This Week in Cybersecurity #39

UK Prime Ministers' Phones Hacked by China for Years, Poland's Grid Attacked by Sandworm, eScan Antivirus Pushes Malware, Nike Faces Extortion Without Encryption, and Identity Becomes the New Lateral

Good morning, Security Gang!

This week proved we’ve entered the age of convergence—where cyber, physical, and geopolitical boundaries have dissolved, and trust itself is the primary attack vector. China infiltrated UK Prime Ministers’ phones for years (Johnson, Truss, Sunak aides compromised), Russia’s Sandworm attacked 30 Polish energy facilities with wiper malware destroying equipment beyond repair, eScan antivirus pushed malicious malware to users after server breach, and Nike faces extortion threats without encryption—proving exposure pays better than ransomware.

Add VMware’s zero-day exploited for hypervisor access, Microsoft Office zero-day weaponizing documents, Fortinet’s incomplete then complete FortiCloud patch, ShinyHunters hitting 100+ organizations with OAuth token phishing, 800,000 Telnet servers still exposed, European door locks hackable via cloud APIs, 35,000 LLM jacking attacks, the $16 billion Chinese crypto laundering network, and the Pentagon’s CyberCom 2.0 focused on “living off the land” detection—and you have a week proving identity is the new lateral movement, trust is the new vulnerability, and every consent moment is now a battlefield.

Let’s break it down—coffee ready, Security Gang, because this is the age when gates and seasons determine who survives.

🕵️ UNPRECEDENTED NATION-STATE ESPIONAGE

China’s Espionage Campaign Hits the Heart of Downing Street

An explosive report from the Telegraph reveals that Chinese intelligence operatives infiltrated senior officials’ mobile phones around 10 Downing Street for years, targeting aides to Boris Johnson, Liz Truss, and Rishi Sunak between 2021 and 2024. The breach reportedly penetrated cabinet-level communications and secure messaging systems, giving Beijing insight into UK diplomatic strategy, negotiation timings, and internal policy debates.

The discovery only surfaced after the U.S. shared intelligence on the “Salt Typhoon” espionage campaign with Five Eyes allies. British authorities are still determining whether Prime Ministers themselves were directly compromised.

James emphasized the downstream implications: “If Beijing can listen to Downing Street, imagine what they’re doing to private companies that don’t even have detection capability.”

This operation underscores that China’s cyber ambitions are not about disruption but long-term intelligence positioning—and it’s a wake-up call for global enterprises doing business with the UK or China to assume ongoing exposure and tighten mobile security and diplomatic comms segregation.

China’s Military Purge Raises Cyber Red Flags

China’s top general, a key Xi Jinping ally, has been arrested and accused of spying for the U.S., sparking a massive leadership purge inside the PLA’s cyber and nuclear divisions. This upheaval could cause erratic shifts in targeting, rules of engagement, and operational tempo, especially for companies operating in telecom, aerospace, and critical infrastructure.

James warned: “When Beijing gets paranoid, the world’s attack surface shifts.”

CISOs Should:

• Re-evaluate China risk tiers

• Enhance geo-blocking on login attempts

• Monitor for tenant access from Chinese infrastructure

The shake-up may embolden lower-level operators to act independently—making the next few months unpredictable.

⚡ CRITICAL INFRASTRUCTURE WARFARE

Sandworm Blamed for Attack on Polish Power Grid

Polish officials confirmed that the Russian Sandworm group was behind the recent power grid attack, which targeted telemetry and control systems rather than generation plants. The attack aimed to cause grid instability through distributed substation manipulation, a technique reminiscent of the Industroyer2 playbook from Ukraine incidents.

If Poland had gone dark, NATO could have considered invoking Article 5—making this not just a cyber event, but a geopolitical flashpoint.

James put it bluntly: “You don’t need to blow up a power plant to start a war — you just have to flick the wrong digital switch.”

