The Broadside
Watch hubsRSS →

Watch hub·gcc-high · aws-govcloud · azure-government · ms-cloud-us-gov

Cloud & Platforms

GCC High, AWS GovCloud, Azure Government, and the cloud choices that shape compliance scope.

Updated ·RSS ↗

Cloud-platform selection shapes a contractor's CMMC scope, FedRAMP authorization path, and audit cost. This hub tracks platform compliance announcements, FedRAMP authorizations relevant to CUI workloads, and the harmonization between FedRAMP, GovRAMP, and CMMC across GCC High, AWS GovCloud, Azure Government, and Microsoft Cloud for US Government.

What changed in the last 30 days

  • cisa/vendor

    Governments drew 27% of Microsoft's observed 2026 threat activity

    Microsoft's 2026 Digital Defense Report puts government agencies and services at 27% of threat activity its telemetry observed between July 2025 and June 2026, up from 17% in 2025, and names the sector the top nation-state target. Dwell time rose across sectors, and phishing jumped to 23% of observed intrusions from 7%. Those figures are vendor telemetry, not an independent census, and the five government priorities are advocacy. The phishing swing is load-bearing: compromised identities as the entry point.

  • ai-cybersecurity/vendor

    JADEPUFFER used compromised service principals to destroy Azure resources

    Microsoft detailed Storm-3168's Azure operations, two compromised service principals from the same tenant ran reconnaissance for 15+ hours, then executed a seven-minute destructive sequence of 100+ storage account deletion attempts, most succeeding. The same principals also enumerated App Service configuration stores and attempted credential collection, consistent with prior JADEPUFFER patterns Sysdig documented in July. The activity used python-requests/2.34.2 and infrastructure already linked to the actor. Microsoft calls it an evolution: agentic orchestration compressing post-compromise operations that would normally require manual coordination.

  • supply-chain/vendor

    Microsoft IDs NeedyMantis malware in DAEMON Tools supply chain campaign

    Microsoft Threat Intelligence has identified NeedyMantis, a modular post-compromise malware family deployed in targeted intrusions against telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. The malware, active since at least October 2025, was discovered during follow-on analysis of the DAEMON Tools supply chain compromise first reported by Kaspersky. Microsoft associates observed activity with threat actors operating from China but hasn't attributed it to a specific nation-state actor or confirmed whether all deployments trace to the same operator.

Open questions

  • 01When will additional CUI-capable cloud platforms enter the market?
  • 02How does FedRAMP 20x affect contractors using Moderate platforms?
  • 03Which platforms have publicly attested to NIST 800-171 r3 readiness?

Sources we watch

Related from Deep Fathom

Earlier coverage