Signal Brief #3: exploited Metabase, private cyber operations and AI-assisted espionage

Analytical brief

Key findings

• Metabase turns one unauthenticated SQL injection into a wider identity, credential and connected-database problem.
• AI agents are moving from support tooling into operational intrusion workflows, but public evidence still does not justify every headline about fully autonomous warfare.
• Shipping data is becoming ready-made social-engineering context, while hotel networks show that even the path to the login page can be hostile.

Scope

Defender-relevant developments selected as of 14 August 2026, prioritising new CISA KEV entries, current disclosures and campaigns still generating material reporting.

Limitations

This is a prioritisation brief, not a complete threat landscape. Several campaigns remain under investigation. Attribution labels reflect the cited sources and are separated from HECAVEX analysis.

This week’s signal is not one campaign. It is the same operational problem appearing in different clothes: trusted systems, trusted providers and trusted network paths becoming the attacker’s leverage. Patch the exposed software first, then look at identity, third-party data and travel infrastructure. The compromise rarely respects the box drawn around the original alert.

Vulnerabilities to triage

CRITICAL · KNOWN EXPLOITED · PRE-AUTH SQL INJECTION

CVE-2026-72898: Metabase

Affected surface

Unpatched Metabase instances

Attack result

Application-database SQL injection leading to administrative access and connected-data exposure

CISA added CVE-2026-72898 to KEV on 11 August. An unauthenticated attacker can inject SQL into the Metabase application database, gain administrative access, alter configuration, recover stored credentials for connected databases and read or export data available through those connections. This is not merely a dashboard bug. Metabase is often a convenient map of where the useful data lives.

Do now: upgrade to a fixed Metabase release. If the reset-password endpoint was temporarily blocked, treat that as breathing room, not remediation. Revoke active sessions and API keys, review administrator changes and query history, and rotate connected-database credentials where exposure cannot be excluded.

Read the Metabase advisory → · CISA KEV entry →

HIGH PRIORITY · KNOWN EXPLOITED · LOCAL PRIVILEGE ESCALATION

CVE-2026-68820: Windows Ancillary Function Driver for WinSock

Affected surface

Supported Windows systems covered by Microsoft's August update

Attack result

Privilege escalation by an already authenticated local attacker

The use-after-free in the Windows AFD component is not an initial-access shortcut. It is the next step after access. That makes it relevant in ransomware, hands-on-keyboard intrusion and malware chains where a low-privilege foothold needs to become control of the host. CISA added the flaw to KEV on 11 August with a 25 August remediation date for covered agencies.

Do now: deploy the applicable Windows security update, prioritise endpoints where browsers, email clients or internet-facing services provide realistic initial access, and hunt for suspicious privilege transitions around newly created processes and services.

Read Microsoft's advisory → · CISA KEV entry →

HIGH PRIORITY · KNOWN EXPLOITED · NETWORK EDGE DOS

CVE-2026-20349: Cisco ASA and FTD

Affected surface

Cisco ASA and Secure Firewall Threat Defense devices in affected configurations

Attack result

Unauthenticated remote device reload and denial of service

An unauthenticated remote attacker can trigger a heap-inspection flaw and make an affected firewall reload. The result is availability impact rather than code execution, but an internet edge that repeatedly disappears is still an incident. CISA’s KEV remediation date was 14 August, the cut-off date for this brief.

Do now: confirm the exact platform, release and exposed services against Cisco’s advisory, apply the fixed software and review unexplained reloads. If the device is part of a high-availability pair, verify failover behaviour instead of assuming the second node has silently solved the problem.

Read Cisco's advisory → · CISA KEV entry →

Geopolitical cyber signals

WATCH · AI-ASSISTED INTRUSION · ATTRIBUTION LIMITED

Taiwan reports put autonomous agents inside a government intrusion

Research published this week describes a four-day campaign against Taiwanese government systems using an orchestration stack built around the open-source Hermes and OpenClaw agent frameworks. Reporting based on Dream’s findings says the system mapped 21 systems, compromised at least 85 accounts and obtained more than 2,500 personnel records while running up to eight agents in parallel.

The evidence is important, but the wording needs discipline. Public reporting supports AI-assisted and highly automated intrusion activity. It does not independently prove the suspected China nexus, identify the underlying model or demonstrate that every decision was autonomous. Taiwan also acknowledged a July intrusion involving AI-agent assistance, but the public record does not establish that both accounts describe the same operation.

Watch: agent execution logs, exposed orchestration panels, unusual parallel authentication and reconnaissance patterns, and the possibility that a failed path is retried with materially different techniques faster than a human-led playbook normally allows.

Read the report on Dream's findings →

WATCH · CYBER POLICY · PRIVATE OPERATORS

The United States opens a government-controlled path for private offensive cyber operations

A new U.S. memorandum creates a framework under which vetted companies could conduct cyber surveillance and cyber effects operations against foreign cyber-enabled transnational criminal organisations under federal control and oversight. The practical change is not a general licence for companies to “hack back”. It is an attempt to place private capability inside government investigations and disruption operations.

The strategic questions are less exciting than the headline and more important: who owns attribution, how activity is deconflicted with intelligence operations, what happens when an operator hits shared infrastructure, and who carries liability when the target is not what it first appeared to be.

