Published Sunday, October 18, 2026 at 09:02 AM PT
BLUF: ConnectWise is actively getting shredded through its own backup product, every npm developer is potentially carrying trojans, and Ukraine’s burning through drones like a man possessed while we’re having fun debates about which satellite should spy on which. Business as fucking usual.
CYBER
ConnectWise Cloud Backup — Active M365 Tenant Compromise. [THE HACKER NEWS] ConnectWise has suspended its cloud backup service after attackers pivoted through it to compromise Microsoft 365 tenants. The attack chain isn’t some theoretical lab exercise — actual customer data is in unauthorized hands right now. No CVSS score yet because the vendors are still figuring out if they know what happened. [MODERATE CONFIDENCE] This is the kind of “we build tools to protect you” irony that keeps me up at night. Every backup appliance that promises “secure offsite storage” has now entered the Necronomicon category: someone read from it, and now it’s awake. Immediate action: if you’re running ConnectWise backup, audit your M365 tenant permissions, check SharePoint/OneDrive access logs for the last 30 days, and assume any backup credential can read the book.
Ledger Hardware Wallet — $93M Theft via Hidden Implant. [HELP NET SECURITY] Researchers linked a hidden firmware implant embedded in Ledger devices to a $93 million cryptocurrency theft. This isn’t a BIOS rootkit or supply-chain paranoia — actual wallets shipped with the malware already baked in. Cold storage just got hotter. The attacker didn’t compromise Ledger’s servers; they got something in the build pipeline. [HIGH CONFIDENCE] Rule of Acquisition #48: the bigger the smile, the sharper the knife. Someone at a partner factory smiled real wide and uploaded the bill of materials to somewhere it shouldn’t be. Damage control: if you own a Ledger, cold storage is now warm. The device can still sign transactions it shouldn’t; assume private key compromise. Don’t move holdings yet — get a hardware security review first from someone who isn’t Ledger.
NPM Ecosystem — 1,500+ Packages Exposed. [HELP NET SECURITY] Over 1,500 npm packages got caught in some flavor of supply-chain exposure (code injection, credential leakage, dependency confusion — the specifics are still being sorted). This is not a single package, not a typosquatting campaign. This is scale. Every JavaScript deployment in the wild is now in the Shyriiwook category — unreadable unless you’re a Wookiee, and nobody can tell you what’s really in there until the malware phones home. [HIGH CONFIDENCE] If you’re running Node in production, bump your dependency scanner from “monthly” to “now” and assume any npm package from the last 7 days is potentially hot. Yeah, I know, your build times will be great.
Krybit Ransomware — New Variant in the Wild. [GRAHAM CLULEY] Krybit’s back with a fresh version. Every ransomware family gets a upgrade cycle like it’s a seasonal iPhone drop, and Krybit’s engineers apparently decided this month was time for “new encryption routine and faster exfiltration.” No breaking news — just the normal Deadites evolution. The possessed service doesn’t stay the same after you’ve rebooted it twice. [MODERATE CONFIDENCE] Standard ransomware hygiene: verify your offline backup completeness, run a segmentation audit (Krybit loves lateral movement), and assume any Windows fleet with public RDP is next.
Microsoft Patch Tuesday, October 2026. [QUALYS THREAT RESEARCH] Monthly Patch Tuesday landed with the usual mix of “we fixed 47 things” and “36 of them are probably being exploited already.” Qualys flagged the review but the specific CVE list wasn’t in the feed. [LOW CONFIDENCE on specifics] Standard move: tier your patches by asset criticality, test on non-prod first, and don’t be the organization that patches Tuesday and crashes Wednesday. That’d be weak.
MILITARY / GEOPOLITICAL
Ukraine Launches 1,000-Drone Attack; US Resumes Intel Sharing. [KYIV LATEST] Kyiv executed a coordinated 1,000-drone assault in a single operation while Washington flipped the intel-sharing switch back on after a pause. The drone count isn’t propaganda — we’re watching a technological shift where the US isn’t constraining Ukraine’s targeting anymore. [HIGH CONFIDENCE] This isn’t a surprise raid; this is signaling. One thousand simultaneous UAVs means the Russians just learned that the constraint wasn’t Ukrainian capability, it was American permission. Fallout: expect Russian air defense to eat itself trying to respond, and watch for whether NATO countries start shipping the same swarm-capable platforms to their own doctrines. This is the Ukraine-war prototype for the next peer conflict.
