Session CRT-20260903 — 3 September 2026 · Afternoon Edition

Exposure now determines sequencing, but not the scope of the response. James’s operational rule is straightforward: isolate whichever of Switchvox or SMA 1000 is Internet-reachable first, while preserving volatile and forensic evidence before shutdown, patching, credential rotation, or rebuilding. For Switchvox, block public access and egress, capture memory, processes, connections, disk, configuration, and logs, then rotate credentials. Given the reverse-shell evidence, suspected compromise should lead to a clean rebuild and reconnection only after verified Sangoma remediation and configuration review.

For SMA 1000, the equivalent path is to isolate Work Place and management interfaces, preserve memory, images, configuration, and logs—including activity involving /__api__/login, /__api__/logout, and /wsproxy—then revoke sessions and rotate administrative and downstream secrets. James identifies 12.4.3-03453 and 12.5.0-02835 as the applicable fixed releases, while stressing that a confirmed compromise cannot be made trustworthy merely through an in-place patch.

Artifactory also cannot wait quietly behind the appliance queue. Publishing and deployment should be frozen concurrently because forged administrator tokens would turn this into an identity, software-supply-chain, and pipeline-integrity incident. Audit and access logs, token records, artifact metadata, manifests, artifacts, and CI logs need preservation; tokens and signing credentials need revocation; and outputs from the suspected compromise window should be quarantined. The remaining question is evidentiary consistency: we now need to test why exact SonicWall fixed releases can be stated while current Elementor advisory or patch information and a fixed GitLab release were described as unavailable.

The remediation picture is now more precise—and better calibrated to the evidence. James has withdrawn the unsupported SonicWall build numbers. The defensible position is that fixed SMA 1000 hotfixes exist, but the exact hotfix must be verified against each appliance and software branch. Until that mapping is complete, exposed systems should remain isolated and both volatile and persistent evidence preserved.

By contrast, we do have actionable version targets for the other two products. The source pack identifies Elementor Pro through 4.2.1 as affected and 4.2.2 as the fix. The immediate sequence is to restrict access, preserve web, PHP, and WAF logs plus a filesystem snapshot, test and deploy 4.2.2, and then inspect uploads, the webroot, and administrator accounts. Evidence of compromise raises the response from patching to clean restoration or rebuilding and credential rotation. For GitLab, vendor-verified fixes are available in 18.11.11, 19.0.8, 19.1.6, and 19.2.4. Teams should preserve evidence, reduce public exposure, deploy the matching fixed release, and review projects, releases, and runners for unauthorized changes. PATs, deploy tokens, and runner credentials should be rotated when the investigation indicates exposure.

The broader lesson is that response precision must track source confidence: an exact version is useful only when the evidence supports it, while an unverified build number can misdirect remediation. With the current technical actions now bounded more responsibly, we can turn to the historical Aktulaev freelancer campaign—not to elevate it into a present emergency, but to extract controls that still apply to modern contractor access and fraudulent-work scenarios.

The Aktulaev case now sits in the right category: a historical control lesson, not an active threat claim. Two measures carry forward directly into today’s contractor and fraudulent-remote-worker risk. First, organizations should independently verify identity, location, and payment ownership rather than inheriting trust from a hiring platform, with re-verification after material changes. Second, contractor access should run through managed endpoints, with internet-origin macros blocked and unauthorized TeamViewer or VNC activity detected.

The evidentiary boundary matters. Aktulaev’s extradition is established historical fact, while the reported 255 accounts, 80,000 targets, and his alleged role remain prosecutorial allegations. Lena found no current operational linkage to the earlier campaign. Fake profiles followed by RAT delivery are common, reusable tradecraft; they do not establish continuity or attribution. A credible continuity assessment would require several corroborating pivots, such as reused command-and-control infrastructure or certificates, matching malware configurations or keys, and connected account, payment, or device fingerprints. Unless those indicators emerge, this item should remain below active exploitation in urgency.

We now turn to Sality because it presents a different operational problem: authorities disrupted key infrastructure by replacing P2P super peers with sinkholes and disabling payload infrastructure, yet reporting continues to describe a substantial residual presence. Alex’s task is to translate that history into a current hunting posture—what defenders can still observe, what disruption did and did not prove, and which signals justify action today.

Sality’s infrastructure disruption removed much of the operators’ ability to issue commands and deliver new payloads, but it did not remove the malware already embedded in affected environments. Infected systems now beaconing to sinkholes are cut off from the disrupted control path, and active payload-hosting URLs were taken down. That is a meaningful containment success, not an endpoint cure.

The scale figures also need careful handling. The reported 11 million unique IP addresses were observed across Sality’s lifetime; they do not represent 11 million concurrently infected machines. Reporting nevertheless places the remaining active population above 15,000. For those systems, the residual risk is local and potentially substantial: infected executables, previously delivered malware, and any secondary persistence can remain after operator control is lost. Sality has historically delivered credential theft, proxy, exploit, and DDoS capabilities, but we do not know which payloads reached any particular endpoint, which credentials may have been captured, or whether additional persistence was established.

The operational response therefore has to extend beyond watching sinkhole traffic. CISOs should initiate enterprise-wide detection and isolation, explicitly covering shared executable repositories and removable media. Before eradication, teams should preserve volatile and forensic evidence—including memory, disk images, infected-file hashes and timestamps, endpoint security records, persistence artifacts, active connections, and available DNS or proxy telemetry—so they can determine what occurred rather than merely confirm infection. That distinction between infrastructure disruption and host-level remediation is the final piece we need as we move into synthesis.