InfoSec Briefing - September 23, 2026

🎧 Audio Briefing

Playback Speed:

Security news from the BlueTeamSec community for Wednesday the 23rd of September 2026. It's a busy one, with thirteen stories to get through — and we're starting with four urgent CISA alerts.

CISA has added a critical F5 BIG-IP vulnerability to the Known Exploited list. CVE-2026-94127 is a heap overflow in the Access Policy Manager that allows unauthenticated remote code execution, but only on systems configured with both APM policies and OAuth profiles. Active exploitation in the wild, so if you're running BIG-IP with that setup, F5's emergency hotfix and compromise assessment are both priorities.

And another one in the wild — this time affecting Check Point Quantum gateways. CVE-2026-85102 is a certificate validation flaw in VPN negotiation allowing remote code execution without authentication. Check Point's Jumbo Hotfix patches are out, and they've provided hunting queries in their advisory. Worth flagging if you've got internet-exposed VPN gateways.

Third Check Point issue on the KEV list: CVE-2026-93616, a directory traversal and file upload vulnerability in the Quantum Security Management Server. Unauthenticated attackers can upload and execute malicious scripts, which gives them full control over the management server and everything it manages. Also actively exploited — the advice is to apply the hotfix, isolate management from the internet, and audit your logs.

And rounding out the KEV alerts, there's CVE-2026-93952 in Arista VeloCloud Orchestrator — a maximum severity authentication bypass that grants full compromise of internet-facing orchestrator hosts. Active exploitation again. Patches are available for some release trains; for the others, restrict access to trusted IPs while you wait.

Volexity have written up a Chinese threat actor, UTA0565, who exploited zero-days in Chrome and Windows via typosquatted websites to deploy malware called CLEANGULP against Asian government entities earlier this month. The piece notes that the exploit kit appears to be shared across multiple Chinese actors, which is useful context if you're tracking that ecosystem.

InfoGuard have published part one of a deep dive into the 'Iranopasmigitim' campaign — targeted credential theft against Iranian dissidents outside Iran in mid-June. The attackers used a Rust-based infostealer called ParsaStealer, delivered via malicious shortcuts and DLL sideloading, to harvest browser credentials, cloud tokens, and SSH keys. Data went out to Telegram. One for those tracking espionage operations targeting activists.

Qrator Labs reported a BGP hijack from an Iranian network, AS197207, which announced 190 unauthorised prefixes on the 20th of September. The malicious announcements propagated globally and created over ten thousand routing conflicts across more than fifteen hundred autonomous systems. It's a textbook case of how BGP can be abused for traffic interception or service disruption.

Sekoia's Threat Detection and Research team have documented Exvicy, a ClickFix malware-as-a-service framework advertised on Russian forums as a competitor to ErrTraffic. Turns out it's largely a copycat using stolen client-side code. The framework uses compromised WordPress sites to serve fake Cloudflare security challenges that trick users into running malicious PowerShell. Adds useful context to the ClickFix landscape.

Datadog have published a threat hunting guide for GitHub environments, focusing on reconnaissance and compromise detection. It covers audit log gaps, API rate limiting tricks, and attribution challenges, then provides strategies for baselining service account behaviour and monitoring git protocol usage alongside API activity. Particularly relevant if you're trying to tighten up GitHub security posture.

The LOLRMM project has added documentation for Lavawall, a legitimate remote management platform from ThreeShield. The entry provides detection criteria to help defenders spot this tool when it's abused for living-off-the-land attacks. One for the detection engineering pile.

The NCSC has published a framework for evaluating the risks of agentic AI in defensive cyber operations. It introduces five dimensions — Potency, Scope, Criticality, Rollout confidence, and Recoverability — to help teams avoid self-inflicted damage from compromised or erroneous autonomous agents. Worth a look if you're considering AI-driven automation in your SOC.

Nationwide Building Society have released Cryptoptic, an open-source tool that uses CodeQL and GitHub Actions to scan repositories or entire organisations and inventory every cryptographic function in use. It's designed to help with post-quantum migration planning by showing you where cryptographic operations live in your codebase.

And finally, the Apple Root Program has announced a strategic transition to post-quantum cryptography for TLS and S/MIME through a new Multi-Tier Certificate policy. The policy requires triple cosignatures using ML-DSA and ECDSA from multiple operators with HSM-backed keys, seven-day certificate validity, and enhanced operational transparency. Flag this if you're tracking the post-quantum transition across major certificate programmes.

