TLDR INFORMATION SECURITY 2025-09-04

REGISTER TODAY

SILVER FOX APT EXPLOITS SIGNED WINDOWS DRIVER TO DELIVER VALLEYRAT

Silver Fox APT exploits a Microsoft-signed but vulnerable WatchDog Antimalware driver (amsdk.sys v1.0.600) to disable security processes on Windows 10/11 and deploy ValleyRAT malware, with the driver never being flagged by Microsoft's Vulnerable Driver Blocklist or LOLDrivers database. The attackers bypassed hash-based blocklists even after a patch by changing a byte in the driver's timestamp while keeping its valid Microsoft signature, showing how trusted signed drivers can be weaponized. The campaign exposes gaps in Microsoft's driver blocklist and the need for security teams to use additional verification beyond signature validation, as the malware terminated nearly 200 security processes targeting mainly Asian organizations.

WORDPRESS WOES CONTINUE AMID CLICKFIX, TDS THREATS

Cybercriminals are exploiting vulnerable and fake WordPress plugins to hijack sites and redirect visitors to malicious destinations. Two major campaigns, ClickFix ("ShadowCaptcha") and Help TDS, have targeted thousands of websites for scams and data theft. Attackers often gain access through stolen credentials or unpatched plugins, making regular updates, strong authentication, and vigilant plugin management critical for site security.

IRANIAN HACKERS EXPLOIT 100+ EMBASSY EMAIL ACCOUNTS IN GLOBAL PHISHING TARGETING DIPLOMATS

An Iran-linked hacking group executed a broad spear-phishing campaign, compromising over 100 embassy and government accounts worldwide. Masquerading as urgent diplomatic emails, attackers distributed malware using Word documents with malicious macros. The operation, associated with the group Homeland Justice, mainly targeted Europe and Africa.

AGENTIC AI: A CISO'S SECURITY NIGHTMARE IN THE MAKING?

Agentic AI's autonomous decision-making poses cybersecurity risks, including shadow AI deployments without IT oversight, multi-agent systems spreading sensitive data, and AI chaining actions that mimic multi-stage attacks while evading security controls. CISOs struggle with visibility into these systems, increased attack surfaces via third-party APIs, and distinguishing between emergent AI behavior and security breaches. This calls for new defense models with real-time monitoring, tight governance, and cross-team coordination. Organizations must adopt secure-by-design methods and proactive governance to maximize AI benefits while managing risks from systems that can access data, decide, and adapt without human oversight.

HOW THEY GOT IN — DAVITA INC.

The data breach at DaVita Inc. unfolded due to a combination of weak security controls, persistent vulnerabilities, and a lack of timely action on previous advisories. Attackers exploited leaked credentials, unpatched internet-facing systems, legacy software, and insufficient monitoring, allowing them to compromise sensitive healthcare data. The repercussions were serious: DaVita's stock value plunged over 14%, substantial regulatory fines are expected, and the company's reputation took a significant hit.

AZURE AD CLIENT SECRET LEAK: THE KEYS TO CLOUD

Exposing Azure AD credentials in public configuration files (like appsettings.json) gives attackers direct access to cloud resources because with these secrets, attackers can impersonate trusted apps, exfiltrate data, escalate privileges, and persist within an organization. Leaks occur due to misconfiguration, poor secrets management, and insufficient security checks. To prevent this, restrict access, move secrets out of code, rotate exposed keys immediately, use least privilege, and monitor for misuse to prevent severe breaches.

actually matters. Get the report

SUDOMY

Sudomy is a subdomain enumeration tool that collects subdomains and analyzes domains, performing advanced automated reconnaissance (framework). This tool can also be used for OSINT (Open-source intelligence) activities.

MSSQLHOUND

MSSQLHound is a PowerShell collector for adding MSSQL attack paths to BloodHound with OpenGraph.

DETECTION ENGINEERING FRAMEWORK

The Detection Engineering Framework is a comprehensive framework for SOC use case development, detection engineering, implementation, and management.

PROLIFIC RUSSIAN RANSOMWARE OPERATOR LIVING IN CALIFORNIA ENJOYS RARE LENIENCY AWAITING TRIAL

Russian national Ianis Antropenko, arrested for deploying Zeppelin ransomware against 138 U.S. victims, including critical infrastructure, from 2018 to 2022, remains free on bail in California despite multiple parole violations and $2.8M in seized cryptocurrency—a rare leniency that security experts suggest may indicate cooperation with authorities. His poor operational security, including using personal PayPal accounts linked to ransomware operations and storing cryptocurrency seed phrases in iCloud, enabled FBI investigators to trace over 101 Bitcoins through the seized ChipMixer service and build their case. The case highlights the evolving challenge of prosecuting cybercriminals operating from within U.S. borders, with Antropenko's lenient pretrial conditions (including no ban on internet use) contrasting sharply with the typical detention of ransomware suspects, raising questions about potential cooperation agreements or intelligence value.

INLINE STYLE EXFILTRATION: LEAKING DATA WITH CHAINED CSS CONDITIONALS

Attackers can now use only inline CSS styles—with the help of chained if statements—to steal sensitive data like user IDs directly from web pages, all without external files or selectors. This creative trick works on Chromium browsers and highlights how inline CSS itself can be a security threat if user-controlled content isn't locked down properly.

FIRE ANT: A DEEP-DIVE INTO HYPERVISOR-LEVEL ESPIONAGE

Cybersecurity firm Sygnia has been tracking a campaign targeting VMware ESXi, vCenter, and network appliances to compromise environments. The attackers compromise the hypervisor by exploiting CVE-2023-34048 to obtain code execution and install an HTTP backdoor on the hypervisors. The attackers then used PowerCLI commands to compromise guests without guest credentials and also ran unregistered VMs with the VMware CLI to bypass registration in vCenter.

GMAIL'S PROTECTIONS ARE STRONG AND EFFECTIVE, AND CLAIMS OF A MAJOR GMAIL SECURITY WARNING ARE FALSE.

Google has refuted recent inaccurate claims about a major Gmail security issue, reaffirming that its protections block over 99.9% of phishing and malware attempts while recommending users adopt passkeys and follow phishing prevention best practices.

GOOGLE FIXES ACTIVELY EXPLOITED ANDROID FLAWS IN SEPTEMBER UPDATE

Google's September Android security update patches 84 vulnerabilities, including two actively exploited zero-day privilege escalation flaws (CVE-2025-38352 in the kernel and CVE-2025-48543 in Android Runtime) under limited targeted exploitation, plus four critical RCE vulnerabilities affecting System and Qualcomm components.

CISA, NSA, AND 19 INTERNATIONAL PARTNERS RELEASE SHARED VISION OF SOFTWARE BILL OF MATERIALS FOR CYBERSECURITY GUIDE

CISA, NSA, and partners release a vision document to promote global Software Bill of Materials (SBOM) adoption to improve software transparency and mitigate supply chain risks through standardized practices.