Daily Reading for 2026-09-29

Post-Compromise Threat Operations

Two Microsoft threat-intelligence reports show what attackers do after they already have a foothold. NeedyMantis is a modular malware family — DLL sideloading, custom encrypted archives, staged loaders, WebSocket C2 — that Storm-3069 deploys selectively to keep long-term access. Storm-3168 (JADEPUFFER) instead abuses compromised Azure service principals to enumerate and destroy storage accounts, databases, Key Vaults, and recovery locks, then harvests access keys. Together they describe a post-compromise playbook that is increasingly automated and spans endpoints and cloud. The defensive throughline is the same: protect identities and secrets, keep independent recovery safeguards, and assume exposed credentials stay compromised until rotated.

Watch for:

• New NeedyMantis modules/loaders and whether operators beyond Storm-3069 adopt the framework.
• Azure service-principal secrets leaked in public repos or issue edit history, and whether they get rotated.
• Whether resource locks and backup/recovery protections hold when an identity has broad administrative rights.

Wardley signals:

• Components: DLL sideloading; custom encrypted file archives; staged loaders; WebSocket command-and-control; Azure service principals (workload identities); Azure RBAC roles; Azure Storage Accounts, SQL Databases, Key Vaults, Function Apps, and App Services; Azure Resource Locks; Azure Backup and Site Recovery; Microsoft Defender for Cloud; Project Perception/MDASH.

• Evolution stage: DLL sideloading — Commodity (a ubiquitous, well-documented technique). Custom encrypted archive/loader formats — Custom (bespoke per sample). WebSocket C2 — Product (mature protocols and tooling). Azure service principals and RBAC — Product (standard Entra features). Resource locks and backup protections — Commodity (standard cloud controls). Agentic attack orchestration — Genesis (emerging, few documented cases).

• Doctrine: Hits — “Know the details” (endpoint and cloud telemetry), “Manage failure” (backup/recovery as resilience), “Effectiveness over efficiency” (independent safeguards). Misses — “Manage inertia” (secrets left valid after public exposure) and “Listen to your ecosystem” (acting on shared IOCs).

• Climatic patterns: “Everything evolves through supply and demand competition”; “Change is not always linear (discontinuous & exponential change exists)” — agentic, automated attack chains; “Creative Destruction” — recovery infrastructure deliberately targeted; “Competitors actions will change the game.”

• Diffusion markers: reuse of commodity open-source tooling (Impacket, Neo-reGeorg, MeshAgent); copy-cat agentic ransomware after JADEPUFFER; standardised MITRE ATT&CK mapping; public IOC and threat-analytics sharing.

• NeedyMantis: Unpacking a post-compromise malware family used in targeted operations

• 🚩 Storm-3168 Uses Compromised Service Principals for Automated Azure Resource Destruction

wardley-beta
%% Q1 Users: enterprise security operations (defenders) and the targeted organisations.
%% Q2 Needs: detect and contain post-compromise activity; preserve and recover data.
%% Q3 Capabilities: endpoint telemetry/EDR, cloud identity monitoring, malware analysis, backup and recovery controls, threat intelligence.
%% Q4 Components: DLL-sideloaded loaders, custom encrypted archives/loaders, WebSocket C2, compromised cloud service principals, cloud recovery controls (locks/backup), Defender telemetry.
%% Q5 Maturity: DLL sideloading Commodity; custom archive/loader Custom; WebSocket C2 Product; service principals Product; recovery controls Commodity; Defender telemetry Product.
%% Q6 Managed by: attackers (malware/C2), the cloud platform (RBAC/locks), defenders (telemetry/detections).
anchor defenderNeed [0.94, 0.90]
anchor organizationRecoveryNeed [0.88, 0.74]
component defenderTelemetry [0.62, 0.70]
component cloudServicePrincipal [0.55, 0.55]
component websocketC2 [0.52, 0.45]
component loaderSideloading [0.80, 0.35]
component encryptedArchiveLoader [0.28, 0.42]
component cloudRecoveryControls [0.78, 0.32]
loaderSideloading -> defenderTelemetry
encryptedArchiveLoader -> loaderSideloading
websocketC2 -> defenderTelemetry
cloudServicePrincipal -> defenderTelemetry
defenderTelemetry -> defenderNeed
cloudRecoveryControls -> organizationRecoveryNeed
%% note: signals listed archives, loaders and C2 separately; merged archives+loaders into one Custom node and kept agentic orchestration as context, not a component.

