You paid extra so the hypervisor couldn’t peek. Then researchers showed a small circuit that starves writes to DRAM, and the processor keeps decrypting yesterday’s page like it is live. That is the cybersecurity product meeting colliding with a colo cage, and it is a bad look for every slide that treated Intel TDX and AMD SEV-SNP as a substitute for an operator you trust.

The attack is called DDRop. It does not smash the crypto. It quietly drops writes to a server’s memory so the CPU reads old ciphertext, decrypts it, and treats the stale plaintext as current. The attacker already needs control of the host software, plus a few minutes of physical access to sneak in a little hardware. If you have ever watched a tech walk a cage with a badge and a smile, you already know how that second requirement gets met.

You bought a promise about the hypervisor

Confidential computing is a clean pitch. Keep the guest encrypted in RAM. Attest the firmware. Tell the auditor the cloud admin can schedule the VM and still cannot dump the secrets. Plenty of cyber security programs moved regulated workloads onto that story because it felt like physics, not policy.

DDRop punches the assumption underneath the pitch. The TEE still has to talk to real memory chips over a real bus. If something on that path can discard a write, integrity becomes a rumor the CPU tells itself. Fresh data never lands. Old ciphertext comes back. The enclave is doing exactly what the vendor promised, on a lie the silicon cannot see.

Read the preconditions twice. Software control of the host. Brief hands on the machine. That is not a random internet brute-force against your login page. It is a hostile rack neighbor, a compromised BMC path, a contractor who already has root on the hypervisor, or an insider who can open a chassis without anyone writing a ticket. Colo and on-prem both sell that access as a feature. You called it remote hands.

The real problem here is threat models that stop at “the hypervisor is untrusted” and never continue to “the memory bus is a place someone can sit.” Defense in depth on a slide is not the same as defense in depth on a DIMM slot.

Meanwhile Sandworm is doing the unglamorous version

If hardware interposers feel exotic, look at what landed the same news cycle. Sandworm is chaining Cisco vulnerabilities to spread an upgraded Cyclops Blink, the botnet malware the FBI disrupted in 2022. Same personality, cheaper costume. You trusted a box because it had a firewall badge. The implant now lives in the device you told the SOC not to scan too hard, because it is “infrastructure.”

That is how you get the first DDRop precondition without a nation-state silicon lab. Own the software that sits next to the workload. Edge gear, out-of-band controllers, and “we don’t patch the TEE host because it is stable” are how boring campaigns graduate into host control. Threat-protection catalogs love novel malware names. Your actual exposure is still a management plane that answers on the WAN and a rack that badges like a courtesy.

File the 2022 takedown under folklore if you want. The operators did not.

Do the cybersecurity work the sticker can’t

Tonight, write down every workload you parked in a confidential VM because someone said the cloud admin was out of the threat model. Those jobs still need application-level crypto, keys that never live only in the guest, and an owner who can rebuild the thing from a snapshot the host never touched. If the only copy of the wrapping key is in the enclave you are defending, you already designed a single point of failure.

Pull the physical path while you are at it. Who can walk the cage. Who can reseat a DIMM. Whether BMC, iLO, iDRAC, or Redfish is reachable from any network that is not a dedicated jump path. Disable unused memory slots in firmware if the platform lets you. Tamper stickers are theater unless someone actually looks at them after a remote-hands ticket. Log the tickets. Correlate them with host reboots and attestation failures the same day, not at quarter-end.

This week, get host and BMC telemetry into the same threat detection stream you use for servers. Alert when attestation reports change, when a TEE VM migrates to a host that never passed your baseline, when a hypervisor admin session overlaps a hardware ticket. Security hardening on the host OS and firmware is the job; the confidential guest is a mitigation after that work exists. Patch the Cisco and other edge devices that Sandworm is actually chaining, and yank their admin interfaces off the internet so “software control of the adjacent box” is not a weekend project for someone else.

Ongoing, put confidential computing in the same incident response playbook as a compromised hypervisor. You do not forensically trust the guest’s own memory view after the host is dirty. You rotate keys from an HSM or KMS the host cannot mint by itself. You rebuild on hardware that still has an intact chain of custody. You keep a paper or out-of-band map of serial numbers, cage locations, and which tenant secrets sat on which DIMM population. That map is boring. It is also the only document that still means something if the CPU has been reading stale pages with a straight face.

Treat remote hands like privileged access. Time-bound the badge. Escort the work. Photograph the chassis before and after. If a vendor needs a few minutes inside the machine, that window is an incident you scheduled on purpose.

If IR starts at the SIEM, the DIMM already lied

Most stacks still assume the host tells the truth about writes. Your SIEM will cheerfully ingest guest logs that were generated against a memory image an interposer chose not to update. Threat detection that only watches east-west traffic inside the enclave is watching a play the attacker can pause.

Start incident response at the serial number and the cage log. Then the BMC session. Then the hypervisor identity. The confidential VM is a witness with a motive to look healthy. Ask it questions after you have a second source.

None of this means you rip TDX and SEV out tomorrow. It means you stop selling them internally as “the admin can’t hurt us.” They raise the cost of a casual dump. They do not survive a host you already lost plus a circuit in the memory path. Pair them with keys kept elsewhere, hosts you actually patch, racks you actually control, and edge gear that is not still running last year’s Cyclops Blink sequel.

If your board deck still has a single bubble labeled isolation, redraw it. The bubble has a DIMM in it now. Plan accordingly, or wait for the next researcher to bring a smaller circuit.

Sources

• New DDRop Attack Breaks Intel TDX and AMD SEV-SNP Confidential Computing
• ‘Sandworm’ Chains Cisco Vulnerabilities to Deploy Cyclops Blink