3 pieces by Tomasz Wierzbicki.
Eleven months after the first detailed account of an AI-orchestrated espionage campaign, agent-assisted attacks have become routine in threat reporting. A synthesis of what the year’s public reporting shows, and which defensive assumptions held up.
The SharePoint exploitation wave stole cryptographic machine keys, so attackers could return after servers were patched. A timeline of the campaign, why key theft changes response, and what to check on any on-premises SharePoint farm.
The telecom intrusions disclosed this month reached call records and lawful-intercept systems. For enterprises, the practical lesson is about where trust in a communications path should end.