Cybercrime-as-a-Service Takedown Assisted by AI; SASE Zero Trust Guidance from CISA; Cloudflare PACT Designed to Verify Human Internet Traffic

More good news on international cooperation tackling cybercrime. What I liked in particular about this story was the use by Microsoft of AI to analyse the criminal gangs. Amidst all the hype about criminals using AI to undermine all our security controls, it's a pleasant relief to read a story about defenders using AI to undermine the criminals.

Two things of note here: first, Microsoft is showing how AI can be used to help analysis of malicious activity and aid in more comprehensive takedowns, and second is a call to WordPress (WP) users to change login credentials, install MFA, remove unknown additional accounts, and keep your WP site up to date, as the SocGholish dropper was actively spreading via hacked WP sites.

This appears to be a large, coordinated shutdown across multiple countries. Even if the amount of money doesn’t appear to be as high as in other heists, this targeted a large number of people, including many who were probably vulnerable to such an attack chain. With so many systems taken down, one has to wonder if these individuals won’t just pop back up with another infrastructure set just as large.

Europol and Microsoft just pulled off a massive takedown with two really cool twists. Instead of just shutting things down, they actually remediated the infected websites to keep them safe moving forward. Plus, they used AI to hunt down the command and control infrastructure, showing exactly how AI can supercharge human intelligence. Love to see it!

Identity is the new perimeter, and in this case, I am very happy to see agencies do this correctly. Done correctly, this will have some flaws, but it will be a step forward. If done incorrectly, I can see a new set of vulnerabilities emerging. The agency is making a call here that decentralized perimeters relying on Firewalls and VPNs are no longer appropriate, and that centralized, shared zero-trust architectures are the way to go.

This modernizes the approach to Zero Trust — a required change for agencies. The guidance incorporates the change in architecture for services, where traffic ran through common control points, visible to the EINSTEIN sensors, akin to the old castle and moat model, to the decentralized model of today, and removes the requirement to break TLS traffic, which reduces latency, complexity, and the need for custom back-haul for cloud services, allowing support for the communication patterns of current cloud apps. This comes at a regulatory cost, requiring agencies to provide an equivalent data feed to CISA's Comprehensive Log Aggregation Warehouse (CLAW) and to rely on encrypted traffic analysis to detect suspicious patterns. This should speed implementations and lower their cost and complexity once you have the supporting processes worked out.

Although this guidance is aimed at US federal agencies, the underlying principles apply to organisations everywhere, and I would encourage you to become familiar with the guidance.

While specifically addressed to federal agencies, this guidance can be useful to private enterprises. We desperately need for all enterprises to get to zero trust. We cannot continue to accept the risk that the compromise of one user's reusable credentials or one rogue insider can bring down an entire enterprise.

If we can ensure privacy and anonymity while also ensuring that this system is not spoofable, PACT could work to remove CAPTCHAS once and for all. That is, however, a really tall order; done wrong, we will have a super, super, super cookie, one that advertisers and others can use to pinpoint the human right behind that keyboard, so to speak.

The PACT standard has not been finalized, but Cloudflare’s support will be critical to make this standard work. Currently, websites are flooded with automated requests, causing outages and forcing sites to provision additional resources to respond to them. Websites frequently use CAPTCHA to defend against automated requests. While effective, CAPTCHA is adding friction for human users. PACT’s goal is to establish a “human user” once and provide proof to various websites that a request originated from a human user, not a bot. This assertion protects privacy and prevents websites from identifying a particular user.

The industry desperately needs a protocol like this. With agentic AI making software look exactly like legitimate users, the details will be tricky to solve, and we'll have to watch out for false positives blocking real traffic. Still, anything that gets us closer to a post-CAPTCHA world is a huge step forward.

