Espionage, pre-positioning, and the long eviction. Attribution here is a graded claim, never a headline: we name a government only when two independent sources and a reviewed artefact agree, and we say so when they do not.
Exploitation of CVE-2026-88772 dates to at least 3 September. Citrix patched and CISA listed it on Sunday 27 September. Mandiant describes dozens of victims in government, finance and telecom, custom web shells hiding command traffic in HTTP headers, and intruders who clean up after themselves. Patching, it warns, does not evict them.
No organisation was the target. Three governments named a state, and the harm to the people in the data is not the kind a letter addresses.
Same code, same comments, four operators, one week. The fix was public in the source tree for a month before it reached the browser.
The application saw exactly the traffic it always does. The copy was taken one layer down, inside the load balancer that decrypts it.
Adopting ML-KEM cost the attacker one library. It costs a defence contractor its entire estate.
A private network is still a network. Once anything inside it could reach anything else, the isolation was a route.
Post-incident guidance that leads with the exposed device rather than the adversary. For a utility with one engineer, that is the usable document.
New guidance asks operators to build and test plans for running vital systems disconnected. The assumption underneath it is the story.
More than 30 Minnesota communities disrupted through internet-facing controllers. Manual operation was the fallback, and it is a capability most utilities are losing.
76% of the year’s crypto theft value attributed to one state. On a public ledger, attribution is tractable in a way network telemetry never is.
More than 600 organisations across 80 countries since 2019, including US carriers and the lawful-intercept systems they run. The metadata was always the point.
Common-use platforms are why terminals can flex, and why one supplier failure degrades four countries at once. Nobody in the contract chain prices that.
Unpatched vulnerability, persistent tooling, deleted logs. The deletion is a finding in itself — nobody spends that effort on a boring record.
Foothold to exfiltration in about 72 minutes. Every response process that assumes a human decides in time is now mistimed.
Up roughly tenfold since 2021 and projected to double again. The manual fallback that limits the damage is a wasting asset.
Mass credential compromise across tens of thousands of firewalls. Patching fixes the device; it does not un-disclose the credentials.
Five years of access with no exfiltration objective. Pre-positioning breaks every response method that starts by asking what the intruder wanted.
Carriers are the target, the transit and the only party who can see an individual compromised device. The benefit of acting accrues to everyone else.
73,500 accounts on the state’s own messenger. For an internal platform the graph is the intelligence, not the messages.
The algorithms are free. The $15 billion is discovery, hardware replacement and re-certification — and small institutions will not be paying it.
Three standards finalised, deadlines from September. The blocker is that nobody knows where their cryptography actually is.