Microsoft names the group behind the ConnectWise breach, and says AI agents sped it up
Decrypted: The UK Cyber BriefingShow Notes
Microsoft now attributes the ConnectWise Cloud Backup compromise to China-aligned Storm-0940, which it says used an AI pentest tool to reach privileged access in under three hours. Plus a patched bootkit flaw that stayed open, and a Windows Server 2016 deadline.
More from Decrypted: The UK Cyber Briefing
Researchers took over the lapsed update domain of a dead Popcorn Time fork and found its updater would run anything it was sent, as the most privileged user. The Secure by Design lesson is cheap: sign your updates and plan for end of life.
Forever Security found a planted AGENTS.md file steering a developer's coding agent into installing malware, and says there is nothing for the vendors to patch. Plus an abandoned update domain, a lab portal breach and Windows Server 2016's end of support.
A Decrypted special. Two engine-level flaws, PHP2Shell and Node2Shell, were patched on the same Wednesday. One took parts of the British state offline as a precaution. Both were found by AI. Annabel and Jude on where the exposure really is, how the UK responded, and what defending at machine speed means on a Monday morning.
The UK has put out a consultation to replace the 1885 Submarine Telegraph Act with tougher penalties and security duties for subsea cable operators. The Secure by Design lesson is to plan for the cable to break. Also: an abandoned updater, and a US lab portal outage.
A critical flaw in the Collabora server bundled with Nextcloud was exploited from 10 September, but the advisory only appeared on 14 October. Plus Microsoft's account of AI agents in the ConnectWise attacks, and the UK's undersea cable sabotage proposals.