Alex: Welcome to Cleartext. It's Thursday, October 1st, 2026. I'm Alex Chen.

Jordan: And I'm Jordan Reeves. Let's get into it.

Alex: We have a packed show today. China is running a coordinated espionage campaign across multiple fronts — targeting AI policy, stealing AI model weights, and now blending APT tradecraft with ransomware in Europe. We'll unpack all of that. We've also got the Pentagon breach finally going public after nearly a year of exposure, an agentic AI attack that's going to change how you think about incident response timelines, a critical Cisco SD-WAN zero-day you need to patch today, and half a million valid credentials just sitting in public GitHub repos. Plus a quarter-billion-dollar funding round that tells you where the market thinks offensive security is headed.

Jordan: Let's start with China because there are three stories today that, taken together, paint a very clear picture of strategic intent. First: Proofpoint published research on TA419, a Chinese threat actor running phishing campaigns against U.S. AI policy experts. Think tanks, university researchers, legal professionals — anyone shaping the policy conversation around AI governance. They're impersonating AI industry figures and government officials to compromise Microsoft 365 accounts.

Alex: And this is the part that should get CISOs' attention: the target set has shifted. This isn't about stealing chip designs or source code anymore. They want to know what the policy framework is going to look like before it's published. If you're advising government on AI regulation, or if your organization is in an AI-adjacent sector with policy exposure, you are now a target for state-level espionage. Your threat model needs to reflect that.

Jordan: And the tradecraft is social engineering at scale against cloud accounts. We're talking credential harvesting through well-crafted impersonation — not malware droppers, not zero-days. This is identity-layer compromise, which means your MFA posture, your conditional access policies, your ability to detect anomalous sign-ins on M365 — that's your defensive surface here.

Alex: Story two makes this even more interesting. OpenAI disclosed what they're calling a novel encryption bypass technique used in a model distillation attack against their systems. Individuals associated with Chinese company MoonshotAI were linked to parts of the attack, though OpenAI hasn't provided hard evidence of that attribution publicly.

Jordan: So what happened technically is that someone found a way to bypass the protections designed to prevent unauthorized extraction of model weights and capabilities. Model distillation is essentially cloning — you query a frontier model systematically and use the outputs to train a cheaper copy. The novel part here is the encryption bypass that defeated the guardrails OpenAI had in place. This is a new class of IP theft. If you're running proprietary AI models, whether you built them or fine-tuned them, you need to understand that the model itself is now a theft target, not just the training data or the code around it.

Alex: For CISOs, this means your AI governance framework can't just be about responsible use and bias. It needs to include model security — access controls on inference endpoints, rate limiting, output monitoring for systematic extraction patterns. This is IP protection in a form most security programs haven't contemplated yet.

Jordan: And then the third China story takes us in a completely different direction. Warlock ransomware — a group that's been active about a year, linked to a Chinese threat actor, targeting large organizations in Spain and Portugal. What's unusual here is the hybrid tradecraft: they operate like a cybercrime gang on the surface, but underneath they're using techniques associated with state-level APTs.

Alex: The geographic targeting is the tell. Chinese-linked threat actors historically don't focus on the Iberian Peninsula for ransomware. This looks strategic, not opportunistic. Whether it's economic pressure, intelligence collection under the cover of cybercrime, or testing operational capabilities — CISOs at large European enterprises need to stop assuming that Chinese threat actors only care about the U.S. and Asia-Pacific. Your attribution assumptions and your response playbooks may need updating.

Jordan: Shifting to Russia briefly — Star Blizzard has a new trick. They're deploying a technique Microsoft's calling RedFlick to install their CosmicPulse backdoor. This is an evolution in their delivery mechanism specifically designed to bypass existing endpoint and network detections. If you're in Star Blizzard's target set — government, defense, policy organizations, NGOs — your threat hunting team needs to be aware that previous detection signatures for CosmicPulse delivery may no longer fire. Check your vendor advisories, update your behavioral baselines.

Alex: Now let's talk about the Pentagon breach, because this is significant. The Defense Manpower Data Center — DMDC — has been breached, exposing personal data on more than three million people. That includes 2.76 million living individuals — current and former defense personnel and their dependents — plus records on 294,000 deceased individuals. The breach originated in October 2025. That's nearly a full year of exposure before public disclosure.

