Hello, stay ahead with CISO Brief 🚀

🔎 SentinelOne researchers have identified a sabotage-focused malware framework from around 2005 that predates Stuxnet by at least five years. The investigation uncovered a service binary (svcmgmt.exe) embedding a Lua 5.0 VM and a boot-start kernel driver (fast16.sys) that intercepts and patches executables at the storage layer. Fast16 acted as a wormable carrier with multiple 'wormlet' payloads, targeted Windows 2000/XP file shares using weak credentials, and included environmental checks to avoid specific security software. The framework was designed to corrupt outputs from engineering and simulation suites, and was later referenced in the Shadow Brokers leak.

🔒 AI is transforming DevSecOps by moving security earlier into the development lifecycle and shifting teams from reactive validation to continuous, intelligent enforcement. Organizations are embedding security controls into AI coding assistants, using LLMs for contextual vulnerability scanning, and surfacing automated remediation directly in IDEs and pull requests. Experts caution this brings new risks—model access, prompt injection, data leakage and provenance—that demand enterprise governance, cross-functional alignment, and updated skill sets.

🤖 AI agents are shifting the Tier 1 SOC analyst role from manual triage to oversight and decision-making. Instead of spending hours pivoting across logs and telemetry, analysts can delegate evidence collection to agentic AI that queries systems, correlates signals and builds evidence chains in real time. The human role becomes orchestration—reviewing outcomes, validating uncertainty and aligning actions with business risk. Trust is earned via transparency, staged deployments and practitioner-led adoption.

📞 Unit 42 and RH-ISAC report BlackFile has targeted retail and hospitality since Feb 2026, linking activity to CL-CRI-1116 and overlaps with UNC6671/Cordial Spider. The group uses vishing—impersonating IT helpdesks with spoofed VoIP—and phishing pages that mimic corporate SSO, plus antidetect browsers and residential proxies to harvest credentials and OTPs. After access they register devices to bypass MFA, escalate privileges, and exfiltrate data via Salesforce and SharePoint APIs. Recommendations include caller identity checks, strict escalation for IT support, and simulation-based phone-security training.

🔍 Cybersecurity researchers from Infoblox disclosed an international revenue‑share fraud campaign that uses multi‑step fake CAPTCHA pages to trick users into sending premium SMS messages. The scheme leverages traffic distribution systems and JavaScript back‑button hijacking to force multiple prefilled SMS sends to dozens of international numbers, with charges often appearing weeks later. Operators also repurpose Keitaro TDS instances and compromised licenses to scale cloaking, tracking, and delivery of scams and malware.

🔒Attackers are increasingly hijacking legitimate AI agents and compromised credentials to extract sensitive information, turning in-house assistants into active threats. These agents become 'agentic endpoints'—autonomous identities with broad privileges that often evade traditional controls by using plugins, extensions, and stolen API tokens. Organizations need a consolidated security platform, continuous verification through PAM and Zero Trust, and board-level governance to manage this accelerated, AI-driven risk.

🔒 On April 13, 2026, Itron, Inc. detected unauthorized access to certain internal IT systems and activated its cybersecurity response plan. The company notified law enforcement and engaged external advisors to investigate, mitigate, remediate, and contain the activity. Itron reports the intrusion has been blocked with no observed follow‑up, no customer impact, and no material disruption to business operations. The investigation is ongoing and the company expects a significant portion of incident-related costs to be covered by insurance.

🛠️ Microsoft is rolling out a revamped Windows Insider Program to simplify channel structure and improve transparency around feature availability. The company is merging Dev and Canary into a new Experimental channel for high-risk or potentially non-shipping work, while maintaining an updated Beta channel where features in release notes will be broadly available without gradual rollouts. Experimental items may be gated behind Feature flags that users can toggle in Settings, and Microsoft is migrating Insiders in phases while shipping several preview builds and an updated Windows Update experience to give users more control over updates and reboots.

❄️UNC6692 uses social engineering and Microsoft Teams to deliver a custom malware suite dubbed Snow. The attackers combine an 'email bombing' tactic with Teams messages posing as IT helpdesk staff to lure victims into installing a fake patch. The link drops AutoHotkey scripts that load SnowBelt, a malicious Chrome extension that operates in a headless Edge session, establishing persistence and relaying commands to a Python backdoor via a WebSocket tunneler.