Energy sector operators should:

• Implement mass disconnect thresholds

• Deploy setpoint anomaly detection across distributed OT systems

Russia Targets Poland’s Energy Grid with Wiper Malware

Poland confirmed that Russian-linked attackers breached 30 energy facilities in December 2025, disrupting control and communication systems. Investigators say the operation mirrored Sandworm’s destructive wiper tactics, targeting low-visibility distributed energy assets and attempting to cross IT-OT boundaries.

The attack didn’t cause blackouts, but it did disable equipment beyond repair at one site—forcing hardware replacements that could take months to source, impacting the energy supply chain.

James emphasized: “Wiper malware isn’t about ransom — it’s about economic destruction. Some companies never come back from it.”

For energy and critical infrastructure operators:

• Validate network segmentation

• Test east-west traffic rules

• Rehearse wiper-grade restore plans using out-of-band backups

Pentagon Unveils CyberCom 2.0

The U.S. Cyber Command announced its CyberCom 2.0 modernization plan, focusing on:

• Faster force generation

• Better hunt operations

• Stronger detection of “living off the land” techniques

Lt. Gen. William Hartman highlighted Chinese operators’ growing use of legitimate admin tools (PowerShell, WMI, PSRemoting, RDP) to blend into U.S. networks undetected.

CyberCom 2.0 will prioritize joint operations with private industry to identify and remove intruders already embedded in U.S. infrastructure.

James observed: “The Pentagon finally gets it — the next war isn’t about bombs, it’s about persistence.”

For Defenders:

• Map all LOLBins

• Move to allow-listing

• Apply behavioral analytics to catch misuse of built-in admin tools

UK Told to “Go Offensive or Be a Punching Bag”

At a national security hearing, UK officials were warned that Britain risks becoming a cyber punching bag without a visible offensive cyber policy. Experts argued that deterrence through response—not regulation—is what keeps hostile states at bay.

For CISOs operating in the UK:

• Expect increased regulatory scrutiny and higher cyber insurance rates

• Strengthen threat hunting and collaboration with NCSC

🦠 TRUST CHAIN COMPROMISES & SUPPLY CHAIN ATTACKS

eScan Pushes Malicious Update After Server Breach

eScan, a major antivirus vendor, confirmed that attackers breached one of its regional update servers on January 20th, pushing a malicious binary to users for several hours. The rogue update deployed a backdoor downloader (”contsctlx”) capable of modifying host files, blocking update servers, and maintaining persistence.

This marks another trust chain compromise similar to SolarWinds and Kaseya—an attacker exploiting the vendor’s update mechanism itself.

James’s warning was stark: “When your AV becomes your initial access, that’s not defense — that’s disaster.”

Mitigation:

• Enforce package signing verification

• Proxy block unsigned updates

• Audit all clients that fetched eScan updates on Jan 20

• Always test software updates in isolated environments before organization-wide rollout

Nike Probes Security Incident Amid Extortion Threats

Nike has launched an internal investigation after a threat group claimed to have stolen sensitive data and began threatening public leaks unless the company pays. Attackers released partial data samples as proof, including internal communications and financial statements, which suggests another data theft–without-encryption extortion play—a model quickly replacing ransomware.

James observed: “We’ve entered an era where ransomware isn’t the risk — exposure is. Attackers don’t need encryption when embarrassment pays better.”

CISOs should:

• Treat extortion leaks as PR crises, not just security incidents

• Implement rapid public transparency

• Maintain segmented backups

• Prepare pre-approved press response plans

Nova Ransomware Hits KPMG Netherlands

KPMG Netherlands confirmed a ransomware incident by the Nova gang, which claimed to have exfiltrated and encrypted sensitive data from the firm’s audit environment. The danger here lies in data reuse—Nova’s playbook includes leaking authentic-looking audit papers and supplier documents to impersonate clients or commit financial fraud downstream.

James emphasized: “This isn’t about encryption — it’s about brand exploitation. Ransomware’s new weapon is trust.”

If you’re a KPMG Netherlands customer:

• Revoke all existing integration credentials

• Enforce callback verification on all audit-related communications

• Set new authentication keywords or key phrases for financial teams

• Reissue updated procedures for how auditors should contact accounts payable

🔥 CRITICAL ZERO-DAYS & ACTIVE EXPLOITATION

VMware Zero-Day Exploited in the Wild

A VMware remote code execution (RCE) flaw, tracked as CVE-2025-3079, is now being actively exploited in the wild. The exploit targets vCenter and ESXi components, allowing attackers to gain hypervisor-level access—a nightmare for virtualized environments.

Attackers are using this to pivot laterally across enterprise networks and exfiltrate snapshots of sensitive virtual machines.

Immediate Actions:

• Patch ESXi and vCenter

• Isolate management interfaces behind VPN or jump boxes

• Review all snapshot and backup activity for anomalies

James warned: “Virtualization isn’t security by obscurity — it’s a high-value target with a front-row seat to everything you own.”

Fortinet’s FortiCloud Authentication Bypass

Fortinet admitted its recent patch for the FortiCloud authentication bypass vulnerability left certain conditions still exploitable, allowing attackers to access cloud control planes and enroll rogue devices. The incomplete patch exposes logging, policy, and API control layers—meaning that even after updating, threat actors may retain persistent administrative access.

James emphasized: “A patched system isn’t a clean system — especially when the bad guys got in before the fix.”

Post-Patch Actions:

• Run integrity sweeps

• Rotate all admin credentials

• Audit API keys

• Isolate FortiCloud tenants until you verify clean configurations

Fortinet later confirmed active exploitation and issued a complete fix for CVE-2026-24858. Admins must:

• Apply the patch immediately

• Rotate local credentials

• Revoke API tokens

Microsoft Office Zero-Day Actively Exploited

Microsoft has confirmed active exploitation of CVE-2026-21509, a zero-day impacting Office 2016, 2019, LTSC 2021/2024, and Microsoft 365 apps. The vulnerability allows remote code execution through weaponized documents, primarily via malicious macros or content-handling exploits in email attachments.

Attackers are using this to establish initial footholds before EDR signatures update.

Mitigation Steps:

• Enable “Block all macros from the internet” enterprise-wide

• Minimize exceptions and disable legacy content handlers

• Push patches immediately once released

James noted: “Every time we let one macro through, we’re not helping productivity — we’re funding persistence.”

SolarWinds Web Help Desk Flaw Fixed

SolarWinds has issued patches for two critical authentication bypass and RCE vulnerabilities (CVE-2025-40552 and CVE-2025-40554) in its Web Help Desk product. If exploited, attackers could achieve unauthenticated code execution, pivot laterally, and compromise ticketing automation systems.

Mitigation:

• Patch immediately

• Isolate WHD from management networks

• Review service account permissions tied to ticket automations

Gemini MCP Zero-Day Allows Remote Code Execution

AI infrastructure isn’t safe either. Gemini’s MCP tool has an unauthenticated RCE flaw (CVE-2026-0755), allowing remote attackers to run commands on exposed endpoints.

To Mitigate:

• Restrict MCP endpoints behind VPNs and authentication layers

• Rotate API keys frequently

• Monitor for outbound traffic anomalies on AI servers

James warned: “AI tools are the new soft targets — and the bad guys already know it.”

European Cloud Access Flaws Allow Remote Door Unlocking

Researchers at Sec Consult discovered cloud API flaws and default credentials in several European corporate access control systems, allowing remote attackers to unlock physical doors and view badge logs. The vulnerable systems belong to Dormakaba, affecting hundreds of enterprises.

Attackers could chain these flaws to gain physical entry or steal on-site devices for on-prem pivots.

To Mitigate:

• Isolate these systems on dedicated OT VLANs

• Remove direct internet exposure and restrict API origins

• Rotate all cloud API keys immediately

James said plainly: “You can’t have your door locks talking to the internet — that’s not access control, that’s an open invitation.”

TP-Link Archer Router Command Injection Flaw

A command injection vulnerability (CVE-2025-14756) in TP-Link Archer MR600 v5 routers allows authenticated attackers to execute arbitrary commands via the admin panel.

Patches are available—update firmware immediately, disable remote admin, and replace any end-of-life routers still in production.

800,000 Telnet Servers Still Exposed to the Internet

Internet-wide scans have identified nearly 800,000 open Telnet endpoints, primarily legacy DVRs, industrial devices, and IoT gear still running on plain-text authentication.

This is a dream scenario for botnet herders, who can exploit these devices for DDoS, lateral movement, or persistence in critical networks.

Mitigation is simple but critical:

• Block Telnet (port 23) at the edge

• Quarantine any devices still using it

• Require SSH key-based authentication for CLI access

James was blunt: “If Telnet’s still open in your environment, you’re just asking to be owned.”

🔐 IDENTITY AS THE NEW PERIMETER

Crunchbase Confirms Data Breach Following ShinyHunters Claims

Crunchbase confirmed a data breach after the ShinyHunters group claimed responsibility, leaking what they say is a large dataset of user emails, hashed passwords, and API tokens.

At first glance, this looks like an account information exposure, not a product compromise—but the downstream impact could be severe. Threat actors could leverage investor and founder email addresses for spear phishing or token replay attacks targeting connected CRMs and deal-management platforms.

James advised: “If you’re using Crunchbase integrations, rotate your tokens and invalidate every long-lived session — don’t wait to see your brand in a breach thread.”

CISOs Should:

• Enforce API key rotations

• Force password resets

• Monitor for credential reuse across shared tools

ShinyHunters’ Phishing Blitz Hits 100+ Organizations

The ShinyHunters group is back with a massive credential-harvesting phishing campaign targeting over 100 organizations worldwide. Their attacks use realistic SSO and corporate login clones to steal OAuth tokens and MFA-bypassed credentials.

This isn’t the same crowd we saw months ago going after Okta and Microsoft—this is an evolved operation leveraging token replay and session persistence to achieve stealthy account takeovers.

James emphasized: “One good identity is all an attacker needs to pivot downstream — identity theft is the new lateral movement.”

To Mitigate:

• Shorten session lifetimes

• Rotate refresh tokens upon device or ASN changes

• Audit all cloud sign-ins for token anomalies

Expect public breach disclosures in the next 30–60 days as victims uncover the blast radius.

Okta Admin Phishing Surge Targets Identity Teams

A voice and MFA fatigue phishing campaign is hitting Okta and Microsoft admin teams, where threat actors are calling help desks to request password resets or MFA bypasses, often combining SIM swapping with session hijacking.

The attackers only need one pressured help desk employee to pivot into critical SaaS or VPN access.

To Mitigate:

• Enforce ticketed, manager-approved resets for privileged accounts

• Require shared secret challenges before approving resets

• Empower help desks to say “no” and back them when they do

James stressed: “If your identity provider is the crown jewel, stop letting anyone reset its keys without ceremony.”

🤖 AI SECURITY & EMERGING THREATS

Chrome and Edge Extensions Steal ChatGPT Sessions

Malicious Chrome and Edge browser extensions are stealing ChatGPT session tokens and cookies, allowing threat actors to hijack AI service accounts. Masquerading as productivity add-ons, these extensions exfiltrate credentials to command servers, enabling full account takeover without credentials.

Mitigate by:

• Enforcing enterprise browser controls

• Locking down extensions to an approved allowlist

• Auto-revoking OAuth tokens whenever an extension is removed

James noted: “Once a session token leaks, it’s logging in without logging in — and that’s game over.”

Chrome Web Store Extensions Weaponized Post-Approval

A new scheme dubbed “Guaranteed Approval Service” is selling Chrome Web Store approvals to developers, who then flip benign extensions into token-stealing malware after installation. These extensions hijack OAuth tokens, granting attackers persistent access to SaaS apps and cloud dashboards.

