Daily Reading for 2026-09-26

Storm Threat Actor Campaigns

Two Microsoft threat-intelligence reports show how named “Storm-” actors industrialise post-compromise operations. Storm-3168 abused two compromised Azure service principals to enumerate and then destroy storage accounts, databases, Key Vaults, and backup/recovery locks while harvesting access keys — an early, AI-orchestrated “agentic ransomware” case. Storm-2570 is a cross-ecosystem ransomware affiliate that reuses remote-management tooling, credential dumpers, and cloud exfiltration utilities regardless of which payload (Qilin, DragonForce, Anubis, or BERT) it finally deploys. Together they show that workload identity, recovery infrastructure, and credential hygiene — not the final ransomware brand — are the decisive control points for defenders.

Watch for:

• Reuse of legitimate RMM and tunnelling tools (MeshAgent, Atera, Cloudflared) as pre-ransomware access.
• Public credential exposure in GitHub issues and edit history treated as live secrets.
• Backup/recovery lock tampering and storage-key harvesting as ransomware precursors.

Wardley signals:

• Components: Azure service principals; Azure Storage, SQL, Key Vault, and Backup/Site Recovery locks; RMM platforms (Atera, MeshAgent, ScreenConnect, Splashtop, NinjaRMM); credential dumpers (Mimikatz, LaZagne, pypykatz, ntdsutil); exfiltration tools (s5cmd, Rclone); tunnelling (ngrok, Cloudflared); Microsoft Defender for Cloud/XDR; Project Perception and MDASH agentic defences.

• Evolution stage: RMM and cloud object storage are Commodity (utility) — widely available, interchangeable, and abused precisely because they blend in; credential-dumping tools are late Product/Commodity; agentic defensive response (Project Perception/MDASH) is Genesis/Custom (novel, poorly understood); Azure resource locks are Product trending to Commodity.

• Doctrine hits/misses: “Know your users” / “Focus on user needs” (defenders must map identity and recovery dependencies); “Use appropriate tools” / “Use standards” (least privilege, FIDO2, OIDC); misses on “Manage inertia” (long-lived secrets, mutable tags persist) and “Bias towards data” (credential exposure ignored).

• Climatic patterns: “Success breeds inertia” (legacy PATs and static keys); “Everything evolves through supply and demand competition”; “Commoditisation <> Centralisation” (cloud IAM); “Competitors actions will change the game” (affiliates shift RaaS brands).

• Diffusion markers: Cross-ecosystem ransomware affiliates standardising TTPs; Microsoft publishing repeatable hunting queries; AI-orchestrated attack tradecraft spreading from one documented case into a recognised pattern.

• Storm-3168: Agentic-driven cloud attacks using compromised service principals

• 🚩 Storm-2570 Uses Consistent RMM, Credential Theft, and Cloud Exfiltration Tradecraft Across Multiple Ransomware Operations

wardley-beta
%% 1. Users: SOC analysts and incident responders
%% 2. Needs: detect and disrupt cloud and ransomware intrusions, protect identities and recovery paths
%% 3. Capabilities: cloud-identity monitoring, credential protection, recovery hardening, threat detection
%% 4. Components: Storm tradecraft, Azure service principals, RMM tooling, credential theft tools, cloud exfiltration tools, recovery protection, XDR detections
%% 5. Maturity: RMM tooling (Commodity), cloud exfiltration (Commodity), Azure service principals (Product), credential theft (Product), recovery protection (Product), XDR detections (Product), Storm tradecraft (Custom)
%% 6. Managed by: Microsoft-tracked threat actors across RaaS ecosystems; Microsoft Defender/XDR and internal security teams on the defence

anchor socAnalyst [0.95, 0.90]
anchor incidentResponder [0.86, 0.80]
component stormTradecraft [0.30, 0.80]
component cloudIdentity [0.55, 0.70]
component rmmTooling [0.85, 0.55]
component credentialTheft [0.58, 0.45]
component exfiltrationTools [0.82, 0.40]
component recoveryProtection [0.62, 0.60]
component xdrDetections [0.60, 0.68]

