Daily Reading for 2026-10-01 - Learning in Public

Daily Reading for 2026-10-01

William Glaser
12 mins to read
daily-reading
Home / Daily Reading / Daily Reading for 2026-10-01

Daily Reading for 2026-10-01

Abuse of Legitimate Tools and Cloud Services for Persistence

Two threat reports converge on a shared playbook: adversaries no longer break trusted enterprise software — they rent it. Talos documents UAT-11587, a China-nexus espionage cluster whose Rust “Antino” backdoor uses Microsoft 365 as dead-drop C2, polling Outlook for commands and using OneDrive for heartbeats and file transfer to blend with normal sync traffic. Microsoft describes phishing that delivers signed MSP360 RMM installers and then pivots to ConnectWise ScreenConnect for a redundant remote-access channel. Together they show how signed, cloud-hosted tooling yields durable persistence while shrinking defenders’ detection windows.

Watch for:

  • Cloud-service C2: Microsoft Graph/Outlook command polling and OneDrive dead drops instead of dedicated C2 servers.
  • RMM abuse: signed MSP360 installers, ScreenConnect as a second channel, and FaronicsDeployAgent used the same way.
  • DLL sideloading of signed Windows binaries (GatherOsState.exe → slc.dll) and masquerading filenames.
  • Phishing lure themes: meetings, e-cards, PDF/Adobe updates, and government/tax documents.

Wardley signals:

  • Components: Microsoft 365 / Microsoft Graph API, Outlook, OneDrive, Entra ID OAuth client-credentials, MSP360 RMM, ConnectWise ScreenConnect, FaronicsDeployAgent, signed Windows ADK binaries (GatherOsState.exe), Cloudflare Pages/R2, Amazon CloudFront, the Antino backdoor, PowerShell/msiexec.

  • Evolution stage: Microsoft 365/Graph/Outlook/OneDrive and Cloudflare R2/Pages → Commodity (ubiquitous utility infrastructure); commercial RMM platforms → Product (feature-differentiated, growing market); the bespoke Antino backdoor and .NET deserialization chain → Custom, edging toward Genesis (actor-specific, changing between Gen1/Gen2); signed Windows binaries → Commodity.

  • Doctrine hits/misses: hits “Know your users”/“Focus on user needs” (know which RMM is approved) and “Use standards” (SPF/DMARC/MFA), but the DMARC p=none domain and deferred RMM governance are misses of “Set exceptional standards” and “Manage inertia”; attackers illustrate “Exploit the landscape”.

  • Climatic patterns: “Everything evolves through supply and demand competition” (RMM as a product/utility); “Success breeds inertia” as trusted tools create detection blind spots; “Increased stability of lower order systems increases agility & speed of re-combination” as stable M365/Graph primitives enable novel abuse.

  • Diffusion markers: copy-cat TTPs (both MSP360 and FaronicsDeployAgent lead to ScreenConnect), shared CloudFront infrastructure overlap with UNC6384, and standardised Graph APIs lowering the barrier to cloud-service C2.

  • 🚩China-nexus UAT-11587 Targets Government and Policy Organizations Across Asia with Antino Backdoor And Microsoft 365-based C2.

  • 🚩 Phishing Campaigns Abuse MSP360 and ScreenConnect for Persistent Remote Access

wardley-beta
%% 1. Users: SOC analysts, incident responders and detection engineers
%% 2. Needs: detect and contain intrusions that hide behind trusted enterprise tooling
%% 3. Capabilities: cloud-service C2 detection, RMM abuse detection, signed-binary sideload detection
%% 4. Components: Microsoft 365/Graph, OneDrive, Outlook, RMM platforms (MSP360/ScreenConnect), Antino backdoor, signed-binary sideloading, Cloudflare R2/CloudFront, OAuth client credentials
%% 5. Maturity: M365/Graph, OneDrive, Cloudflare staging Commodity; RMM platforms Product; sideload technique Custom; Antino Genesis/Custom
%% 6. Managed by: Microsoft (cloud services), RMM vendors, threat actors (bespoke malware), defenders (detections)