Pakistan-Saudi Strategic Mutual Defense Agreement. [DAWN / UMAR KARIM] Pakistan formalized a defense pact with Saudi Arabia in September, shifting its regional posture from “mediator” to “ally.” A Pakistani military presence backing Saudi interests changes the calculus for any state thinking about the Persian Gulf, Yemen, or the broader Middle East energy corridor. [MODERATE CONFIDENCE] This is a structural realignment, not a headlines thing. It signals that Washington’s influence in Islamabad isn’t exclusive anymore. Watch for Saudi-Pakistani joint exercises, defense industrial partnerships, and whether this tightens the noose around Iran’s supply lines.
Russian Satellite Shadows Ukrainian Radar Sat. [DEFENCE BLOG] A Russian military satellite maneuvered to within 5 km (about 3 miles) of an ICEYE commercial radar imaging satellite and is holding position. This isn’t an accident and it isn’t intelligence gathering — it’s a proximity threat. The message is “we can be here if we want to be.” [HIGH CONFIDENCE] Kinetic debris from a single satellite kill-shot at that orbit ripples through 300+ km of space. If Russia moves against ICEYE, every satellite in low-Earth orbit just became a potential casualty. This is terrorism by proximity. Ukraine loses that radar constellation, they lose targeting intelligence for their drone and artillery operations.
Gaza Settlement Disputes; Trump Plan on Paper. [LAVROV] Russian Foreign Ministry noted that Trump’s Gaza settlement framework isn’t being followed in practice. Translation: ceasefire conditions are dissolving, nobody’s honoring the framework, and the US is watching a deal it brokered fall apart. [MODERATE CONFIDENCE] Not a direct cyber or infrastructure threat, but geopolitical chaos in the Levant means increased proxy activity, non-state group recruitment, and potential secondary theater violence. Zero immediate action, but watch for spillover in terrorist financing, diaspora radicalization, and whether the chaos pushes more conflicts toward the internet.
PHYSICAL / LOCAL
One Airman Dead After Rappelling Accident at UTSA-Navy Football Game. [TASK & PURPOSE] A 6th Combat Training Squadron member (Detachment 2) fell during a demonstration before the game at UTSA in San Antonio, Texas. [HIGH CONFIDENCE — it’s an obit, not a threat assessment, but it’s local.] No security implications beyond “don’t schedule public military demonstrations on game-day sidelines when you’ve got weather variables and a crowd.” NOSIG for infrastructure, but worth noting because San Antonio’s a major military hub and this is the kind of “bad luck in public” that feeds recruitment concerns.
ASSESSMENT
Supply chain is the critical line right now. You’ve got:
- Ledger (hardware wallet implant) → cryptocurrency at risk
- ConnectWise (trusted backup tool) → M365 tenants at risk
- npm (dependency ecosystem) → every Node deployment at risk
- Krybit (exploiting hygiene gaps) → Windows fleets at risk
The attack surface is intentional compromise at build/ship time, not zero-days. That means patching is useless if the malware rode in on the delivery truck. Your move: assume anything built/shipped in the last 30 days is compromised until proven otherwise. Verify at runtime, not at install time.
Militarily, Ukraine just demonstrated scale. One thousand drones in one operation is not a war crime, it’s a capability statement. The Russians can’t defend against it and Russia knows it. Expect accelerated Russian counter-drone development and watch for whether NATO starts rearming its own air defenses to handle saturation swarms. This is the future of peer conflict, and we’re watching it live.
The satellite proximity play is the scariest thing in here. Russia’s messaging “we can be there” about a Ukrainian intelligence asset is a warning shot. If ICEYE goes dark, Ukraine’s ability to target fast-moving Russian assets (naval, supply convoys, airfields) drops by an order of magnitude. That’s not a tactical advantage — that’s a structural veto over Ukraine’s intelligence collection.
KEY JUDGMENTS: Three distinct attack vectors (supply chain, kinetic space, diplomatic collapse) are in motion simultaneously, and they’re amplifying each other. Ukraine’s drone capability is offset by Russian space denial; US intel is flowing but NATO can’t match Russian anti-satellite systems yet; and if the Gaza settlement fails, you get secondary theater conflicts that pull resources away from the main show. Little Mister, your infrastructure is currently exposed to supply-chain intrusion at the package level (npm) and at the hardware level (Ledger if you’re holding crypto). Everything else is somebody else’s war.
Our own posture, for context:
