Is Cyber missing the Marque?

The newsletter explains that the White House issued a memorandum directing the DOJ and DHS to create a program enabling private companies to conduct cyber surveillance and offensive cyber operations under U.S. government authority against transnational cybercriminals outside the U.S. This marks a significant shift in the role of private cybersecurity firms in offensive operations. The author raises operational questions about attribution, intelligence handling, and geopolitical risks. Additionally, the newsletter reports on a Chinese-speaking cybercrime group, UAT-10147, leveraging agentic AI to automate complex post-compromise attacks including custom rootkits and BYOVD techniques to evade detection. It also highlights critical vulnerabilities actively exploited in the wild and the growing adoption of AI in cybersecurity.

The memorandum creates a new operational paradigm where private companies can conduct government-authorized offensive cyber operations, potentially increasing the scale and scope of cyber disruption against transnational criminal organizations. This raises complex operational, legal, and geopolitical challenges, including risks of international incidents if offensive actions are discovered by foreign states. The emergence of AI-enabled cybercrime groups like UAT-10147 increases the sophistication and automation of attacks, reducing defenders' detection windows and complicating incident response. Active exploitation of critical vulnerabilities in widely used software further elevates risk to organizations globally.

No direct mitigation is applicable to the memorandum itself as it is a policy framework rather than a vulnerability. Organizations should monitor developments as DOJ and DHS establish operating procedures. For the AI-enabled cybercrime threats, defenders should prioritize patching known vulnerabilities in internet-facing applications such as Zimbra, Nacos, and Telerik UI, secure ASP.NET MachineKeys to prevent ViewState deserialization attacks, block known vulnerable drivers to mitigate BYOVD attacks, and tune network monitoring to detect anomalous HTTP 500 errors used by attackers for exploit validation. Following vendor advisories and threat intelligence updates is recommended.