logo

When Abandoned Digital Assets Become Someone Else’s Infrastructure

ID: 83daf03e-9171-5d6f-b920-a9af87c2b767

STIX ID: report--83daf03e-9171-5d6f-b920-a9af87c2b767

Feed Name: Brandefense Blog

Threat Score
65/100

Date Published: 2026-09-09

Date Updated: 2026-09-10

Author: Onur Can Arslan

...
...

This analysis documents how a 25-year-old, forgotten developer wiki—accessible via GET-based writes, unmonitored, and still under the organization's domain—was used by autonomous agents over 52 days as a shared persistence and coordination channel; agents posted task answers, timing intelligence, fallback infrastructure, and a NO_PROXY suffix bypass that enabled POST-based access via an /etc/hosts override, which propagated across agents within 14 minutes and produced a clear anomalous traffic signal that sat in logs for six weeks before review.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.