anchor defendAgainstToolAbuse [0.93, 0.90]

component rmmPlatforms [0.60, 0.55]
component m365GraphC2 [0.80, 0.60]
component onedriveDeadDrop [0.78, 0.45]
component antinoBackdoor [0.18, 0.35]
component signedBinarySideloading [0.35, 0.40]
component cloudCdnStaging [0.82, 0.30]
component identityOauthClients [0.70, 0.50]

rmmPlatforms -> defendAgainstToolAbuse
m365GraphC2 -> defendAgainstToolAbuse
onedriveDeadDrop -> m365GraphC2
identityOauthClients -> m365GraphC2
antinoBackdoor -> m365GraphC2
signedBinarySideloading -> antinoBackdoor
cloudCdnStaging -> antinoBackdoor

%% note: summarize signals placed Antino as Custom; sources show a bespoke, generational implant better read as Genesis/Custom — adjusted.
evolve rmmPlatforms 0.65
evolve m365GraphC2 0.85
evolve antinoBackdoor 0.25

AI Security and Model Policy

Two AI-security pieces frame the agentic era’s core tension between capability and containment. Matthew Green observes that separately sandboxed agents able to leave instructions for one another in a shared package cache are effectively the two halves of a worm; swap the cache for email, Slack, or shared documents and training runs for deployed personal agents, and the ingredients are in place. Niels Provos argues defenders need capable open-weight models they control, after provider safety classifiers blocked Hugging Face’s forensics and his own security work, and calls for regulating deployment and operational security rather than model access.

Watch for:

  • Cross-agent instruction passing through shared caches, email, Slack, or documents as a worm vector.
  • Whether sandbox isolation survives multi-agent shared state and inter-agent messaging.
  • False-positive refusals blocking legitimate defensive and forensic work.
  • The open-weight vs. provider-controlled access debate and where AI regulation lands (deployment vs. models).

Wardley signals:

  • Components: AI agents / personal agents, sandboxing and isolation, shared package caches, open-weight models (GLM-5.2/5.3), frontier provider models (Claude Opus/Fable, OpenAI models), safety classifiers and guardrails, Hugging Face forensic tooling, AI regulation and evaluation frameworks.

  • Evolution stage: frontier models → Custom (rapidly changing, competing forms, uncertain); open-weight models → Product (multiple providers, maturing, feature competition); agent sandboxing → Custom/Emerging (techniques unsettled); safety classifiers → Custom (immature, false positives); AI regulation → Genesis (proposed, undefined).

  • Doctrine hits/misses: hits “Challenge assumptions” (Green’s worm thought experiment; Provos questioning safeguard claims), “A bias towards open” (open-weight advocacy), and “Know your users” (defenders’ needs); frontier labs’ containment failures miss “Manage failure” and “Effectiveness over efficiency”.

  • Climatic patterns: “Everything evolves through supply and demand competition” (model capabilities); “Evolution consists of multiple waves of diffusion with many chasms”; “Creative Destruction”; “Success breeds inertia” as labs defend hosted business models; “Capital flows to new areas of value”.

  • Diffusion markers: open-weight model proliferation, spreading agent frameworks, repeated frontier-lab agent intrusions, and public policy proposals (Anthropic’s framework, OpenAI Trusted Access for Cyber, Project Glasswing).

