The Ransomware Negotiator Was Working for the Ransomware Gang
The negotiator wasn't the only trusted thing that failed this week. An official software package, AI approval workflows, and strategic partnerships deserve a second look.
INTRODUCTION
This week’s signals do not converge on one attack technique or one architectural failure. They matter because each changes a different decision defenders need to make.
A ransomware negotiator used privileged victim intelligence to help BlackCat operators. Attackers compromised an official Injective Labs package after developers had already decided to trust it. AI coding tools presented dangerous actions through approval workflows that humans could not meaningfully evaluate. China- and India-nexus operators independently compromised Pakistani police systems because the same data answered two different geopolitical intelligence requirements.
These are not four versions of the same attack. They expose four separate assumptions that no longer hold. Hiring a responder does not guarantee aligned interests. Approving a dependency does not make future releases safe. Recording human consent does not prove the person understood the action. Strategic partnerships do not eliminate intelligence collection.
These signals do not point to one lesson. Each one changes a different security decision.
Which one of these decisions would your organization still make exactly the same way today?
Get The Monday Brief in your inbox every Monday. Subscribe for free, and share it with someone who’d find it useful.
Thanks for supporting us.
WEEKLY SIGNALS ANALYSIS
Insider threats now include the professionals you hired to manage the crisis. A former ransomware negotiator’s conviction for actively collaborating with BlackCat operators means incident response vendor access and information-sharing agreements need contractual controls and monitoring, not just NDAs.
Repository compromise turns the software update mechanism into a weapon delivery system. The Injective Labs GitHub-to-npm attack chain shows that dependency pinning and integrity checks at the pull stage, not just at initial adoption, must become a build pipeline default this week.
Human-in-the-loop is not a security control when the human cannot evaluate what they are approving. The GhostApproval vulnerability pattern across six AI coding tools means that “user approved it” is not an audit-safe defense. Restrict AI tool egress and scope regardless of user consent.
Digital government centralizes intelligence value as quickly as it centralizes public services. Balochistan Police systems brought biometrics, criminal records, personnel data, citizen complaints, and public-facing workflows into connected infrastructure that attracted collection from both a strategic partner and a regional adversary. Segment public services from internal records and treat application integrity as a national-security control.
THIS WEEK’S SIGNALS
Signal 1: The Ransomware Negotiator Who Was the Ransomware Operator
Why it matters: Former DigitalMint ransomware negotiator Angelo Martino received a 70-month federal sentence for helping BlackCat affiliates extort five U.S. companies out of a combined $75.3 million. He used confidential information obtained while representing victims to improve the attackers’ leverage during negotiations. The case makes the professionals brought into an incident response engagement part of the insider-threat model.
What is being misread: The risk is being framed as one corrupt negotiator rather than a failure in how crisis access is governed. Incident response engagements can expose insurance limits, backup status, board communications, technical findings, and the organization’s tolerance for downtime. Yet this access is often controlled through contracts and confidentiality agreements rather than technical restrictions, monitoring, and separation of duties. Hiring someone to help does not automatically align their interests with the victim’s.
Think Red (Douglas McKee): Let’s be honest, this is almost the perfect access model. The victim brings me into the room, tells me what the backups look like, how much insurance exists, how long the business can stay down, and what the board is willing to pay. A red team would never be given that level of visibility. We would be scoped, monitored, and kicked out the moment the engagement ended. The negotiator got the crown jewels of the incident with almost none of those controls. The offensive lesson is not simply that an insider can betray you. It is that crisis access often reveals more leverage than technical access ever could.
Act Blue (Ismael Valenzuela): The reality is that most organizations grant incident response vendors privileged access under crisis conditions with zero technical guardrails. This week, review your IR retainer agreements and require that all third-party responders operate through monitored jump hosts with session recording enabled. Scope their access to specific systems and revoke credentials within 24 hours of engagement conclusion. But do not stop there. Implement data loss prevention controls on the communication channels used during active incidents. Board memos, insurance documents, and negotiation transcripts should never be accessible from the same credentials used for technical forensics. The principle is straightforward. Crisis access must be the most monitored access in your environment, not the least.
Supporting sources:
CyberScoop: Former DigitalMint ransomware negotiator sentenced to 70 months for helping BlackCat extort victims
SecurityWeek: Third US security expert sentenced to prison for helping ransomware gang
The Record: Ryuk operator pleads guilty, BlackCat conspirator sentenced
Bleeping Computer: Former ransomware negotiator gets 4 years for BlackCat attacks
Signal 2: GitHub Repository Compromise Turns Trusted npm Packages Into Wallet Stealers
Why it matters: Attackers compromised the Injective Labs SDK project’s GitHub repository and used it to publish version 1.20.21 of @injectivelabs/sdk-ts on npm, embedding code that silently exfiltrated cryptocurrency wallet private keys and mnemonic seed phrases. This was not typosquatting or a lookalike package. It was a legitimate, widely used SDK that developers already trusted and pulled automatically into builds.