cloudIdentity -> stormTradecraft
rmmTooling -> stormTradecraft
credentialTheft -> stormTradecraft
exfiltrationTools -> stormTradecraft
stormTradecraft -> xdrDetections
xdrDetections -> socAnalyst
recoveryProtection -> xdrDetections
recoveryProtection -> socAnalyst
stormTradecraft -> incidentResponder

evolve stormTradecraft 0.42
evolve cloudIdentity 0.68

Agentic AI Systems

Two commentaries converge on the same theme: agentic AI is arriving faster than users understand it. John Gruber warns that Meta’s Muse — a consumer-accessible agent with its own persistent Linux VM in Meta’s cloud — is packaged as a cute mascot while carrying power comparable to a tool that can hurt you. Simon Willison adds that coding agents, for all they enable, make software engineering harder: their full value appears only with extraordinary discipline and knowledge. Read together, they argue that the binding constraint on agentic AI is not raw capability but judgement, context, and guardrails.

Watch for:

• Consumer agentic assistants (Meta Muse) running persistent VMs with real system access.
• Whether “cute” packaging understates security and autonomy risks.
• The discipline and verification practices needed to use coding agents safely.

Wardley signals:

• Components: agentic AI assistants (Meta Muse); persistent cloud Linux VMs; coding agents; prompt/context-engineering practices; guardrails and sandboxing; human-in-the-loop review.

• Evolution stage: agentic assistants are Genesis/Custom (novel, rapidly changing, poorly understood); coding agents are Custom trending to Product (rapidly diffusing); sandboxing and guardrails are Custom (emerging practice); cloud VM infrastructure is Commodity.

• Doctrine hits/misses: “Focus on user needs” (agents packaged for ease of use); “Use appropriate methods” (discipline required); “Challenge assumptions” / “Understand what is being considered” (users underestimate risk); misses where marketing obscures capability (“A bias towards open” absent).

• Climatic patterns: “Everything evolves through supply and demand competition”; “Increased stability of lower order systems increases agility & speed of re-combination” (commodity cloud VMs enable agents); “Not everything is random” (capability is predictable, misuse is not).

• Diffusion markers: Consumer-accessible agent products with mascots; rapid spread of coding-agent practices; emerging norms around human review and sandboxing.

• Quoting John Gruber

• Note on 24th September 2026

wardley-beta
%% 1. Users: developers and consumers
%% 2. Needs: use agentic AI safely, understand the risks, keep control of their machines
%% 3. Capabilities: agent orchestration, sandboxing, context management, human oversight
%% 4. Components: Meta Muse, persistent cloud VMs, coding agents, guardrails, human review, context engineering
%% 5. Maturity: persistent cloud VMs (Commodity), coding agents (Product), context engineering (Custom), human review (Custom), guardrails (Custom), Meta Muse (Custom)
%% 6. Managed by: platform vendors (Meta) shipping consumer agents; developers and users supplying discipline and oversight

anchor developer [0.95, 0.90]
anchor consumer [0.85, 0.80]
component metaMuse [0.28, 0.85]
component persistentVms [0.82, 0.50]
component codingAgents [0.55, 0.75]
component guardrails [0.22, 0.58]
component humanReview [0.25, 0.45]
component contextEngineering [0.20, 0.62]

persistentVms -> metaMuse
contextEngineering -> codingAgents
guardrails -> codingAgents
guardrails -> humanReview
codingAgents -> developer
humanReview -> developer
metaMuse -> consumer
metaMuse -> developer

evolve metaMuse 0.40
evolve codingAgents 0.62

CI/CD Supply Chain Hardening

Mandiant’s blueprint argues that supply-chain defence can no longer treat pipeline stages as independent domains, because attackers now compromise trusted scanners, AI developer tools, and IDEs to inherit their privileges. The report catalogs concrete escalation paths — GitHub Actions cache poisoning, OIDC token extraction, repointed mutable action tags, and published packages carrying legitimate provenance — and answers with defence-in-depth across five pillars: endpoints, repositories, artifacts, CI/CD, and deployment. The recurring themes are short-lived, identity-bound credentials; immutable digest pinning; isolated ephemeral runners; and continuous cryptographic verification rather than point-in-time scanning.

