Trust Is the Vector. Every Major Attack This Week Exploited Something You Trusted.

# Trust Is the Vector. Every Major Attack This Week Exploited Something You Trusted.

This week, nine major cyber incidents made headlines. A Windows zero-day. A PDF zero-day. An npm supply chain compromise. A CPU utility hijack. A WordPress plugin backdoor. Router hijacking by Russian military intelligence. Industrial control systems accessed with the manufacturer's own software. A telehealth breach through customer support. A Python notebook exploited within ten hours of disclosure.

Every single one exploited something the victim trusted.

Not a vulnerability. Trust.

Windows Defender. Adobe Reader. The npm install command. The CPU-Z download page. The WordPress auto-update mechanism. Your home router's DNS settings. The PLC engineer's own software license. The Zendesk support portal. The Marimo notebook server running on localhost.

The bodyguard became the assassin. The doctor became the disease. The lock became the key. Not metaphorically — literally, in production, this week.

This post names the pattern, connects the incidents, and describes a detection method that catches the pattern before the attack lands.

The pattern

Every incident this week followed the same structure:

Step one. Identify something the target trusts — a software update mechanism, a document viewer, a development tool, a network device, an authentication provider.

Step two. Compromise the trusted thing — not the target directly, but the thing the target relies on. Poison the update. Trojanize the download. Hijack the DNS. Phish the SSO.

Step three. Deliver through the trust channel. The target accepts the payload because it comes from a source they already authorized. No exploit needed. The front door was open because the victim opened it themselves — for the trusted entity that is now controlled by the attacker.

This is not new as a concept. Supply chain attacks have been documented for years. What is new is the density. Nine incidents in one week, all following the same pattern, across five different nation-states and criminal groups, targeting every layer of the stack from silicon to SaaS.

The incidents

BlueHammer. Leaked April 3 by a group called Chaotic Eclipse. A local privilege escalation in Windows that exploits a time-of-check-to-time-of-use race condition between Windows Defender and the Volume Shadow Copy Service. The security process that is supposed to protect you becomes the escalation path. Over a billion Windows 10 and 11 devices affected. No CVE assigned. No patch available. Ransomware weaponization expected within days. The trusted defender is the attack surface.

Adobe Reader CVE-2026-34621. CVSS 9.6. Prototype pollution leading to arbitrary code execution on PDF open. No clicks required. Active exploitation since December 2025 — four months before the emergency patch on April 12. The lure documents contain Russian-language oil and gas sector content. The trusted document viewer executes arbitrary code the moment you open a file.

Axios npm supply chain. DPRK-attributed (UNC1069 / Sapphire Sleet). The most widely used HTTP library in JavaScript — approximately 100 million downloads per week — was compromised for three hours on March 31. Malicious versions 1.14.1 and 0.30.4 deployed WAVESHAPER.V2, a cross-platform backdoor. The maintainer was socially engineered. The trusted dependency became the implant.

CPUID supply chain. The official download page for CPU-Z and HWMonitor was hijacked for 19 hours on April 9-10. Trojanized installers delivered STX RAT. DLL sideloading, DNS-over-HTTPS via Cloudflare to evade monitoring. 150 confirmed victims. The trusted system utility was the weapon.

Smart Slider 3 WordPress plugin. The update infrastructure for a popular WordPress and Joomla plugin was compromised. Version 3.5.1.35 distributed with an embedded RAT via the CMS auto-update mechanism. The trusted content management system delivered the backdoor automatically.

FBI Operation Masquerade. GRU APT28 (Forest Blizzard) hijacked 18,000 TP-Link and MikroTik home routers across 120 countries. DNS settings modified to redirect Microsoft OAuth authentication flows to GRU collection servers. Your home router — the device you never think about — was silently rerouting your Office 365 login to Russian military intelligence. The FBI obtained a court order and remotely patched the routers without individual owner consent. The trusted network device was the intercept point.

Iran ICS targeting. IRGC CyberAv3ngers connected to 3,891 internet-exposed Rockwell Allen-Bradley PLCs using the manufacturer's own engineering software — Studio 5000 Logix Designer. No exploit required. They downloaded the legitimate tool and logged in. The trusted industrial control software was the access method.

Hims telehealth breach. ShinyHunters compromised two employees' Okta SSO credentials via social engineering, pivoted to Zendesk, and exfiltrated a year of support tickets for erectile dysfunction, mental health, and hair loss prescriptions. The trusted identity provider was the entry point. The trusted support platform was the exfiltration target.