Actively Exploited Enterprise Vulnerabilities

Two bulletins cover critical, actively exploited flaws in internet-facing enterprise software. Citrix NetScaler ADC and Gateway carry CVE-2026-88771/88772 — unauthenticated RCE rated 9.5 — with several more memory and request-smuggling issues; patches are out and exploitation is confirmed. Oracle PeopleSoft’s CVE-2026-35273 is being mass-exploited by UNC6240 (ShinyHunters), who bypassed string-matching WAF rules by URL-encoding one path character (/%50SEMHUB/) and dropped JSP web shells and the SIDEEYE backdoor. The shared lesson is blunt: perimeter rules and WAFs are not mitigations. Patch, remove or restrict the vulnerable endpoint, and rotate credentials after any suspected compromise.

Watch for:

• Percent-encoded or otherwise non-normalised path variants that slip past WAF/proxy rules.
• Unpatched NetScaler appliances and internet-exposed PeopleSoft PSEMHUB/EMHub endpoints.
• Post-exploitation web shells (x.jsp, u.jsp, tunnel.jsp) and unexpected MeshCentral agents.

Wardley signals:

• Components: Citrix NetScaler ADC/Gateway; Oracle PeopleSoft PSEMHUB; web application firewalls and reverse proxies; Java deserialisation; JSP web shells; the SIDEEYE backdoor (Ple64.exe); Neo-reGeorg tunnelling; MeshAgent/MeshCentral; vendor security patches and configuration preconditions.

• Evolution stage: NetScaler and PeopleSoft — Commodity (mature, widely deployed enterprise infrastructure). WAFs — Commodity/Product (standard but imperfect). Web-shell tooling — Commodity (copy-paste, widely reused). The bespoke exploit/loader chain — Custom (adapted per target). Vendor patches — Product (scheduled, standardised).

• Doctrine: Hits — “Know the details” (the bulletins enumerate configuration preconditions), “Use appropriate tools” (patch rather than block), “Effectiveness over efficiency.” Misses — “Manage inertia” (organisations that deployed WAF rules but never patched) and “Remove bias and duplication.”

• Climatic patterns: “Everything evolves through supply and demand competition”; “Success breeds inertia” — reliance on WAF rules delayed patching; “Competitors actions will change the game” — attackers adapted to published defensive guidance; “No choice over evolution.”

• Diffusion markers: mass exploitation spreading across higher education, healthcare, technology, government and more; standardised MITRE ATT&CK mappings; published IOCs and detection rules; copy-cat reuse of the percent-encoding bypass.

• NetScaler Zero-Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild

• 🚩 ShinyHunters Bypasses WAF Rules to Renew Mass Exploitation of Oracle PeopleSoft CVE-2026-35273