Watch for:

• Cache poisoning and mutable action/tag repointing inside CI/CD workflows.
• Compromise of AI coding agents and MCP packages as a new supply-chain entry point.
• Provenance signing (SLSA, transparency logs) becoming table stakes rather than optional.

Wardley signals:

• Components: CI/CD pipelines (GitHub Actions); OIDC federated tokens; SBOM and SLSA provenance; artifact registries and internal proxies; secret scanners; SAST/SCA/DAST/CSPM; ephemeral runners; dependency cooldowns; MCP packages and AI coding agents.

• Evolution stage: CI/CD platforms, containers, and SBOM/SPDX are Product trending to Commodity; OIDC federated identity is Product (standardising); MCP and AI-agent security is Genesis/Custom (unmodelled); provenance attestation is Custom moving to Product.

• Doctrine hits/misses: “Use standards” (SLSA, CycloneDX/SPDX, exact SemVer); “Focus on the outcome” (defence-in-depth over stage isolation); “Know your users” / “Focus on user needs” (developer workflow); “Exploit the landscape” / “There is no core” (treat every dependency as replaceable); misses where organisations keep mutable tags and long-lived tokens (“Manage inertia”).

• Climatic patterns: “Everything evolves through supply and demand competition”; “Efficiency enables innovation (Componentisation effect)”; “Higher order systems create new sources of value”; “Capital flows to new areas of value” (AI dev tooling); “Competitors actions will change the game”.

• Diffusion markers: Open standards (SLSA, SBOM) spreading; platform defaults (npm minimumReleaseAge, secure pip indexing) standardising; ecosystem-wide cooldown and quarantine practices; copy-cat campaigns targeting developer tooling.

• Mandiant Urges CI/CD Hardening Against Developer Compromise, Cache Poisoning, and Supply Chain Manipulation

wardley-beta
%% 1. Users: platform/DevSecOps engineers and software architects
%% 2. Needs: secure the SDLC, stop pipeline compromise, verify what ships
%% 3. Capabilities: pipeline hardening, identity-bound credentials, provenance verification, dependency gating
%% 4. Components: CI/CD pipelines, OIDC federation, provenance attestation, artifact registry, runner isolation, secret scanning, MCP/agent security
%% 5. Maturity: artifact registry (Product), secret scanning (Product), runner isolation (Product), CI/CD pipelines (Product), OIDC federation (Product), provenance attestation (Custom), MCP/agent security (Genesis)
%% 6. Managed by: platform engineering and security teams, with platform vendors (GitHub, Google) and open standards (SLSA) shaping practice

anchor platformEngineer [0.95, 0.90]
anchor securityArchitect [0.85, 0.80]
component ciCdPipelines [0.62, 0.72]
component oidcFederation [0.58, 0.60]
component provenanceAttestation [0.35, 0.55]
component artifactRegistry [0.66, 0.48]
component runnerIsolation [0.60, 0.42]
component secretScanning [0.64, 0.58]
component mcpAgentSecurity [0.12, 0.68]

oidcFederation -> ciCdPipelines
secretScanning -> ciCdPipelines
runnerIsolation -> ciCdPipelines
provenanceAttestation -> artifactRegistry
artifactRegistry -> ciCdPipelines
mcpAgentSecurity -> secretScanning
ciCdPipelines -> platformEngineer
provenanceAttestation -> securityArchitect
artifactRegistry -> securityArchitect
ciCdPipelines -> securityArchitect

evolve provenanceAttestation 0.52
evolve mcpAgentSecurity 0.30

Psychedelic Stealer ClickFix Campaign

Arctic Wolf Labs documents a ClickFix campaign that compromises legitimate Ukrainian business websites and injects iframes serving a fake, Ukrainian-language Cloudflare verification page. Visitors who click are told to paste an msiexec command into Windows Run, which installs an MSI that delivers “Psychedelic Stealer” — an infostealer harvesting browser passwords, session tokens, and cryptocurrency wallets before establishing scheduled-task persistence and polling C2 for further tasks. An exposed lure-management panel showed 557 interactions across 32 countries, most in Ukraine. The case shows how trusted-site delivery plus user-executed commands can bypass controls tuned to encoded PowerShell.