🔎 SentinelOne researchers have disclosed fast16, a Lua-based cyber‑sabotage framework compiled in 2005 that predates Stuxnet. The implant embeds a Lua 5.0 VM and encrypted bytecode inside a carrier binary svcmgmt.exe and pairs with a kernel driver that patches executables to corrupt high‑precision calculations. fast16 targets legacy Windows 2000/XP environments and engineering simulation tools, and its discovery revises the timeline of state-backed cyber sabotage.

⚠️ CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog affecting SimpleHelp, Samsung MagicINFO 9 Server, and D-Link DIR-823X routers, citing evidence of active exploitation. The listed flaws include two SimpleHelp issues (CVE-2024-57726, CVE-2024-57728), a Samsung path traversal (CVE-2024-7399), and a D-Link command injection (CVE-2025-29635). Agencies are urged to apply fixes or retire affected devices by May 8, 2026.

🔒 ADT confirmed unauthorized access to customer and prospective customer data detected on April 20, saying it terminated the intrusion and opened an investigation. The company reported that stolen information was limited to names, phone numbers, and addresses, with a small subset including dates of birth and the last four digits of SSNs or Tax IDs. ADT emphasized no payment data or customer security systems were affected. ShinyHunters claims over 10 million records were taken after a vishing attack that allegedly compromised an employee’s Okta SSO and accessed Salesforce data.

🔒 Unit 42 describes a fundamental shift in the npm threat landscape following the September 2025 Shai‑Hulud worm and subsequent 2026 incidents. Adversaries now harvest npm and GitHub tokens to persist inside CI/CD pipelines, deploy dormant multi‑stage payloads, and automatically republish backdoored packages. The report attributes a broad, coordinated campaign to TeamPCP, documents propagation via Docker Hub, GitHub Actions and VS Code extensions, and recommends mitigations such as credential rotation, egress filtering, and dependency pinning.

🚀 AWS Lambda now offers Provisioned Mode for event source mappings that consume Apache Kafka in the Asia Pacific (Taipei) and both AWS GovCloud (US‑East) and GovCloud (US‑West) Regions. Provisioned Mode lets you provision and auto-scale a configured minimum and maximum number of event pollers so polling capacity is ready to handle sudden traffic spikes and reduce processing delays. It supports Amazon MSK and self‑managed Kafka and can be enabled via the ESM API, Console, CLI, SDKs, or CloudFormation. Usage of event pollers is billed by Event Poller Units (EPUs).

🔗 Amazon Quick now integrates with Vee, the AI assistant from Visier, via the Model Context Protocol (MCP), enabling HR, finance, and operations leaders to access governed workforce intelligence directly inside the Quick workspace. After connecting to Visier’s remote MCP server, users can ask natural-language questions about headcount, attrition, tenure, and open requisitions and receive answers grounded in Visier’s governed data model. Vee can also be invoked from automated Quick Flows to run recurring reviews or draft documents, and Quick augments responses with enterprise knowledge from Quick Spaces—such as budgets, policies, and plans—so answers reflect the broader organizational context. The Visier integration is available in all AWS Regions where Amazon Quick is offered.

🔒 Amazon announced VPC egress support for AgentCore Gateway targets and AgentCore Identity, available in managed and self‑managed configurations. The capability lets Gateways invoke private resources inside a customer VPC (for example, EKS-hosted MCP servers) and allows Identity to validate tokens from and fetch tokens for private IdPs. The release also adds private DNS resolution for managed egress resources and is available in fourteen AWS Regions.

🔍 Researchers from three Hong Kong universities demonstrated a method to extract acoustic information from fiber-optic cables by measuring vibration-induced changes in the optical signal. Their experiments showed that strong vibrations such as footsteps can be detected remotely, but clear human speech was not recoverable without a local audio-to-vibration converter or significant control over provider equipment. The attack relies on sending optical pulses and measuring Rayleigh scattering-related deviations, and while technically feasible, it remains an unlikely and costly targeted threat requiring access to the Optical Distribution Network or an implanted converter to amplify audio signals.

🔥 A custom backdoor named Firestarter has been observed persisting on Cisco Firepower and Secure Firewall devices running ASA or FTD software, surviving reboots, firmware updates, and security patches. U.S. CISA and the U.K. NCSC link the activity to a threat actor tracked as UAT-4356, which exploited CVE-2025-20333 and CVE-2025-20362. Cisco recommends reimaging and upgrading affected devices; administrators can check compromise with show kernel process | include lina_cs, and CISA published YARA rules and mitigation guidance.