Session CRT-20260713 — 13 July 2026 · Afternoon Edition

The strongest pattern across these lanes is that “trusted” channels are becoming the incident path: package managers, browser extensions, SaaS sessions, OAuth grants, CI/CD material, contractor repos, and identity proofing workflows. Tomas drew a useful boundary for developer trust: if malicious npm code actually executed in a developer or build environment, especially around the affected jscrambler releases, secret rotation and clean rebuilds are warranted; if it only sat inert in an SBOM, cache, or lockfile, removal may be enough. That distinction matters because over-rotating everything burns time, but under-rotating a CI or release token can preserve the attacker’s real objective.

Marcus and Priya pushed the same theme from the identity and cloud sides. The room should take away that password resets are not a sufficient response when the attacker may hold session cookies, refresh tokens, OAuth grants, or API-capable SaaS access. For Microsoft 365 AiTM and Salesforce-style abuse, the response has to include session revocation, token invalidation, OAuth app review, export monitoring, and attention to unusual API behavior. Priya’s cloud read also reframes public GitHub exposure: leaked AWS, CI/CD, Terraform, Kubernetes, or workflow artifacts are not just “secrets in code,” they can reveal the control-plane trust graph. The CISA contractor reporting still has an important caveat — the roughly two-day credential-validity claim comes from independent reporting, not a fully adjudicated public incident record — but the operational lesson is still sound.

Isabelle kept the AI fraud discussion grounded: the headline loss and document-fraud figures support urgency, but the practical fix is not blind faith in deepfake detection. It is removing voice, video, selfie likeness, and executive familiarity from approval paths, then adding pre-enrolled out-of-band verification, dual control, cooling periods, device/session risk, and consistency checks.

The unresolved tension now is prioritization under incomplete evidence. We have treated ShareFile Storage Zone Controllers as a top isolation candidate because the vendor reportedly used emergency shutdown-style guidance, yet the public mechanics remain thin. The next challenge should pressure-test whether that high placement is justified compared with better-documented exploitation lanes.

What changed here is the priority model: Alex separated “we have strong exploitation evidence” from “a vendor has issued emergency operational instructions.” That matters because ShareFile Storage Zone Controllers may still demand immediate action, but the reason is Progress’s emergency shutdown guidance — operational smoke — not the same evidentiary footing as CISA KEV listings, observed webshell deployment, or reported session compromise.

The room now has a sharper ordering for the next triage window. NetScaler CVE-2025-5777 moves to the front where exposure exists, because the concern is not just a bug but a reported session-compromise path tied to ransomware activity. The Joomla iCagenda and Balbooa Forms CMS path also stays very high because arbitrary upload/PHP execution plus KEV-style exploitation means exposed vulnerable systems should be treated as potentially webshell-compromised, not merely “patch when convenient.” PAN-OS GlobalProtect remains urgent, but Alex’s caveat is important: isolation depends on whether the vulnerable configuration conditions are actually present.

The caveat we should preserve is that ShareFile has not been downgraded to “ignore.” It has been downgraded in exploitation confidence relative to NetScaler and CMS/Joomla evidence. So the operational answer may still be fast containment or shutdown, but the analytical label should be more careful: emergency vendor signal, not confirmed in-the-wild compromise based on what the panel has validated here.

That sets up James well: the next step is to close the operational lane by turning this evidence-ranked view into a defensible tonight-plan — what gets isolated, what gets patched and hunted, and where teams should avoid burning scarce incident-response cycles on the wrong assumption.

James has now turned the ranking into an executable overnight sequence. The key clarification is that “most urgent” is not a single bucket anymore: CMS/Joomla webshell activity and NetScaler session-compromise risk come first on exploitation confidence, while ShareFile Storage Zone Controllers still stay in the emergency lane because Progress reportedly told customers to shut them down and because public patch or IOC detail is still missing.

Operationally, the room has a cleaner order of operations. Announce downtime, preserve evidence before making noisy changes, isolate exposed Joomla/CMS and NetScaler paths, hunt for webshells and abnormal POST behavior, then invalidate sessions and tokens before doing password resets. That last point is important: James reinforced Marcus’s warning that credential rotation alone can create false comfort if active sessions, refresh tokens, VPN sessions, or admin portal sessions remain valid. For ShareFile, the advice remains conservative: keep self-hosted SZCs offline and preserved; do not bring them back through a “test restore” into production just to see what happens.

He also separated what can wait until the morning but should not drift: router and SNMP hardening for critical infrastructure. Disable Cisco Smart Install where present, remove SNMPv1/v2 or force SNMPv3 with authPriv, rotate router credentials and community strings, block internet-facing management, and compare running configs against gold images. That is not being treated as more exploited than the CMS or NetScaler items; it is being treated as an exposure-reduction lane that can close quickly once the highest-confidence incident-response work is underway.

One caveat stays on the table: the ShareFile urgency is still based on vendor emergency posture rather than independently verified exploitation details in this discussion. So we preserve systems, reduce exposure, and wait for better indicators without overstating what has been proven. Before we close, Lena has one remaining intelligence lane: spear-phishing activity attributed to APT-C-60 targeting Japanese organizations, including Proton Drive links or attachments, RAR archives, and LNK files. That matters because it shifts us from exposed-edge triage to user-delivered intrusion paths.

The added lane here is narrower, but important: APT-C-60 does not change the top emergency order for everyone, yet it gives Japanese organizations and Japan-connected businesses a concrete phishing-and-execution pattern to hunt immediately. Lena’s framing keeps this in proportion. This is not a universal board-level crisis on the same footing as the exposed infrastructure issues we discussed earlier, but it is absolutely relevant for teams with Japanese operations, partners, hiring flows, or users likely to receive Japan-themed lures.

What we learned is the dependable signal chain: spear-phishing through Proton Drive links or attachments, RAR archives, LNK execution, obfuscated JavaScript run through mshta.exe, and follow-on use of trusted developer or CDN platforms such as GitHub, GitLab, jsDelivr, and Codeberg. The attribution should stay bounded: JPCERT/CC ties this activity cluster to APT-C-60, and Lena treats that as high confidence for the reported cluster, not as proof of sponsor, state direction, or broader strategic intent. That distinction matters because defenders can act on the tradecraft without overstating what the evidence proves.

For operations, the immediate value is detection and triage: detonate inbound RAR/LNK combinations, look closely at Proton Drive links in Japanese-language lures, alert on mshta.exe launched from user-writable locations or shortly after archive extraction, and map the behavior to phishing, user execution, signed binary proxy execution, obfuscation, and trusted-service abuse. The main caveat is that trusted hosting platforms create noise, so blocking them wholesale may be impractical; the better move is correlation around the sequence, source, language, file type, and process behavior.

With no further lane to add, we now have the shape of the final synthesis: separate what is globally urgent from what is regionally actionable, keep confidence levels explicit, and turn each threat into a defensible action path rather than a headline-driven scramble.