Cyber Decision LedgerDecision area
Campaign
7 public Decision Records in the whole ledger carry this label. Back to the full Ledger →
Decision Records
Separate tracking for distinct incident classes
Do not treat the discussed incidents as one homogeneous campaign on the current packet evidence. Track separate evidence classes for CI/CD control-plane abuse, water-sector operational control exposure, identity trust abuse, cloud malware, SaaS or token exposure, and supply-chain activity until shared technical pivots justify merging them.
On the current packet evidence, do not merge the discussed activity into one broad campaign. Track the incident classes separately and revisit the linkage decision if credible shared technical pivots are attached.
Microsoft 365 calendar and Graph abuse telemetry
Instrument Microsoft 365 and Graph telemetry to hunt for unusual calendar creation and attachment activity, far-future events, abnormal Graph API use, OAuth and Entra token changes, suspicious endpoint configuration files, and DNS-tunnel fallback behavior.
SOC teams should add hunting coverage for abnormal Microsoft 365 calendar and Graph activity, unusual OAuth or Entra token behavior, suspicious endpoint configuration files, and fallback DNS tunneling patterns associated with SaaS abuse.
DevMan and Funky Mantis ransomware readiness posture
Do not change the OT threat model around an unverified industrial locker claim. Monitor affiliate tooling and hunt Windows, Linux, and ESXi ransomware behavior while hardening identity, backup, virtualization, and IT-to-OT recovery choke points.
Treat the reported industrial locker capability as unconfirmed unless sample-level evidence emerges, but use the ransomware-service reporting to harden identity, backup, virtualization, and IT-to-OT recovery paths and to hunt common Windows, Linux, and ESXi ransomware behavior.
Split CMS webshell incidents from exposure-only cases
Use an evidence-based split: isolate confirmed compromised CMS hosts with webshell evidence, preserve evidence, rotate related credentials, and rebuild from clean media; if there is only matching exposure without shell evidence, patch and hunt, remove public admin paths, and add WAF/CDN controls.
For public CMS hosts with confirmed webshell evidence, treat the host as an incident: isolate it, preserve evidence, rotate related credentials, and rebuild from clean media. For exposure without compromise evidence, patch and hunt, remove public admin paths, and add WAF/CDN controls. Avoid product-specific or global-campaign claims until authoritative details are attached.
Treat Canonical/Ubuntu hacktivist claims as availability triage absent supply-chain evidence
Treat the Canonical/Ubuntu pro-Iran hacktivist claim as geopolitical disruption context and availability-risk triage, not as assumed Iranian state tasking or Ubuntu supply-chain compromise, unless authoritative evidence shows deeper impact.
Treat public pro-Iran Canonical/Ubuntu disruption claims as availability and context triage; do not assume Iranian state tasking or Ubuntu package/supply-chain compromise absent authoritative impact or integrity evidence.
Brief incidents as separate lanes with a delegated-trust pattern
Do not brief the day’s incidents as one grand control-plane campaign. Track a narrower delegated-trust abuse pattern across identity, workflows, packages, agents, and cloud services while keeping CMS webshelling, weak wallet randomness, and conventional exploitation in separate operational lanes.
Brief the incidents as separate operational risk lanes while tracking a narrower delegated-trust abuse pattern across identity, workflow, package, agent, and cloud-service contexts. Avoid presenting unrelated CMS exploitation, weak wallet randomness, or conventional exploitation as one campaign.
Restrict Microsoft 365 trust-enrollment and session-persistence paths
Restrict new passkey, security-key, authenticator, phone, and recovery-method enrollment for high-risk users to managed devices, trusted networks, or verified help-desk workflows; limit broad device-code authentication where feasible; revoke suspicious sessions, refresh tokens, OAuth grants, and attacker-added authentication methods.
Microsoft 365 tenants should harden trust-enrollment and session-persistence controls now: restrict new authentication-method registration for high-risk users, limit device-code authentication where feasible, and review or revoke suspicious sessions, refresh tokens, OAuth grants, and added authentication methods. Named campaign details in the source packet are treated as source-reported rather than independently confirmed.