The Watch

The targets were the third-party operators of the .gh, .sl and .as country-code registries. Attackers compromised those operators, modified authoritative DNS and requested certificates through the normal process, which is why nothing in the chain counts as a vulnerability in the conventional sense. Certificate authorities ran domain-control validation as designed, and because that validation proves control of DNS, the attackers passed it. Between Sept 22 and 27, at least a dozen certificates were issued, mostly by Let's Encrypt, for Google and YouTube properties and other unnamed global brands. The certificates were revoked by Oct 1.

Why 'no action needed' is wrong for most fleets

Google's public line is that Chrome users are protected. The fine print is narrower: Chrome's CRLSets protect Chrome. Mobile apps, native API clients, other browsers and service-to-service TLS rely on revocation checks that are frequently soft-fail or disabled outright, and a revoked certificate still works against any client that does not check. A CA can also reuse a completed validation to reissue for months after the hijack ends. Ed Skoudis describes registrars, registries, DNS and certificate issuance as one connected trust chain:

You can secure the site and still lose the name.

What actually defends against it

CAA records are the first control, and since they are DNS records themselves, they are unavailable for as long as an attacker holds the zone. Their value arrives once control is restored, when a restrictive CAA entry (issuer plus accounturi and validationmethods parameters) stops cached validations from minting more certificates. Certificate Transparency monitoring is the second control and the only real-time detection available; it flags a cert nobody requested as soon as it is logged, and it cannot block issuance. Johannes Ullrich notes ccTLDs are hijacked more often than mainstream TLDs because many registries predate modern operating rules.

The wider exposure is that DNS as proof of ownership underpins far more than certificates. SaaS domain verification, MX-based mail routing (and with it password resets) and ACME automation all rest on it, so whoever holds authoritative DNS can do considerably more than obtain a cert. Auth redirects, federated-login callbacks and short links hosted on a weakly operated ccTLD carry risk that the owner inherited the day the domain was registered.

LMCache sits on the cluster network. KV-cache layers exist to share state across inference workers, so they are typically network-reachable inside the GPU cluster. Remote code execution there puts an attacker on hosts that hold model weights, node-level cloud credentials, and every prompt and completion flowing through the service. The Hacker News reports the flaw at CVSS 9.8 and unpatched. LMCache has published no affected-version range and no in-the-wild data. Until LMCache ships a fix, the working assumption is that the flaw is exploitable.

The rest of the stack, triaged

LiteLLM is a credential concentrator. A single gateway typically holds API keys for every model provider the company pays for. It also sees every routed prompt. One compromise yields all of those keys at once. Pwn2Own entries go through coordinated disclosure. The fixes ship as patched binaries, and attackers can diff them. Those diffs shorten the path from fix to weaponized exploit.

Microsoft and AWS ship agent containment

On the same day, Microsoft made Execution Containers generally available and AWS open-sourced Strands Box, per TLDR IT. Two hyperscalers shipped the same control in the same week. We read that as a sign the risk is current. These components warrant the patching, isolation and egress discipline already applied to the VPN. Both products are built to stop 'YOLO mode' agents from running unsafe shell commands or reaching external channels.

The MonsterCloud indictment names Zohar Pinhasi. Prosecutors allege he billed hundreds of clients over $19M for 'proprietary decryption' while quietly paying cybercriminals $8M+. In one case an $8,200 ransom was marked up to roughly $150K. For a security program, the problem is the undisclosed payment. An intermediary that pays a ransom on a victim's behalf without telling the victim leaves that victim unable to screen the payee against sanctions lists or report the payment accurately to regulators or a cyber insurer. As prosecutors allege happened here, the victim may also be charged up to twice the ransom. The timeline is the uncomfortable part. ProPublica exposed the practice in 2019. Prosecutors say it continued until 2023.

The seizure that erases nothing

DOJ/FBI seized the domains hosting Microscan, a vulnerability scanner, and FishHub, a spearphishing tool. Both were built by China-based Integrity Technology Group, the previously sanctioned contractor tied to Flax Typhoon. The accompanying FBI/CISA/NSA advisory describes a three-stage chain: noisy automated scanning, then IoT botnets as relay infrastructure, then quiet hands-on exploitation to preposition in OT. Named targets include a South Carolina power company and airports in Japan and Poland. A domain seizure removes distribution infrastructure. The scan data, credentials and footholds already collected stay where they are. Integrity Tech kept operating through sanctions and a 2024 botnet takedown. A domain seizure is unlikely to end that pattern. The group's favored CVEs are all old: Shellshock, 2019 Pulse Secure, 2016 Apache Struts, 2021 GitLab.

What to do with both

Both actions produced a public record: an indictment in one case, an advisory and seized domains in the other. Neither changes what is already on the network or what is already in the vendor contract. For Flax Typhoon, the defensive work is ingesting the joint advisory's indicators and a 90-day retro-hunt across perimeter, VPN, email and edge-device logs. After that, the check is whether those four legacy CVEs are dead on every externally-facing asset. They are the entry points this group favors. For MonsterCloud, the fix is contractual. No IR or recovery vendor should be able to pay an attacker without the client's written authorization and pre-payment sanctions screening.