Alex: Welcome to Cleartext for Tuesday, October 27th, 2026. I'm Alex Chen.

Jordan: And I'm Jordan Reeves. So here's your wake-up call this morning: a China-linked ransomware crew didn't just hit a critical infrastructure operator — they killed the security tools first. The EDR, the SIEM connectors, the visibility stack — all dark before the encryptor ever touched a disk. Most of you have incident response playbooks that assume your tools are working. That assumption just got expensive.

Alex: That's our lead story today, and it's a big one. We're also covering Lazarus Group deploying post-quantum encryption in operational malware, a Teams-based social engineering campaign that's breaching organizations in under fifteen minutes, CISA's new five-year strategy and the credibility gap around it, AI companies buying security startups, and a pair of PHP vulnerabilities you need to patch by Thursday. A lot to get through, so let's move.

Jordan: Let's start with the Storm-2603 story from CyberScoop, because this is the one that should change how you think about your architecture. This is a China-linked group — they've been called Warlock — and the campaign used SharePoint as the initial access vector, which is notable on its own. But the real escalation is what happened next. Before deploying ransomware, they systematically disabled security tooling across the environment. We're talking about deliberate, targeted degradation of the defender's ability to see what's happening.

Alex: And this is where it gets strategically uncomfortable. Most CISOs I know have invested heavily in detection and response. That's the right investment. But the implicit assumption is that your detection layer is operational when the attack matters most. Storm-2603 is flipping that model. They're treating your security stack as the first objective, not an obstacle to work around. If your resilience posture depends entirely on tools that can be disabled by an adversary with admin-level access, you have a single point of failure dressed up as defense in depth.

Jordan: Right. And this maps to the broader pre-positioning doctrine we've been tracking out of Chinese cyber operations for years. The strategic patience here is the tell. They're not smash-and-grab operators. They get in, they map the defensive infrastructure, they neutralize it, and then they execute. The ransomware might even be a cover for the real objective. CISOs at critical infrastructure organizations need to be running tabletop exercises where the scenario starts with "your tools are blind." What's your detection path then? Out-of-band alerting? Canary tokens? Network flow anomalies from a separate pipeline? If you don't have an answer, that's your priority this quarter.

Alex: And the budget conversation here is real. When you go to the board and say "we need to invest in resilience against our own tools being compromised," that's a harder sell than "we need better detection." But it's the right conversation to have right now.

Jordan: Staying in the geopolitical lane, let's talk about Lazarus. Kaspersky attributed a campaign called Operation FlashHole to North Korea's Lazarus Group, active since at least July 2025, targeting South Korean construction, software, and wire-communication manufacturing firms. The headline grabber is that they're using post-quantum encryption in deployed malware.

Alex: Let me decode why that matters beyond the technical novelty. Post-quantum encryption in operational malware means Lazarus is assuming that traffic captured today could be decrypted in the future by quantum-capable adversaries — or by law enforcement with future capabilities. They're protecting their command-and-control infrastructure and their exfiltrated data against future cryptanalysis. This is a nation-state actor investing in the longevity of their operations.

Jordan: Exactly. And the other piece is the delivery mechanism — they're abusing legitimate South Korean security software to deploy the payload. So you have a trusted application being weaponized as a loader. This is the supply chain trust problem in miniature. For CISOs outside South Korea, the specific software isn't the point. The pattern is. If your security tools or any privileged software in your environment can be subverted as a delivery mechanism, you need to treat those binaries with the same scrutiny you'd give any other high-value target.

Alex: And it ties directly back to the Storm-2603 story. Security tools as attack surface. It's a theme today.

Jordan: Let's pivot to the Teams story because this one is operationally urgent. Arctic Wolf documented over four hundred incidents — four hundred — where attackers used Microsoft Teams' external chat feature to impersonate IT helpdesks. The playbook is elegant in its simplicity: flood the target's inbox with spam, then immediately contact them on Teams posing as IT support offering to help. Remote access in under fifteen minutes.

Alex: Fifteen minutes from first contact to compromise. That's faster than most SOCs can triage an alert. And this isn't some exotic zero-day chain — it's social engineering through a collaboration tool that most enterprises have federated with external tenants by default. The fix here is straightforward: restrict or disable Teams external chat from unmanaged tenants. If your business requires external collaboration, whitelist specific partner tenants. This is a policy change, not a technology purchase.

Jordan: And train your people. Not the annual checkbox training — actual scenario-based awareness that says "if someone contacts you on Teams claiming to be IT after your inbox blows up with spam, that's the attack." Make it specific.

