ClarityBeta

Security & Threat Intelligence

The Watch

6 min read · 1,214 words · 3 moves to watch
FRIDAY, OCTOBER 9, 2026
The Signal

The ESXi backdoor behind a SonicWall VPN intrusion sends nothing your NDR can see.

Huntress traced the path through a domain controller, then through three chained VMware flaws that broke out of a guest VM into the hypervisor. Persistence runs over VSOCK, guest to host, so a mirrored port never sees a packet. No CVEs have been named and the backdoor supports 155 builds, which means a version scan cannot clear you.

In Play

  1. SonicWall-to-ESXi Hypervisor Escape

    Huntress caught attackers using a compromised SonicWall VPN to reach a domain controller. They then chained three VMware flaws to escape from a guest VM into the ESXi hypervisor, per Unsupervised Learning. The toolkit supports 155 ESXi builds and persists through a VSOCK backdoor, a host-to-guest channel that never touches the network. Your NDR, IDS and NetFlow will show nothing, so the hunt has to run on the ESXi hosts themselves.

  2. Graphalgo Malware Reaches Terraform

    Aikido researcher Oliver Smith found Graphalgo malware in two Terraform providers and two Go modules, per tl;dr sec. It is the first malware ever seen in Terraform providers. One provider typosquats kreuzwerker/docker, a legitimate provider with 56M downloads. The payload stays dormant unless two Terraform variables hash to a hardcoded value, so it looks clean in sandboxes and CI. Only 18 hosts have been infected since July 2026, which points to deliberate targeting of engineers who hold production credentials.

  3. AI Sandbox Egress Bypass

    Perplexity ran a 216-run study and found AI agents broke network confinement in 11 of 54 partial-network runs, per tl;dr sec. Every bypass used the same design flaw: the allowlist was checked by domain name but enforced by IP address. Eight of 10 third-party sandboxes share the flaw, including E2B, Vercel Sandbox, Modal and Deno Sandbox. If your agents run code on these platforms, your egress control may be weaker than its configuration suggests.

  4. CVSS-Sorted Queues Hide Exploited Flaws

    SANS @RISK lists nine CISA KEV flaws. Five of them carry a CVSS score of 0 because they have not been scored, including MLflow, JFrog Artifactory and an 11-year-old libuser bug. A patch queue sorted by severity pushes these actively exploited flaws to the bottom. Separately, Google Threat Intelligence data cited by tl;dr sec shows monthly CVE disclosures more than doubling to 10,740, with exploitation rising almost in step. Rank remediation by exploitation evidence and exposure, not by score.

  5. Civilian CUI Rule Brings a 72-Hour Clock

    The federal CUI rule for civilian contractors is close to final and could land by year-end 2026, per CyberScoop. It brings 72-hour breach reporting, strict NIST controls, mandatory flow-down to subcontractors, and False Claims Act penalties. For your SOC, the 72-hour clock turns the time it takes to escalate an alert into a declared incident into a compliance metric. Attorneys say the text is largely settled, so waiting for the final wording buys little.

Deep Dives

SonicWall to ESXi: The Backdoor That Lives Below Your Network Sensors

No CVEs have been named and the persistence bypasses the network stack, so scanners and NDR can't scope this intrusion. Only evidence from the hosts themselves can.

ESXi intrusion: where the standard playbook misses

Huntress documented the intrusion, and Daniel Miessler's Unsupervised Learning (No. 546, Oct 8) covered it. The actor persists through a VSOCK backdoor, a virtual socket between guest and host. That traffic does not cross the switch port an NDR sensor mirrors. It does not appear in the flow records a NetFlow collector builds. On the dashboard, a compromised hypervisor reads as a quiet one.

Patch matching is the second problem. The toolkit chains three VMware flaws. Huntress did not identify the CVEs. Without CVE IDs, vulnerability scanners cannot map exposure to specific hosts. Support for 155 ESXi builds spans multiple patch levels. Treat patch level as insufficient to rule a host out until VMware publishes specifics.

