Daily Reading for 2026-08-10

Security

Microsoft Security Blog

• Microsoft named a Leader in the 2026 IDC MarketScape for MDR/MXDR for the Enterprise

  ONE SENTENCE SUMMARY

  Microsoft Defender Experts MDR was named a Leader in the 2026 IDC MarketScape for enterprise MDR/MXDR, leveraging AI, global threat intelligence, and expert-led operations to deliver round-the-clock managed detection and response.

  MAIN POINTS

  1. Microsoft named Leader in 2026 IDC MarketScape for MDR/MXDR enterprise vendor assessment.
  2. Defender Experts MDR provides 24/7 expert-led managed detection and response service.
  3. Service operates natively on Microsoft Defender platform across endpoints, identities, email, cloud.
  4. Microsoft analyzes 100 trillion signals daily from over 10,000 security researchers.
  5. AI-assisted workflows achieve 97% classification accuracy and 72% faster resolution.
  6. Defender Experts mitigated 27,000 high-severity incidents over the past year.
  7. Proactive threat hunting included as core service, not premium add-on.
  8. Threat research contributes meaningful share of all Defender detections.
  9. Dedicated security delivery experts provide proactive check-ins and live dashboards.
  10. IDC MarketScape evaluates capabilities and strategy over 3-5 year timeframe.

  TAKEAWAYS

  1. Native platform integration enables continuous detection improvements reaching customers automatically.
  2. AI filters noise while human experts maintain decision ownership and accountability.
  3. Global threat intelligence enables early pattern recognition before campaigns escalate.
  4. Managed threat hunting included standard, extending SOC capabilities without premium costs.
  5. Customer insights feed back into broader ecosystem, benefiting all Defender users.

• DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure

  ONE SENTENCE SUMMARY:

  DeadLock ransomware uses Rust, decentralized blockchain and Session-based recovery infrastructure, and resource-aware encryption to target organizations globally with double extortion tactics.

  MAIN POINTS:

  1. DeadLock ransomware emerged July 2025, linked to Lynx and INC ransomware affiliates.
  2. Over 80 organizations published on DeadLock blog, majority in Europe.
  3. Encryptor uses XOR-decrypted configuration with geofencing for former Soviet countries.
  4. Malware elevates privileges via batch script and UAC consent dialog retries.
  5. Empties recycle bin, registers custom .dlock icon, and terminates security services.
  6. Employs resource-aware throttling to maintain system responsiveness during encryption.
  7. Uses hybrid cryptography: Curve25519 ECDH, XChaCha20, and NaCl crypto_box.
  8. Implements tiered file encryption based on size thresholds from configuration rules.
  9. Recovery chat uses Polygon blockchain, Session network, and Wasabi file hosting.
  10. Self-deletes via batch loop after encryption completes.

  TAKEAWAYS:

  1. Decentralized infrastructure (blockchain, Session) makes takedown significantly harder.
  2. Resource-aware throttling reduces detection likelihood by maintaining normal system behavior.
  3. Geofencing avoids former Soviet and Middle Eastern countries, indicating origin.
  4. Hybrid cryptographic design is sound with no practical decryption without private key.
  5. Microsoft Defender detections and attack surface reduction rules can mitigate infections.

Security Risk Advisors

• Metabase Unauthenticated SQL Injection Vulnerability Enables Administrative Access and Complete Database Compromise Across Affected Versions.

  ONE SENTENCE SUMMARY:

  Metabase patched a critical 0-day SQL injection vulnerability allowing unauthenticated attackers to gain admin access and fully compromise affected instances.

  MAIN POINTS:

  1. Metabase Cloud was attacked using an unknown 0-day vulnerability in versions 1.58 and above.
  2. The vulnerability allows arbitrary SQL injection against the Metabase application database.
  3. Attackers can gain administrator access, steal credentials, read data, and export information.
  4. Self-hosted Metabase instances are vulnerable and require immediate patching.
  5. Upgrade to the latest point release for your specific Metabase version.
  6. Attack pattern involves POST /api/session/reset_password with 400 status, then GET /api/user/current with 200.
  7. Revoke all active user sessions by deleting rows in the core_session table.
  8. Review API keys, administrator accounts, and rotate connected database credentials.
  9. Check data warehouse logs and Metabase activity for unauthorized access.
  10. Temporary workaround: block the /api/session/reset_password endpoint if unable to upgrade.