AI use means that the way we detect non-human users needs to evolve, preferably without making the use by legitimate users harder. We've implemented and used CAPTCHAs and tracking; when the dust settles, PACT is promising to provide a better solution with less impact to legitimate users while promising to preserve privacy. While CAPTCHA service providers have worked to improve their detection and impact, I still keep an eye out for a better option. For now, all we can do is watch, as the protocols are still under development, and identify environments to test in when solutions are made available.

This initiative will also reduce the risk of counterfeit CAPTCHAs.

Squid for FTP is a strange use case. The interesting thing I find is that while many of these bugs are 29-30 years old, most are in edge cases. Does this mean that Mythos cannot find fully exploitable bugs, or does this mean that the code is at a stability point where it's harder to find bugs? I will be watching closely for this, but as the models mature, it would be interesting to see whether they find a similar bug in a widely deployed configuration, such as HTTP Proxy or HTTPS Proxy.

Again, Mythos is helping to identify issues in old code. The flaw stems from a (now identified) simple oversight in making sure that the return was a NULL, not a null terminator. The name Squidbleed points back to Heartbleed, which leaked memory the same way. Two fixes here: first, update to Squid v7.6 if you're still using it; second, disable FTP. FTP is a venerable service, and it's fundamentally not up to today's security requirements; you should have moved to some other file transfer system. Take a minute to read the Calif log (the analysis is good and easy to follow), if for nothing else than to check out the cute logo created for Squidbleed.

Certainly not a cyberattack, but when a scheduled technical change to a critical communications system halts rail operations nationwide it raises questions about the resiliency of the entire system. Infrastructure operators should ask questions like, “if this system (pick one, there are many to choose from) was not available for four hours, what stops?” The answer may reveal dependencies that deserve additional redundancy and testing.

Tough spot to be in. GSM-R is based on old 2G technology, and component failures are having impact in other countries besides Germany. Odds are there is not a pre-production system to test changes, and there's nothing like testing an "innocuous" change in production. I have found two approaches to help the risks of that scenario. One: Don't work alone, and have someone cross checking your work and the changed system. Two: Make sure that you really can execute the proposed back-out plan, keeping in mind that even after reverting a change, returning to normal can take a bit due to layered dependencies.

Not every major outage is caused by a cyberattack, but the impact on essential services can be just as severe. The EU's NIS2 Directive rightly places resilience and availability alongside cybersecurity as core requirements. Organisations providing essential services, particularly those operating within the EU, need to ensure that change management, testing, and recovery processes are just as robust as their security controls.

Targeted phishing attacks still work, so do everything you can to help staff who fall for them. Good on Xsolis for detecting the breach only two days after it occurred, and for reporting in less than six months. Given this is the third largest health data breach reported in 2026, and that the company specializes in AI based solutions, there is an opportunity to shorten the reporting interval. Healthcare providers, like many others, have rapidly adopted AI solutions. We need to make sure that monitoring, detection and access controls are in place to detect proper data use, access, and sharing (with fourth parties), as well as ensuring active participation in the governance process.

Although specific details regarding the initial compromise are limited, the attacker's ability to locate protected data immediately following a successful phishing exploit suggests gaps in internal defenses. This incident highlights the critical need for robust data segmentation and identity access management.

The motivations of teenage hackers have changed over the decades from the early days where most of the activity was driven by curiosity, then later by activism/hacktivism, and now seemingly by a focus on inflicting damage and criminal intent. Unfortunately, these teenagers are often underage, making it extremely difficult for law enforcement to deal with cases like this. I don't have any ready answers to this situation apart from supporting law enforcement in their efforts to deter and divert such teenagers away from a life of crime before it is too late for them and their victims.

NCA agents had completed a comprehensive, complex, and painstaking investigation. This work is not wasted; it gave legal representatives the ammunition they needed to win in court or negotiate an early settlement, in this case a guilty plea. It will also support the case for the sentence made in July. Expect the US indictment to be similarly supported.

Well, that’s a wild twist for this early in the trial! Now comes the really tough question: with so many people affected by what they did, how much jail time are we looking at? Let's hope they finally learn the hard way that crime doesn't pay.