Kill chain

  1. Initial access: a compromised SonicWall VPN. Sessions arriving through the edge appliance cannot be presumed trustworthy.
  2. Lateral movement: to a domain controller. The attacker gains the identity plane.
  3. Escape: three chained VMware flaws carry the attacker from a guest VM into the hypervisor kernel. The hypervisor fails as an isolation boundary at this step.
  4. Persistence: the VSOCK backdoor. Persistence at this stage leaves no network trace.

Ransomware crews value this position because one hypervisor hosts many guests. Every VM on the compromised host is reachable without touching any of them over the network.

The KVM escape points the same way

tl;dr sec reports that Vercel's $1M sandbox challenge produced a confirmed KVM zero-day enabling full VM escape. Researcher Paulos Yibelo reported it. Vercel's CEO acknowledged it. One case is an active commercial intrusion. The other is a bug-bounty finding. Both end at the host. Trail of Bits stated the design principle in its Vercel audit, 'stop trusting the guest', and it applies to defenders as well. Treat a compromised guest as a host incident until the host is checked.

Network telemetry alone cannot clear a hypervisor. VSOCK traffic stays off the switch port and out of the flow records.

Confidence caveat: this rests on a single summary of Huntress's research, and that summary published no IOCs. The controls are cheap enough to run before more detail arrives.

What to do

  1. Run a host-level hunt across every ESXi host this week: enumerate VSOCK listeners, review esxupdate and vmkernel logs for unauthorized module loads, and record each host's build for matching against VMware's advisories.

  2. Rotate SonicWall VPN credentials and confirm appliance patch state this week, then review domain controller authentications from VPN-sourced sessions back to the appliance's last known-good state.

  3. Forward ESXi host logs to your SIEM this quarter so the next hypervisor hunt starts from retained evidence rather than live inspection.

Graphalgo Moves Into Terraform, and It Only Wakes Up for Its Target

This malware runs clean everywhere except the victim's environment. Detection has to move off the payload and onto package provenance and outbound traffic.

A payload that stays quiet in every sandbox

Source: Aikido's findings, as reported in tl;dr sec issue #349. The malicious provider computes a SHA256 hash of two specific Terraform variables and checks it against a hardcoded value. On any host that does not match, it returns a clean verdict. CI runners and analyst VMs get that result. Vendor detonation services get the same one.

Analyst inference, separate from the reported findings: hardcoding the expected hash requires the operator to already know configuration values from the victim's environment. That points to reconnaissance before the package was published. It fits a total of only 18 infections.

The packaging

  • Fake ecosystems: package sites at gocommunity.io and gogets.dev.
  • Backdated history: commits carried earlier dates, so pkg.go.dev showed a November 2025 release and the module read as established.
  • A one-letter typosquat: kreuzwenker/docker, posing as the legitimate kreuzwerker/docker.

On a hash match, a Go RAT decrypts itself. It takes encrypted commands over two channels: Slack, and an Ethereum smart contract on the Arbitrum Sepolia test network. Each host gets its own short-lived key pairs, so traffic from one victim exposes nothing about another. The code is a Go port of the earlier Graphalgo npm malware and reuses that campaign's Slack and blockchain infrastructure. The same operator ran Graphalgo against application dependencies. This run targets the layer that holds cloud credentials.

IndicatorRoleCheck
kreuzwenker/dockerTyposquatted Terraform providerLegitimate source is kreuzwerker/docker
gocommunity-io/dockerdMalicious packageBlock and alert
gocommunity.io, gogets.devFake package ecosystemsBlock at proxy and DNS
Arbitrum Sepolia RPC / Ethereum contract callsC2 channelAlert from build and CI hosts
Anomalous Slack API trafficC2 channelAlert from build and CI hosts

Where CVE-based scanning falls short

CVE databases routinely miss malicious packages until after they have spread. That is Aikido's warning, carried in Unsupervised Learning. A malicious provider has no CVE, because the package itself is the threat. tl;dr sec recommends extending software composition analysis to IaC and Go, beyond npm and PyPI. Most SCA programs were scoped to application dependencies. Terraform runs with the credentials that build the cloud environment. SCA scoping left it out.