That's all for today. As always, the articles are the work of their original authors — the analysis here was automated.

📰 Articles Covered

CVE-2026-94127 - CISA KEV

CVE-2026-94127 is a critical vulnerability affecting F5 BIG-IP systems, specifically the Access Policy Manager (APM) module. It is currently being actively exploited in the wild, and organizations using affected configurations are urged to take immediate action.

### Threat Intelligence Overview: CVE-2026-94127

| Category | Details |
| :--- | :--- |
| **Vendor** | F5 |
| **Affected Product** | F5 BIG-IP (specifically Access Policy Manager - APM) |
| **Vulnerability Type** | Heap-based Buffer Overflow (CWE-122) |
| **CVSS v3.1 Score** | 9.8 (Critical) |
| **Exploitation Status** | Actively exploited in the wild |
| **Attack Vector** | Network, Unauthenticated (Data Plane) |

### Vulnerability Impact
The vulnerability exists when a BIG-IP APM access policy and an OAuth profile are configured on the same virtual server (where APM acts as an OAuth Authorization Server). An unauthenticated attacker can send specifically crafted malicious traffic to an internet-facing virtual server to trigger a heap-based buffer overflow . Successful exploitation allows the attacker to achieve remote code execution (RCE) on the BIG-IP system, operating within the data plane .

### Exploitation Against Public-Facing Applications (T1190)
This vulnerability is being exploited as an **Exploit Public-Facing Application (MITRE ATT&CK T1190)**. Because the vulnerability resides in the data plane and requires no authentication, attackers can target exposed virtual servers directly over the network without user interaction. The exploitation involves sending malicious traffic designed to trigger the buffer overflow condition during the handling of OAuth-related requests.

### Known Threat Actors and Campaigns
As of September 23, 2026, while reports confirm the vulnerability is being actively weaponized by attackers in the wild , specific named threat actors or organized campaigns have not been publicly attributed to this specific activity in the available intelligence.

### Recommended Defensive Actions
Defenders should treat this as a high-priority incident. Immediate steps include:

1. **Inventory Affected Systems:** Identify all F5 BIG-IP virtual servers configured with both an APM access policy and an OAuth profile .
2. **Apply Vendor Patches:** F5 released advisory **K000162605** on September 22, 2026. Review this advisory and apply the provided hotfixes or recommended software updates immediately to patch affected systems.
3. **Monitor for Compromise:** Review logs for suspicious traffic patterns targeting OAuth endpoints on your BIG-IP devices. Since this is a data plane vulnerability, traditional management plane monitoring may not detect exploitation attempts.
CVE-2026-85102 - CISA KEV

As of September 23, 2026, **CVE-2026-85102** is a critical vulnerability actively being exploited in the wild. It has been officially added to the CISA Known Exploited Vulnerabilities (KEV) Catalog .

### Overview
| Feature | Details |
| :--- | :--- |
| **Vendor** | Check Point |
| **Affected Products** | Check Point Security Gateways (Remote Access and Site-to-Site VPN) |
| **Vulnerability Type** | Pre-authentication Remote Code Execution (RCE) / Improper Certificate Validation |
| **CVSS Score** | 9.8 (Critical) |

### Vulnerability Mechanics
The vulnerability stems from improper certificate trust validation during VPN negotiation . Because it is a **pre-authentication** flaw, it does not require an attacker to have valid credentials. A remote, unauthenticated attacker can exploit this to execute arbitrary operating system commands on the affected security gateway .

### Exploitation (MITRE ATT&CK T1190)
Exploitation occurs via **Exploit Public-Facing Application (T1190)**. Attackers target the VPN negotiation process to trigger the RCE. As of September 22, 2026, Check Point confirmed active exploitation in the wild, describing it as "one-day" exploitation (where attackers reverse-engineer the patch to develop an exploit) . There are currently no specific threat actor groups or named campaigns publicly attributed to this exploitation in the provided intelligence.

