Desk note: No live news retrieval was available for this filing. The five threads below are documented, ongoing campaigns and regulatory deadlines, not confirmed same-day disclosures. Figures are attributed to named primary reports and flagged for verification before publication. No verbatim expert quotation has been invented; three attribution slots are marked for the copy desk.

The Master-Key Problem

Rekeying a hotel after the master key has been copied does not retrieve the copies. It only decides which door the thief tries first. That is the operational position of every organisation that patched an on-premises SharePoint farm during the ToolShell exploitation wave and left the stolen ASP.NET machine keys in place — patched, compliant, and still owned.

Five threads now dominate the threat-intelligence board: state-linked interception of telecom infrastructure, mass exploitation of internet-facing edge and collaboration servers, self-replicating package-registry worms, extortion that no longer requires encryption, and the first vendor-documented intrusion sets orchestrated largely by an AI agent. Taken together they mark the point at which the intelligence cycle — collection, analysis, dissemination — has fallen behind the exploitation cycle it exists to describe.

Your EDR Does Not Live on the Router

The structural failure is not detection quality; it is collection coverage. Endpoint detection and response assumes an agent, a kernel, and a filesystem. The devices being targeted — VPN concentrators, load balancers, IOS XE routers, on-prem collaboration farms — offer none of those in a form a commercial sensor can instrument. Salt Typhoon's documented tradecraft is deliberately uninteresting to signature-based tooling: valid credentials, native configuration commands, modified ACLs, GRE tunnel manipulation. Nothing detonates. Nothing writes a PE header to disk. The intelligence product that would catch it is a configuration diff against a known-good baseline, which most enterprises neither capture nor retain.

The consequence is an asymmetry that mainstream coverage misses: adversaries are operating in the one network segment where defenders have no telemetry and no forensic timeline, then pivoting into segments where telemetry exists but is trusted implicitly because the traffic arrives from the management plane.

Attribution slot 1 — primary statistic. Verizon's 2025 Data Breach Investigations Report recorded exploitation of edge devices and VPNs as an initial-access vector rising roughly eightfold year-on-year to 22% of vulnerability-exploitation breaches, with only about 54% of those edge vulnerabilities fully remediated during the measurement period and a median remediation time of 32 days.

Desk action: confirm figures against the published DBIR 2025 vulnerability-exploitation section; pair with an on-record CISA or NCSC statement on edge-device patch latency.

The Registry Is the New Tier-Zero

Supply-chain compromise has been discussed for a decade as a theoretical multiplier. The npm worm lineage made it mechanical. The pattern is consistent: phish a maintainer, publish a poisoned patch release, execute a postinstall script that runs a legitimate secret-scanner against the build environment, exfiltrate cloud and registry tokens to an attacker-controlled webhook, then republish using the stolen tokens. Propagation is a function of dependency graph density, not attacker effort. A single compromised package with millions of weekly pulls becomes thousands of compromised pipelines within hours.

The under-reported implication is a governance one. Build systems now hold more standing privilege than most production workloads — publishing rights, cloud federation tokens, signing material — yet they sit outside the identity tiering that protects domain controllers. Under the EU Cyber Resilience Act, whose Article 14 actively-exploited-vulnerability reporting duties began applying on 11 September 2026, a manufacturer that cannot reconstruct which build artefacts consumed a poisoned dependency cannot meet a 24-hour early-warning obligation. Software composition analysis is no longer a procurement formality; it is the disclosure-readiness control.

In Defence of the Disclosure Clock

It is fashionable to dismiss the CRA, NIS2 and their national equivalents as compliance theatre that taxes vendors while attackers ignore deadlines. That reading is too cheap. Mandatory 24-hour early warning creates something voluntary sharing has never produced at scale: a legally compelled, time-bounded signal from the manufacturer to the CSIRT network, with a defined recipient and an audit trail. The 2017 Equifax failure and the 2023 MOVEit cascade both turned on information held privately for weeks. Regulation does not stop exploitation, but it converts private knowledge into a public indicator on a schedule defenders can plan against. The legitimate objection is capacity, not principle — and capacity is a budget question, not a philosophical one.