wardley-beta
%% Q1 Users: enterprise security/IT teams defending internet-facing systems, and the organisations whose data those systems hold.
%% Q2 Needs: prevent exploitation of exposed enterprise software; remediate quickly and protect data.
%% Q3 Capabilities: vulnerability management and patching, perimeter/WAF defence, exposure reduction, compromise detection, credential rotation.
%% Q4 Components: Citrix NetScaler ADC/Gateway, Oracle PeopleSoft PSEMHUB, WAF/reverse-proxy rules, vendor security patches, JSP web shells, the SIDEEYE backdoor.
%% Q5 Maturity: NetScaler and PeopleSoft Commodity; WAF rules Commodity/Product; vendor patches Product; web shells Commodity; SIDEEYE backdoor Custom.
%% Q6 Managed by: vendors (Citrix/Oracle) ship patches; enterprises deploy; attackers adapt exploits.
anchor enterpriseDefenderNeed [0.96, 0.92]
anchor dataProtectionNeed [0.70, 0.82]
component netScalerAppliance [0.88, 0.58]
component peopleSoftPsemhub [0.62, 0.66]
component wafPerimeterRules [0.78, 0.34]
component vendorSecurityPatches [0.44, 0.50]
component webShellTooling [0.90, 0.20]
component backdoorLoader [0.16, 0.34]
netScalerAppliance -> enterpriseDefenderNeed
wafPerimeterRules -> netScalerAppliance
vendorSecurityPatches -> netScalerAppliance
vendorSecurityPatches -> peopleSoftPsemhub
peopleSoftPsemhub -> enterpriseDefenderNeed
peopleSoftPsemhub -> dataProtectionNeed
webShellTooling -> peopleSoftPsemhub
backdoorLoader -> webShellTooling
%% note: signals named Neo-reGeorg and MeshCentral separately; consolidated attacker tooling into webShellTooling, with SIDEEYE as the Custom backdoorLoader node.

Agentic AI in Security Operations

Both pieces argue that agentic AI in security lives or dies on foundations, not model capability. SRA’s data-layer essay contends that AI triage agents fail when telemetry is siloed, un-normalised, or missing identity resolution, and that a data-lake-centric architecture — with an ontology and semantic layer — is what makes agent reasoning reliable; MCP-only stacks and federated search over unequal sources inherit every gap. The OpenAI Agent Security quote supplies the cultural counterpart: sudden jumps in AI capability are a resilience problem, and organisations need the posture, incident response, and people to absorb surprises. Read together, technical data readiness and organisational readiness are the two halves of the same agentic-security prerequisite.

Watch for:

• Whether agentic SOC platforms ship a governed semantic layer or lean on MCP alone.
• Identity-resolution and timestamp-normalisation gaps that silently degrade agent output.
• Incident-response and communications readiness for abrupt AI capability jumps.

Wardley signals:

• Components: security data lake; SIEM; EDR; Model Context Protocol (MCP); ontology; semantic layer; federated search; identity resolution; normalisation and enrichment pipelines; agentic SOC platforms (e.g. SCALR AI); AI triage agents.

• Evolution stage: SIEM and EDR — Product/Commodity (mature, consolidated). Data lake — Product (common design, competing implementations). MCP — Genesis/Custom (emerging standard). Ontology and semantic layer — Custom/Genesis (still forming). Agentic SOC — Genesis (early, few proven deployments).

• Doctrine: Hits — “Know your users”/“Focus on user needs”, “Remove bias and duplication” (one governed vocabulary), “Use standards”, “Bias towards data”, “Design for constant evolution.” Misses — “Manage inertia” (organisations buying the AI platform before the data layer) and “Listen to your ecosystem.”

• Climatic patterns: “Higher order systems create new sources of value”; “Components can co-evolve (practice with activity)”; “Efficiency enables innovation (Componentisation effect)”; “No single method fits all”; “Everything evolves through supply and demand competition.”

• Diffusion markers: Gartner’s prediction that 60% of MCP-only agentic analytics projects fail without a semantic layer; vendor movement toward ontology/semantic layers; standardised schemas; agentic-readiness methodologies emerging.