Alex: Let's move to the UK police breach story, because it reinforces a point we've been making on this show for months. His Majesty's Inspectorate found that British police data was breached multiple times through third-party IT suppliers. Not once. Multiple times across this decade. The watchdog described repeated and persistent failures in supplier cybersecurity.

Jordan: This is the third-party risk management problem in its purest form. And if you're sitting there thinking "well, that's government, we're more sophisticated" — I'd push back. Most enterprise CISOs I talk to have hundreds of vendors with some level of access to sensitive data or systems. The question isn't whether your vendor assessment questionnaire is thorough enough. The question is whether you have continuous validation of your suppliers' security posture, and whether your contracts give you the right to audit and the leverage to enforce remediation.

Alex: The parallel for our audience is direct. If you're in financial services, healthcare, or any regulated industry holding sensitive data through vendor ecosystems, this is your problem. The UK watchdog is now pushing mandatory improvement standards. Expect similar regulatory pressure to cascade.

Jordan: Let's talk about the ARTEX AI story briefly because it's an important data point. South Korean police identified seven suspects who used an AI-powered pentesting framework called ARTEX AI to breach over ninety organizations and steal 8.2 million records. One of the suspects is a former professional penetration tester.

Alex: This is the offensive AI democratization story we've been warning about, except it's not theoretical anymore. An AI-augmented attack framework enabled a small crew to hit ninety-plus organizations. The skill floor for conducting large-scale intrusions just dropped. CISOs need to calibrate their threat models accordingly — the adversary doesn't need to be a nation-state to operate at scale.

Jordan: Now, CISA 2030. The agency released its new five-year strategy, and on paper it's ambitious — aggressive, anticipatory defense against nation-state adversaries targeting critical infrastructure. But analysts are already poking holes. The strategy is silent on ransomware payment policy and corporate liability reform. And here's the number that matters: CISA has lost approximately one-third of its staff.

Alex: This is a credibility gap that directly affects how much CISOs can rely on federal partnership. If you're running critical infrastructure security and your planning assumptions include meaningful CISA support during a major incident, you need to stress-test that assumption. The strategy's priorities — OT security, software security, emerging technology — are the right priorities. But strategy without execution capacity is just a document.

Jordan: I'll be blunt: plan as if you're on your own. Hope for federal support, but don't depend on it.

Alex: Quick hit on the vendor landscape. Datadog is reportedly in talks to acquire cloud security startup Upwind for around four billion dollars. Upwind is also weighing a three hundred million dollar funding round from Bessemer as an alternative. If the Datadog deal goes through, you'd have a combined observability and cloud-native security platform that could reshape how enterprises consume cloud security telemetry.

Jordan: For CISOs evaluating cloud security tooling, the question is consolidation risk. Do you want your observability vendor and your cloud security vendor to be the same company? There are efficiency arguments for it and independence arguments against it. Put it on your radar, but don't let it stall procurement decisions today.

Alex: And on the broader M&A theme: Workday acquired identity governance startup C1.ai. Cohere bought Aisle. OpenAI is reportedly in talks to acquire Trail of Bits. AI platform companies are buying security capabilities. If you're a customer of both the AI platform and the security tool they just acquired, think hard about where your data flows and where the loyalty lies. Vendor independence matters.

Jordan: Last operational item. CISA confirmed active exploitation of two PHP vulnerabilities — both CVSS 9.2, both enabling unauthenticated remote code execution. They're in the Known Exploited Vulnerabilities catalog now with a Thursday deadline for federal agencies. PHP powers roughly seventy percent of the web. If you have PHP-based infrastructure, patch today. Not this week. Today.

Alex: So, Jordan, let's zoom out. What's the thread connecting today's stories?

Jordan: It's the collapse of assumptions. The assumption that your security tools will be operational when you need them. The assumption that your adversary needs elite skills. The assumption that your government partner has the capacity to help. The assumption that your vendors are independent. Every one of those got challenged today.

Alex: And for CISOs, the takeaway is that resilience planning in 2026 means stress-testing the things you take for granted. Your detection stack, your vendor ecosystem, your federal partnerships, your collaboration tools. The adversaries are already testing those assumptions. You should be too.

Jordan: The theme for the week is architectural humility. Build for the scenario where your foundational assumptions fail.

Alex: That's our show for Tuesday, October 27th. Show notes and links to every story we covered are at cleartext.fm. I'm Alex Chen.

Jordan: I'm Jordan Reeves. See you tomorrow.