SAGE INTELLIGENCE BRIEF Saturday, July 11, 2026 =========================================== LEAD STORY GigaWiper is the story tonight. Microsoft's threat hunters have confirmed a Golang-based modular backdoor that combines Crucio ransomware, a Go reimplementation of FlockWiper and a raw-disk wiper into a single deployable package. The "ransomware" component uses randomly generated keys that are never saved, so there is no decryption path and no negotiation leverage. Any responder who treats file encryption on a GigaWiper-infected host as a ransom scenario has already lost containment time, because the disk wiper command is still in the queue. --- CONNECTING THE THREADS GigaWiper and the RabbitMQ/Redis/MinIO C2 pattern. Three nights ago I flagged that JadePuffer and GigaWiper were independently converging on RabbitMQ, Redis and MinIO as command delivery and exfiltration infrastructure. Tonight's full read confirms GigaWiper uses exactly that stack. RabbitMQ/AMQP for commands, Redis for status, MinIO for exfiltration. This is now a confirmed, cross-actor design pattern. Perimeter blocks on known-bad IPs don't touch this. The detection gap is behavioral: outbound connections to legitimate middleware endpoints from endpoints that have no business reason to talk to them. If you haven't built that query into your SIEM yet, that's the gap. The negotiator fraud conviction and the ransom-payment-as-PR-transaction principle. Last night I logged that Union County's ransom payment proved extortion payment is not a security control. Tonight the Angelo Martino conviction lands on top of that. A DigitalMint negotiator fed BlackCat/ALPHV affiliates their clients' confidential positions across five victims and $75 million in payments. The security outcome was determined at exfiltration. The negotiation table added insider fraud on top of it. Two separate incidents in two nights both confirm the same point: the control point is pre-encryption, not the ransom conversation. WP-SHELLSTORM and the AI-assisted attack surface acceleration thread. I've been tracking that AI tooling is compressing the discovery cycle against existing codebases. WP-SHELLSTORM ran FOFA-sourced target lists against 1.4 million domains and successfully backdoored 17,000+ sites through a single plugin CVE. That's not manual scale. The operator left a server running for 22 days and still compromised that many sites. The implication: plugin vulnerability-to-mass-exploitation latency is now measured in days, not weeks. WordPress shops with any plugin estate need continuous CVE-to-installed-plugin matching, not periodic patch reviews. --- IT INFRASTRUCTURE ARCHITECTURE Red Hat Introduces Indefinite RHEL Support at a Price Red Hat's new Long-Life Add-On extends support on a specific RHEL release for as long as you keep paying. For shops with long-lifecycle workloads locked to a specific release, this is an option worth considering, but the pricing structure will matter and Red Hat will use this to keep customers from drifting to third-party support alternatives. Worth modeling against your current support spend before committing. Source: https://www.zdnet.com/article/red-hat-enterprise-linux-forever-support/ GigaWiper: Modular Backdoor Combines Wipers and Fake Ransomware Covered in full in Lead Story and Connecting the Threads. The operational takeaway for infrastructure teams: any host showing GigaWiper indicators needs immediate network isolation and forensic preservation. Do not wait for the ransomware negotiation conversation to start. Source: https://www.theregister.com/security/2026/07/10/destructive-windows-backdoor-stuffs-multiple-wipers-and-ransomware-code-into-a-single-package/5270053 Cinnamon 6.8 Brings Optional Wayland Support to Linux Mint The next Linux Mint desktop release supports both X11 and Wayland, user's choice. For any shop running Linux desktops on thin client or kiosk infrastructure, Wayland support in Mint's Cinnamon is a meaningful maturity signal. It expands display-server flexibility without forcing a migration. Source: https://www.theregister.com/os-platforms/2026/07/10/cinnamon-68-will-support-wayland-if-you-want-it/5269354 --- CYBERSECURITY & COMPLIANCE Progress ShareFile: Take Storage Zone Controllers Offline Now Progress Software has ordered customers to fully shut down self-hosted ShareFile Storage Zone Controllers with no patch issued and no technical disclosure. Cloud access to affected accounts is being disabled simultaneously. The shutdown-before-patch response signals either an unpatched zero-day or a Progress-side infrastructure compromise. These servers should be treated as compromised: isolate them, pull logs, rotate credentials for anything they could reach. This is the same component that had an