• The Data Layer Is the Foundation, Not an Afterthought, for Agentic SOC

• Quoting @joedaroo

wardley-beta
%% Q1 Users: SOC analysts and security leaders (defenders), plus the data-engineering teams supporting them.
%% Q2 Needs: reliable agentic triage and investigation; resilience to sudden AI capability jumps.
%% Q3 Capabilities: normalised security telemetry, identity resolution, a governed semantic layer, an agentic SOC platform, incident-response readiness.
%% Q4 Components: security data lake, SIEM/EDR, Model Context Protocol (MCP), ontology/semantic layer, agentic SOC platform, incident-response readiness.
%% Q5 Maturity: SIEM/EDR Product/Commodity; data lake Product; MCP Genesis/Custom; ontology/semantic layer Custom/Genesis; agentic SOC Genesis; incident-response readiness Product.
%% Q6 Managed by: security platform vendors, in-house data engineering, standards bodies (MCP).
anchor socAnalystNeed [0.94, 0.90]
anchor securityLeaderNeed [0.88, 0.76]
component securityDataLake [0.55, 0.55]
component siemEdr [0.80, 0.60]
component modelContextProtocol [0.25, 0.40]
component semanticLayer [0.30, 0.52]
component agenticSocPlatform [0.22, 0.72]
component incidentResponseReadiness [0.62, 0.68]
siemEdr -> securityDataLake
securityDataLake -> agenticSocPlatform
semanticLayer -> agenticSocPlatform
modelContextProtocol -> agenticSocPlatform
agenticSocPlatform -> socAnalystNeed
agenticSocPlatform -> securityLeaderNeed
incidentResponseReadiness -> securityLeaderNeed

GLM-5.3 Sparse Attention and Memory

SemiAnalysis dissects GLM-5.3 and asks whether sparse attention actually shrinks memory demand. It does not: top-k selection still needs the full context resident, so sparse attention cuts SDPA bandwidth but not capacity. The article maps the workarounds — KV compression, DeepSeek Sparse Attention with a lightning indexer, IndexShare to cut indexer cost, and SGLang’s HiSparse/HiCache offloading KV cache from HBM to host DRAM — then benchmarks serving economics across GB300, GB200, MI355X and TileRT. It also infers hardware intent from GLM-5’s head count, hinting at Moore Threads rather than H800. The takeaway for infrastructure watchers: memory TAM depends on systems design, not on the attention-sparsity headline alone.

Watch for:

• Whether HiSparse-style KV offload keeps total memory capacity demand flat as context grows.
• Hardware-specific optimisation signals (GLM-5’s 64 heads pointing at Moore Threads MTT S4000).
• Serving-cost curves across GB300/GB200/MI355X and TileRT at high interactivity.

Wardley signals:

• Components: DeepSeek Sparse Attention (DSA); lightning indexer; Multi-Latent Attention (MLA); IndexShare/IndexCache; HiSparse; HiCache; SGLang; vLLM; ATOM; TileRT; Dynamo-TRT-LLM; GB300/GB200; AMD MI355X; Moore Threads MTT S4000; HBM/DRAM/NAND; KV cache.

• Evolution stage: HBM and DRAM — Product/Commodity (standardised memory tiers). Inference serving engines (vLLM, SGLang) — Product (competitive, converging). Sparse attention designs — Custom (several competing architectures). KV-cache offloading (HiSparse) — Genesis (novel). MoE models — Product.

• Doctrine: Hits — “Think fast, inexpensive, restrained and elegant”, “Use appropriate tools”, “Focus on the outcome”, “Bias towards data”, “Know the details.” Misses — “Manage inertia” (incumbents optimising for older hardware assumptions).

• Climatic patterns: “Efficiency does not mean a reduced spend (Jevon’s Paradox)” — cheaper inference drives more usage and memory demand; “Characteristics change as components evolve”; “Efficiency enables innovation (Componentisation effect)”; “Higher order systems create new sources of value”; “Commoditisation <> Centralisation.”

• Diffusion markers: open GLM-5 tech reports; day-0 hardware support (GLM-5.3-Flash); shared benchmark boards (InferenceX/AgentX); cross-vendor adoption of DSA and MLA; standardised serving-engine comparisons.