  • Quoting Matthew Green

  • Cybersecurity Defenders Need Open-Weight Models

wardley-beta
%% 1. Users: security defenders/forensic teams and organisations deploying AI agents
%% 2. Needs: contain rogue agents; retain capable models for defensive work
%% 3. Capabilities: agent isolation, cross-agent containment, dependable defensive model access, AI governance
%% 4. Components: frontier models, open-weight models, agent sandboxing, shared agent caches, safety classifiers, forensic tooling, AI regulation
%% 5. Maturity: frontier models Custom; open-weight models Product; sandboxing Custom/Emerging; classifiers Custom; forensic tooling Custom/Product; regulation Genesis
%% 6. Managed by: frontier labs, open-weight providers/self-hosting teams, standards/policy bodies, defenders

anchor secureAgentDeployments [0.92, 0.88]
anchor ensureDefensiveAccess [0.88, 0.78]

component frontierModels [0.35, 0.65]
component openWeightModels [0.55, 0.60]
component agentSandboxing [0.25, 0.50]
component sharedAgentCaches [0.50, 0.40]
component safetyClassifiers [0.30, 0.45]
component forensicTooling [0.48, 0.42]
component aiRegulation [0.12, 0.35]

frontierModels -> ensureDefensiveAccess
openWeightModels -> ensureDefensiveAccess
forensicTooling -> ensureDefensiveAccess
agentSandboxing -> secureAgentDeployments
sharedAgentCaches -> agentSandboxing
safetyClassifiers -> frontierModels
aiRegulation -> frontierModels

evolve frontierModels 0.45
evolve openWeightModels 0.65
evolve agentSandboxing 0.30
evolve aiRegulation 0.15

Microsoft Ignite 2026 Security Guide

Microsoft’s Ignite 2026 guide frames the agentic era as a trust problem: AI agents now act with real access to identities, data, and cloud, so every adoption decision is a security decision. The Security track splits into four themes — Defend with AI (agentic SOC operations), Secure AI (discovering, governing, and protecting agents), Get Ready for AI (identity, Zero Trust, phishing-resistant authentication), and Secure Data (Purview, data security posture). For a technical reader this is a roadmap signal: Microsoft is pushing Agent 365, Defender, Entra, and Purview as the platform stack that makes agent adoption governable, with hands-on labs and customer-zero lessons behind the marketing.

Watch for:

  • Agentic SOC sessions (The Alert Is Dead, Project Perception lab) and how response playbooks change when AI acts.
  • Agent governance and non-human identity: Agent 365, local-agent discovery, access controls for agents.
  • Phishing-resistant identity: passkeys and the “SMS MFA is dead” thread.
  • Data security posture: using Purview to find and protect sensitive data before Copilot rollout.

Wardley signals:

  • Components: Microsoft Defender (XDR), Microsoft Purview, Microsoft Entra ID, Agent 365, Microsoft Security Copilot / agentic SOC, Zero Trust for AI, passkeys, Microsoft Intelligent Security Association (MISA) partner ecosystem.

  • Evolution stage: Agentic SOC and AI-agent security tooling → Custom (emerging, competing forms, no accepted model yet); Defender/Purview/Entra → Product (feature-differentiated, growing-to-mature markets); passkeys and MFA standards → Commodity (standard, expected, utility-like); MISA partner solutions → Product.

  • Doctrine hits/misses: hits “Know your users”/“Focus on user needs” (governing agents from code to runtime) and “Use standards” (passkeys, Zero Trust); a possible miss of “There is no core” in framing one broad platform as the security core.

  • Climatic patterns: “Everything evolves through supply and demand competition” (AI security tooling); “Components can co-evolve (practice with activity)” as SOC practice co-evolves with agent technology; “Higher order systems create new sources of value” and “Commoditisation <> Centralisation”.

  • Diffusion markers: conference sessions, instructor-led labs and certifications, customer-zero case studies, a partner ecosystem (MISA), and standardisation pressure around passkeys and Zero Trust for AI.

