The Advanced Persistent Threat (APT) group designated UNC3886 represents a structural challenge to traditional enterprise and telecommunications defence. Operating with extraordinary operational discipline, UNC3886 systematically targets “unmonitored” perimeter edge appliances (Fortinet, Juniper) and core virtualisation platforms (VMware ESXi, vCenter). By pairing zero-day Remote Code Execution (RCE) vulnerabilities with kernel-level Loadable Kernel Module (LKM) rootkits like REPTILE and MEDUSA, the actor maintains persistent, invisible access across critical information infrastructure (CII) for years at a time—operating entirely below the visibility threshold of standard Endpoint Detection and Response (EDR) platforms.
Blog
-
Below the Operating System: Deconstructing UNC3886’s Zero-Day Exploitation and Kernel-Level Telco Persistence
-
Weaponising the Guards: Deconstructing TeamPCP’s Cascading CI/CD Supply Chain Campaign
In late March 2026, the financially motivated cybercriminal group TeamPCP executed a five-day cascading supply chain operation that compromised three widely deployed developer security tools: Aqua Security’s Trivy, Checkmarx’s KICS, and BerriAI’s LiteLLM. By exploiting a pull_request_target misconfiguration and intercepting incomplete credential rotations, TeamPCP hijacked mutable GitHub version tags (@v2) and PyPI publishing tokens. The compromised tools—running with elevated permissions in thousands of enterprise CI/CD pipelines—were turned into automated credential-harvesting engines, exfiltrating over 300GB of secrets across more than 500,000 environments.
(more…) -
Collapsing the Patch Window: How Frontier AI is Automating Zero-Day Discovery and Accelerating Time-to-Exploit
The integration of reasoning-focused frontier AI models into vulnerability research has fundamentally broken traditional exposure management. Adversaries and defenders are deploying agentic LLM pipelines that evaluate multi-repository codebases, perform continuous patch-diffing, and generate functional exploit payloads in minutes. This shift has collapsed the Mean Time to Exploit (MTTE) across both zero-day and N-day vulnerabilities, rendering standard 30-day patch SLAs structurally obsolete.
(more…) -
The Machine-Speed Intrusion: Deconstructing Agentic Attack Chains and Automated Execution
Threat actor tradecraft has reached an inflexion point. Adversaries have moved past passive LLM prompt generation to deploy Agentic AI Orchestrators – autonomous software frameworks capable of executing dynamic, multi-step kill chains at machine speed. By shifting from human-driven hands-on-keyboard operations to programmatic decision loops, threat groups are compressing intrusion lifecycles from days to hours, rendering traditional, human-reliant SOC SLAs obsolete.
(more…) -
Shai-Hulud: When Trust in npm Becomes the Attack Surface
Modern JavaScript development runs on an assumption that rarely gets questioned:
dependencies are safe by default.Every
npm installpulls code written by strangers, maintained at unknown cadence, and executed automatically in trusted environments. The Shai-Hulud npm campaigns did not exploit a vulnerability in npm itself. They exploited belief – belief that widely used ecosystems self-regulate.This was not a smash-and-grab operation.
(more…)
It was a slow poisoning of trust, designed to persist quietly inside developer workflows and CI/CD pipelines. -
MongoBleed: A Critical MongoDB Vulnerability Shaking Database Security
On December 12, 2025, the MongoDB Security Engineering team disclosed a high-severity security flaw in the core MongoDB Server product — a vulnerability that quickly earned the nickname “MongoBleed.” In the weeks that followed, this issue transitioned from academic concern to active exploitation, making it one of the most important database security stories heading into 2026.
(more…) -
Silk Typhoon: The APT That Weaponised Trust – A Deep Dive into China’s Premier Supply Chain Attack Group
In the pantheon of nation-state cyber threats, few groups have demonstrated the systematic evolution of attack methods as thoroughly as Silk Typhoon. From their explosive debut with the 2021 Microsoft Exchange zero-day campaign that compromised over 60,000 organisations globally, to their recent infiltration of the US Treasury Department, this Chinese state-sponsored Advanced Persistent Threat (APT) group has consistently redefined the boundaries of supply chain warfare.
