MorningUpdates
Executive-ready analysis of cybersecurity, AI security and governance, and private equity — focused on practical implications for diligence, portfolio oversight, and operational risk.
High-signal developments across cybersecurity, AI security and governance, and private equity — with practical implications for diligence, portfolio oversight, and operational risk.
Executive Summary
Top Cybersecurity Incidents and Trends
ConnectWise Cloud Backup abuse exposes Microsoft 365 tenants through application identities.
ConnectWise shut down Cloud Backup access after unauthorized access to application identities; BleepingComputer reports Microsoft, Huntress, and Todyl observed malicious Microsoft 365 tenant activity, with Huntress identifying at least 162 compromised tenants in its environment. Because the attacker used application/service-principal permissions, MFA was not the control boundary.
Immediately inventory ConnectWise/SkyKick application IDs in Entra ID, review service-principal sign-ins since October 13, inspect app credential/certificate changes, revoke unauthorized credentials, and validate Graph, Exchange, SharePoint, OneDrive, Teams, and OAuth grant activity.
BeyondTrust Remote Support zero-day exploitation moves from advisory to active incident-response priority.
BeyondTrust disclosed CVE-2026-102764, a critical Remote Support vulnerability affecting versions up to 26.2.3, and CISA added it to the KEV catalog. Mandiant/GTIG observed Armory Castle exploiting it as a zero-day since late August to deploy web shells, escalate to root, harvest appliance credentials, delete logs, and move laterally.
Treat internet-reachable self-hosted BeyondTrust RS appliances as potentially compromised if exposed during the exploitation window; patch, preserve logs/images, rotate credentials brokered by the appliance, and hunt for SAWFLY/BARECLAW-related activity and suspicious file operations.
BAE Systems incident disrupts U.S. federal bankruptcy court notices.
The Administrative Office of the U.S. Courts said a cybersecurity incident affecting BAE Systems infrastructure disrupted the Bankruptcy Noticing Center, pausing generation and delivery of bankruptcy notices and taking BNC-related websites and the National Creditor Registration Service offline.
For legal, financial-services, restructuring, and creditor-facing portfolio companies, verify contingency procedures for court notices, creditor-service workflows, and third-party dependencies that can interrupt statutory or time-sensitive processes.
French supermarket refrigeration attacks expand across controller vendors.
ANSSI/CERT-FR warned compromises affected Danfoss refrigeration controllers and later Copeland/Dixell XWEB systems; roughly 700 French supermarkets were reportedly affected, with food spoilage, fire reports, and no clear ransom demand or attribution. This is a live example of internet-exposed OT causing material business interruption.
Retail, food, logistics, manufacturing, and facilities-heavy companies should review internet-exposed building/industrial controllers, remove direct exposure, require VPN/segmented access, and replace unsupported end-of-life devices rather than relying on resets.
Cyber Regulatory and Enforcement Changes
CISA KEV adds rapid-action exploited vulnerabilities with forensic-triage expectations.
CISA’s KEV catalog added recent Fortinet, BeyondTrust, Atlassian, and other exploited vulnerabilities with short due dates and BOD 26-04 references; several entries require forensic triage. Even outside federal agencies, KEV remains a strong exploit-prioritization signal for boards and insurers.
Map KEV to external attack surface, require same-week remediation or compensating controls for internet-facing systems, and create evidence packs showing exposure status, patch state, and forensic review for high-impact appliances.
NYDFS clarifies cybersecurity risk-assessment expectations for regulated financial entities.
NYDFS issued guidance emphasizing annual risk assessments and reassessment after material business or technology changes, including migrations, acquisitions, new critical systems, shared third-party dependencies, and emerging technologies such as AI.
For financial-services portfolio companies, tie cyber risk assessments directly to M&A integration, cloud/MSP concentration, AI adoption, and board-level control decisions; avoid treating the risk assessment as a static compliance document.
FTC sues Digital Forensics over alleged deceptive sextortion-assistance services.