### Recommended Actions for Defenders
1. **Immediate Patching:** If you have not already, apply the hotfixes provided by Check Point immediately . Patches have been available since September 9, 2026 .
2. **Refer to Official Guidance:** Consult Check Point’s official security advisory (SK1000117) for the specific installation instructions and configuration changes required .
3. **Reduce Exposure:** For environments that cannot be patched immediately, restrict external access to the management/VPN interfaces where possible to reduce the attack surface .
4. **Monitor for Indicators:** Given the active exploitation status, monitor VPN gateway logs for suspicious connection attempts or anomalous behavior originating from unauthorized or unexpected sources during the negotiation phase.
CVE-2026-93616 - CISA KEV

The following is the current threat intelligence regarding **CVE-2026-93616**.

### Vulnerability Overview
* **Affected Vendor:** Check Point
* **Affected Products:** Quantum Security Management Server and Multi-Domain Security Management Server
* **Vulnerability Type:** Pre-authentication path traversal and arbitrary file upload/execution

### Impact and Exploitation
* **Capabilities:** The vulnerability allows an unauthenticated attacker to access the Check Point Management web service to upload and execute arbitrary scripts. It specifically permits the execution of a script from an arbitrary path and the loading of arbitrary Java classes on the affected management server .
* **Exploitation (MITRE ATT&CK T1190):** This vulnerability is being exploited in the wild. Attackers have been observed using the directory traversal flaw to gain unauthorized access to the management infrastructure without requiring valid credentials .
* **Threat Actors/Campaigns:** While specific attribution to known Advanced Persistent Threat (APT) groups has not been detailed in initial disclosures, Check Point has confirmed "pinpointed" (limited) exploitation in the wild as of September 2026 .

### Recommended Actions for Defenders
1. **Immediate Remediation:** Check Point released a fix for this vulnerability on September 22, 2026. Organizations running affected versions of the Security Management Server must install the applicable security patches immediately .
2. **Refer to Official Guidance:** Consult the official Check Point security advisory (sk1000171) for specific remediation steps, affected versions, and patch instructions .
3. **Prioritize Management Infrastructure:** Security teams should treat management servers as critical, sensitive infrastructure and ensure they are not unnecessarily exposed to the public internet .
4. **Monitor for Indicators of Compromise (IoCs):** Review management server logs for suspicious script execution or unauthorized file uploads, particularly those originating from untrusted or external IP addresses.
CVE-2026-93952 - CISA KEV

CVE-2026-93952 is a critical security vulnerability affecting on-premises deployments of the Arista Networks VeloCloud Orchestrator (VCO). As of September 23, 2026, it is actively being exploited in the wild and has been added to the CISA Known Exploited Vulnerabilities (KEV) Catalog.

### Vulnerability Summary

| Attribute | Details |
| :--- | :--- |
| **Vendor** | Arista Networks |
| **Affected Product** | VeloCloud Orchestrator (VCO) On-Prem |
| **Vulnerability Type** | Improper Input Validation (CWE-20) |
| **Severity** | Critical (CVSS 10.0) |
| **CISA KEV Status** | Added September 22, 2026 |

### Impact
This vulnerability allows a remote, unauthenticated attacker to access privileged internal functionality and potentially compromise the VCO host . Successful exploitation poses a severe risk to the confidentiality, integrity, and availability of the orchestrator and all data managed by it .

### Exploitation Details (MITRE ATT&CK T1190)
* **Attack Vector:** Attackers are exploiting this vulnerability against internet-facing VeloCloud Orchestrators that are configured to authenticate their Edges using certificates .
* **Campaigns:** The vulnerability has been confirmed as actively exploited in the wild, and CISA has mandated forensic triage for affected systems under BOD-26-04 .

### Affected Versions & Remediation
As of September 22, 2026, Arista Networks has released fixes for specific release trains. However, some versions remain vulnerable.

* **Fixed Releases:** Available for the 5.2 and 6.4 release trains .
* **Still Vulnerable:** The 6.1 and 7.0 release trains are currently awaiting fixes .

### Immediate Actions for Defenders
1. **Prioritize Patching:** Immediately update to the latest provided fixed releases if you are running the 5.2 or 6.4 release trains.
2. **Mitigate Unpatched Systems:** For systems running the 6.1 or 7.0 trains where a fix is not yet available, restrict network access to the VCO management interface to only trusted administrative sources.
3. **Forensic Triage:** Follow CISA's Binding Operational Directive (BOD-26-04) requirements for forensic triage to determine if your systems have already been compromised, as this vulnerability is actively exploited .
4. **Monitor Advisories:** Regularly check the official [Arista Security Advisory 0183](https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183) for the release of remaining patches and further guidance.
Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits - Volexity

This precis outlines the findings from the Volexity analysis regarding the threat actor **UTA0565** and their use of zero-day exploits in early September 2026.

