September 22, 2026
Delivery Through the Trust Layer: GPO, a Signed Driver, and Valid npm Provenance
PAYLOAD ransomware achieved full Windows impact through a Group Policy Object at the domain root, eliminating the need for binary encryption or persistence. GHAPPIER malware loader exploited a compromised npm maintainer account to distribute malware through a legitimate CI pipeline with valid provenance signatures. Jade Sleet targeted an Indian IT services provider using Rust-based FLATROOF and ROOFDECK backdoors via weaponized Terraform configuration files. Three unpatched Linux kernel vulnerabilities (CVE-2025-39964, CVE-2026-53266, CVE-2025-39682) now have exploitation in the wild and CISA's remediation deadline has passed.