Marimo CVE-2026-39987. Pre-authentication RCE in a Python notebook server. The /terminal/ws WebSocket endpoint skips authentication entirely. Exploited nine hours and 41 minutes after disclosure. Credential theft observed within three minutes of first access. The trusted development environment was wide open.

Nine incidents. Nine trusted things turned into weapons. Five nation-states and criminal groups. One week.

Why traditional detection misses this

Traditional threat detection looks for known-bad indicators: malicious IPs, bad file hashes, suspicious domains. These indicators assume the attack comes from an untrusted source through an untrusted channel.

When the attack comes through npm install, through a Windows Defender process, through your router's DNS, through the PDF your colleague forwarded, through the WordPress auto-update you enabled because the vendor told you to — there is no untrusted source. Every indicator is legitimate until the moment it is not.

Signature-based detection cannot catch a legitimate Rockwell PLC login from a new IP. Hash-based detection cannot catch a trojanized CPU-Z binary that was signed and distributed from the official download page. Network-based detection cannot catch DNS hijacking on a home router that is forwarding traffic to a GRU server that responds with valid-looking OAuth pages.

The indicators are clean. The channel is trusted. The only signal is behavioral: something changed in the pattern of how a trusted thing is being used.

How precursor detection helps

We run a six-signal Markov-based precursor detection system called PreCog V2. It does not look for known-bad indicators. It looks for changes in the pattern of normal behavior that predict an attack is coming.

Three of the six signals are directly relevant to the trust-as-vector pattern:

Signal 1: Consumer Collection Pattern. When a threat actor is preparing to exploit a trusted channel, they first collect intelligence about how that channel works — what endpoints exist, what the response format looks like, what authentication is required. This collection phase appears in our logs as high-volume API access followed by silence. The silence is the staging period. The collection phase is detectable days before the attack.

Signal 5: Dormant Account Awakening. Supply chain attacks require access to the trusted source — a package maintainer account, a download server, an update infrastructure. When a dormant account suddenly becomes active (the Axios maintainer was socially engineered, the CPUID download server was hijacked), the activation itself is a signal. A GitHub account dormant for 90 days that suddenly pushes code is not the same as an active developer shipping a feature. The dormancy-to-activity transition is detectable.

Signal 6: Intel Harvest Convergence (Princess and the Pea). When multiple distinct actors from the same country converge on your threat intelligence endpoints within a time window, they are coordinating. This week we detected three Chinese actors converging on our STIX feed from different infrastructure — one from AT&T Wireless near Kennedy Space Center, one harvesting CSV exports from China direct, one probing application structure from a Hong Kong cloud provider. The convergence across different techniques from the same country is the precursor signal. It fired because the pattern of three is different from the pattern of one.

None of these signals require knowing the specific attack in advance. They detect the preparation phase — the intelligence collection, the account activation, the coordinated probing — that precedes the exploitation of trust.

What you can do tonight

Audit your trust assumptions. List every external dependency your systems trust implicitly: npm packages, pip packages, CMS plugins, auto-update mechanisms, DNS resolvers, SSO providers, support platforms, document viewers, engineering software. Each one is a potential trust-as-vector surface.

Monitor for behavioral changes in trusted channels. A package that has not updated in six months that suddenly pushes a new version. A download URL that resolves to a different IP. A DNS response from your router that points somewhere new. A support platform login from a geography that has never logged in before. The behavioral change is the signal.

Separate trust from verification. Trust is a policy decision. Verification is a technical control. You can trust npm as a package source while verifying every install against a lockfile hash. You can trust your PLC vendor's software while requiring VPN access to port 44818. You can trust your SSO provider while requiring hardware MFA that cannot be phished. Trust without verification is the attack surface. Trust with verification is security.

Subscribe to a threat feed that tracks the preparation phase, not just the indicators of compromise after the attack. Our STIX feed includes precursor signals, behavioral IOCs, and real-time domain rotation tracking — the signals that appear before the traditional IOCs exist.

The pattern this week is clear. Trust is the vector. The only defense is to verify what you trust before it is used against you.

— Patrick

Search our feed: analytics.dugganusa.com/api/v1/search?q=BlueHammer+OR+WAVESHAPER+OR+CyberAv3ngers

STIX feed (free): analytics.dugganusa.com/api/v1/stix-feed

Register: analytics.dugganusa.com/stix/register

---

Her name was Renee Nicole Good.

His name was Alex Jeffery Pretti.