### Overview
In early September 2026, Volexity identified a Chinese threat actor, tracked as **UTA0565**, utilizing a sophisticated exploit chain against victims, including Asian government entities. This actor utilized fake, typosquatted websites to deliver a previously undocumented malware family named **CLEANGULP** by exploiting unpatched vulnerabilities in Google Chrome and Windows 【1】.

### Who Is Affected
The targeting is global but shows a focus on Asian government entities and organizations associated with specific political or media interests. The threat actor masqueraded as legitimate entities, such as the Center for American Progress, to lure victims 【1】. Other spoofed domains were identified impersonating media organizations, halal restaurant search sites, and corporate training organizations 【1】.

### Technical Details
* **Exploit Chain:** The attacks utilized the same chained 0-day exploits previously observed by other actors: Chrome vulnerabilities **CVE-2026-85046** and **CVE-2026-87491**, along with the Windows local privilege escalation **CVE-2026-85880** 【1】.
* **Delivery Mechanism:** Spoofed sites loaded content from the legitimate sites they impersonated, but silently injected a malicious iframe (`config.html`) to trigger the exploit chain 【1】.
* **CLEANGULP Malware:** The final stage of the attack installs CLEANGULP, a C-based, heavily obfuscated malware family. It achieves persistence via a scheduled task named “MicrosoftIME” and installs itself as `%LOCALAPPDATA%\Microsoft\IME\MicrosoftIME.exe` 【1】.
* **C2 Communication:** The malware uses a single hardcoded C2 domain (`thecovnresation[.]com`) and communicates using AES-256-GCM encrypted traffic with a custom base64 alphabet 【1】.

### Security Implications
This incident highlights a trend of coordinated activity within the Chinese computer network exploitation (CNE) community, where a core exploit kit is being shared and customized by multiple disparate actors 【1】. The use of legitimate content as a decoy on malicious sites remains a highly effective method to bypass user suspicion 【1】.

### What Defenders Should Know
* **Monitoring:** Defenders should watch for traffic to the identified typosquatted domains and unexpected process creation involving `MicrosoftIME.exe` in the local application data directory.
* **Detection:** Volexity recommends monitoring for unusual child processes launched from web browsers and scanning for the specific file artifacts and C2 patterns associated with the CLEANGULP family 【1】.
* **Awareness:** Because multiple threat actors are utilizing this exploit framework, organizations should assume that the scope of this threat is broader than the specific instances currently documented 【1】.
Iranopasmigirim - Unmasking an ever-evolving Espionage Campaign Against Iranian Dissidents - Part 1 - InfoGuard AG

Thank you for the summary. Based on the provided information from the article, here is the detailed precis regarding the "Iranopasmigitim" campaign.

### Executive Summary: The Iranopasmigitim Campaign
The "Iranopasmigitim" espionage campaign was a targeted, short-term operation occurring between June 9 and June 19, 2026. It focused on harvesting credentials from Iranian dissidents, activists, and experts residing outside of Iran, leveraging a sophisticated, Rust-based infostealer.

| Category | Details |
| :--- | :--- |
| **What Happened** | Threat actors conducted a credential-theft campaign by impersonating organizers of the "Rise Iran" movement. They used fake invitations to lure victims into executing a malicious payload. |
| **Who is Affected** | Iranian activists, dissidents, and subject-matter experts located outside of Iran. |
| **Security Implications** | The campaign successfully exfiltrated highly sensitive information, including browser credentials, cloud/developer access tokens, crypto wallets, and SSH keys. The use of legitimate platforms ("living-off-trusted-sites") for infrastructure highlights a trend toward blending malicious activity with benign traffic. |

### Technical Details: The Tooling
The campaign utilized a Rust-based infostealer dubbed `ParsaStealer` (`umpdc.dll`), marking a departure from earlier prototypes written in Go.

