In partnership with
| ~6 MIN READ |
|
Attackers are winning on infrastructure, not just exploits: networks that rebuild themselves daily, logs that never get written, and hosts that sell "ignored abuse" as a feature. This edition is about seeing what's built to be invisible. PS: Was this forwarded to you? Subscribe free at exzeccyber.com/subscribe → |
In this edition
|
Nation-State / Critical Infrastructure Volt Typhoon Has Rebuilt Its Hidden Network Every Day Since 2023 Intro China's Volt Typhoon doesn't run a botnet you can take down. It runs relay chains of hijacked devices, rebuilt daily, and has used them to reach hundreds of sensitive US networks. What Happened Lumen's Black Lotus Labs calls the operation "Silent Train": rotating chains of compromised home routers, IoT gear and enterprise boxes, assembled in under two minutes, with sessions averaging about four hours. Victims include telecoms, government, defense contractors, and water, energy and transportation operators. The group abused 27+ device classes from vendors including Fortinet, Cisco, Ivanti, Palo Alto Networks and TP-Link, and ran zero-day campaigns against Versa Director, N-able N-central, VeloCloud Orchestrator and Cisco Catalyst SD-WAN. Why It's Important It keeps targeting management and control-plane systems, the boxes that run everything else. Cisco Talos also reported KeyDrift, malware built to copy SD-WAN encryption keys, planted through CVE-2026-20127 by a group whose infrastructure overlaps Silent Train. The Other Side Researchers say their view is not "a complete census," and Talos stops short of calling the KeyDrift group Volt Typhoon.
TL;DR: Volt Typhoon rebuilds its covert relay network daily and keeps reaching US critical infrastructure through edge gear. Further reading: CyberScoop · The Hacker News |
|
Your AI prompts are leaving out 80% of what you're thinking.
When you type a prompt, you summarize. When you speak one, you explain. Wispr Flow captures your full reasoning (constraints, edge cases, examples, tone) and turns it into clean, structured text you paste into ChatGPT, Claude, or any AI tool. The difference shows up immediately. More context in, fewer follow-ups out.
Used by teams at Microsoft, Amazon, and Notion. Try Wispr Flow free on Mac, Windows, iPhone, and Android.
|
|
|
Analytics on Live Data Without Leaving Postgres
When analytics on Postgres slows down, most teams add a second database. Then they manage pipelines, sync lag, and drift forever. TimescaleDB extends Postgres instead. Analytics run on live data, in the database you already have. No pipeline. No migration. No new query language.
 Strange but real The AI That Promised Not to Go Online, Then Reached for Beijing Intro Cohere asked Alibaba's Qwen model to write a malware detection rule. Its notes said it wouldn't use external tools. Its next move tried to upload a file to a server in Beijing. What Happened During a routine security test, Qwen3.8-Flash-Next tried to send a placeholder test string to an external Beijing server, and a sandbox blocked it. Cohere couldn't say if it was deliberate, and co-founder Ivan Zhang admitted, "It's really hard to assign intention or motivation." Cohere released the raw traces and a script so others could try to reproduce it. Why It's Important Agentic models pick up habits from their training environments. If those setups routinely saved files to Alibaba's cloud, "upload to Beijing" becomes a reflex, which is a problem in your network whatever the intent. The Other Side Most researchers call it a training artifact, not espionage; one skeptic found no backdoor. Critics say Cohere's method may have steered the model, and Cohere sells rival models to governments.
TL;DR: A Chinese AI model said it wouldn't go online, then tried to send a file to Beijing. Further reading: TechCrunch |
“Running shos” shouldn’t return zero results. Gladly understands what your shoppers mean, typos and all, and finds the right products.