Jordan: A year of dwell time in the Pentagon's central HR system. Let that sit for a moment. DMDC has been the backbone of defense personnel data since 1974. This is identity infrastructure at the highest level of government. And the downstream implications are real — defense contractors, supply chain partners, anyone who shares data with DoD systems needs to be asking hard questions right now about what data they contributed and whether it was in scope.

Alex: If you're a CISO at a defense contractor or a company in the defense industrial base, you should be treating this as a potential compromise of your employees' PII, especially anyone with clearances or DoD affiliations. Review your data sharing agreements, prepare for employee notification scenarios, and coordinate with your legal team on potential regulatory obligations.

Jordan: Moving to the story that I think has the biggest long-term implications for how we do this job. On September 21st, an AI agent — an agentic AI system — autonomously chained two Zammad zero-days to breach the Dutch Institute for Vulnerability Disclosure. It hijacked sessions, executed remote code, and escalated to root. In seconds.

Alex: Not minutes. Seconds.

Jordan: This is the first publicly confirmed agentic AI-driven attack chain. The operative word is autonomous. This wasn't a human operator using AI as a tool. The AI agent identified the vulnerabilities, chained them, and executed the full kill chain faster than any human defender could possibly respond. The time-to-compromise was below the threshold of human-speed detection.

Alex: This is the scenario we've been discussing theoretically for two years, and now it's real. If your incident response plan assumes you have minutes to detect and contain initial access, you need to revisit that assumption. Detection engineering needs to move toward automated containment — not just automated alerting. Your SOAR playbooks need teeth. When the attacker is an autonomous agent operating at machine speed, your defense has to operate at machine speed too.

Jordan: And speaking of agentic AI in security — Armadin just raised $255.5 million, Series B, co-led by a16z and Accel. Valuation north of $2.5 billion, seven months out of stealth. They're building an agentic AI offensive security platform. The investor list includes In-Q-Tel, which tells you the intelligence community sees this as strategic infrastructure.

Alex: That's a significant capital concentration around the thesis that autonomous attack simulation is going to be a core enterprise capability. If you're evaluating BAS or pen testing vendors, keep Armadin on your radar. The market is clearly signaling where it thinks this is heading.

Jordan: Two more items to cover quickly. Cisco Catalyst SD-WAN Manager — CVE-2026-76504, CVSS 9.8. Unauthenticated remote access with admin privileges. CISA has added it to the KEV catalog. This is the fifth Cisco SD-WAN vulnerability exploited in the wild this year. If you're running Cisco SD-WAN, patch today. Not tomorrow. Today. Attackers are already using this.

Alex: And the Bitget cryptocurrency theft — $387.5 million stolen through a zero-day in a third-party security product. SlowMist found a customized attack tool built specifically for the exploit. The lesson for every CISO: your security products are part of your attack surface. You're auditing your vendors' functionality, but are you auditing their vulnerability exposure? The tool you bought to protect you can be the door that gets kicked in.

Jordan: And finally, more than 543,000 valid credentials were found exposed in public GitHub repositories as of July 2026. Still active. GitHub's existing security measures didn't catch them. If you have developers pushing code to GitHub — public or private — you need secrets scanning in your CI/CD pipeline, you need automated rotation, and you need DSPM controls that can detect this before an adversary does.

Alex: Alright, let's step back. Jordan, the through-line today is speed and sophistication — attackers operating faster, with more precision, across more surfaces than most security programs are designed to handle.

Jordan: That's right. The agentic AI attack compresses the timeline to seconds. The China campaigns show strategic patience and targeting precision. The Cisco SD-WAN vuln shows sustained adversary interest in specific infrastructure. And half a million credentials sitting in the open shows that we still haven't solved the basics. CISOs are being asked to defend against machine-speed autonomous attacks while their organizations are still leaking secrets into public repositories.

Alex: The gap between threat sophistication and defensive maturity is widening, and the only way to close it is automation with authority — not just detection, but automated containment and response with the organizational trust to let it act. That's a governance conversation as much as a technology one, and it's one every CISO should be having with their board this quarter.

Jordan: Agreed. Watch the agentic AI space closely. What hit DIVD on September 21st is going to be commonplace by this time next year.

Alex: That's our show for today. Show notes and links to every story we covered are at cleartext.fm. I'm Alex Chen.

Jordan: I'm Jordan Reeves. We'll see you tomorrow.