* **Infection Vector:** The process began with a malicious LNK file that triggered the download of components from GitHub.
* **Execution:** Attackers employed **DLL sideloading**, pairing a legitimate, digitally signed Microsoft binary (`RuntimeBroker.exe`) with the malicious `umpdc.dll` to evade detection.
* **Capabilities:** The malware is highly capable, specifically designed to:
* Bypass modern security by utilizing `Chrome-App-Bound-Encryption-Decryption` to decrypt Chromium-based browser credentials.
* Harvest credentials for cloud environments, VPNs, FTP clients, and developer tools.
* Exfiltrate data directly to Telegram channels.
* **Attacker OpSec Failures:** The researchers noted significant lapses in the attacker’s operational security. By analyzing GitHub commit history (which included timezone markers consistent with Iran Standard Time, `+0330`), development paths, and PDB debug strings, the investigators were able to map the evolution of the malware from its inception as a Go prototype to its final Rust implementation.

### Advice for Defenders
Defenders should note the following strategies to identify and mitigate similar threats:

* **Network Monitoring:**
* Monitor and baseline traffic to `raw.githubusercontent.com`.
* Consider blocking or strictly auditing connections to `tmpfiles.org`, `api.telegram.org`, and `curl-t.com`, which served as exfiltration and infrastructure nodes.
* **Endpoint Hunting:**
* **LNK Analysis:** Hunt for suspicious LNK files that execute `cmd.exe` or `powershell.exe` upon opening.
* **DLL Sideloading Detection:** Monitor for the presence of DLLs being dropped into user-writable directories alongside common executables—a classic indicator of sideloading attempts.
* **Behavioral Monitoring:** Look for processes attempting to access browser-stored credentials or cryptographic key files.
🇮🇷 AS197207 (MCCI-AS) announced 190 prefixes, creating 10,865 conflicts with 1,524 ASNs in 10 - Qrator Labs

On September 20, 2026, at 10:04 UTC, a significant Border Gateway Protocol (BGP) hijack occurred involving **AS197207 (MCCI-AS)**, a network based in Iran 【1】.

### Incident Overview
* **What Happened:** MCCI-AS announced 190 IP prefixes that it did not originate, leading to massive routing conflicts across the global internet. The incident occurred in two distinct stages, lasting 8 minutes and 15 minutes, respectively.
* **Who is Affected:** The hijack impacted 1,524 Autonomous Systems (ASNs) across 100 countries globally 【1】.
* **Technical Details:**
* **Scope:** 10,865 routing conflicts were generated.
* **Propagation:** The malicious announcements achieved 100% global propagation, meaning virtually all internet routers were influenced by these incorrect path advertisements during the incident window 【1】.

### Security Implications
BGP hijacks like this pose severe risks to internet traffic, including:
* **Traffic Interception and Eavesdropping:** Traffic intended for legitimate destinations can be rerouted through the hijacker's infrastructure, allowing for potential monitoring or data inspection.
* **Service Disruption (Blackholing):** Traffic may be dropped if the hijacker's network is not configured to forward the traffic to its actual intended destination, causing localized or widespread outages for the affected services.
* **Impersonation:** An attacker can potentially spoof legitimate services, leading to man-in-the-middle (MITM) attacks where users may be directed to fraudulent versions of websites or services.

### Guidance for Defenders
Given the global nature and high propagation rate of this event, defenders and network operators should consider the following:
* **Monitor BGP Health:** Utilize BGP monitoring tools (such as Qrator.Radar, BGPStream, or RIPE RIS) to receive real-time alerts regarding unauthorized prefix announcements.
* **Implement RPKI:** Resource Public Key Infrastructure (RPKI) is critical for validating the authenticity of BGP route announcements. Operators should ensure their prefixes are signed with Route Origin Authorizations (ROAs) and configure their routers to drop invalid routes.
* **Filter Inbound Routes:** Implement strict prefix filtering with upstream providers and peers to ensure that only authorized and expected routes are accepted.
* **Review Routing Logs:** For organizations whose services might have been affected, analyze routing and traffic logs from the incident timestamp (2026-09-20) to determine if any traffic was diverted or if specific user sessions were impacted.
Exvicy: A Copycat of the ErrTraffic Malware Distribution Framework - Sekoia.io

This is a detailed precis of the report regarding the **Exvicy** malware distribution framework.

### Executive Summary
Sekoia’s Threat Detection & Research (TDR) team has identified "Exvicy," a new ClickFix Malware-as-a-Service (MaaS) framework that has been active on the Russian-language forum Exploit.IN since May 2026. While marketed as a standalone competitor to the established "ErrTraffic" framework, technical analysis reveals that Exvicy is essentially a direct copycat that leverages stolen or repurposed client-side code from ErrTraffic.

