< Back
Episode #
5

Agentic Overload: The Rise of AI Exploits and the "Wet Bandit" APT

This week on Dragon News Bytes, Will Baxter and Will Thomas dive into a week defined by "Paradigm Shifts." We break down how top-tier state actors like Salt Typhoon are abandoning traditional phishing to live inside your edge infrastructure and how a new era of Agentic AI is creating a "One-Click RCE" nightmare for enterprise security teams.

Plus, we look at the "Wet Bandits" of the APT world—a state-aligned group that remains surprisingly easy to hunt—and discuss why the latest hoax from 0APT was a "Vibe-Op" designed specifically to waste your team's time.
‍

Topics & References:

Part 1: The Edge is the New Endpoint

  • Salt Typhoon’s European Pivot: Norwegian intelligence (PST) confirms that Salt Typhoon is bypassing EDR entirely. They are now persisting inside edge gateways and telco infrastructure using the D-Knife Linux-based implant.
  • TGR-STA-1030 (The Shadow Campaigns): A state-aligned group targeting global ministries of finance. Their tradecraft includes using Mega[.]nz for C2 to blend in with legitimate business traffic.
  • Critical Takeaway: If your detection strategy assumes compromise starts on a laptop, you’ve already lost the battle. The "Metal Layer" of the network is the current battlefield.

Part 2: Emerging AI Threats & "Vibe-Ops"

  • OpenClaw & Agentic AI (CVE-2026-25253): We examine the birth of the "Agentic Supply-Chain Attack." Malicious AI "skills" are now being used to exfiltrate tokens via WebSocket hijacking.
  • 0APT: Anatomy of a "Vibe-Op": Claims of a new ransomware operation targeting retail and healthcare turned out to be a low-capability hoax. We discuss why this was a "resource-drain operation" intended to panic security teams rather than a technical breach.
  • Operation Neusploit: Zscaler observes APT28 (Fancy Bear) weaponizing Microsoft RTF vulnerabilities (CVE-2026-21509) at "wartime tempo"—just days after the patch was released.

Hunter’s Field Notes (Immediate Action):

  • Hunt for D-Knife: Look for any Linux process on Cisco or Fortinet appliances spawning a shell, or outbound connections from management interfaces not tied to update daemons.
  • Mega[.]nz Monitoring: Flag high-volume uploads to Mega[.]nz from Server VLANs or Service Accounts. Ask, "why is a domain controller talking to Mega?"
  • AI Socket Hunting: Monitor for unfamiliar WebSocket (WS/WSS) connections initiated from workstations to external IPs during browser navigation windows.

Events & Community:

Connect with Us:

Disclaimer: The views expressed in this podcast are those of the hosts and do not necessarily reflect the official policy or position of our employers.