An AI vulnerability remediation startup raised $2.1 million this week. In the same news cycle, attackers called a US law firm pretending to be IT support and walked out with client data inside a few hours. Both stories are true. Only one of them is solvable with a Series A. That gap is the cybersecurity story worth reading right now, and it has nothing to do with neural networks.

Mandiant’s new report on Silent Ransom Group is blunt about the timeline. Phone calls in the morning, data exfiltration before lunch. Meanwhile a fresh Gafgyt variant called C0XMO is busy turning DD-WRT routers into a botnet aggressive enough to kill rival malware on the same box. Different victims, different tradecraft, same underlying lesson: defenders keep funding the shiny layer while attackers keep winning at the boring one.

Mandiant Watched Hours. Not Days. Hours.

Silent Ransom Group isn’t running a particularly clever attack. They call US law firms and professional services shops, claim to be IT, and talk a paralegal or admin into installing a remote support tool. Once they’re in, they steal files and follow up with extortion. The actual exploit is empathy under deadline pressure. The phone is the initial access vector.

What’s worth pausing on is the speed. Mandiant says these social-engineering calls escalate to data theft within hours of first contact. That’s faster than most managed detection providers escalate a ticket. It’s faster than most law firms can convene partners to authorize an incident response retainer. By the time someone realizes the IT guy on the phone was somebody else entirely, the documents are sitting at a hosting provider you’ve never heard of.

Law firms get hit because the data is concentrated, the staff is friendly under pressure, and the IT function is outsourced enough that “someone from IT” sounds plausible by default. The fix here is a callback policy and the willingness to make a senior partner wait two minutes while reception verifies the caller against the internal directory. Your firewall has no role in this play.

Meanwhile, Your DD-WRT Router Joined A Botnet

C0XMO is the part of the news cycle nobody will fix. DD-WRT is open-source router firmware that runs on a long tail of consumer and small business hardware, much of it sitting in branch offices, attorneys’ home networks, and the closets of every law firm with under fifty seats. The new Gafgyt variant exploits a known DD-WRT flaw, gets root, and then conveniently murders any competing malware it finds. Botnet operators learned territorial behavior from wildlife.

BleepingComputer also notes the variant ports cleanly across CPU architectures. That means the scope reaches well past DD-WRT itself. Once C0XMO operators tune the build, it walks into ARM and MIPS appliances of every shape: cameras, NAS boxes, VoIP gateways, and the print server somebody bought in 2018 and never logged into again.

The connecting thread with the law firm story is ownership. The router in the senior partner’s home office is on the corporate VPN every day. Nobody on the security team has the credentials. Nobody patched it. Nobody will. That router is unowned attack surface, and unowned attack surface is the genuine attacker advantage in 2026.

Forgotten infrastructure is a process problem. Treat it as an ownership question, not a patching one.

The Cybersecurity Money Trail Skips The Boring Wins

Emphere’s $2.1 million seed for AI-driven vulnerability remediation lands in the same news cycle as both of these stories, and that’s a market signal more than a coincidence. The cybersecurity funding pipeline rewards work that looks like a model: AI-powered triage, AI-driven patch generation, AI-assisted code review. Some of that tooling will genuinely cut your mean time to remediate for CVEs you already know about.

The law firm that got social-engineered through reception is outside that scope. So is the consultancy whose VPN ran through a DD-WRT box now drafted into a botnet. The attacks that landed this week were a phone call and a router nobody loved.

Defense in depth only works when the cheap layer gets funded too. Security hardening on the human side, callback verification on IT requests, an inventory of every router or appliance that touches your network, brute-force controls on every exposed login, and incident response playbooks that include “the attacker is on the phone right now” matter more than another remediation tool that needs a CVE identifier to function. Threat detection should fire on first-seen remote support binaries on a paralegal’s laptop. Threat protection has to reach the home networks of partners who tunnel into your environment from a router with default firmware.

None of that pitches well on a Series A deck.

What Actually Helps On Monday Morning

The good news is the fixes are unsexy enough that you can probably ship most of them this week. Tool-agnostic, vendor-neutral, and applicable whether you have a dedicated SOC or one overworked sysadmin moonlighting as the security team.

• Write a one-page IT verification policy. Inbound calls or chats claiming to be IT trigger a callback to a number from the internal directory, never the one the caller offered. Train reception, paralegals, and finance specifically, since they’re the named targets.
• Inventory every device that bridges remote work to your environment, including partner home routers on the VPN. Replace anything running DD-WRT or unsupported consumer firmware. Treat “I don’t know what’s at that address” as a finding.
• Restrict remote support tools to an allowlist. AnyDesk, ScreenConnect, TeamViewer, Splashtop and their cousins should fail to launch on user endpoints without explicit approval. Alert on first-seen execution.
• Lock down inbound auth surfaces with MFA, rate limits, and brute-force protection. The attackers calling law firms today are the same talent pool running credential stuffing against your Citrix portal tomorrow.
• Rehearse an incident response drill where the initial alert is a phone call, not a SIEM ticket. Who decides to disconnect a user? Who calls counsel? Who notifies affected clients? Run it on a Friday.

AI remediation has its place. The attacks winning this week sit outside the scope your remediation budget covers. Cyber security maturity is the willingness to fund the layer that doesn’t demo well.

Sources

• Silent Ransom Group targets law firms with fake IT support calls
• C0XMO botnet spreads via DD-WRT router flaw, kills rival malware
• Emphere Raises $2.1 Million for AI-Powered Vulnerability Remediation