Watch for:

• ClickFix lures that use msiexec/MSI rather than encoded PowerShell to evade detection.
• Compromised legitimate sites (not look-alike domains) as the delivery surface.
• Infostealers combining credential, token, and wallet theft with remote tasking.

Wardley signals:

• Components: ClickFix social-engineering lures; injected iframes on compromised sites; fake CAPTCHA pages; Windows Installer (msiexec); MSI delivery packages; the Psychedelic Stealer implant; scheduled-task persistence; the C2 panel; TDS/lure-management panels; cryptocurrency wallet extensions.

• Evolution stage: infostealers and phishing lures are Commodity (cheap, reusable, productised); ClickFix is Product (widely copied technique); TDS/lure panels are Product; wallet-stealer target lists are Commodity; the specific Psychedelic Stealer is Custom (newly observed, un-attributed).

• Doctrine hits/misses: “Know the details” (defenders must distinguish lure views from confirmed compromise); “Bias towards data” (telemetry gaps around execution); misses on “Understand what is being considered” / “Challenge assumptions” (dashboard labels “complete” as execution).

• Climatic patterns: “Competitors actions will change the game” (technique shifts to evade detection); “Evolution consists of multiple waves of diffusion with many chasms”; “Not everything is random” (a predictable, commodity playbook).

• Diffusion markers: ClickFix copy-cat campaigns across regions; centralised reusable lure panels with “Global” command configuration; Ukrainian-language targeting observed across 32 countries.

• 🚩 Psychedelic Stealer Delivered Through ClickFix Lures on Compromised Ukrainian Business Websites

wardley-beta
%% 1. Users: malware analysts and incident responders
%% 2. Needs: detect ClickFix lures, stop credential and wallet theft, contain the implant
%% 3. Capabilities: lure detection, delivery-chain analysis, credential/wallet protection, C2 tracking
%% 4. Components: compromised sites, ClickFix lure, MSI delivery, Psychedelic Stealer, C2 panel, browser credentials, wallet extensions
%% 5. Maturity: browser credentials (Commodity), wallet extensions (Commodity), compromised sites (Commodity), MSI delivery (Product), ClickFix lure (Product), Psychedelic Stealer (Custom), C2 panel (Custom)
%% 6. Managed by: a financially motivated operator running the lure panel and implant C2; Arctic Wolf and incident responders on the defence

anchor malwareAnalyst [0.95, 0.90]
anchor incidentResponder [0.85, 0.80]
component compromisedSites [0.78, 0.45]
component clickFixLure [0.58, 0.62]
component msiDelivery [0.55, 0.50]
component psychedelicStealer [0.30, 0.72]
component c2Panel [0.33, 0.40]
component walletTargets [0.85, 0.32]
component browserCredentials [0.88, 0.35]

compromisedSites -> clickFixLure
clickFixLure -> msiDelivery
msiDelivery -> psychedelicStealer
c2Panel -> psychedelicStealer
walletTargets -> psychedelicStealer
browserCredentials -> psychedelicStealer
psychedelicStealer -> malwareAnalyst
psychedelicStealer -> incidentResponder
clickFixLure -> incidentResponder

evolve psychedelicStealer 0.45
evolve clickFixLure 0.68

Chinese AI Infrastructure Boom

SemiAnalysis introduces a China Datacenter Model to quantify the country’s AI infrastructure build-out. Although the full body was unavailable (subscription-gated), the framing matters: China’s datacenter expansion is now large and measurable enough to warrant its own supply-and-demand model tracking compute capacity, power, chips, and deployment timelines. For a technical reader this is a clear signal that AI compute has become a national-scale infrastructure race, with direct implications for the semiconductor supply chain, energy demand, and the cost and availability of model training outside the US ecosystem.

Watch for:

• China’s AI datacenter capacity and power-demand projections.
• Domestic accelerator supply (Huawei Ascend and alternatives) versus export controls.
• How Chinese compute build-out reshapes global model-training economics.

Wardley signals:

• Components: AI datacenters; GPU/accelerator supply; power and cooling infrastructure; datacenter supply-demand models; the semiconductor supply chain; foundation-model training compute.

• Evolution stage: AI datacenters and power/cooling are Product trending to Commodity (industrialising, capital-intensive); frontier training compute is Custom (differentiating, capacity-constrained); supply-chain models are Custom (an emerging analytical practice).

