Summary: Google’s Cloud Threat Horizons H1 2026 report documents how threat actor UNC6426 exploited the long tail of the August 2025 nx npm supply chain compromise. Attackers used stolen developer GitHub tokens — acquired during the initial supply chain breach — to abuse GitHub-to-AWS OpenID Connect (OIDC) trust relationships. Within 72 hours, UNC6426 created a new AWS administrator role, exfiltrated data from S3 buckets, and destroyed production infrastructure. This attack reveals a new exploitation phase: long-tail weaponization of previously executed supply chain compromises against organizations that believe the incident is resolved.

Why This Matters for CISOs: OIDC federation is widely adopted precisely to eliminate static cloud credentials — yet when an upstream identity provider (GitHub) is compromised, that trust becomes the highest-value lateral movement vector in your environment. Organizations that patched the original nx supply chain incident and closed their incident response tickets may still have live, exploitable OIDC trust relationships.

Recommended Actions: Audit all GitHub-to-cloud OIDC trust policies. Review and rotate any tokens that may have been exposed in the August 2025 window. Implement conditional trust policies requiring branch and repository protections. Monitor OIDC role assumption events in CloudTrail for anomalous patterns.

View Full Research Note

Summary: Lumen’s Black Lotus Labs has documented KadNap, a malware family targeting ASUS routers that has compromised over 14,000 devices since August 2025. KadNap’s defining architectural innovation is its use of a custom Kademlia Distributed Hash Table (DHT) protocol — borrowed from P2P file-sharing networks — to distribute and conceal the addresses of its command-and-control servers. This design renders traditional C2 detection and sinkholing ineffective: there is no centralized server to block or seize. Compromised devices are recruited as proxy nodes, routing malicious traffic through residential and enterprise IP space while maintaining operator anonymity.

Why This Matters for CISOs: With over 60% of infections in the US, KadNap directly threatens enterprise network perimeters. Beyond the direct compromise risk, organizations whose traffic is proxied through KadNap nodes may appear as the source of attacks — creating reputational and legal exposure. The DHT architecture sets a precedent for botnet C2 designs that will be extremely difficult to dismantle through law enforcement or industry takedown operations.

Recommended Actions: Inventory all ASUS router deployments; apply available firmware patches immediately. Implement network behavioral monitoring to detect unusual outbound proxy traffic from edge devices. Consider network segmentation to isolate router management interfaces from production networks.

View Full Research Note

Summary: SentinelOne researchers (Delamotte, Bromfield, Murphy, and Patne) have documented an active campaign exploiting recently disclosed vulnerabilities — and in some cases weak credentials — in FortiGate Next-Generation Firewall appliances to extract configuration files containing service account credentials and network topology data. The stolen credentials frequently include Active Directory and LDAP service accounts, providing attackers with broad lateral movement capability. Healthcare organizations, government agencies, and managed service providers are the primary targets due to their heavy reliance on FortiGate infrastructure and the severity of downstream blast radius when service accounts are compromised.

Why This Matters for CISOs: FortiGate devices sit at the highest-privilege intersection of network access and authentication infrastructure. Compromising a FortiGate doesn’t just expose network traffic — it hands attackers the credential store that unlocks Active Directory, LDAP, VPN, and downstream SaaS integrations. For MSPs, a single compromised FortiGate can cascade into dozens of customer environments through shared service account architectures.

Recommended Actions: Apply all available FortiGate patches immediately. Rotate all service account credentials stored in FortiGate configurations. Audit LDAP/AD service account privilege levels — apply principle of least privilege. MSPs should review shared service account architectures across customer environments and implement per-customer credential isolation.

View Full Research Note