Daily digest

AryStinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network

QiAnXin's XLab has identified a new malware family called AryStinger that has compromised at least 4,300 end-of-life home and small-office routers, primarily D-Link devices. Unlike typical router botnets focused on DDoS, AryStinger is purpose-built for pre-intrusion reconnaissance and proxying attacker traffic, effectively anonymizing the source of follow-on attacks. The infected device count is still growing.

Why it matters: If any remote workers connecting to your environment use older D-Link or similar EOL routers, their traffic could be proxied through AryStinger nodes — making malicious activity appear to originate from known-good employee IPs. This is worth adding to your remote access risk discussion and may warrant pushing router firmware/replacement guidance to your workforce.

Stop Your Legacy Infrastructure from Hijacking Your AI Agents

Research presented at the Gartner Security & Risk Management Summit found that attackers are exploiting legacy infrastructure — old APIs, unpatched services, forgotten integrations — to manipulate or hijack AI agents deployed on top of modern stacks. Roughly 71% of organizations piloting AI agents have not fully accounted for how these agents inherit the trust and access of the underlying legacy systems they connect to. The attack surface expands significantly when agents are given tool-use or data-retrieval capabilities.

Why it matters: If you are running or planning a self-hosted AI stack with agent capabilities, any legacy services those agents can reach — including on-prem Ansible controllers, older AWS endpoints, or unpatched internal APIs — become an indirect attack surface. This is a non-obvious CMMC access control and least-privilege concern (NIST 800-171 3.1.x) worth reviewing before expanding agent permissions.

Gizmodo Readers Hit with ClickFix Malware Prompts After Account Compromise

Attackers compromised a Gizmodo account and injected ClickFix-style social engineering prompts into the site, instructing Windows visitors to paste a malicious PowerShell command under the guise of fixing a browser error. Security researchers confirmed Windows users who followed the prompts could have been infected with a remote access trojan; macOS users were largely unaffected. ClickFix as a delivery technique continues to gain traction across compromised high-traffic websites.

Why it matters: ClickFix attacks bypass most traditional email security controls by targeting browser sessions on legitimate-looking sites. Ensure your Intune-managed Windows 11 fleet has PowerShell execution policy enforced and that users cannot paste arbitrary commands into Run dialogs or terminals — a control gap that is directly relevant to NIST 800-171 3.14 (malicious code protection).

Canada's Spy Agency Used First-of-Its-Kind Warrant to Clean Botnet-Infected Devices

Canada's Federal Court authorized CSIS to use its threat reduction warrant powers to remotely access and neutralize two foreign-operated botnets by modifying infected servers, home routers, and IoT devices on Canadian soil. A public version of the ruling was released June 15 and marks the first confirmed use of this warrant authority for active network intervention. The operation targeted infrastructure being used by foreign state-linked actors.

Lessons from the VMwars – Nothing Virtual About the Broadcom vs Tesco Slugfest

The Register examines the ongoing contract and licensing disputes between Broadcom and large VMware customers following Broadcom's 2023 acquisition, using the Tesco case as a detailed example. Customers who resisted Broadcom's new subscription-based licensing terms faced service disruptions and legal pressure, highlighting the leverage Broadcom holds over organizations deeply embedded in VMware stacks. The article draws out strategic lessons for enterprise customers still negotiating or planning migrations.

Why it matters: As a Nutanix AHV shop you are likely already past the worst of this, but the Tesco case illustrates the legal and operational risks for any peer organizations still on vSphere that you may share infrastructure or CUI workflows with. It also reinforces the importance of documenting your own migration rationale for audit and continuity planning purposes.

First 17 Parts of the FAR Move into Formal Rulemaking Process

The Federal Acquisition Regulation overhaul initiated over a year ago has reached a milestone: the first 17 parts of the FAR have entered formal notice-and-comment rulemaking, with a 30-day public comment window now open. The rewrite effort is aimed at streamlining and modernizing acquisition rules. Federal acquisition experts and contractors have 30 days to submit comments before the rules are finalized.

Why it matters: FAR changes can cascade into contract clause updates that affect how cybersecurity requirements — including CMMC flow-downs — are written into new and renewed contracts. Monitoring this rulemaking is worthwhile if your organization is approaching any re-competition or new contract awards in the next 12–18 months.

Cloud Exchange 2026: GSA's Jessie Posilkin on How TMF Investments Help Accelerate Modernization

GSA's Technology Modernization Fund currently has approximately $200 million available for new agency modernization projects, but the fund requires congressional reauthorization before the end of fiscal year 2026. GSA officials emphasized that TMF is actively seeking new project applications, particularly for cloud migration and cybersecurity improvements. Failure to reauthorize before FY2026 closes would pause new investments.

Cloud Exchange 2026: Forrester's Lauren Nelson on Trends in Cloud Maturity

Forrester analyst Lauren Nelson outlined emerging themes in federal cloud maturity at the 2026 Cloud Exchange, centering on portability, governance, procurement modernization, and managing AI-related cloud costs. Agencies are shifting focus from raw cloud adoption toward mission-outcome-driven cloud strategies. Cost governance for AI workloads was called out as an underestimated challenge for agencies in the near term.