Watch: implementing rules, participant vetting, reporting requirements, operational oversight and how the framework distinguishes criminal infrastructure from state-directed activity.

Read the current reporting → · Read the preceding White House order →

Breaches, extortion and ransomware

WATCH · THIRD-PARTY BREACH · HIGH-CONTEXT PHISHING

Trezor customers exposed through ShipMonk

Trezor says unauthorised access at shipping provider ShipMonk exposed data belonging to 13,689 customers. Full exposure for 11,742 people included name, email, phone number and shipping address. Another 1,947 had name, city and email exposed. Trezor systems, devices and wallet backups were not compromised.

The operational risk is context. A message that knows the recipient bought a hardware wallet and can repeat their address does not need stolen seed material to sound convincing. It only needs the victim to provide it next.

Do now: affected users should distrust support, delivery and firmware-update messages, navigate to Trezor through a known bookmark and never disclose a wallet backup. Defenders should prepare help desks for targeted calls that quote legitimate order details.

Read Trezor's incident notice →

WATCH · LOGISTICS SUPPLY CHAIN · DELIVERY DATA

CEVA Logistics incident reaches Valve hardware customers

Valve notified European hardware customers after a cyberattack affected its shipping partner CEVA Logistics between 29 July and 1 August. Delivery-related data could include names, addresses, postcodes, phone numbers, email addresses and ordered items. Valve says passwords, payment information and Steam Guard codes were not involved.

This is useful data for a second-stage campaign. Fake customs fees, missed-delivery messages and account-verification calls become much more credible when the sender knows which product is on the way.

Do now: treat messages referencing recent Steam hardware orders as untrusted, even when they contain correct delivery details. Organisations should inventory which logistics providers retain customer data, for how long and with what breach-notification route.

Read Valve's confirmed details →

WATCH · RANSOMWARE · STATE-CRIME OVERLAP

Gunra expands while the attribution boundary stays messy

U.S. and South Korean reporting this week warned about Gunra ransomware activity against government and critical-infrastructure sectors. The operation uses a double-extortion model, a cross-platform locker and affiliate tooling influenced by leaked Conti code. Separate South Korean joint-advisory material describes overlap between a state-sponsored intrusion set and Gunra-related activity under the name Operation Double Barrel.

Overlap is not identity. Shared vulnerabilities, infrastructure or access paths can indicate cooperation, access brokering, tool reuse or simply two operators feeding from the same weak perimeter. “State actor plus ransomware” is a hypothesis to test, not a label to paste onto every Gunra intrusion.

Do now: prioritise exposed remote-access infrastructure, preserve evidence before encryption response destroys it, and separate observations about initial access, hands-on-keyboard behaviour, exfiltration and locker deployment. Those phases may not belong to one operator.

Read the current warning → · Read the Operation Double Barrel analysis →

Espionage campaigns

WATCH · KIMSUKY · LOCAL AI WORKBENCH

Operation GitPower shows Kimsuky building an AI-assisted workflow

Genians reports that Kimsuky operators assembled local LLM environments using Ollama, GPT4All and Msty, with RAG, agent and speech-to-text components. The wider operation used GitHub and GitLab as command-and-control channels, encrypted AsyncRAT payloads, LNK files, PowerShell and AI-generated decoy material against diplomatic, military, security and virtual-asset targets.

The most defensible conclusion is that Kimsuky is integrating and testing AI inside an existing workflow. It is not evidence that the group trained its own model or handed the entire operation to an autonomous agent. The old tradecraft did not disappear. It gained a faster research and content-production layer.

Watch: developer-style local AI tooling on systems that do not need it, unusual GitHub or GitLab API traffic, LNK-to-PowerShell chains, encrypted RAT staging and decoys whose language quality is better than the surrounding operational security.

Read the Genians analysis →

WATCH · MIDNIGHT BLIZZARD · HOSTILE TRAVEL NETWORKS

CaptiveCrunch turns hotel Wi-Fi into an espionage delivery path

Microsoft attributes CaptiveCrunch to Storm-2945, assessed as an operational sub-cluster of Midnight Blizzard. Since May, the actor has compromised hospitality captive-portal infrastructure and manipulated DNS and HTTP traffic to redirect travellers through actor-controlled systems. Fake sign-in and update flows were used for credential theft and delivery of surveillance-capable malware including CornFlake.

The important shift is where trust fails. The hotel name can be real, the Wi-Fi network can be the one provided at reception and the portal can still be controlled by the adversary. For diplomats, executives and researchers, travel networking is part of the threat model, not a convenience setting.

Do now: use managed mobile connectivity where possible, require phishing-resistant authentication for sensitive accounts, prevent users from installing browser updates from captive portals and review sign-ins for token reuse after travel. Hospitality operators should monitor portal configuration, DNS changes and administrative access as security-critical infrastructure.

Read Microsoft's CaptiveCrunch analysis →

Bottom line

The urgent queue is straightforward: patch Metabase, Windows and affected Cisco edge devices, then check whether the vulnerable state was used. The wider signal is about trust boundaries. Shipping providers know enough to make phishing believable. Hotel networks can shape the traffic before a user reaches the real service. AI agents can compress reconnaissance and execution time without making attribution any easier.

Do not flatten those developments into one dramatic story. Keep the evidence separate, record confidence and act on the parts you can actually verify.