• How GLM5.3 Sparse Attention Affects HBM Memory Usage

wardley-beta
%% Q1 Users: AI inference/platform operators and the model labs designing long-context models.
%% Q2 Needs: serve long-context models cheaply at high interactivity; forecast memory capacity demand.
%% Q3 Capabilities: efficient attention, KV-cache management, memory tiering (HBM/DRAM), serving engines, appropriate accelerators.
%% Q4 Components: DeepSeek Sparse Attention, lightning indexer, IndexShare, HiSparse/HiCache KV offload, serving engines (SGLang/vLLM/ATOM/TileRT), HBM+host DRAM, inference GPUs (GB300/MI355X).
%% Q5 Maturity: HBM/DRAM Product/Commodity; serving engines Product; sparse attention Custom; lightning indexer and IndexShare Custom/Genesis; HiSparse KV offload Genesis; GPUs Product/Commodity.
%% Q6 Managed by: model labs (Z.ai/DeepSeek), serving-engine communities, and hardware vendors.
anchor inferenceOperatorNeed [0.94, 0.90]
anchor modelLabNeed [0.86, 0.80]
component inferenceGpu [0.82, 0.60]
component servingEngine [0.58, 0.50]
component sparseAttention [0.28, 0.55]
component lightningIndexer [0.22, 0.42]
component indexShare [0.18, 0.36]
component kvOffloading [0.16, 0.48]
component memoryTierHbmDram [0.86, 0.40]
sparseAttention -> servingEngine
sparseAttention -> modelLabNeed
lightningIndexer -> sparseAttention
indexShare -> lightningIndexer
kvOffloading -> servingEngine
servingEngine -> inferenceOperatorNeed
memoryTierHbmDram -> servingEngine
memoryTierHbmDram -> kvOffloading
inferenceGpu -> servingEngine

AI and Higher Education

Daniel Miessler argues that “is college worth it?” is the wrong question because college is not one thing. He decomposes the university into its parts — textbooks and base knowledge, in-person lectures, the social experience of leaving home and meeting difference, campus life and extracurriculars, lifelong networks, and the credential itself — and asks which parts AI changes. Base knowledge and generic lectures are already weak and AI can improve them; Feynman-grade teaching and the social/network dimensions are much harder to substitute; the credential’s value is falling except at elite filters. The useful move is to evaluate each component separately and decide which to keep, refactor, or replace.

Watch for:

• Which university components AI genuinely replaces versus merely augments.
• Continued devaluation of the credential and growth of internship/workforce pathways.
• Whether the social and network component stays a durable reason for campus.

Wardley signals:

• Components: textbooks and base knowledge; in-person lectures; AI-generated/custom video and interactive tutors; the social experience; campus life and extracurriculars; lifelong networks; the credential/degree; internships and direct workforce entry.

• Evolution stage: textbooks — Commodity (cheap, standardised, already commoditised). Lectures — Product/Commodity (standardised delivery). The credential — Product (devaluing). AI tutoring — Genesis/Custom (emerging, uneven). The social/network experience — Commodity (essential, hard to substitute).

• Doctrine: Hits — “Know your users”/“Focus on user needs”, “Challenge Assumptions”, “Remove bias and duplication”, “Use appropriate methods.” Misses — “Manage inertia” (institutions defending the bundled degree).

• Climatic patterns: “Creative Destruction”; “Higher order systems create new sources of value”; “Characteristics change as components evolve”; “Different forms of disruption (predictable vs non-predictable)”; “Everything evolves through supply and demand competition.”

• Diffusion markers: rapid AI adoption in teaching; recorded Feynman/Sapolsky-style lectures shared widely; refactoring of the degree into modular components; alternative credentialing and workforce pathways.

• College Is Not One Thing

wardley-beta
%% Q1 Users: students (and parents) and the educators/institutions delivering the experience.
%% Q2 Needs: acquire knowledge and skills, a credential, and social/network experience; deliver education effectively.
%% Q3 Capabilities: teaching and tutoring, credentialing, social/network formation, career pathways.
%% Q4 Components: textbooks, in-person lectures, AI tutors, the campus social experience, the degree credential, internships/workforce entry.
%% Q5 Maturity: textbooks Commodity; lectures Product/Commodity; AI tutors Genesis/Custom; campus social experience Commodity; degree credential Product (devaluing); internships Product.
%% Q6 Managed by: universities (institutions), AI providers, and employers.
anchor studentNeed [0.95, 0.92]
anchor institutionNeed [0.84, 0.78]
component textbooks [0.85, 0.40]
component lectures [0.70, 0.55]
component aiTutors [0.22, 0.62]
component campusSocialExperience [0.78, 0.68]
component degreeCredential [0.62, 0.72]
component internshipsWorkforce [0.60, 0.60]
textbooks -> lectures
lectures -> studentNeed
lectures -> institutionNeed
aiTutors -> studentNeed
campusSocialExperience -> studentNeed
degreeCredential -> studentNeed
degreeCredential -> institutionNeed
internshipsWorkforce -> studentNeed

