3 posts
The TeamPCP threat actor deployed the Mini Shai-Hulud worm in a sophisticated supply chain attack targeting the npm ecosystem via a GitHub Actions CI cache-poisoning technique. The malware steals credentials, establishes persistence via developer tools like VS Code and Claude Code, and features a destructive dead man switch that wipes the victim's home directory if access tokens are revoked.
Elastic provided the core defensive security platform and AI capabilities for the UK Ministry of Defence's Defence Cyber Marvel 2026 (DCM26) cyber exercise. The deployment featured a highly scalable, multi-tenanted Elastic Cloud architecture managed via Terraform, integrating advanced AI assistants and automated workflows to support 40 defending Blue Teams.
Elastic has introduced capabilities to manage security detection rules and exceptions as code using the Elastic Stack Terraform provider. This enables DevOps and platform teams to integrate detection lifecycle management into broader infrastructure-as-code pipelines, complementing existing detection engineering workflows.