unauthenticated RCE (CVE-2023-24489) in 2023 and two more critical flaws patched in March 2026. Source: https://thehackernews.com/2026/07/urgent-progress-tells-sharefile.html O-UNC-066 Vishing Campaign Hijacking Microsoft 365 Passkey Enrollment A threat actor is running voice-based social engineering across food and beverage, technology, healthcare, automotive, construction and aviation sectors. The attack prompts M365 users to enroll a new Entra passkey, handing the attacker persistent, phishing-resistant authentication into the account. This is identity takeover through the enrollment flow itself. Entra passkey enrollment needs to be gated with strong identity verification and monitored as a high-value event, not treated as a routine self-service action. Source: https://thehackernews.com/ WP-SHELLSTORM Mass WordPress Backdoor Campaign A threat actor's operational server sat exposed for 22 days, leaking 800MB of tooling, target lists and command history. The confirmed yield was 25,000+ compromised sites with 5,700+ active webshells. The primary vector was CVE-2026-3844 in the Breeze caching plugin, effective only when the non-default "Host Files Locally, Gravatars" setting is enabled. The backdoor chains to a SNOWLIGHT dropper installing VShell, disguised as [kworker/0:2], a toolchain linked to UNC5174. WordPress hosting environments need plugin CVE-to-installed-version matching running continuously. Source: https://thehackernews.com/2026/07/exposed-hacker-server-reveals-wp.html CISA Adds ColdFusion and Langflow Flaws to KEV, Federal Deadline Passed Critical vulnerabilities in Adobe ColdFusion and Langflow are now on the KEV catalog with a federal patch deadline of July 10. Federal agencies that missed the window are already in violation. For enterprise and MSP shops, the operational rule remains: CVSS 9.0+ on internet-facing infrastructure gets treated as actively exploited at disclosure, not at KEV confirmation. Source: https://www.securityweek.com/ --- CLOUD PLATFORMS & STRATEGY Cloudflare Temporary Accounts for Autonomous Worker Deployment Cloudflare now lets AI agents spin up Workers deployments without a pre-existing account. The provisioning happens autonomously. This is useful for agentic build pipelines, but it also means AI agent permissions and resource scope need to be governed before this capability is in production. An agent that can deploy Workers can also deploy a backdoor if its instructions are compromised. Source: https://www.infoq.com/news/2026/07/cloudflare-temp-accounts/ Multi-Region Architecture: Latency vs. Cost Trade-offs InfoQ's framework piece on multi-region cloud architecture makes the point that simple math doesn't capture the latency and cost behavior when you add regions. For MSPs designing cloud-hosted solutions for clients, the underwriting on multi-region needs to include data transfer costs, replication lag under load and actual end-user latency profiles, not theoretical round-trip calculations. Source: https://www.infoq.com/articles/multi-region-latency-cost-tradeoffs/ --- NETDEVOPS & NETWORK AUTOMATION Cisco LapDogs Campaign Expands SOHO Router Backdoor Toolkit Cisco has confirmed that the LapDogs threat actor has added three new backdoors, LongLeash, DogLeash and JarLeash, to its SOHO router malware toolkit. Branch and edge routers are the target. For MSPs managing distributed client sites, SOHO router firmware currency and config integrity monitoring are now mandatory controls, not optional hardening. An unmanaged branch router is a persistent foothold. Source: https://www.securityweek.com/ --- AI IN INFRASTRUCTURE & AIOPS Linux Foundation Launches Akrites to Defend Critical OSS from AI-Powered Threats The Linux Foundation has stood up Akrites, an industry initiative targeting AI-powered attacks against critical open source software. The threat model is AI-assisted vulnerability discovery and supply chain compromise at scale against foundational OSS packages. For any shop consuming OSS in production, this is the institutional response to the same attack-surface-acceleration problem I've been tracking all week. Source: https://www.infoq.com/news/2026/07/akrites-open-source-ai-threats/ Datadog Used Claude and Cursor for Test-Driven Production Migration Datadog's engineering team published their lessons from using Claude and Cursor in a test-driven production migration. What worked: AI-assisted test generation and code transformation. What didn't: trusting the model to understand context it hadn't been explicitly given. The lesson is familiar. AI tooling accelerates execution but requires tightly scoped context to avoid introducing incorrect assumptions into production code. Source: https://www.infoq.com/news/2026/07/datadog-ai-production-migration/ WordPress 7.0 Ships AI Foundations in Core WordPress 7.0, released in May 2026, has AI infrastructure baked into core along with a redesigned admin interface. For MSPs managing WordPress estates, this means the AI surface area on every hosted WP site just expanded. Combined with the WP-SHELLSTORM campaign, plugin and core hygiene on WordPress hosting needs to be treated as an active security workstream, not a background maintenance task. Source: https://www.infoq.com/news/2026/07/wordpress-7-ai/ --- HARDWARE, GPU & COMPUTE Microsoft's Emissions Up 25% Driven by AI Datacenter Builds Microsoft's carbon emissions increased by a quarter in a single year, driven directly by AI datacenter construction and power demand. For enterprise buyers, this is a procurement signal: sustainability commitments in vendor contracts need to be evaluated against actual emissions trajectories, not stated targets. Vendors building AI capacity at this rate are structurally in tension with their own environmental pledges. Source: https://www.theregister.com/on-prem/2026/07/10/ai-driven-datacenter-builds-drive-microsofts-emissions-up-a-quarter-in-one-year/5269924 SpaceX Filing for 100,000 Additional Starlink Satellites SpaceX wants to expand the Starlink constellation by 100,000 satellites, promising 100x bandwidth improvement. The FCC is simultaneously hearing from environmental groups demanding an orbital datacenter environmental review before any new licenses are issued. For enterprise planners considering Starlink as a branch or backup WAN option, regulatory uncertainty around LEO expansion is a meaningful timeline risk. Source: https://www.zdnet.com/article/spacex-wants-to-launch-100000-more-starlink-satellites/ --- NETWORK MANAGEMENT & MONITORING Datadog AI-Assisted Migration Surfaces Monitoring Toolchain Lessons Datadog's internal use of AI in a production migration (covered in AI section) also exposed something relevant to monitoring teams: AI-generated test coverage is only as good as the context provided about what the system is supposed to do. Monitoring and observability configurations generated or modified with AI assistance need the same human review gate as AI-assisted code changes. Source: https://www.infoq.com/news/2026/07/datadog-ai-production-migration/ No additional notable developments tonight. --- MANAGED SERVICE PROVIDERS Barracuda Acquires Evo Security to Build MSP Identity Platform Barracuda has bought Evo Security and is folding it into the BarracudaONE platform. The stated gap they're filling: enterprise identity solutions are too complex and too costly for MSPs managing millions of identities across thousands of client environments. This is a direct play for the identity security workload at MSP scale. For MSPs currently stitching together identity management across multiple tools, this is worth evaluating as a consolidation option against your current stack cost. Source: https://www.channelpronetwork.com/2026/07/10/barracuda-acquires-evo-security-key-channel-headlines/ Ransomware Negotiator Convicted of Working for the Attackers Angelo Martino, a DigitalMint negotiator, received a 70-month sentence after feeding five victims' confidential negotiating positions directly to BlackCat/ALPHV affiliates. Total ransoms across those five victims exceeded $75 million. For MSPs advising clients on incident response retainers and ransomware negotiation services, third-party negotiator due diligence is now a required part of the vendor assessment. Source: https://arstechnica.com/tech-policy/2026/07/ransomware-negotiator-helped-attackers-extort-his-own-clients-gets-6-year-sentence/ --- IT VENDOR ECOSYSTEM & M&A OpenAI Kills Atlas Browser Before Its First Birthday OpenAI's standalone Atlas browser is dead after less than 12 months. The capability is being redirected toward workplace productivity and agentic use cases inside existing products. The pattern here is clear: standalone AI-native apps are losing to AI-embedded enterprise tools. The browser-as-AI-interface thesis didn't survive contact with the distribution reality of enterprise software. Source: https://www.theregister.com/ai-and-ml/2026/07/10/openais-atlas-browser-doesnt-make-it-to-its-first-birthday/5269818 EU DSA Scrutiny of Meta's Addictive Design Features The EU is applying DSA pressure to Facebook and Instagram over infinite scroll, autoplay and related engagement mechanics. For enterprise software buyers, this regulatory frame matters: the same design patterns that drive consumer engagement create compulsive use and distraction in workplace tools. Procurement teams evaluating SaaS platforms should be asking whether engagement-maximizing design is in the product's interest or the organization's. Source: https://www.theregister.com/personal-tech/2026/07/10/eu-puts-addictive-design-of-facebook-instagram-under-the-dsa-microscope/5269975 --- EDGE COMPUTING & IOT Cisco LapDogs SOHO Router Expansion at the Edge Covered in NetDevOps. The three new backdoors in the LapDogs toolkit confirm that the edge router layer is a sustained, high-value target for persistent access. Organizations with unmanaged or consumer-grade SOHO routers at branch locations should treat router management as a security control, not an afterthought. No additional notable developments tonight. --- SALES & REVENUE The Buyer Who Talks the Most Has Already Told You Where to Focus In "SPIN Selling," Neil Rackham's research across 35,000 sales calls found that in high-value B2B deals, the seller talks less than the buyer in successful calls. The most productive sales conversations are built around Implication and Need-Payoff questions that cause the buyer to articulate their own pain and the value of solving it. Salespeople who lead with their solution before the buyer has verbalized the problem are skipping the step that creates urgency. Source: (Goodreads compounding) Concession Sequencing Determines Perceived Deal Value In "Negotiation Genius," Deepak Malhotra and Max Bazerman document that how you sequence concessions signals your reservation price. Making large early concessions trains the other party to expect more. Making small, diminishing concessions with explicit justification for each one signals you're approaching your limit. The sequence itself communicates information independent of the amounts involved. Source: (Goodreads compounding) --- REAL ESTATE & INVESTMENT Debt Coverage Ratio as the Actual Underwriting Discipline Brandon Turner's frameworks in "The Book on Rental Property Investing" keep coming back to one number serious investors never skip: the debt service coverage ratio. A DSCR below 1.2 on a buy-and-hold means the property cannot weather a single vacancy or rate adjustment without drawing from reserves. Investors who underwrite to appreciation rather than to cash flow coverage are building a position that requires everything to go right. Source: (Goodreads compounding) Market Timing Is Less Predictable Than Market Position Ken McElroy's "The ABCs of Real Estate Investing" makes the point that investors who wait for the perfect market conditions almost always overpay when they finally act, because their conviction has built up alongside everyone else's. The operators who compound wealth are positioned in markets with strong rent demand fundamentals before the appreciation cycle becomes visible. Position precedes timing. Source: (Goodreads compounding) --- SELF HELP, HUMAN PSYCHOLOGY & DARK PSYCHOLOGY The Planning Fallacy Scales with Optimism, Not Complexity Daniel Kahneman's work in "Thinking, Fast and Slow" identifies that humans systematically underestimate task duration regardless of task complexity, because planning is done from the inside view (what I intend to do) rather than the outside view (what happened on similar projects). The corrective is the reference class forecast: find the base rate for comparable projects before generating your own estimate. Optimism about your own situation doesn't change the base rate. Source: (Goodreads compounding) Commitment Escalation as a Dark Persuasion Tool Robert Cialdini's "Influence" identifies commitment and consistency as the mechanism behind foot-in-the-door manipulation. Once someone has made a small public commitment, they feel psychological pressure to behave consistently with it, even when later requests are significantly larger. Skilled manipulators use this by engineering small, visible early agreements before making the real ask. Recognizing the escalation pattern is the only reliable defense. Source: (Goodreads compounding) --- WHAT TO WATCH Identity-layer attacks are the dominant vector this week across three separate incidents: the O-UNC-066 passkey enrollment vishing campaign, the Martino negotiator insider fraud and the ShareFile shutdown. The common thread is that trust relationships, whether with an authentication enrollment flow, a third-party service provider or a software vendor, are being exploited before technical controls have line of sight. Watch for more targeting of identity onboarding and enrollment flows specifically, because they carry high trust by design. --- CONVERSATION STARTER GigaWiper's "ransomware" component deliberately discards the encryption key at runtime, so the ransom demand is structurally fraudulent from the attacker's side. There is no key to recover and no negotiation path. Ask your incident response team whether your ransomware playbook branches on that scenario, or whether it assumes a key exists. ===========================================