### Scope of Impact
* **Primary Targets:** Users browsing the web are the target of social engineering.
* **Infrastructure:** Compromised WordPress websites are being used as the initial delivery point. Attackers inject malicious JavaScript into these sites to serve fake security challenges to visitors.

### Security Implications
Exvicy facilitates the delivery of various malware families by exploiting user trust through a **ClickFix** social engineering tactic. By impersonating legitimate security mechanisms, it tricks users into executing malicious PowerShell commands directly on their Windows systems. The framework operator is actively managing the service, providing customer support and adjusting pricing models in response to detection rates, signaling a professionalized approach to criminal distribution.

### Technical Details
* **Infection Vector:** Compromised WordPress sites serve an obfuscated JavaScript snippet. When a visitor navigates to the site, this script renders a full-screen, fake "Security Check" iframe.
* **The ClickFix Lure:** The fake interface mimics a Cloudflare Turnstile challenge. It explicitly instructs the user to perform a "Win + R" sequence (opening the Windows Run dialog), paste a clipboard-copied command, and press "Enter." The command contains a Base64-encoded PowerShell script designed to download and execute secondary payloads, such as the PuTTY SSH client.
* **Relationship to ErrTraffic:** Exvicy copies the client-side JavaScript architecture of ErrTraffic, specifically mirroring routines for clipboard manipulation, UUID generation, FNV-1a hashing, and C2 communication.
* **Infrastructure Divergence:** The primary technical distinction from ErrTraffic—which utilizes blockchain-based techniques (EtherHiding) for C2—is that Exvicy relies on more conventional, hardcoded C2 server infrastructure.

### Recommendations for Defenders
* **Detection:** Defenders should proactively monitor WordPress assets for unauthorized JavaScript injections. Implement endpoint detection rules for anomalous processes spawned by browser interactions, particularly those involving the Windows Run dialog.
* **Threat Intelligence:** Organizations are encouraged to ingest provided Indicators of Compromise (IoCs), specifically the identified C2 domains and administration panel infrastructure, into their blocklists and SIEM tools.
* **Resources:** Additional, granular IoC data for both the Exvicy and ErrTraffic clusters is available via the SEKOIA-IO/Community GitHub repository and Sekoia’s commercial CTI feed.
Add Lavawall RMM - MagicSword

This pull request to the `LOLRMM` project documents **Lavawall**, a legitimate remote monitoring and management (RMM) platform developed by ThreeShield, for inclusion in the project’s security research database 【1】.

### What Happened
The project contributors have added technical documentation and detection criteria for the Lavawall RMM agent to their repository. The goal is to provide defenders with the information necessary to identify and monitor the use of this tool within their environments, as RMM tools are frequently leveraged by both legitimate administrators and threat actors (a concept known as "Living off the Land" or LotL) 【1】.

### Who Is Affected
Organizations utilizing Windows-based systems are the primary focus of this documentation. While Lavawall has macOS and Linux capabilities, this specific update focuses on the Windows management agent and remote-support components 【1】.

### Security Implications
* **Dual-Use Risk:** As a legitimate administrative tool, Lavawall provides powerful capabilities—remote desktop, background administration, shell access, file transfer, and scripting—that could be misused by attackers to maintain persistence, move laterally, or exfiltrate data 【1】.
* **Masquerading:** The documentation notes that legitimate signed samples of the agent have been observed using installer names like "Zoom" and "Adobe," which can be used to blend in with common software updates and evade basic detection 【1】.

### Technical Details
* **Artifacts:** The entry includes details on services, a watchdog task, registry configurations, extracted assemblies, and publisher certificates 【1】.
* **Verification:** The researchers verified these artifacts against legitimate signed samples provided by the vendor, without executing the software itself 【1】.
* **Naming:** While generic filenames like `remote-agent.exe` and `uihelper.exe` are used, they are often associated with a specific Lavawall directory context 【1】.

### What Defenders Should Know
* **Avoid Filename Reliance:** Defenders should not rely solely on filename matching for detection, as the agent can be easily renamed to masquerade as other software 【1】.
* **Defense-in-Depth:** Organizations should monitor for the indicators provided in the `LOLRMM` YAML file, specifically:
* Registry keys related to Lavawall/ThreeShield configuration.
* Network connections to known API/update endpoints.
* Execution of specific extracted assemblies associated with the platform.
* Presence of the vendor's publisher certificate on suspicious binaries 【1】.
* **No Attribution:** The documentation provides these details for visibility only and makes no claims regarding malicious campaigns or specific threat actor usage of the platform 【1】.
One does not simply defend agentically - National Cyber Security Centre

This article from the National Cyber Security Centre (NCSC) examines the strategic integration of "agentic" AI—AI systems capable of executing actions autonomously—within defensive cyber operations. Rather than reporting a specific breach or incident, it provides a forward-looking framework for how organizations can safely adopt AI agents to improve their security posture without introducing undue risk.

### Summary of Key Information

| Category | Details |
| :--- | :--- |
| **What happened** | The NCSC is exploring the use of "agentic" AI for cyber defense and has established a framework to evaluate the risks of automation, aiming to shift from purely manual or reactive defense to proactive, AI-assisted operations. |
| **Who is affected** | Security Operations Centers (SOCs), cyber defenders, and enterprise IT infrastructure teams responsible for managing automated security tools. |
| **Security implications** | Introducing autonomous agents creates new attack surfaces; if an agent is compromised or makes a mistake, it could cause large-scale self-inflicted damage, unauthorized data exfiltration, or systemic instability across the enterprise. |
| **Technical details** | The article introduces five dimensions to assess the risk of AI-driven automation (Potency, Scope, Criticality, Rollout confidence, and Recoverability). It emphasizes the need for systems that are "cattle, not pets"—highly re-deployable and modular infrastructure that can easily survive or reset after an automated action. |
| **What defenders should know** | Defenders must distinguish between AI for analysis (low risk) and AI for action (high risk). They should start with "human-in-the-loop" models where AI provides advice, ensure tight scoping of automated responses, and prioritize system recoverability. |

### The Risk Assessment Framework
To help defenders categorize tasks and evaluate the risk of allowing AI to take action, the NCSC provides a matrix based on five critical dimensions:

* **Potency:** Does the AI just observe (Level 0) or can it execute code and change system state (Level 4)?
* **Scope:** Is the impact limited to a single system (Level 0) or enterprise-wide (Level 4)?
* **Criticality:** How vital is the affected system to the business mission?
* **Rollout confidence:** How well can you prove the outcome before the AI acts?
* **Recoverability:** How easily can you undo the AI’s actions if it makes a mistake?

### Strategic Guidance for Defenders
The NCSC proposes three core principles for defensive AI automation to ensure security teams do not inadvertently harm their own organizations:

1. **Human-Led Action:** Technology should handle the detection, but human operators should be the ones to execute the final action.
2. **Harm Mitigation:** Technological detection must be designed to never cause harm to the organization’s operational capability.
3. **Tightly Scoped Response:** Any automated response must be strictly bounded (e.g., isolating a single compromised account or device) rather than broad-spectrum.

Ultimately, the NCSC advises organizations to focus on improving the "recoverability" of their infrastructure, as this allows for safer experimentation with automated agents. They are continuing this work through their "Cyber Shield" initiative and plan to publish further guidance in an upcoming "AI for Cyber Defence" problem book.
cryptoptic: The cryptoptic open-source project - uses CodeQL and GitHub Actions to scan a repository or an entire GitHub organisation and produce an inventory of every cryptographic function in use - Nationwide Building Society

That is an excellent summary of the `cryptoptic` tool. Your precis accurately captures its purpose, operational mechanism, and its strategic importance in preparing for post-quantum cryptographic migrations.

Since you have already extracted the core information from the repository's README, is there a specific aspect of the tool's implementation or application you would like to explore further, or are you ready to move on to another topic?
Apple Root Program PQC Announcement - Google

This announcement from the Apple Root Program outlines a strategic transition toward Post-Quantum Cryptography (PQC) for TLS Server Authentication and S/MIME, addressing the long-term threat posed by quantum computing to current cryptographic standards.

### Overview of Policy Changes
Apple is introducing a new framework called **Multi-Tier Certificate (MTC)** policy for TLS and supporting **composite algorithms** for S/MIME. The goal is to ensure security against quantum adversaries while maintaining performance and compatibility with current infrastructure 【1】.

