Session CRT-20261023 — 23 October 2026 · Morning Edition

An unexplained successful GlobalProtect session with no corresponding IdP or MFA event now crosses the operational threshold from exposure to presumed breach. James’s first 30 minutes prioritize evidence preservation, session termination, account and IdP revocation, and immediate segmentation of VPN pools from virtualization, backup, identity, management, and secrets infrastructure. The important caveat is sequencing: do not reboot or upgrade before securing volatile evidence and relevant logs. Containment should then expand according to observed activity, while credential rotation remains focused on credentials shown to have been exposed or used.

For the ConnectWise activity, the room now has a more disciplined way to describe scope. The reported 2,250 tenants represent a possible authorization surface, not 2,250 confirmed compromises, and roughly 2,900 sign-ins per minute describes attack throughput rather than successful access. Each tenant must be classified separately as reachable, targeted, authenticated, acted upon, or subject to privilege and persistence changes. Storm-0940 attribution increases confidence about the operator, but it does not by itself prove impact in any tenant. Reports of elevated application privilege in one tenant are serious evidence for that tenant, not a basis for generalizing across the full population.

The government warning on SafePay adds board relevance by validating a repeatable loss path—edge or credential compromise, defensive-control disablement, theft, backup disruption, and encryption—rather than by making the cumulative victim count more meaningful. The proposed readiness test is concrete: isolate the simulated intrusion within 30 minutes, prevent production credentials from altering immutable recovery copies, and integrity-verify and restore a Tier-1 service within the lesser of eight hours or its approved RTO while meeting RPO. We still lack the requested assessment of the two mobile campaigns, so no mobile-risk conclusion should be inferred from this round. The next question is where containment should stop: which evidence justifies patch-and-hunt, and which findings require isolation, rebuilding, or a declaration that integrity can no longer be trusted.

The escalation boundary is now sharper: a lack of detections is meaningful only when the environment had enough historical visibility to detect the relevant behavior. On a sparsely monitored, internet-facing server, reported pre-disclosure activity, working exploit research, and persistent PHP-worker behavior create an exposure window that newly enabled logging cannot reconstruct. That does not prove exploitation, and neither the estimated population of 22 million systems nor the uncertain success rate for CVE-2026-109619 should be treated as proof. It does mean host integrity may be unprovable—and that condition itself supports taking the server out of service rather than leaving it exposed while hunting.

The practical response is therefore more precise than either “patch everything and watch” or “automatically rebuild every exposed host.” Remove an inadequately observable host from the load balancer, preserve a snapshot, patch it, and restart every PHP worker so potentially persistent worker state does not survive remediation. A FortiGate signature configured only to Pass is detection, not a compensating preventive control. Patch-and-hunt without isolation is defensible only where retained, synchronized, off-host telemetry spans the full exposure window and covers HTTP requests, PHP and web-server failures, process ancestry, child processes, file writes, network and DNS activity, and integrity changes across webroots, temporary directories, scheduled jobs, services, and SSH keys. James’s agreement reinforces the need to correlate suspicious upload and POST activity, but we still do not have case-specific evidence establishing execution or persistence on any particular host.

That distinction—between a control appearing to exist and being provably effective across every relevant runtime—takes us directly to eMudhra. The next step is to turn distrust status into a pass/fail control for tonight, accounting not just for browsers and operating systems but also private trust stores, Java runtimes, containers, appliances, and code-signing paths that may retain independent trust.

The eMudhra issue has now become an evidence-based go/no-go control rather than a general assurance that browser or operating-system distrust is underway. A pass requires an authoritative inventory covering all eight affected keys and 16 certificates, including cross-signs, followed by machine-generated scans across every relevant validator class: native trust stores, Java runtimes, application bundles, containers and dormant images, appliances, TLS-inspection systems, mTLS endpoints, and code-signing enforcement points. Removal alone is not enough; dependent certificates must be replaced, affected services restarted or images redeployed, and the resulting state demonstrated.

The strongest element is the negative testing requirement. Each production validator class must reject an affected or subordinate test chain while accepting its replacement. That means testing both directions of mTLS and confirming that an affected code-signing chain can no longer authorize execution. Revocation of the intermediates and cross-signs is necessary, but not sufficient, because some clients may not enforce CRL or OCSP checks, and Certificate Transparency does not itself eliminate private trust paths. The binary failure condition is equally important: if even one dependency remains unscanned, a trust store cannot be exported, or rejection cannot be demonstrated, the organization cannot claim eradication tonight. The response’s final containment wording was cut off, so we should not infer a more specific isolation procedure than the evidence provided.

We now turn from trust-chain eradication to the reported Sandworm/UAC-0099 operation against a Ukrainian grain company. The decision-relevant question is what the apparent sequencing and division of labor add beyond the existing threat picture—particularly whether they change attribution confidence, defensive priorities, or expectations about how access is converted into destructive action.

The key change is that this incident now looks like an operational handoff between two threat actors, not merely overlapping activity. According to ESET’s telemetry, UAC-0099 established access to the Ukrainian grain company in July 2025; Sandworm subsequently used that compromised environment and Group Policy to distribute SDelete in September. MythicRatatoskr supported data theft and command execution over Yggdrasil, although ESET could not determine which group operated that tooling. The technically supported conclusion is therefore collaboration and shared access across distinct phases of the intrusion.

That evidence does not establish the larger geopolitical claims that might be tempting to draw from it. It does not prove that Russia’s GRU directed, funded, controlled, or centrally tasked UAC-0099, nor does a single victim establish a coordinated regional campaign against the grain sector. Elena’s assessment is appropriately narrower: the evidence strongly supports operational coordination, while command hierarchy and strategic sponsorship remain unresolved. With no peer consultation recorded here, we should also treat that interpretation as a well-grounded expert judgment rather than an independently tested roundtable consensus.

The wider significance may lie beyond the damaged systems. Ukraine’s agricultural exports are already under pressure from Russian physical attacks on seaports, and Reuters has reported that Ukraine reduced its 2026/27 grain-export forecast by as much as 12%. Against that backdrop, destructive cyber activity targeting a grain company could amplify uncertainty among shippers, insurers, ports, buyers, and technology providers. Elena’s proposition—that confidence in the export corridor may be the ultimate target—is strategically plausible, but remains a hypothesis rather than a demonstrated campaign objective. As we move to synthesis, the disciplined takeaway is to preserve both sides of that distinction: the operational collaboration is strongly evidenced; the broader chain of command, campaign scope, and intended economic effect are not yet proven.