Hardware exploits, domain seizures, and red-team misconfigs all trace to the same unpatched trust fabric

GPUThor’s Rowhammer bypass of TRR and ECC on NVIDIA GDDR6, CISA’s domain-level takeover via default credentials and AD CS flaws in two critical-infrastructure entities, and the DOJ’s seizure of QTFY’s QScan/QTRouter platforms (plus parallel Mabna sanctions) are not separate security stories. They are three points on the identical attack surface: any system that still trusts “our hardware will behave” or “our directory will authenticate” can be turned into an observation or exfiltration node. The older Hormuz transit and Black Sea wheat pieces show the same surface extended into physical chokepoints; once the digital layer is compromised, the physical layer follows. No single desk connected the NVIDIA memory attack to the PRC-linked obfuscation service to the domestic AD CS failures because each was filed under a different vertical.