What distinguishes Silk Typhoon — also known as Hafnium, APT27, and Murky Panda — across different threat intelligence communities is not merely its technical sophistication but also its strategic patience and architectural understanding of modern digital trust relationships. Unlike opportunistic cybercriminal groups or even other nation-state actors who focus on individual high-value targets, Silk Typhoon has mastered the art of leveraging trust infrastructure to achieve scalable, persistent access across entire sectors simultaneously.
To understand why this group represents the future of nation-state cyber operations, we must examine their evolution from opportunistic vulnerability exploitation to systematic compromise of trust infrastructure — and why their methodology poses an existential challenge to the foundational assumptions of enterprise cybersecurity.
(more…) -
The Trusted Path to Breach: How China’s APT Turned Cybersecurity Infrastructure Against the US Treasury
In our ongoing examination of supply chain compromises—from the Shai-Hulud worm’s ecosystem-wide assault on npm to the systematic exploitation of GitHub Personal Access Tokens—we’ve consistently observed how attackers weaponise the trust relationships that underpin modern digital infrastructure. On December 30, 2024, this pattern reached a new zenith when the US Treasury Department disclosed that Chinese state-sponsored actors had compromised its systems through BeyondTrust, a cybersecurity vendor specifically tasked with protecting privileged access.
This breach represents more than another supply chain compromise – it exemplifies the sophisticated evolution of Advanced Persistent Threat (APT) operations where security infrastructure itself becomes the attack vector. The incident, attributed to the Chinese APT group known as Silk Typhoon, demonstrates how threat actors have moved beyond breaking through security perimeters to systematically exploiting the very tools designed to enforce them.
(more…) -
The Master Key Vulnerability: How GitHub PATs Became the Crown Jewel of Cloud Compromise
In our recent analysis of the Shai-Hulud worm’s devastating impact on the npm ecosystem, we observed how supply chain attacks have evolved from opportunistic package poisoning to systematic ecosystem compromise. At the heart of that attack—and increasingly at the centre of modern cloud breaches – lies a deceptively simple credential: the GitHub Personal Access Token (PAT).
These tokens, designed to streamline developer workflows and enable seamless automation, have become the skeleton key that unlocks entire organisational infrastructures. From the SolarWinds compromise to recent attacks on major cloud service providers, GitHub PATs consistently appear as both the initial attack vector and the mechanism for persistent access.
This isn’t coincidental. GitHub PATs represent a perfect storm of high privilege, broad scope, and minimal oversight, making them irresistible targets for sophisticated threat actors. To understand why these tokens have become the crown jewel of cloud compromise, we must examine how their design philosophy— prioritising developer convenience over security boundaries—creates systemic vulnerabilities that extend far beyond GitHub itself.
(more…) -
Shai-Hulud Weaponisation of npm’s Trust Model
In our ongoing analysis of supply chain compromises, we’ve examined how attackers exploit the fundamental trust relationships that power modern software development. From dependency confusion attacks to compromised build systems, threat actors have consistently demonstrated that the most devastating breaches don’t break through defences—they walk through open doors marked “trusted.”
On September 23, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) issued an alert that crystallises this threat: a self-replicating worm named “Shai-Hulud” has compromised over 500 packages in the npm ecosystem, the world’s largest JavaScript registry. This isn’t merely another supply chain attack; it’s a systematic exploitation of the trust architecture that underpins modern web development.
The significance of this compromise extends far beyond its immediate impact. Shai-Hulud represents an evolution in supply chain attacks—from opportunistic package poisoning to automated, self-propagating ecosystem compromise. To understand why this attack succeeded so spectacularly, and how to defend against its successors, we must examine how it weaponised the very mechanisms designed to make software development seamless.
(more…)