Daily digest

Ukraine Says Russian Intelligence Used Fake Support Texts to Steal Messaging Credentials

The SSU and FBI jointly disclosed a long-running Russian intelligence campaign that used fraudulent support SMS messages to compromise messaging accounts belonging to government officials, military personnel, politicians, and activists across Ukraine, Europe, and the U.S. The operation involved credential theft targeting secure communications platforms. Both agencies attributed the campaign to Russian intelligence services.

Why it matters: Smishing campaigns targeting government personnel are directly relevant to a CMMC L2 environment — ensure end-user awareness training covers SMS-based credential phishing, and verify that CUI-adjacent messaging accounts enforce phishing-resistant MFA (NIST 800-171 control 3.5.3).

Clean GitHub Repo Tricks AI Coding Agents into Running Malware

Researchers demonstrated that an agentic AI coding tool can be manipulated into executing a malicious payload by cloning a GitHub repository that appears clean to security scanners, AI agents, and human reviewers. The malicious code is hidden in a way that evades static analysis, only triggering during the automated setup phase. This represents a supply-chain attack vector specific to AI-assisted development workflows.

Why it matters: If your team uses AI coding agents (e.g., GitHub Copilot, Cursor, or similar) against any repos — including internal Ansible playbooks or infrastructure-as-code — this attack class could silently execute arbitrary code in your pipeline. Review whether agentic tools run with least-privilege and whether repo cloning occurs in sandboxed, audited environments.

Third-Party Breaches Teach Education Sector a Costly Lesson in Vendor Risk

A wave of third-party and supply-chain breaches has hit education institutions, with ransomware actors increasingly targeting vendors that hold or process student data on behalf of multiple organizations. The pattern underscores how a single compromised vendor can cascade into breaches across many downstream clients. Institutions are being forced to reassess their vendor risk management programs.

Why it matters: CMMC L2 requires active supply-chain risk management (NIST 800-171 3.1.20 and the broader SCRM practices); if any of your third-party vendors process or store CUI, a breach at their end creates a reportable incident and potential assessment finding for your organization.

OpenAI Previews GPT-5.6 Sol With Restricted Access and Stronger Cyber Safeguards

OpenAI released three variants of GPT-5.6 — Sol, Terra, and Luna — as a limited preview to a small set of companies as part of a U.S. government engagement. Sol is the flagship model with the strongest capabilities and enhanced cybersecurity safeguards; Terra balances power and efficiency; Luna prioritizes speed and cost. Access is restricted during this preview phase.