Defensive Actions:

• Deploy enterprise browser management with allowlists

• Automatically revoke OAuth tokens when extensions are removed

• Treat browsers like endpoints—because they are

LLM Jacking: 35,000 AI Attacks in 40 Days

Researchers tracked 35,000 attack sessions abusing open AI-compatible ports (port 11434) for crypto mining, API reselling, and prompt data theft. This “LLM-jacking” trend shows how exposed AI endpoints are being hijacked for profit.

CISOs Should:

• Put AI endpoints behind auth

• Rotate API keys regularly

• Block egress to known crypto pools from AI servers

🎯 NORTH KOREA’S OPERATIONS

North Korea’s Lazarus Targets European Drone Manufacturers

The Lazarus Group is actively targeting European drone and aerospace firms, aiming to steal firmware and flight control IP to backfill disrupted Iranian and Russian supply chains.

Following Venezuela’s regime collapse and the resulting disruption in Iran’s drone production, North Korea is moving in to fill the gap and resell designs to Russia and dark markets.

Mitigation Steps:

• Enforce hardware-backed firmware signing

• Restrict build signing keys to isolated hosts

• Require multi-person code review for all flight control updates

James explained: “When rogue states start stealing drones, it’s not espionage — it’s procurement.”

North Korea’s Kimsuky Group Deploys AI-Generated Phishing Campaign

The Kimsuky (a.k.a. CUNY) threat group is deploying AI-generated phishing emails and documents to target crypto miners, NGOs, and government contractors in Japan, Australia, and India.

These lures are written with LLM-quality grammar and context awareness, making them more convincing than traditional phishing.

Defenders Should:

• Enforce PowerShell policy restrictions

• Scan for AI-generated content indicators

• Integrate behavioral analytics for email attachments

China’s Mustang Panda Deploys CoolClient Infostealer

China-linked APT Mustang Panda is deploying the CoolClient backdoor to install infostealers and credential theft tools across NGOs, government contractors, and policy think tanks.

This campaign uses targeted spear-phishing lures, focusing on political content to increase click-through.

Organizations Should:

• Implement sandbox analysis for attachments

• Auto-quarantine suspicious documents

• Monitor for unusual child process behavior in email clients

💰 FINANCIAL CRIME & RANSOMWARE

$16B Chinese Crypto Laundering Network Exposed

Law enforcement agencies and blockchain analytics firms have identified a $16 billion Chinese crypto laundering operation, supporting ransomware gangs, pig-butchering scams, and North Korean affiliates.

These professionalized networks leverage nested exchanges, OTC brokers, fake KYC data, and mixers to obscure flows.

Financial institutions and crypto exchanges should:

• Increase AML/KYC friction

• Restrict withdrawals to pre-approved wallets

• Require hardware wallet verification for transactions

ATM Malware Operation Busted — 31 More Charged

Federal prosecutors have charged 31 new suspects tied to a Venezuelan ATM malware gang, known for jackpotting cash from U.S. ATMs across multiple states.

Over 87 members have now been indicted, with several sentenced to prison and slated for deportation. These takedowns highlight how physical and cybercrime have fully merged, targeting financial systems at both the hardware and network level.

James summed it up: “The cyber meets the physical in the worst way — and it’s happening in our own backyard.”

FBI Seizes RAMP Cybercrime Forum

The FBI and international partners have taken down the RAMP cybercrime marketplace, a major hub for ransomware negotiation, malware sales, and initial access brokering.

The forum’s clearweb and Tor versions now display federal seizure banners. While criminals will regroup elsewhere, this is still a temporary disruption for ransomware brokers and affiliates.

Tsundere Bot Emerges as Ransomware Broker Tool

The Tsundere bot, paired with Xworm, is the latest tool leveraged by initial access brokers to sell footholds into enterprises.

These brokers evolve quickly—especially after forum takedowns like RAMP—so defenders must hunt for rare outbound beacons and script-based downloaders on new endpoints.

🚨 PHYSICAL-CYBER CONVERGENCE

Russia’s Delta Security Suffers Disruptive Cyberattack

Russia’s largest alarm and monitoring company, Delta Security, suffered a major cyberattack that disrupted dispatch systems and subscriber monitoring nationwide.