Claude Sonnet 5.5

Simon Willison’s link-blog note covers Anthropic’s Claude Sonnet 5.5, a mid-tier model that runs 30%+ faster and costs up to 30% less than Sonnet 5 while beating it on every benchmark — and now powers the free tier on claude.ai, making Anthropic’s free offering more capable than OpenAI’s Luna 5.6. The fun detail is a reproducible stress test: the “max” thinking effort repeated Opus 5.5’s failure, burning 128,000 tokens ($1.28) without producing the pelican SVG, while “xhigh” succeeded for under six cents. Willison flags Sonnet 5.5’s coding strength and the coming Haiku 5.5, whose pricing against GPT-6 Luna is the next thing to watch.

Watch for:

• Whether Anthropic’s free-tier Sonnet 5.5 outpaces OpenAI’s Luna 5.6 free tier.
• The “max” thinking-effort token-waste bug recurring across models.
• Haiku 5.5 pricing and positioning against GPT-6 Luna.

Wardley signals:

• Components: Claude Sonnet 5.5; Opus 5.5; Haiku 5.5; GPT-6 Luna; claude.ai free tier; ChatGPT free tier; benchmark suites; the SVG/WebGL pelican test.

• Evolution stage: frontier LLM APIs — Product (fast-moving, feature-differentiated). Free-tier chat — Commodity (expected, invisible). Model benchmarking — Commodity (standardised practice). Coding assistance — Product (converging feature set).

• Doctrine: Hits — “Bias towards new”, “Move fast”, “Use appropriate tools”, “Listen to your ecosystem”, “Think fast, inexpensive, restrained and elegant.” Misses — “Effectiveness over efficiency” (the max-effort mode wasting tokens before failing).

• Climatic patterns: “Everything evolves through supply and demand competition”; “Creative Destruction”; “Capital flows to new areas of value”; “Competitors actions will change the game”; “Shifts from product to utility tend to demonstrate a punctuated equilibrium.”

• Diffusion markers: free-tier access broadening adoption; viral reproducible benchmark prompts; rapid release cadence (Sonnet 5.5, Haiku 5.5 pending); price/performance competition between Anthropic and OpenAI.

• Claude Sonnet 5.5

wardley-beta
%% Q1 Users: developers/AI builders and everyday chat users on free tiers.
%% Q2 Needs: a capable, fast, affordable model for coding and general tasks.
%% Q3 Capabilities: frontier reasoning/coding, low-latency inference, free-tier access, comparative benchmarking.
%% Q4 Components: Claude Sonnet 5.5, Opus 5.5, Haiku 5.5, GPT-6 Luna, free-tier chat, benchmark suites.
%% Q5 Maturity: frontier LLM APIs Product; free-tier chat Commodity; benchmark suites Commodity; coding assistance Product.
%% Q6 Managed by: Anthropic and OpenAI, with the ecosystem driving benchmarks and adoption.
anchor developerNeed [0.95, 0.92]
anchor chatUserNeed [0.72, 0.82]
component sonnetModel [0.55, 0.68]
component opusModel [0.34, 0.60]
component haikuModel [0.48, 0.46]
component competitorModel [0.66, 0.60]
component freeTierChat [0.88, 0.44]
component benchmarkSuites [0.30, 0.28]
sonnetModel -> developerNeed
opusModel -> developerNeed
haikuModel -> developerNeed
sonnetModel -> freeTierChat
competitorModel -> freeTierChat
freeTierChat -> chatUserNeed
benchmarkSuites -> sonnetModel
benchmarkSuites -> competitorModel