• Doctrine hits/misses: “Know the details” / “Bias towards data” (a model exists to quantify the build-out); “Exploit the landscape” (state-directed industrial policy); “Focus on the outcome”.

• Climatic patterns: “Capital flows to new areas of value”; “Evolution to higher order systems results in increasing local order and energy consumption”; “Everything evolves through supply and demand competition”; “A ‘war’ (point of industrialisation) causes organisations to evolve”.

• Diffusion markers: National-scale build-out; standardising datacenter designs; maturing domestic accelerator ecosystems; analyst coverage and modelling of the sector.

• The Chinese AI Infrastructure Boom: Introducing the SemiAnalysis China Datacenter Model

wardley-beta
%% 1. Users: AI-infrastructure analysts and datacenter planners
%% 2. Needs: forecast compute capacity, plan power and chips, understand supply-demand
%% 3. Capabilities: capacity modelling, accelerator sourcing, power/cooling provisioning, supply-chain visibility
%% 4. Components: China datacenters, domestic accelerators, power and cooling, training compute, supply-chain model, semiconductor supply
%% 5. Maturity: power and cooling (Product), semiconductor supply (Product), China datacenters (Product), domestic accelerators (Custom), training compute (Custom), supply-chain model (Genesis)
%% 6. Managed by: Chinese hyperscalers and state industrial policy; SemiAnalysis and investors modelling the build-out

anchor infraAnalyst [0.95, 0.90]
anchor datacenterPlanner [0.85, 0.80]
component chinaDatacenters [0.60, 0.78]
component domesticAccelerators [0.30, 0.68]
component powerCooling [0.62, 0.55]
component trainingCompute [0.28, 0.82]
component supplyChainModel [0.10, 0.60]
component semiconductorSupply [0.58, 0.45]

powerCooling -> chinaDatacenters
domesticAccelerators -> chinaDatacenters
semiconductorSupply -> domesticAccelerators
trainingCompute -> chinaDatacenters
chinaDatacenters -> infraAnalyst
chinaDatacenters -> datacenterPlanner
supplyChainModel -> infraAnalyst
supplyChainModel -> datacenterPlanner
trainingCompute -> infraAnalyst

evolve domesticAccelerators 0.42
evolve supplyChainModel 0.22

Bird Photography

A personal field note from Simon Willison’s weblog: an evening sighting of a Northern Gannet, Great Blue Heron, and California Brown Pelican in the Monterey Bay National Marine Sanctuary, captured with a new 200-800mm Canon EF lens — his best photo of “Morris” yet. It is a small, concrete record of birding practice: knowing where birds reliably gather (under a harbour sign), upgrading optical reach, and logging species and time. Its value to a technical reader is as a reminder that disciplined observation and the right tooling apply outside software too.

Watch for:

• Local wildlife sightings and repeatable perching spots.
• Long-telephoto reach (200-800mm) for bird photography.
• Structured, eBird-style sighting logs.

Wardley signals:

• Components: long-telephoto lenses (Canon EF 200-800mm); camera bodies; birding observation practice; species-sighting logs (eBird-style); the Monterey Bay sanctuary.

• Evolution stage: cameras and telephoto lenses are Commodity (mature, widely available); birding field guides and sighting databases are Product trending to Commodity; the specific lens-and-technique combination is Product.

• Doctrine hits/misses: “Know the details” / “Bias towards data” (recording species, time, place); “Use appropriate tools” (right lens for reach); none clearly apply beyond these.

• Climatic patterns: none identified.

• Diffusion markers: Citizen-science sighting platforms and shared field notes; standardised species taxonomies; hobbyist gear ecosystems.