This breach highlights how physical security systems are becoming high-value cyber targets, serving as bridges between OT and IT networks. Cameras, alarms, and access control panels—all managed from the same pane of glass—give attackers lateral movement opportunities that can cripple both digital and physical operations.

James explained: “The cyber and physical worlds always converge. When they finally meet, it’s catastrophic.”

The Key Takeaway: Isolate your physical security stack into its own IoT network with strict allow-listing and no flat access from corporate IT.

🧩 MALWARE & SOCIAL ENGINEERING

ClickFix Malware Evolves with IT-Theater Trickery

The ClickFix malware campaign has evolved with new fake update installers and scripted payloads disguised as legitimate Windows updates or IT service tools. Delivered via SEO poisoning, malvertising, and phishing, it tricks users into running PowerShell and VBScript combos to install loaders.

Best Defenses:

• Enforce Windows Defender Application Control and signed installer policies

• Block WScript and CScript execution for all non-IT users

• Monitor for unexpected PowerShell child processes

New ClickFix Malware Wave Exploits Driver Prompts

The ClickFix malware campaign has evolved again, now posing as video card and driver update pop-ups. The fake installers deploy signed-looking VB scripts that drop stealers and RAT payloads.

Because users are conditioned to “fix the problem with a click,” this social engineering is highly effective.

Mitigate by:

• Enforcing Windows Defender Application Control

• Blocking script hosts (WScript/CScript) for non-IT users

When users can’t execute unsigned installers, the trap fails.

GitHub Desktop Repo Hijack Attempt

Attackers are attempting to hijack GitHub Desktop repositories, spoofing legitimate installer links to compromise developer workstations. Once infected, they can steal signing keys and inject backdoors into CI/CD pipelines—a textbook supply chain compromise vector.

The Fix:

• Host internal package registries

• Restrict developer installs to trusted sources

• Disable arbitrary URL-based installations on managed endpoints

🏛️ REGULATORY & POLICY

Google Settles $68M Voice Recording Privacy Case

Google will pay $68 million to settle a lawsuit over voice data collection and retention practices from its Assistant and Nest products. Regulators focused on lack of consent and data retention beyond user expectations.

For enterprises, this is a warning: if you record calls or use AI assistants internally, you could be next.

Action Steps:

• Publish plain-language recording disclosures

• Offer opt-out options to employees and customers

• Enforce automated data deletion policies for recordings

James noted: “Every ‘this call may be recorded’ message is a liability notice — not a disclaimer.”

India Tax Season Triggers Phishing Tsunami

It’s tax season in India, which means phishing campaigns impersonating the Tax Authority and banks are surging. Attackers harvest PAN and banking credentials through fake refund portals targeting payroll vendors and expats.

Defensive Measures:

• Funnel all tax-related communications into a single verified mailbox

• Require out-of-band verification before processing any refunds or changes

• Reinforce awareness among payroll teams about spoofed government domains

✅ YOUR COMPREHENSIVE ACTION LIST

IMMEDIATE CRITICAL PATCHING:

1. 💻 VMware vCenter/ESXi - CVE-2025-3079 RCE exploited in wild—isolate management interfaces

2. 📄 Microsoft Office - CVE-2026-21509 zero-day—block all macros from internet

3. 🧱 Fortinet FortiCloud - CVE-2026-24858 authentication bypass—rotate all credentials and API keys

4. 🧩 SolarWinds Web Help Desk - CVE-2025-40552, CVE-2025-40554—patch and isolate from management networks

5. 🤖 Gemini MCP - CVE-2026-0755 RCE—restrict endpoints behind VPN/auth

6. 📡 TP-Link Archer Routers - CVE-2025-14756 command injection—update firmware; disable remote admin

7. 🚪 Dormakaba Access Control - Cloud API flaws—isolate on OT VLANs; rotate API keys

TRUST CHAIN DEFENSE:

• 🦠 eScan audit - Check all clients that updated Jan 20; enforce package signing verification