  TAKEAWAYS:

  1. Immediately upgrade self-hosted Metabase to the latest point release for your version.
  2. Check application logs for the specific attack pattern to detect potential compromise.
  3. After upgrading, revoke all sessions and review API keys and admin accounts.
  4. Rotate credentials for all connected databases as a precautionary measure.
  5. Block the vulnerable endpoint as a temporary workaround if immediate patching isn’t possible.

• 🚩 UNC6671 Rebrands Across Multiple Extortion Fronts While Continuing Vishing and SaaS Data Theft

  ONE SENTENCE SUMMARY:

  UNC6671 threat actors continue vishing and SaaS data theft attacks while rebranding across multiple extortion fronts including Redact, Pink, Helix, and Falcon.

  MAIN POINTS:

  1. UNC6671 uses voice phishing posing as IT helpdesk to target enterprise employees.
  2. Attackers contact victims on personal mobile devices to bypass corporate security.
  3. Adversary-in-the-Middle infrastructure intercepts credentials and MFA tokens.
  4. Automated scripts exfiltrate data from Microsoft 365 and Okta environments.
  5. Shared infrastructure links BlackFile, Redact, Pink, Helix, and Falcon brands.
  6. Targeting evolved from manufacturing to financial services and private equity.
  7. Domain registration tempo increased to one domain every 1.6 days.
  8. Ransom payments totaled 141.65 BTC (~$10.69 million USD).
  9. Initial ransom demands ranged from $1 million to $3 million USD.
  10. Final payments averaged $750,000 USD in over 53% of tracked cases.

  TAKEAWAYS:

  1. Enforce phishing-resistant MFA using FIDO2-compliant authenticators and passkeys.
  2. Integrate all SaaS applications with centralized SSO platforms like Entra ID.
  3. Monitor IdP logs for abandoned MFA challenges and authentication failures.
  4. Audit file access events for scripting library user agents indicating exfiltration.
  5. Restrict authentication to trusted networks and corporate-managed devices.

• 🚩 DeadLock Ransomware Uses Decentralized Messaging and Blockchain Infrastructure to Support Extortion

  ONE SENTENCE SUMMARY:

  DeadLock ransomware uses decentralized infrastructure—Session messaging and Polygon blockchain—to enhance extortion resilience, combining double extortion with resource-aware encryption and geofencing.

  MAIN POINTS:

  1. DeadLock ransomware emerged July 2025, using double extortion tactics with over 80 victims published.
  2. More than half of claimed victims are located in Europe across multiple sectors.
  3. Encryptor uses hybrid cryptography: Curve25519 ECDH and XChaCha20 stream cipher.
  4. Resource-aware throttling maintains system responsiveness by pausing file dispatch when CPU or memory thresholds exceeded.
  5. Language geofencing prevents execution in former Soviet, CIS-linked, and select Middle Eastern countries.
  6. Malware terminates security, backup, remote access, and system processes before encryption.
  7. Event logs are cleared, disabled, and access-restricted using three complementary methods.
  8. Recovery chat HTML app uses Session network and Polygon blockchain for censorship-resistant communication.
  9. File size-based encryption strategy encrypts only portions of large files for speed.
  10. Self-deletion batch loop removes malware binary after encryption completes.

  TAKEAWAYS:

  1. Decentralized infrastructure (blockchain, Session) makes takedown significantly more difficult for defenders.
  2. Resource-aware throttling reduces detection likelihood by maintaining normal system performance during encryption.
  3. Geofencing and language checks indicate likely origin in former Soviet or CIS regions.
  4. Cryptographic design is sound, offering no practical decryption path without attacker’s private key.
  5. Proactive mitigations like Controlled Folder Access and attack surface reduction rules can block initial infection stages.

