Session CRT-20260915 — 15 September 2026 · Morning Edition

Halil, the dividing line is not CVSS; it is whether the exploit closes the chain. Marimo exposed while vulnerable must be treated as potentially compromised. Sysdig documents pre-auth RCE through one WebSocket connection, an interactive shell, exploitation within ten hours of disclosure, and .env credential theft. Isolate, preserve evidence, patch, rotate exposed credentials, and hunt downstream. GitLab is potential secret compromise, not automatically host compromise: CISA and Rapid7 describe active exploitation of an unauthenticated arbitrary-file-read primitive. Patch immediately and rotate accessible tokens, SSH keys, and database credentials; escalate to host rebuild only with second-stage execution, persistence, integrity changes, or missing telemetry.

For JFrog Artifactory, ScreenConnect, and MikroTik, KEV inclusion proves exploitation somewhere—not exploitation of your system. Internet exposure during the vulnerable window requires isolation, evidence preservation, patching, and hunting. Call it compromised only when you find exploit requests, unauthorized identities or configuration changes, unexpected processes/connections, or when critical telemetry is absent. Otherwise, patch plus validated hunting is enough. Adobe Commerce CVE-2026-75650 remains an evidence gap here: I cannot justify compromise treatment without verified exploitation mechanics or local indicators; patch and investigate exposure, but do not invent an incident.

First 30 minutes: 0–5: freeze changes, identify versions and external reachability, block public administrative access. 5–10: isolate exposed Marimo and any system showing indicators; preserve logs and snapshots before rebooting. 10–20: apply fixes or mitigations; rotate GitLab- and Marimo-accessible secrets. 20–30: hunt for exploit requests and post-exploitation activity, then open incidents where evidence exists—or exposure coincides with unusable telemetry. Claims of worm-like spread or coordinated exploitation are weak: the cited evidence shows KEV status, probing, and multiple Marimo operators, but no demonstrated autonomous propagation or shared campaign control.

The evidence supports a bounded judgment:

• Intrusion/tool use — moderate confidence: Kaspersky reports Gorilla RAT and destructive tooling; Hacking Cat admits some tools were theirs.
• Exchange exploitation — low-to-moderate: Reported as initial access, but no CVE, victim telemetry, or infrastructure corroboration is presented. ATT&CK chain: public-facing application exploitation → remote access → destructive impact.
• Victims and impact — low: Russian targeting is reported, but specific victim attribution, outages, data loss, and recovery outcomes lack independent confirmation.
• Attribution/motive — moderate for some Hacking Cat activity; low for the ransomware: The group explicitly denies owning the lockers. Its pro-Ukraine posture supports a disruptive motive but does not establish state direction.

Assessment: Nemo Wiper makes disruption the strongest explanation, at moderate confidence. Monetization is low confidence because no payment evidence is presented; cover is also low because destruction alone does not prove concealment. If attribution is wrong, defenders should still patch and inspect Exchange, hunt the exploitation-to-RAT-to-destruction sequence, isolate backups, and preserve telemetry. What changes is actor-specific IOC prioritization and assumptions about motive—not the incident-response sequence.

The Canadian Cyber Centre reports an AI-enabled global campaign against internet-exposed PLCs, while CISA separately confirms activity targeting water-sector PLCs. But “agentic AI” is not established by the cited evidence: AI-generated tooling or reconnaissance does not prove autonomous planning or direct PLC control. Likewise, pressure-valve manipulation, operator lockout and device disabling remain campaign-reported impacts unless corroborated by controller logic/configuration, historian trends, authentication records and physical instrument readings. I found no cited evidence confirming contamination, injury or equipment damage.

At Purdue Levels 1–2, pressure manipulation could create overpressure, interrupt treatment or force a shutdown. Yet blindly unplugging an affected PLC could also remove operator control or disrupt safety communications. For the next shift: put an operator and process-safety lead at the process; compare HMI values with independent gauges; confirm interlocks and manual fallback; preserve controller configuration, logs and historian data; then block unsolicited internet and vendor access at the Level 3/DMZ boundary. Do not reboot, download logic, rotate controller credentials or change segmentation while the process is running without validating the effect.

If operators cannot trust process visibility or maintain safe limits, transition deliberately to the engineered safe state and only then isolate the controller. Otherwise, contain upstream while keeping essential control paths intact. Firmware remediation belongs in a tested maintenance window, with temporary firewall allowlisting and tightly controlled engineering access until then.

Halil, these are three separate risk events:

• Symbiosis — fact: A BridgeV2 flaw enabled roughly 46.1 billion unauthorized syBTC to be minted. That figure is token supply—not 46.1 billion BTC or dollars stolen. Shallow liquidity reportedly limited conversion to about 4.39 WBTC, worth roughly $336,000. Symbiosis reportedly recovered about 15 BTC into a team multisig and paused native-Bitcoin routes.
• Assessment: The mint initially created accounting inflation and potential redemption liabilities. Realized theft is the value actually extracted or left as an LP deficit. Protocol insolvency exists only if legitimate claims and deficits exceed recoverable reserves. Without reconciliation of remaining fake syBTC, LP losses, valid claims, and recovered BTC, neither insolvency nor full recovery is established.
• Liquid — unknown: Available reporting only compares Liquid with incidents creating unbacked wrapped-Bitcoin assets. It does not establish a shared exploit, attacker, loss figure, or laundering route. Liquid should therefore remain a separate case.

Revolut — fact: Attackers reportedly used fraudulent information requests sent from a legitimate government-agency email domain. Compliance staff exported identity and financial records—including passports, selfies, IBANs, withdrawals, and Bitcoin transaction histories—after treating the requests as lawful. Revolut said its core systems and customer funds were not compromised. This is a trusted-channel social-engineering and identity-data breach, followed by extortion—not a smart-contract or blockchain-consensus failure.

Actions: Protocol operators should keep affected routes suspended, fix and audit BridgeV2 authorization, and publish a chain-by-chain balance sheet covering unauthorized supply, attacker balances, LP deficits, legitimate liabilities, and recovered assets. Exchanges should block deposits of unbacked assets, monitor identified wallets, and freeze funds reaching KYC accounts. Affected Revolut customers should expect highly tailored impersonation, monitor withdrawals and account recovery attempts, replace compromised identity documents where authorities permit, and independently verify every government or support request.