• 👟 Nike lesson - Treat extortion leaks as PR crises; pre-approve press response plans

• 💼 KPMG Netherlands - Revoke audit integration credentials; establish callback verification

IDENTITY PROTECTION:

• 🔑 Crunchbase/ShinyHunters - Rotate API tokens; force password resets; monitor credential reuse

• 🎯 Okta admin protection - Enforce ticketed, manager-approved resets; require shared secrets

• 📊 Shorten session lifetimes - Rotate refresh tokens on device/ASN changes

• 🔐 Audit cloud sign-ins - For token anomalies and suspicious patterns

AI & BROWSER SECURITY:

• 🌐 Chrome/Edge extensions - Lock to approved allowlists; auto-revoke OAuth on removal

• 🤖 LLM endpoint protection - Put behind auth; rotate API keys; block crypto pool egress

• 📊 ChatGPT token monitoring - Treat session token leaks as immediate compromises

MALWARE DEFENSE:

• ⚙️ Block script execution - WScript/CScript for non-IT users; enforce WDAC policies

• 🧩 GitHub Desktop - Host internal registries; disable arbitrary URL installs

• 📊 Hunt for downloaders - Rare outbound beacons; script-based loaders on new endpoints

LEGACY SYSTEM REMEDIATION:

• 🚫 Block Telnet (port 23) - At network edge; quarantine devices; migrate to SSH keys

• 📊 Audit 800K exposed devices - DVRs, industrial equipment, IoT gear

THREAT HUNTING:

• 🔍 Post-patch integrity - FortiCloud, eScan, Fortinet—assume persistence until proven clean

• 🎯 AI-generated phishing - Train against LLM-quality grammar and context awareness

• 📊 Monitor snapshot activity - VMware environments for anomalies post-zero-day

STRATEGIC PRIORITIES:

• 💼 Gates and seasons - Help desk resets, Office macros, door APIs, extensions are consent moments

• 🔐 Trust as vulnerability - Audit every approval process; shorten trust lifetimes

• 🌍 Convergence planning - Cyber + physical + geopolitical = modern threat landscape

• 📊 Business communication - Translate technical risk into business-effective language

🧠 JAMES AZAR’S CISO TAKE

This week proved we’ve entered the age of convergence—where cyber, physical, and geopolitical boundaries have vanished, and trust is now the primary attack vector. When China penetrates Downing Street for years, Russian wipers destroy Polish energy equipment, eScan antivirus becomes the infection vector, and Nike gets extorted without encryption, we’re witnessing the complete dissolution of traditional security boundaries. ShinyHunters’ OAuth token campaigns, 800,000 exposed Telnet servers, European door locks hackable via APIs, 35,000 LLM jacking attacks, the $16 billion Chinese laundering network, and CyberCom 2.0 recognizing persistence is the new warfare—all prove identity is the new lateral movement and every consent moment is a battlefield.

The critical lesson: every security failure is fundamentally a consent failure. Whether approving help desk resets, running Office macros, clicking driver updates, or installing browser extensions—every gate we carelessly open becomes an adversary’s entry point. As James said: “It’s about gates and seasons. The gates—phones, help desk resets, Office content, door APIs, extensions—all are consent moments. If approval is sloppy, controls downstream won’t save you. The seasons—audits, tax cycles—are attackers’ calendars.” Resilience isn’t about perfect firewalls, it’s about detection tempo, recovery speed, and the operational discipline to shorten every trust window and verify every consent moment. Because as James emphasized: “These threat actors aren’t going anywhere. They follow along. They’re still scoring goals. So we have to get more involved in the business process side and communicate it in a business-effective way.”

Trust is the new vulnerability. Identity is the new lateral movement. Every consent moment is a battlefield. Shorten trust windows, verify every approval, and remember—resilience is detection tempo and recovery speed.

Stay sharp, verify relentlessly, and as always—stay cyber safe, Security Gang!

Coffee cup cheers, y’all—we’ll be back Monday at 9 AM Eastern Live!