weekly

SIGNALS WEEKLY: When Management Planes Become the Battlefield

🛫 Your “management plane” is now the battlefield. Cisco Secure Email + HPE OneView are seeing active exploitation, and UAT-8837 is chasing CI targets. Patch like it’s a fire drill. 🔥🧯

Wes

21 Jan 2026 — 5 min read

Congrats — your management plane just got a hostile takeover.

TL;DR

[Vulnerabilities] Active exploitation is focusing on internet-exposed enterprise management surfaces (Cisco Secure Email appliances; HPE OneView), increasing risk of follow-on persistence and credential access after initial compromise.
[Intrusion Sets] China-nexus UAT-8837 is targeting North American critical infrastructure, leveraging Sitecore CVE-2025-53690 and common post-compromise tooling to expand footholds.
[Disruption/Ransomware] Pro-Russia hacktivists continue DDoS against UK entities while law enforcement escalates pressure on ransomware leadership (Black Basta), reinforcing the need for availability resilience and faster identity hardening (Net-NTLMv1 deprecation).

AlphaHunt

Stop doomscrolling, start decisioning. We chewed through the muck so your team doesn’t have to. → Subscribe!

Like this? Forward this to a friend!

(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

Current Stories

TL;DR

[Vulnerabilities] Exploitation is concentrating on internet-exposed “management plane” targets: Cisco confirms in-the-wild exploitation of Secure Email appliances (incl. root-level command execution and persistence) and Check Point reports mass exploitation of HPE OneView RCE attributed to the RondoDox botnet.
[Intrusion Sets] Cisco Talos reports China-nexus UAT-8837 targeting North American critical infrastructure, including exploitation of Sitecore CVE-2025-53690 and follow-on use of common post-compromise tooling to expand access.
[Geopolitics/Disruption] UK NCSC warns Russia-aligned hacktivists (notably NoName057(16)) continue denial-of-service activity against UK organizations—pushing “availability resilience” (providers/CDN/ISP coordination, scaling, monitoring) back to the top of the list.
[Ransomware] Germany’s BKA published a public appeal for information on Oleg Evgenievich NEFEDOV, alleging he founded/led the Black Basta operation—an indicator of sustained law-enforcement focus on ransomware leadership and monetization infrastructure.
[OT/ICS] CISA and partners released “Secure Connectivity Principles for OT,” reinforcing a cross-government push to reduce insecure/exposed OT connectivity (including third-party access paths) that commonly enables both opportunistic and state-backed intrusion.

AlphaHunt Converge - Plug in your Flight Crew

Get intelligence where it counts. No dashboards. No detours. AlphaHunt Converge teases out your intent, reviews the results and delivers actionable intel right inside Slack. We turn noise into signal and analysts into force multipliers.