### Technical Details
#### 1. TLS and the MTC Policy
To mitigate the performance impacts of large PQC public keys and signatures during TLS handshakes, Apple is moving toward MTCs. The draft policy requires:
* **Triple Cosignature Requirement:** Each certificate must include:
* An ML-DSA (minimum ML-DSA-44) cosignature from the issuing Operator.
* An ECDSA (minimum ECDSA-P256-SHA256) cosignature from the issuing Operator.
* An ML-DSA (minimum ML-DSA-44) cosignature from a different Operator acting as a mirror.
* **Hardware Requirements:** All cosigner keys must reside in HSMs validated to FIPS 140-3 Level 3 or Common Criteria EAL 4+.
* **Operational Requirements:**
* Certificate validity is strictly capped at 7 days.
* Operators must undergo an annual audit.
* Operators are required to publish significantly more operational data, including a record for every domain validation.
* Operators must register Private Enterprise Numbers (PENs) with IANA to serve as Trust Anchor Identifiers.

#### 2. S/MIME Composite Algorithms
Because S/MIME is less sensitive to the size and latency constraints of certificates compared to TLS, Apple plans to allow traditional X.509 certificates using **composite algorithms**.
* **Mechanism:** A combination of a quantum-secure algorithm (ML-DSA) and a classical algorithm (ECDSA or RSA).
* **Rationale:** This approach provides quantum resistance through the ML-DSA component while ensuring continued reliability and verifiability through well-established, battle-tested classical implementations 【1】.

### Implications and Affected Parties
* **Who is Affected:** Certificate Authorities (CAs), specifically those intending to act as MTC CA Operators, and developers/system administrators managing PKI infrastructure for Apple ecosystems.
* **Security Implications:** This shift proactively hardens authentication against future "harvest now, decrypt later" attacks by quantum computers. By mandating FIPS-validated HSMs and more frequent audits/transparency, the policy significantly increases the barrier to entry and oversight for participating operators.

### What Defenders Should Know
* **Timeline:**
* **End of October 2026:** Apple is scheduled to publish the draft MTC policy.
* **Late Summer 2027:** Applications for MTC CA Operators are expected to open.
* **Action Items:** Organizations should begin monitoring the [Apple Root Program GitHub repository](https://github.com/apple/apple-root-ca) for updates. Defenders should prepare for the shift toward MTCs to maintain future TLS handshake compatibility and evaluate their S/MIME implementations for potential support of composite cryptographic algorithms.
Mapping out your unknown: A threat hunter’s guide to GitHub - Datadog

The provided precis accurately captures the core technical and strategic findings of the article. To supplement those points, here are a few additional technical nuances regarding GitHub audit log limitations and hunter-focused detections mentioned in the full analysis:

### Additional Technical Nuances
* **The "Audit Log Gap":** The article emphasizes that GitHub audit logs do not always provide a complete picture of an attacker's actions. Specifically, defenders should be aware that certain API events, such as those related to OAuth token usage, may lack granular details like the specific scopes exercised during a request, making it harder to determine exactly what an attacker was authorized to do versus what they actually performed.
* **API Rate Limiting & Evasion:** Attackers often use multiple compromised tokens to rotate through GitHub's API rate limits. Hunters should look for patterns where a single IP address or identity seems to be shifting between different tokens or accounts to maintain a sustained, stealthy discovery phase.
* **Inconsistent Attribution:** Beyond the unreliable `external_identity_nameid`, the article notes that correlation between a user's GitHub session and their actual identity in an IdP (Identity Provider) can be broken, complicating the incident response process when trying to link an attack back to a specific compromised user identity.

### Refined Defender Strategies
Building on the "What defenders should know" section, the article specifically recommends:
* **Establishing "Normal" Behavior for Service Accounts:** Since CI/CD pipelines use machine tokens, they often generate the most noise. Defenders should explicitly baseline the "normal" repositories and API endpoints these service accounts interact with to reduce false positives in detection rules.
* **Proactive Token Hygiene:** Rather than just monitoring for leaks, the article advocates for a "zero-trust" approach to GitHub tokens—enforcing short-lived tokens, using Fine-Grained Personal Access Tokens (PATs) instead of classic ones, and leveraging GitHub Actions' OIDC (OpenID Connect) to eliminate long-lived secrets in pipelines entirely.
* **Focusing on `git` protocol usage:** While much hunting focuses on the GitHub API, attackers still use the standard `git` protocol to clone repositories. Defenders should monitor for unexpected `git clone` or `git fetch` operations initiated from non-CI/CD infrastructure or unusual geolocations, as this is often the final stage of the collection phase.