The FTC alleges Digital Forensics and affiliates misled sextortion victims into paying at least $60 million for services it often did not perform, while allegedly using fake reviews and abusive pressure tactics. This is a cyber-adjacent enforcement signal around incident-response-like consumer services, claims substantiation, and reviews.
Companies selling cyber, forensics, takedown, identity, or crisis-response services should review marketing claims, refund practices, testimonials, and telemarketing scripts for provable performance and consumer-protection exposure.
SEC proposes tailored custody framework for crypto assets held by advisers and funds.
The SEC proposed rules for registered investment advisers, regulated funds, and BDCs covering custody of crypto assets, including potential self-custody in certain circumstances and use of state trust companies. Custody architecture, key management, auditability, and service-provider diligence will become more board-visible if adopted.
Investment advisers and fund platforms with crypto exposure should reassess qualified custodian choices, wallet/key controls, audit evidence, incident response, and vendor concentration before the rulemaking matures.
Threat Intelligence and Adversary Activity
China-linked actors continue to favor edge appliances and sensitive-data theft.
CISA’s AA26-281A advisory warns Chinese government-linked actors are combining automated and hands-on hacking tools to steal sensitive data. Separately, GTIG/Mandiant detail Armory Castle’s BeyondTrust exploitation, reinforcing a pattern of appliance compromise, credential access, stealth, and lateral movement.
Prioritize VPN, remote support, email security appliances, and other edge systems for patch SLAs, asset ownership, logging, EDR-equivalent telemetry where possible, and post-patch compromise assessment—not just version checks.
Microsoft maps a Chinese-language phishing infrastructure ecosystem.
Microsoft reported an interconnected ecosystem of phishing kit operators, developers, and an illicit marketplace selling tools and infrastructure for large-scale phishing, including access to compromised or fraudulent Microsoft and Google cloud environments.
Strengthen controls against adversary-in-the-middle phishing and cloud identity abuse: phishing-resistant MFA for admins and sensitive users, conditional access tuned to device/risk signals, OAuth app review, token theft detection, and cloud-tenant sign-in anomaly monitoring.
Unit 42 says initial access is still led by public-facing exploitation and credential abuse.
Unit 42’s September 2026 top initial-access vectors highlight external edge exploitation and identity compromise as primary footholds, with social engineering, supply chain intrusions, and drive-by compromises adding systemic risk.
Portfolio security programs should measure attack-surface reduction, exposed-service ownership, credential hygiene, secret rotation, and phishing-resistant MFA as core operating metrics—not just vulnerability scan volume.
FBI and CrowdStrike disrupt DPRK remote IT-worker laptop farms.
CrowdStrike said it supported FBI disruption of U.S.-based laptop farms used by DPRK-linked FAMOUS CHOLLIMA to fraudulently obtain remote jobs, route access through employer-issued devices, and siphon wages while maintaining access to victim organizations.
Tighten remote-worker onboarding: verify identity and location, monitor device shipping anomalies, inspect unexpected RMM tools/peripherals, require hardware attestation where possible, and train HR/IT staffing teams on DPRK worker indicators.
AI News, Security, and Governance
NIST, NSA, and CISA publish incident-readiness practices for frontier AI training and evaluation.
NIST’s CAISSI, NSA’s Super Intelligence Security Center, and CISA published ten voluntary practices covering preparation, detection, response, recovery, and reporting for incidents during super-intelligence training and evaluation, especially where AI agents take significant uninstructed actions.
Enterprises building or evaluating agentic systems should adapt existing cyber IR playbooks to AI incidents: define scope boundaries, containment actions, human oversight, logging, escalation thresholds, and post-incident reporting.
Anthropic expands its Cyber Verification Program for security professionals.
Anthropic introduced tiered access allowing qualified defenders, red teams, and specialized critical-infrastructure testers to use more advanced cyber capabilities with reduced blocking classifiers, while maintaining verification and safeguards.
Security teams using frontier models for vulnerability research or red teaming should formalize authorized-use boundaries, data-retention expectations, workspace controls, and approval workflows before enabling enhanced cyber capabilities.