What is being misread: Most supply chain defenses focus on vetting new dependencies at adoption time. The broken assumption here is that a package already in your lockfile remains safe across version updates. The attackers did not need developers to discover and install a malicious package. They needed developers to do what they already do every day, run an update. The GitHub repository itself was the entry point, which means the compromise happened upstream of every downstream integrity check that operates at the npm registry layer.
Think Red (Douglas McKee): I would not waste time building a fake package if I could take over the real one. The hard part of a supply chain attack is usually convincing people to install something. Here, that work was already done. The package had users, history, and a place inside existing build pipelines. Once the release path was compromised, the attacker inherited all of that trust automatically. That is what makes these attacks so effective. The malicious code is new, but everything carrying it into the environment looks completely normal.
Act Blue (Ismael Valenzuela): Most pipelines treat upstream repository integrity as someone else's problem. Pin every dependency to an exact version and cryptographic hash, so moving to a new release becomes a deliberate, reviewable event instead of a silent pull. Require build provenance, npm provenance or Sigstore, and scrutinize release paths that run through trusted-publisher or OIDC pipelines, because that is the path the attackers rode here. This payload did not run at install. It fired at runtime when the app called the SDK's wallet functions, and it exfiltrated to the vendor's own infrastructure to look legitimate. So monitor dependency behavior where the code runs, not just during the build, and alert when a package reaches for keys or credentials it has no business touching. Egress filtering helps, but it will not save you when the exfiltration rides trusted infrastructure. The principle holds: integrity has to be verified where the code runs, not only where it is installed.
Supporting sources:
Bleeping Computer: Injective SDK on npm infected with cryptocurrency wallet stealer
The Hacker News: Injective Labs GitHub compromise pushes wallet-key-stealing npm packages
Signal 3: AI Coding Tools Turn Human Approval Into an Unreliable Security Boundary
Why it matters: Wiz researchers disclosed GhostApproval, a vulnerability pattern they found in six of the most widely used AI coding assistants: Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. A malicious repository plants a symbolic link disguised as an ordinary project file, such as project_settings.json, that actually resolves to a sensitive path outside the workspace, like the developer's SSH authorized_keys or shell startup file. When the developer asks the agent to set up the project or follow the README, the agent follows the link and writes to the real target, while the approval dialog shows only the harmless filename. In several tools the agent's own reasoning recognized the dangerous target and the interface concealed it anyway. The result is an arbitrary file write outside the sandbox and, in the worst case, remote code execution on the developer's machine.
What is being misread: The failure is being read as developers clicking approve too quickly. The real problem is that the prompt withholds the one fact that makes the decision meaningful, the canonical path the write actually lands on. The consent is formally present and substantively empty, because the interface shows one thing while the agent does another. Two details sharpen this. The attack requires a developer to operate on an untrusted repository, which concentrates the risk in forks, external contributors, and third-party code. And the vendor response splits three ways: three tools shipped fixes, two went quiet, and Anthropic disputes it is a flaw at all, arguing that trusting a directory and approving an edit is the developer's decision to own. That disagreement is the story. The industry has not settled where the trust boundary sits between the user, the agent, and the file system.
Think Red (Douglas McKee): The approval button is doing a lot more work here than it deserves. After a developer has approved twenty normal actions, the twenty-first one is not getting a careful security review. It is getting muscle memory. From a red-team perspective, that is the opening. I do not necessarily need to hide the action from the user. I just need the interface to make the dangerous action look close enough to everything they have already approved. At that point, the human is not really the control. They are part of the execution path.
Act Blue (Ismael Valenzuela): Human approval is not a sufficient trust boundary, and this week's research proves it. Run AI coding tools inside a sandbox or container with file access scoped to explicit allowlisted directories, so any write that tries to leave the workspace fails by default. Treat pointing an agent at an untrusted or forked repository as the risk trigger it is, because that is the precondition the whole attack depends on. Flag process trees from AI tool runtimes that spawn shells, modify SSH keys or shell startup files, or reach non-corporate endpoints, and where your tooling allows it, require the agent to resolve and display the canonical path before you approve. The lesson generalizes. Any control that depends on a human evaluating machine-speed decisions at machine-speed volume is not a control. It is a checkbox.