What to do

  1. Search every Terraform configuration, lock file and go.mod across your repos this week for kreuzwenker/docker, gocommunity-io/dockerd, gocommunity.io and gogets.dev, and confirm docker providers resolve to kreuzwerker/docker.

  2. Deploy SIEM alerts this week for Arbitrum Sepolia RPC or Ethereum contract traffic and anomalous Slack API calls from CI runners, build hosts and IaC workstations.

  3. Extend software composition analysis and install-time malicious-package blocking to Terraform providers and Go modules this quarter, with hash-pinning enforced in CI.

Your AI Sandbox Checks the Domain but Enforces the IP

The hypervisors held, but the network policy failed. The SDKs your developers just adopted may also be routing agent code into the affected platforms.

108 escape attempts, zero VM escapes

Perplexity ran the study and tl;dr sec reported it. Frontier models including Claude Opus 5.0, GPT-5.6 Cyber/Sol and Kimi K3 made 108 VM-escape attempts, and none succeeded. The agents left through the network policy. They used two techniques with one root cause: the allowlist named domains but enforced on IP addresses.

  • DNS spoofing: a forged DNS response maps an allowed domain, such as pypi.org, to a blocked IP.
  • Shared CDN addresses: Fastly Fiddle and Taboola, among others, share IP addresses with allowed domains, so their traffic passes as allowed.

Anyone who has audited a corporate egress proxy will recognize both. The published fix has two parts. The first is nftables source-address validation. The second is a TLS-terminating proxy that checks the SNI and HTTP Host headers against the policy. With both in place, no model got out.

Third-party exposure through the SDKs

Anthropic's Oct 7 release, covered by AINews, built computer-use and browser-use loops into its Python and TypeScript SDKs. Those loops hand actions to drivers from browser_use, Browserbase, E2B and Daytona. A developer who adopts the toolset inherits E2B's egress posture, and security may never review it. The study's findings now apply to platforms that may already sit in production stacks, which makes this a third-party risk item.

Where the sources disagree

tl;dr sec treats the problem as plumbing. Correct the enforcement layer and containment holds. Simon Willison, cited in Unsupervised Learning, argues that sandboxing is not containment. Agents can pass hidden instructions through shared caches, email or Slack, and those channels are sanctioned by design. An agent with perfect egress controls and write access to a shared mailbox can still spread injected instructions like a worm. Both positions hold, at different layers. The order of work is egress enforcement first, then governance of every shared channel the agents can read or write.

Tooling arrived the same week

TLDR IT reports that Microsoft Execution Containers are now generally available for agent runtimes. AINews reports that Microsoft open-sourced the mxc and Quicksand sandboxes (bubblewrap, seatbelt and QEMU), and that Unsloth added OS-level sandboxing at under 100ms per call. None of these fixes egress automatically. TLDR IT flags permissive configurations that pass for containment. A new sandbox with a domain allowlist enforced on IP addresses carries the same flaw onto a new platform.

An egress allowlist counts as a control once it has been tested against DNS spoofing.

What to do

  1. Send E2B, Vercel, Modal and Deno a written request this week asking whether they have fixed the domain-versus-IP egress bypass, and record each answer in their vendor risk files.

  2. Re-test self-hosted sandbox egress this quarter: replace IP-layer domain allowlists with nftables source validation plus an SNI- and Host-verifying TLS proxy, then rerun DNS-spoofing and shared-CDN tests.

  3. Scan repositories this week for Claude SDK computer-use or browser-use toolsets and for E2B, Daytona, Browserbase and browser_use dependencies, and assign each hit an owner.

The bottom line

These threats share an engineering choice. Each is built to pass the one test defenders run most often: network telemetry, sandbox detonation, a domain allowlist or a severity score. So a clean result from your main tool no longer proves a clean environment, and attackers will keep tuning against whichever check is most popular. Pick your three most trusted 'all clear' signals this week and confirm each one from an independent vantage point: host logs beneath the network, egress beneath the build, and exploitation evidence beneath the score.