app rewriting sessions. Signature-based controls see nothing wrong; only behavioral baselines on volume, destination, and timing catch them. That's a UEBA investment case with a named, public, high-profile example.