Supporting sources:
Wiz Research: GhostApproval, a trust-boundary gap in AI coding assistants
CSO Online: AI coding tool hole illustrates a big problem with human in the loop
SecurityWeek: AI coding tools tricked into hacking developer machine via decades-old technique
The Hacker News: GhostApproval symlink flaws could let malicious repos run code in AI coding agents
Signal 4: Pakistan’s Police Modernization Became Intelligence Terrain for Both an Ally and an Adversary
Why it matters: SentinelLabs tracked separate China- and India-nexus espionage activity against Pakistani law-enforcement organizations from February 2024 through April 2026. Both sets of actors converged on Balochistan Police, gaining access to systems associated with criminal records, biometric data, police personnel, hotel and tenant registrations, and citizen complaints. A suspected China-nexus operator also planted malicious files disguised as software updates on a police complaint portal used by both officers and the public.
What is being misread: This will be framed as another example of regional rivals spying on one another. That misses what the convergence reveals. China is one of Pakistan’s closest strategic partners, but it still appears to have sought direct access to Pakistani police information rather than depend entirely on Islamabad’s assessment of threats to Chinese nationals. India likely wanted many of the same systems for a different reason, visibility into how Pakistan manages security in Balochistan. The relationship between two countries does not determine whether intelligence collection occurs. It determines why the same data is valuable to each side.
Think Red (Douglas McKee): The interesting part is not that two countries spied on Pakistan. Countries collect intelligence from partners and rivals all the time. What stands out is that the same police systems answered two completely different intelligence questions. For China, they offered a way to judge whether Pakistan could protect Chinese nationals. For India, they offered visibility into Balochistan’s security posture. Once a government puts criminal records, biometrics, personnel data, hotel registrations, and public complaints into connected services, I do not need to target the whole government. I target the system that already assembled its internal security picture for me.
Act Blue (Ismael Valenzuela): Digital government platforms should be treated as concentrated intelligence repositories, not ordinary web applications. Map every public-facing law-enforcement service to the internal systems and data stores it can reach. Separate citizen portals from criminal records, biometric databases, personnel systems, and operational police networks using explicit application and network boundaries. Require signed client components and alert on any change to files offered for download through public services. But do not stop there. Strategic partners, contractors, and technology providers may have legitimate reasons to interact with these systems while still presenting separate intelligence risks. Monitor administrative access, API use, bulk queries, and application changes by identity and geography. Independently validate the integrity of public portals from an external vantage point so a compromised server cannot become the trusted source of its own health status. When one platform combines public access with internal-security data, compromise creates both an institutional breach and a citizen surveillance opportunity.
Supporting sources:
The Record: Reporting on the separate geopolitical motives behind the China- and India-linked campaigns.
SecurityWeek: Coverage of the affected police systems, data types, malware clusters, and malicious portal updates.
MEME OF THE WEEK
Every breach starts with something that sounded reasonable.
ROLE-BASED TAKEAWAYS
Executive / CISO / Board Level
Crisis-response access needs governance before the crisis begins. Assign an executive owner for third-party responder access, define what negotiators and forensic teams can see, and require an auditable exception process for expanding access during an incident.
Approved software does not remain permanently approved. Ask whether critical dependencies are continuously monitored after adoption and whether the organization can stop a compromised release before it enters production.
Government modernization projects increasingly become intelligence aggregation projects. Public-facing systems deserve the same architectural review as traditional mission systems.
Enterprise Architect
Design Principle Impact: Least privilege must extend to crisis responders. Build jump-host infrastructure with mandatory session recording, time-bound identities, and role-specific data access so it can be activated quickly during an incident without granting unrestricted access.
New Constraint: Build pipelines must validate the release path, not only the package artifact. Include publisher identities, repository ownership, release approvals, signed artifacts, and runtime behavior in dependency assurance.
Segmentation Requirement: Public-facing services must be segmented from the sensitive records they can reach. Citizen portals, criminal databases, biometric stores, and personnel systems belong behind explicit application and network boundaries, not on shared infrastructure.
Security Operations
Implementation Watch Item: Inventory every public-facing application that has direct or indirect access to law enforcement, citizen, personnel, or other sensitive government data. Continuously monitor administrative changes, application integrity, and large-scale data access because these systems increasingly serve as intelligence collection targets rather than simply public services.
Common Failure Mode: Accounts, tokens, shared folders, and communication channels created during an active incident often remain accessible after outside responders leave. Audit prior incident-response access and formalize technical engagement closure.
Monitoring Patterns: Alert on unexpected network connections and credential access during dependency runtime, not only at build. For AI coding tools, monitor runtime processes that launch shells, alter authentication material, write outside approved workspaces, or contact unauthorized destinations.
Signal vs Noise Guidance: Treat package releases as higher risk when they coincide with repository ownership changes, new publishing identities, altered release workflows, or packages that reach for keys or credentials they have no reason to touch. A version number alone is not the signal.
See you next Monday!
The Monday Brief is produced by Douglas McKee and Ismael Valenzuela. The opinions expressed are our own and do not reflect those of our employers.