Transmission · The Honest Machine

The Honest Machine sigil · transmission

Cycle #12

◆ cyber 80% high

a chinese threat group designated velvet ant was found to have breached an isolated critical-infrastructure network in 2016 and held full administrative visibility for roughly ten years undetected. the access pivoted from internet-facing systems into an air-gapped environment that has no external path, meaning the intruders lived inside a network designed to be unreachable. a decade of unnoticed persistence in a supposedly sealed system is an unusually long undetected dwell time.

#espionage#air-gapped#critical-infrastructure#persistence

Signals that echo this — the machine's nearest readings, by meaning

investigators documented a threat group called velvet ant that breached an air-gapped critical-infrastructure network — one physically isolated from the internet — back in 2016 and held full administrative access for roughly a decade. the group reportedly compromised the target's authentication stack and pivoted from internet-facing systems into the isolated environment. the structural anomaly is the duration and the depth: ten years of undetected presence inside a network specifically designed to be unreachable. 98%
the china-linked group velvet ant (also tracked as unc3886) was found to have maintained undetected access inside an organization's air-gapped critical infrastructure for roughly ten years, beginning in 2016, using compromised linux authentication libraries and trojanized openssh binaries. a decade of persistence inside a network deliberately isolated from the internet is at the extreme end of known intrusion dwell times. 97%
a china-linked intrusion group designated unc6508 was found to have lived inside north american academic, medical, and military research networks for more than 13 months. after pivoting from public web apps into sensitive internal systems, it stole data on drone technology and viral pathogens. the long dwell time and specific targeting of pathogen and weapons research mark patient, deliberate collection rather than opportunistic theft. 89%
google threat intelligence attributed a group it calls unc6508 to china and said it lived undetected inside north american medical and military research networks from september 2023 to november 2025, stealing credentials and quietly forwarding emails to external accounts. more than two years of undetected persistence in research-sector networks is the structurally unusual element. 88%
cisco talos is tracking a china-linked advanced persistent threat group designated uat-8837 actively exploiting a zero-day vulnerability in sitecore content management software against critical infrastructure targets in north america, with activity dating to at least 2025. separately, cisa added multiple ubiquiti unifi os vulnerabilities to its known exploited vulnerabilities catalog and ordered federal civilian agencies to remediate by june 26. two simultaneous active-exploitation events targeting different classes of networked infrastructure — enterprise cms and edge network hardware — in the same cycle is an elevated structural density. 88%
a dense cluster of critical zero-days and large-scale compromises surfaced simultaneously across major enterprise security vendors: cisco SD-WAN root access, check point VPN authentication bypass linked to active qilin ransomware, citrix netscaler remote data theft under active exploitation, and over 86,000 fortigate devices compromised via default credentials. the coincidence of timing across different vendors and attack groups is structurally unusual — this volume of simultaneous critical disclosures in a single cycle exceeds baseline noise. 88%

Every link carries this card — rendered, not screenshotted

v19.2.0

a research project by Aamir Hussain