wardley-beta
%% 1. Users: Security teams, CISOs, IT admins, enterprises
%% 2. Needs: Continuous threat detection/response, ransomware resilience, vulnerability remediation, actionable threat intel
%% 3. Capabilities: Managed detection & response, ransomware analysis/defense, vuln management, threat intel production, decentralized infra forensics
%% 4. Components from articles: MDR/MXDR service, DeadLock ransomware analysis, Metabase vuln response, UNC6671 threat tracking, blockchain/decentralized forensics
%% 5. Maturity: MDR/MXDR=Product (0.75), Ransomware analysis=Product (0.65), Vuln management=Commodity (0.90), Threat intel=Product (0.70), Decentralized forensics=Genesis (0.20)
%% 6. Managed by: Security vendors (Microsoft, Google), internal SecOps, threat intel providers, specialized research teams

anchor threatProtection [0.95, 0.90]
anchor vulnRemediation [0.95, 0.75]
anchor intelDrivenDefense [0.95, 0.60]

component mdrMxdrService [0.75, 0.85]
component ransomwareAnalysis [0.65, 0.70]
component vulnManagement [0.90, 0.80]
component threatIntel [0.70, 0.65]
component decentralizedForensics [0.20, 0.50]

mdrMxdrService -> threatProtection
ransomwareAnalysis -> threatProtection
vulnManagement -> vulnRemediation
threatIntel -> intelDrivenDefense
decentralizedForensics -> ransomwareAnalysis
threatIntel -> mdrMxdrService
ransomwareAnalysis -> mdrMxdrService

evolve mdrMxdrService 0.80
evolve ransomwareAnalysis 0.75
evolve vulnManagement 0.95
evolve threatIntel 0.80
evolve decentralizedForensics 0.40

AI

SemiAnalysis

• Ultra-High Interactivity on NVIDIA GPUs? - TileRT InferenceX

  ONE SENTENCE SUMMARY:

  SemiAnalysis introduces TileRT InferenceX, a novel NVIDIA GPU technology enabling ultra-high interactivity for real-time inference workloads.

  MAIN POINTS:

  1. TileRT InferenceX targets ultra-low latency inference on NVIDIA GPUs.
  2. The technology focuses on maximizing interactivity for real-time AI applications.
  3. It addresses challenges in traditional inference serving pipelines.
  4. The approach likely involves novel GPU kernel scheduling techniques.
  5. It aims to reduce overhead in model execution on NVIDIA hardware.
  6. The system is designed for high-throughput, low-latency scenarios.
  7. It may leverage advanced CUDA features for performance gains.
  8. The technology could benefit interactive AI services like chatbots.
  9. It represents a shift toward more responsive AI infrastructure.
  10. The article is authored by Dylan Patel of SemiAnalysis.

  TAKEAWAYS:

  1. TileRT InferenceX promises significant latency reductions for NVIDIA GPUs.
  2. Real-time AI applications will benefit from improved interactivity.
  3. The technology showcases innovation in GPU inference optimization.
  4. It highlights the growing importance of low-latency AI serving.
  5. SemiAnalysis continues to provide cutting-edge hardware analysis.

wardley-beta
%% 1. Users: AI developers, researchers, companies deploying real-time AI applications
%% 2. Needs: Ultra-low latency inference, high interactivity for real-time use cases
%% 3. Capabilities: GPU-optimized inference runtime, tile-based computation, kernel fusion, memory management
%% 4. Components: TileRT InferenceX, Tile-based Execution, NVIDIA GPUs, Inference Runtime, Kernel Fusion
%% 5. Maturity: TileRT InferenceX (Genesis), Tile-based Execution (Genesis), Kernel Fusion (Custom), Inference Runtime (Product), NVIDIA GPUs (Commodity)
%% 6. Managed by: TileRT developers (proprietary), NVIDIA (hardware), AI engineering teams (integration)

anchor ultraLowLatency [0.95, 0.90]
anchor realtimeInteractivity [0.90, 0.85]

component tileRTInferenceX [0.15, 0.60]
component tileBasedExecution [0.25, 0.50]
component kernelFusion [0.35, 0.45]
component inferenceRuntime [0.55, 0.55]
component nvidiaGPU [0.85, 0.30]

tileRTInferenceX -> ultraLowLatency
tileRTInferenceX -> realtimeInteractivity
tileBasedExecution -> tileRTInferenceX
kernelFusion -> tileRTInferenceX
inferenceRuntime -> tileRTInferenceX
nvidiaGPU -> inferenceRuntime
nvidiaGPU -> kernelFusion

evolve tileRTInferenceX 0.20
evolve tileBasedExecution 0.15
evolve kernelFusion 0.40
evolve inferenceRuntime 0.65
evolve nvidiaGPU 0.90

Programming

マリウス

• Teaching an Old Dog New Tricks: Forgejo + XMPP

  ONE SENTENCE SUMMARY:

  Forgejo can be bridged to XMPP via a custom SMTP-to-XMPP daemon called Switchyard, allowing users to register with JIDs instead of email addresses.