  • ​​Secure what’s next: Your guide to Microsoft Security at Microsoft Ignite 2026

wardley-beta
%% 1. Users: security leaders choosing platform direction; SOC analysts defending agentic workloads
%% 2. Needs: a trustworthy security roadmap for AI/agent adoption; an operable agentic SOC
%% 3. Capabilities: agentic detection & response, agent governance, identity/data protection, Zero Trust
%% 4. Components: Defender XDR, Purview, Entra ID, Agent 365, agentic SOC tooling, Zero Trust for AI, passkeys
%% 5. Maturity: agentic SOC & Agent 365 Custom; Defender/Purview/Entra Product; passkeys Commodity; Zero Trust for AI Custom
%% 6. Managed by: Microsoft platform teams (product), MISA partners (ecosystem), customer security orgs (operation)

anchor operateAgenticSoc [0.90, 0.90]
anchor secureAgenticAdoption [0.92, 0.82]

component agenticSocTooling [0.30, 0.75]
component agentGovernanceAgent365 [0.35, 0.70]
component defenderXdr [0.62, 0.80]
component purviewDataSecurity [0.60, 0.55]
component entraIdentity [0.78, 0.65]
component zeroTrustAiFramework [0.22, 0.50]
component passkeyAuth [0.85, 0.60]

agenticSocTooling -> operateAgenticSoc
defenderXdr -> agenticSocTooling
agentGovernanceAgent365 -> secureAgenticAdoption
purviewDataSecurity -> secureAgenticAdoption
entraIdentity -> secureAgenticAdoption
zeroTrustAiFramework -> secureAgenticAdoption
passkeyAuth -> entraIdentity

evolve agenticSocTooling 0.45
evolve agentGovernanceAgent365 0.50
evolve zeroTrustAiFramework 0.35

Cisco Catalyst SD-WAN Authentication Bypass

Cisco discloses CVE-2026-76504, a critical authentication bypass in Catalyst SD-WAN Manager (vManage) caused by improper URI-encoding handling that lets an unauthenticated remote attacker reach an admin-only API endpoint. Cisco reports active exploitation and has shipped fixed releases across the 20.9–26.2 lines; there is no workaround, so remediation is upgrade plus cutting internet exposure. Defenders should audit serviceproxy-access.log and vmanage-server.log for percent-encoded j_security_check requests and viptela-reserved-* accounts — the concrete IOC pattern for a bug that turns an internet-facing management plane into an instant admin foothold.

Watch for:

  • IOC pattern: percent-encoded j_security_check (e.g. /%6a_security_check) from unknown or unauthorized IPs.
  • viptela-reserved-* users appearing in vmanage-server.log.
  • Fixed releases: 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, 26.2.1.
  • Exposure reduction: keep vManage off the internet, two-layer firewall, restrict to trusted hosts.

Wardley signals:

  • Components: Cisco Catalyst SD-WAN Manager (vManage), the j_security_check API endpoint, serviceproxy-access.log and vmanage-server.log, viptela-reserved system accounts, Cisco TAC, Snort rule 67179.

  • Evolution stage: vManage / the SD-WAN control plane → Product (commercial, widely deployed, consolidating market); j_security_check session auth and log telemetry → Commodity (standard, expected mechanisms); the CVE itself is a one-off defect rather than an evolving component.

  • Doctrine hits/misses: hits “Know the details” (log auditing) and “Effectiveness over efficiency” (upgrade over workaround); the improper URI-encoding handling is a miss of “Use standards”, and slow patch cycles illustrate “Manage inertia”.

  • Climatic patterns: “Success breeds inertia” as a large installed base delays patching; “Everything evolves through supply and demand competition” as SD-WAN management consolidates.

  • Diffusion markers: coordinated CVE advisory with active-exploitation warning, vendor patch releases across many branches, public IOCs, and detection signatures (Snort 67179) spreading defender knowledge.