NotPetya, Nine Years On

The closest precedent is June 2017. NotPetya propagated through a compromised Ukrainian accounting-software updater, and Maersk reinstalled roughly 4,000 servers and 45,000 endpoints at a cost near $300 million; the 2018 White House assessment put total damages around $10 billion. Indicators existed. They did not travel as fast as the dependency graph. The lesson was never "share more IOCs" — it was that intelligence distributed at human speed loses to propagation at machine speed, and that recovery capability outperforms prediction.

The economics have since inverted in a way that matters for forecasting. Chainalysis measured ransomware payments falling 35% in 2024 to approximately $813 million from $1.25 billion in 2023, even as incident volume held or rose. Fewer payments, more intrusions, and a shift toward extortion-only leverage means the encryption event that once triggered detection has been removed from the kill chain.

Attribution slot 2 — primary statistic. Chainalysis, 2025 Crypto Crime Report: ransomware payments of ~$813.55m in 2024, down ~35% year-on-year.

Desk action: corroborate against Coveware quarterly extortion-without-encryption share; UnitedHealth's congressional testimony confirming a $22m BlackCat payment remains the strongest on-record datapoint on payer behaviour.

When the Analyst Becomes the Bottleneck

Anthropic's GTG-1002 disclosure described an intrusion set in which the model executed the substantial majority of tactical work — reconnaissance, credential harvesting, lateral movement decisions — with human operators intervening at a small number of approval gates. If that ratio generalises, the operational half-life of an indicator collapses below the review latency of most sharing communities. An IP address or TTP that is valid for ninety minutes cannot survive a MISP event that takes a day to sanitise, classify under TLP, and distribute. The industry's formats were designed for campaigns measured in weeks. Machine-speed adversaries invalidate the premise.

Sovereignty Has a Cost Curve

The concentration argument cuts both ways. Dependence on a handful of US-headquartered telemetry providers is a genuine single-point-of-failure risk for European and Asian critical infrastructure, and the political case for sovereign collection is coherent. But fragmented national stacks produce narrower baselines, and narrow baselines are precisely what allows a campaign to run across eighty jurisdictions without tripping a threshold. Pooled commercial telemetry is, empirically, what surfaced Salt Typhoon and ToolShell at scale. The defensible position is not autarky; it is sovereign retention and independent validation layered over shared collection — a national capability to verify a vendor's claim, not to replace it.

Attribution slot 3 — independent voice. Anthropic's GTG-1002 autonomy percentage is vendor-reported and not independently replicated.

Desk action: obtain an on-record sceptical assessment from a named academic or CERT researcher on human-in-the-loop measurement before publication. Balance is mandatory here.

What to Do This Quarter

  • Rotate after you patch. Machine keys, service-account secrets, API tokens and signing material. A patched server with stolen keys is still compromised.
  • Promote CI/CD to tier-zero. Short-lived OIDC federation instead of standing registry tokens; disable postinstall script execution in build agents; pin and hash-lock dependencies.
  • Instrument the edge out-of-band. Export NetFlow and configuration snapshots from every internet-facing appliance to a collector the appliance cannot authenticate to.
  • Tabletop extortion without encryption. Assume exfiltration only, no ransom note, and a regulator asking questions within 24 hours.
  • Harden the help desk. Phishing-resistant MFA and out-of-band identity verification for password and MFA resets remain the highest-yield control against social-engineering-led intrusion sets.

Six Months Out: April 2027

Expect the first CRA Article 14 notifications to establish an early enforcement pattern, and expect that pattern to be narrower than the compliance industry predicts — a handful of precedent-setting cases against manufacturers with demonstrable internal knowledge and delayed reporting. Expect detection engineering to shift decisively from payload signatures to identity and configuration drift, because extortion-only operations have removed the detonation event. Expect at least one registry-scale worm to force a major ecosystem to disable postinstall execution by default, breaking a decade of build conventions. And expect the term "threat intelligence" to bifurcate: machine-consumed indicators distributed in minutes to automated controls, and a smaller, slower, genuinely human product sold to boards. The organisations that suffer will be those still routing the first category through the second.