  MAIN POINTS:

  1. Forgejo lacks native XMPP support, so email integration is bridged instead.
  2. Switchyard is a daemon that accepts SMTP and delivers XMPP messages.
  3. Email and XMPP share the same address format, enabling direct mapping.
  4. Forgejo requires no patches; it is configured as an SMTP mailer endpoint.
  5. Switchyard handles IDNs by decoding punycode to native XMPP domains.
  6. The service works with any software that can use an SMTP server.
  7. Users should relabel “Email address” fields to “JID” in templates.
  8. The current downside is that email is replaced entirely by XMPP.
  9. Future plans include fallback to email when XMPP is unavailable.
  10. The implementation is pragmatic, not elegant, but functional and maintainable.

  TAKEAWAYS:

  1. Bridging existing protocols can achieve desired features without core modifications.
  2. SMTP-to-XMPP conversion leverages shared address formats for seamless integration.
  3. Pragmatic solutions often outweigh clean implementations for long-term maintenance.
  4. Custom daemons can extend software capabilities without upstream acceptance.
  5. IDN handling demonstrates attention to detail in protocol bridging.

Simon Willison’s Weblog

• Introducing Muse Glimmer

  ONE SENTENCE SUMMARY:

  Meta released Muse Glimmer, a 30B open-weights vision-language model under Apache 2.0, optimized for agentic task completion, reliable tool use, and multi-step reasoning.

  MAIN POINTS:

  1. Muse Glimmer is a 30B model under Apache 2.0 license.
  2. Optimized for end-to-end agentic task completion.
  3. Strong performance on DeepSearch QA, MCP-Atlas, τ-Bench, SWE-Bench.
  4. Handles wide range of function calls with precise schemas.
  5. Chains reasoning over long horizons with coherent plans.
  6. Available in 18.16 GB version via LM Studio.
  7. Tested with llm-coding-agent plugin on Datasette codebase.
  8. Vision model successfully described a pelican photograph in detail.
  9. Runs well on machines with 32 GB RAM or more.
  10. Requires patch for compatibility with LLM 0.32.

  TAKEAWAYS:

  1. Apache 2.0 license is a significant improvement over Llama licenses.
  2. 30B size balances capability with local hardware requirements.
  3. Strong benchmark results suggest real-world agentic coding utility.
  4. Vision capabilities add versatility beyond text-only models.
  5. Practical testing shows seamless integration with existing tools.

wardley-beta
%% 1. Users: Developers, DevOps engineers, technical decision-makers reading the blog
%% 2. Needs: Discover new dev tools; Modernize legacy workflows; Evaluate integration patterns
%% 3. Capabilities: Content curation; Technical deep-dives; Tool comparison; Integration guidance
%% 4. Components: Forgejo, XMPP, Forgejo-XMPP integration, Muse Glimmer, AI-assisted dev tooling, Workflow automation
%% 5. Maturity: Forgejo (Product), XMPP (Commodity), Forgejo-XMPP integration (Custom), Muse Glimmer (Genesis), AI-assisted dev tooling (Custom), Workflow automation (Product)
%% 6. Management: Blog author curates; Community maintains Forgejo/XMPP; Simon Willison builds Muse Glimmer; Industry drives AI tooling

anchor discoverTools [0.95, 0.90]
anchor modernizeWorkflow [0.90, 0.85]

component forgejo [0.85, 0.40]
component xmpp [0.92, 0.30]
component forgejoXmpp [0.40, 0.55]
component museGlimmer [0.18, 0.70]
component aiDevTooling [0.35, 0.60]
component workflowAuto [0.60, 0.50]

forgejoXmpp -> modernizeWorkflow
museGlimmer -> discoverTools
aiDevTooling -> museGlimmer
forgejo -> forgejoXmpp
xmpp -> forgejoXmpp
workflowAuto -> forgejoXmpp
workflowAuto -> aiDevTooling
workflowAuto -> modernizeWorkflow
aiDevTooling -> discoverTools

evolve forgejoXmpp 0.55
evolve museGlimmer 0.15
evolve aiDevTooling 0.45