Session CRT-20260820 — 20 August 2026 · Afternoon Edition

Halil, the facts are bad enough without CVSS theater: public PoC exists, active exploitation is reported, and unauthenticated attackers can forge JWTs to impersonate SharePoint users or administrators and access or modify files. Rapid7-linked reporting counted 12 attempts from eight IPs across five regions. That makes every affected on-premises deployment patch-now.

My decision line tonight:

• Not externally reachable, no suspicious activity: patch immediately, preserve logs, increase monitoring. Do not assume compromise.
• Internet-reachable while unpatched after PoC release: remove external access now, preserve evidence, patch, and investigate every server in the farm. Exposure triggers isolation—not an automatic breach declaration.
• Assume compromise: any forged/S2S-token artifact, unexplained privileged action, abnormal file access or modification, new administrator, or suspicious configuration change. Isolate the affected server, restrict the farm, revoke SharePoint sessions, and investigate farm-wide. Reset credentials only where credential theft or account abuse appears; forged tokens do not prove stolen passwords.
• Rebuild: only with host-level execution, web shells, persistence, tampered binaries, unauthorized accounts, or failure to establish system integrity. Token impersonation alone does not justify bulldozing the farm.

The source pack does not prove reliable RCE or host takeover, persistence, machine-key theft, compromise of every exposed server, or that rebuilding is universally required. It also provides no authoritative log signature here. Treat exposure as smoke; treat concrete unauthorized actions as fire.

The combined blast radius is the union of both workloads’ identities and reachable resources. Fact: MLflow before 3.15.0 permits unauthenticated SSRF through the webhook test endpoint, potentially returning responses from internal or metadata services. Fact: Ray versions before 2.52.0 are affected by CVE-2025-62593, with total technical impact, and both vulnerabilities appear in CISA’s KEV catalog. MLflow is therefore a credential-retrieval path; Ray must be treated as workload execution. If they share an account, VPC/VNet, Kubernetes cluster, service account, artifact bucket, model registry, or database, compromise of either can become lateral movement through the same trust graph.

Contain rather than merely patch any vulnerable instance that was externally reachable, has suspicious requests, can reach a metadata service, or runs with a useful workload identity. That includes AWS instance roles or IRSA, Azure managed/workload identities, GCP service accounts, mounted kubeconfig files, static access keys, and attached secret volumes. Preserve application, proxy, container, and cloud audit evidence; isolate the workload; patch; then invalidate or restrict exposed identities and rotate accessible static secrets. Patch-only treatment is defensible only when teams can demonstrate the vulnerable interface was unreachable, exploitation did not occur, and the process had neither metadata access nor credentials or privileged storage connectivity.

Tonight, verify versions and exposure first, then enumerate each workload’s effective permissions—not merely its nominal role. Review CloudTrail, Azure Activity/Entra, or GCP Audit logs for token use, role assumption, storage enumeration, secret access, new compute, and policy changes originating from those identities. Check every connected bucket, artifact store, model registry, database, and KMS/decryption permission. Also verify whether metadata protections actually prevented the required request flow rather than assuming “temporary” means harmless. The provider owns the underlying compute; the customer owns these trust policies, network paths, and data permissions. Serverless branding remains regrettably ineffective as an IAM control.

Halil, the physical risk is loss of trustworthy control: an unexpected stop can damage equipment, while manipulated interlocks or process values could endanger personnel. Fact: CISA reports an active threat using AI-assisted exploitation scripts, including reported Snap7 components, against Siemens S7 PLCs for access, credential theft, denial of service, and other objectives. Assessment: “AI-generated” describes how tooling was produced; it does not demonstrate autonomous operations, novel PLC capability, attribution, or confirmed physical damage. Directly exposed PLCs effectively collapse the Purdue boundary from the internet into Levels 1–2.

For the first 24 hours across S7-1200/1500/200/300/400 estates:

• Put plant operations, controls engineering, and process safety—not the IT help desk—in command. Independently verify tank levels, pressures, flows, actuator positions, alarms, and interlocks.
• Remove direct internet reachability using upstream firewalls or provider controls. Suspend unverified vendor access, but validate every rule change before deployment; accidentally severing PLC, HMI, or safety communications may create the worse event.
• Preserve controller diagnostics, running configuration/logic, engineering-workstation artifacts, historian and firewall logs. Compare logic and configuration with an approved offline baseline. Do not reboot, mass-scan, clear logs, or download “known-good” logic until operators understand the process state.
• Monitor for unexpected programming sessions, mode changes, stop/start events, credential changes, logic downloads, and Snap7/S7 traffic crossing from Levels 3–4. Plan firmware, credential, and configuration changes by model and lifecycle status during a tested maintenance window—not an IT-style 24-hour patch mandate.

Unknown: the advisory evidence available here does not establish which individual installations were altered or whether any safety function was affected. CameraSwarm is materially different: Hunt.io documented 14,530-plus Dahua devices reached through credential brute force, authentication-bypass vulnerabilities, and P2P relay access; published remediation includes disabling unnecessary P2P and installing corrected firmware. A camera can often be isolated or replaced without changing the controlled process. An S7 PLC may be executing that process, so isolation, credential changes, and firmware work require operator-led sequencing and safety validation.

Talos supports moderate-high confidence that AI generated operational playbooks, automated exploitation and troubleshooting across global Windows/Linux web-server attacks. It supports only low confidence in autonomous campaign orchestration: victim counts, success rate and the degree of human approval remain unpublished. The observed sectors are government, education, media, technology and gaming.

Actor linkage is moderate confidence to Talos’s UAT-10147 cluster—a Chinese-speaking, financially motivated operator—but low confidence for any Chinese state or established MITRE G-group linkage. SPECTRE is a cross-platform post-exploitation implant providing C2, process injection, credential theft, anti-analysis, Windows BYOVD-based EDR neutralization and a Linux rootkit; Talos assesses AI-assisted rootkit development only at medium confidence, alongside human expertise.

AI mainly compresses attacker time and increases scale; it does not change defender priorities. Hunt the durable chain: public-facing IIS/Linux exploitation (T1190), privilege escalation, in-memory web shells (T1505.003), process injection (T1055), credential theft, persistence, BYOVD/EDR impairment (T1562.001), rootkits (T1014) and subsequent SPECTRE C2. Exact campaign size, full autonomy and broader attribution remain unknown.