KVM Januscape Flaw Lets Any Guest Corrupt Host Kernel Memory

Monitoring treats east-west gRPC as trusted-by-default. Instrumenting every mTLS stream costs too much, so you whitelist. MODBEACON weaponizes that. It's Rust, which makes it fast and slow to reverse. It runs C2 over gRPC streaming: persistent, encrypted bidirectional streams identical to a legitimate Envoy/Istio call. Attributed to China-linked Silver Fox, with backing to keep evolving.

Signatures won't help here. The traffic is the pattern. What breaks the disguise is topology: streams to endpoints outside your mesh registry, gRPC methods mapping to no deployed service, a pod opening persistent outbound streams it shouldn't. The anchor is baseline service identity and expected call graphs, not signatures.

The supply-chain half compounds it. The Injective Labs npm compromise hijacked a legitimate GitHub repo, then published poisoned packages under the trusted name. That bypasses typosquatting detection, dependency-confusion guards, and 'only-known-orgs' policies, because the org is known. The payload chased wallet keys. The vector works for any secret.

When the malware speaks your own protocol and ships under your own dependency names, allowlists stop being a control.

Both stories agree: identity, not name or network position, is the trust anchor. The controls that actually hold: npm ci lockfile-only installs, SLSA provenance checks on critical deps, tight GitHub Actions permissions on anything you publish, and alerting on the shape of mesh connections, not their contents.

The Bedrock-linked gateway attack followed a familiar cloud playbook — compromised credential, assumed role, pivot, downstream access. Nothing novel; a novel target. Your AI gateway (LiteLLM, a Kong/Envoy plugin, a managed proxy) was stood up in a hurry and never threat-modeled like your primary API gateway — yet it aggregates model access, identity tokens, prompt logs, and tool-calling permissions into one role. Map what a compromise of that role reaches. Usually: everything.

The deeper gap is non-human identity. AWS IAM, Okta, Azure AD were built for humans and static services. An agent that invokes tools, calls APIs, and spawns sub-agents needs a delegation model: invoked by User X, session Y, delegated permission subset Z, expiring at T. That's capability-based security or a delegation chain, not RBAC/ABAC. Absent it, agents get god-mode on a shared service account. The industry's 6-stage maturity model exists because nobody has converged — most teams sit at stage 1.

GigaWiper raises the recovery stakes: Golang (single cross-platform binary, no runtime deps), modular (RAT + wiper + ransomware), and it deliberately discards encryption keys. A destructor in ransomware's clothes — no decrypt path. Your recovery story is exactly your backup isolation story.

If a compromised production credential can reach your backups through the same trust path, you don't have backups — you have one blast radius.

Sources converge: least-privilege, per-session scoped agent credentials, and a tested guarantee that backup immutability holds even when prod admin paths are owned.