Anthropic updates usage policy for autonomous, high-risk, deceptive, and surveillance use cases.
Anthropic’s November 12 policy update clarifies deceptive campaigns, election interference, weapons software/components, surveillance, high-risk use cases, and autonomous physical-action requirements, including qualified human oversight for consequential domains.
AI governance teams should update acceptable-use policies, vendor assessments, and human-in-the-loop requirements for finance, health, legal, employment, surveillance, and physical-world automation workflows.
OpenAI disrupts AI-enabled false-front influence operations.
OpenAI reported banning Russia- and Iran-origin influence operations that used AI to support false-front entities, journalist personas, fake documents, internal reporting, and media placement; OpenAI assessed one Russia-origin operation as Category 5 on the IO Breakout Scale.
Communications, compliance, and trust-and-safety teams should assume AI-assisted influence operations will target media, employees, and executives through credible personas—not only fake social accounts.
Microsoft and NVIDIA publish open-weight model risk-management guidance.
Microsoft and NVIDIA released enterprise guidance with a shared risk taxonomy across cybersecurity, data protection, content, human-AI interaction, and bias, emphasizing that risk depends on model, use case, deployment, and safeguards—not simply open- versus closed-weight status.
Before deploying open-weight models, document provenance, intended use, users, permissions, runtime, evaluations, monitoring, and accountable control owners across model, application, and operational layers.
Private Equity News
Private credit fundraising reaches record $129.15 billion while lending volume falls.
Direct lending funds raised a record $129.15 billion in the first nine months of 2026, up 35% year over year, while Q3 direct lending volumes fell 28% to $49.77 billion. The gap increases pressure to deploy capital and may affect pricing, leverage, and covenants.
Diligence on private-credit-backed companies should stress-test covenant quality, refinancing options, lender concentration, and whether competition for deals is weakening underwriting discipline.
Sponsors remain below historical share of the M&A recovery.
Private Equity Wire reports Q3 earnings commentary from Goldman Sachs and Morgan Stanley showing corporate strategics, not sponsors, are leading the M&A recovery; valuation marks and delayed exits continue to slow sponsor activity and LP distributions.
Expect more pressure on continuation vehicles, secondaries, partial exits, and operational value creation where full exits remain unattractive at current valuation levels.
EQT agrees to acquire Stockbridge for up to $550 million.
EQT will acquire U.S. real estate manager Stockbridge for $375 million upfront plus up to $175 million in performance payments, adding a platform with about $16.5 billion in fee-generating assets and exposure to U.S. industrial and residential real estate.
Larger managers continue to buy fee-generating platforms to diversify asset classes and deepen permanent or recurring management-fee streams; watch integration, carry-sharing, and senior-team retention mechanics.
Partners Group cuts and reassigns private equity roles amid performance pressure.
Partners Group reportedly cut or reassigned dozens of roles in its global private equity division, following investor scrutiny, older-investment performance pressure, redemption requests in evergreen products, and valuation/distribution concerns.
Evergreen and semi-liquid private-markets vehicles should be reviewed for liquidity management, valuation governance, redemption queues, and portfolio aging—especially where listed-manager share prices signal investor skepticism.
Malwarewolves Watchlist / Suggested Follow-Ups
Run a portfolio-wide check for ConnectWise/SkyKick/Cloud Backup Entra application IDs, unauthorized credentials, and service-principal role assignments since October 13.
Publish a short diligence note on “AI agents and application identities as privileged actors,” using the ConnectWise incident, Anthropic CVP, and Microsoft/NVIDIA open-weight guidance as anchors.
Add OT/building-management exposure checks to retail, food, logistics, manufacturing, and facilities-heavy diligence scopes; refrigeration and environmental controllers are now board-relevant operational risks.
For financial-services portfolio companies, update the cyber risk-assessment template to include M&A events, cloud/MSP concentration, AI adoption, and KEV-driven forensic-triage triggers.