• Northern Gannet, Great Blue Heron, California Brown Pelican

wardley-beta
%% 1. Users: bird photographers and field birders
%% 2. Needs: capture clear bird photos, identify species, log repeatable sightings
%% 3. Capabilities: optical reach, field observation, species identification, structured logging
%% 4. Components: telephoto lens, camera body, observation practice, sighting logs, sanctuary habitat
%% 5. Maturity: camera body (Commodity), telephoto lens (Commodity), sanctuary habitat (Commodity), sighting logs (Product), observation practice (Custom)
%% 6. Managed by: individual birders, with citizen-science platforms (eBird-style) aggregating sightings

anchor birdPhotographer [0.95, 0.90]
component telephotoLens [0.80, 0.70]
component cameraBody [0.82, 0.60]
component observationPractice [0.30, 0.65]
component sightingLogs [0.62, 0.45]
component sanctuaryHabitat [0.85, 0.50]

cameraBody -> telephotoLens
telephotoLens -> birdPhotographer
observationPractice -> birdPhotographer
sightingLogs -> birdPhotographer
sanctuaryHabitat -> observationPractice

evolve observationPractice 0.45
evolve sightingLogs 0.70

Local LLM Inference

Simon Willison walks through running Prism’s Ternary Bonsai 2 27B — a quantised model claiming near-lossless quality in a roughly 9x smaller footprint — locally via a forked llama.cpp. The recipe fetches the Prism macOS runtime and a ~5.95 GB ternary GGUF, starts llama-server, and queries it through an OpenAI-compatible API. Performance was about 20-44 tokens per second on an M5 Pro, with a Metal tensor-API warning suggesting the GPU path was not fully engaged. It is a practical snapshot of how aggressively local inference is compressing model size while staying usable on consumer hardware.

Watch for:

• Ternary/low-bit quantisation closing the quality gap at much smaller sizes.
• Forked runtimes (Prism llama.cpp) and Metal/GPU support maturity.
• Local inference throughput on Apple Silicon hardware.

Wardley signals:

• Components: ternary/low-bit quantised GGUF models (Bonsai 2 27B); llama.cpp and Prism’s fork; llama-server; OpenAI-compatible local APIs; the Apple Silicon Metal backend; consumer GPUs.

• Evolution stage: llama.cpp and GGUF are Product trending to Commodity (a widely adopted local-runtime standard); quantisation tooling is Product; ternary quantisation is Custom (emerging, unproven); local inference servers are Commodity.

• Doctrine hits/misses: “A bias towards open” (open weights and runtimes); “Use appropriate tools” / “Think fast, inexpensive, restrained and elegant” (small local models); “Bias towards action” (a practical recipe); misses on “Know the details” (unexplained Metal warning and variable throughput).

• Climatic patterns: “Efficiency enables innovation (Componentisation effect)”; “Everything evolves through supply and demand competition”; “Shifts from product to utility tend to demonstrate a punctuated equilibrium” (local inference commoditising).

• Diffusion markers: Open-weight model releases on Hugging Face; shared reproducible run recipes; open-source runtime forks; benchmark chatter around tokens per second.

• Bonsai 2 27B: Near-Lossless Compression in a 9x Smaller Footprint

wardley-beta
%% 1. Users: local-AI hobbyists and ML engineers
%% 2. Needs: run capable models locally, control cost and privacy, get usable throughput
%% 3. Capabilities: quantised model execution, local runtime, GPU acceleration, API-compatible serving
%% 4. Components: Ternary Bonsai model, llama.cpp, Prism fork, llama-server, Apple Metal, OpenAI-compatible API
%% 5. Maturity: OpenAI-compatible API (Commodity), llama-server (Commodity), llama.cpp (Product), Apple Metal (Product), Prism fork (Custom), Ternary Bonsai model (Custom)
%% 6. Managed by: open-source maintainers (llama.cpp, Prism) and model publishers; hobbyists running it on consumer hardware

anchor localAiHobbyist [0.95, 0.90]
anchor mlEngineer [0.85, 0.80]
component bonsaiModel [0.28, 0.78]
component llamaCpp [0.62, 0.60]
component prismsFork [0.30, 0.50]
component llamaServer [0.80, 0.55]
component appleMetal [0.58, 0.35]
component openAiApi [0.88, 0.65]

bonsaiModel -> llamaCpp
prismsFork -> llamaCpp
llamaCpp -> llamaServer
appleMetal -> llamaServer
llamaServer -> openAiApi
openAiApi -> localAiHobbyist
llamaServer -> mlEngineer
llamaCpp -> mlEngineer

evolve bonsaiModel 0.40
evolve prismsFork 0.42