  • Active Exploitation of Cisco Catalyst SD-WAN Manager CVE-2026-76504 Enables Unauthenticated Admin Access

wardley-beta
%% 1. Users: network/security teams operating Cisco Catalyst SD-WAN control planes
%% 2. Needs: keep the vManage management plane uncompromised and remediate active exploitation
%% 3. Capabilities: patch management, exposure reduction, log-based IOC detection
%% 4. Components: vManage controller, j_security_check auth endpoint, serviceproxy/vmanage logs, fixed releases, exposure controls, Snort 67179 signatures, CVE-2026-76504 record
%% 5. Maturity: vManage Product; auth endpoint & logs Commodity; fixed releases Product; exposure controls Product; IOC signatures Custom; CVE record Custom
%% 6. Managed by: Cisco (vendor/PSIRT), network operations teams, detection vendors (signatures)

anchor keepSdWanControlPlaneSecure [0.92, 0.90]

component vmanageController [0.62, 0.80]
component authEndpoint [0.72, 0.55]
component auditLogs [0.80, 0.40]
component patchedReleases [0.68, 0.45]
component exposureControls [0.55, 0.50]
component iocSignatures [0.45, 0.35]
component cveRecord [0.30, 0.45]

vmanageController -> keepSdWanControlPlaneSecure
authEndpoint -> vmanageController
patchedReleases -> vmanageController
exposureControls -> vmanageController
auditLogs -> keepSdWanControlPlaneSecure
iocSignatures -> auditLogs
cveRecord -> patchedReleases

evolve vmanageController 0.60
evolve authEndpoint 0.85
evolve auditLogs 0.90
evolve iocSignatures 0.55

Museum of the City of New York Exhibit

A short personal note from Simon Willison about visiting the Museum of the City of New York to see “He Built This City: Joe Macken’s Model” — a 50 x 27 foot balsa-wood and cardboard model of the city built over 21 years. Willison reports it exceeded his already high expectations and urges anyone who can to see it before the exhibition closes on 12 October. It is a human-interest outlier in a day of technical reading, and a reminder that long-running craft projects, like infrastructure, accrete value slowly over decades.

Watch for:

  • The exhibition closes 12 October, so timing matters for anyone nearby.
  • The scale and materials: 50 x 27 feet in balsa wood and cardboard.
  • The 21-year build period as an example of long-horizon craftsmanship.

Wardley signals:

  • Components: Museum of the City of New York, the “He Built This City: Joe Macken’s Model” exhibition, the physical architectural scale model, balsa wood/cardboard craft, Simon Willison’s weblog.

  • Evolution stage: the museum venue and weblog publishing → Commodity (established, expected); physical scale modelling → Custom (bespoke craft practice, not industrialised); this particular model → Genesis (a one-off).

  • Doctrine hits/misses: “Seek the best” and “Bias towards action” (21 years of sustained making); otherwise none clearly apply to the technical doctrine list.

  • Climatic patterns: none identified — the piece sits outside technology evolution.

  • Diffusion markers: none identified beyond the weblog mention that points readers to the exhibit.

  • He Built This City

wardley-beta
%% 1. Users: museum visitors and craft/urban-history enthusiasts
%% 2. Needs: experience a remarkable hand-built model of New York City before it closes
%% 3. Capabilities: curating and exhibiting a large-scale physical model; publicising the show
%% 4. Components: the city model, balsa/cardboard craft, the exhibition venue, museum programming, curatorial research, visitor publicity
%% 5. Maturity: the model Genesis (one-off); craft Custom; venue & programming Product/Commodity; publicity Commodity
%% 6. Managed by: the Museum of the City of New York (venue/curation), Joe Macken (maker), weblog/word-of-mouth (publicity)

anchor experienceCraftModel [0.92, 0.90]

component cityModel [0.20, 0.80]
component balsaCraft [0.30, 0.55]
component exhibitionVenue [0.75, 0.65]
component museumProgramming [0.65, 0.50]
component visitorPublicity [0.70, 0.45]
component curatorialResearch [0.40, 0.40]

cityModel -> experienceCraftModel
balsaCraft -> cityModel
curatorialResearch -> cityModel
exhibitionVenue -> experienceCraftModel
museumProgramming -> exhibitionVenue
visitorPublicity -> experienceCraftModel

evolve balsaCraft 0.35
evolve exhibitionVenue 0.80
evolve visitorPublicity 0.90