TLDR INFORMATION SECURITY 2025-09-08

it never stops. Drata's AI-native Trust Management platform

streamlines the entire GRC workflow. Security questionnaires? Automated. Evidence collection? Continuous. Risk management? Built in.

Get a demo

CRITICAL SAP VULNERABILITY CVE-2025-42957 ACTIVELY EXPLOITED BY HACKERS

Hackers are exploiting a critical CVE in SAP S/4HANA that enables low-level users to gain admin control. The flaw affects multiple versions, risking data theft, backdoors, and ransomware. SAP released patches on August 12. Organizations should update immediately, as the Dutch NCSC issued a medium-high priority advisory on September 5.

DARK WEB VENDOR CLAIMS BREACH OF ANUVU AWS EMPLOYEE DATA

A dark web vendor claims to have breached Anuvu (formerly Global Eagle), a major satellite provider for airlines and cruise lines, allegedly obtaining over 70 admin credentials for internal services like AWS and Postgres databases. The stolen data includes sensitive employee info, customer databases, and Starlink contract details, potentially exposing users of in-flight connectivity. Researchers verified parts of the data appear legitimate and warned that the breach could enable targeted phishing and credential stuffing attacks against airline partners like Air France, Delta, Southwest, and British Airways.

ICLOUD CALENDAR ABUSED TO SEND PHISHING EMAILS FROM APPLE'S SERVERS

A new phishing campaign that leverages iCloud Calendar invites was reported to BleepingComputer. The phishing email notifies the user that their PayPal account is being charged and requests the user to call a given phone number. The notable thing is that the email is sent from Apple's servers because the attackers add the user's email to an Office 365 group, which they invite to the event, and include the phishing text in the Notes field.

WHAT FRAMING SECURITY ALERTS AS A BINARY TRUE OR FALSE POSITIVE IS COSTING YOU

The true/false positive binaries only capture whether an alert accurately alerts on a signal, but not if it is impactful. The author proposes adding a layer of intent or disposition to alert metrics to measure whether the alert had an actual business impact. This leads to a refined classification with the steps: True Positive - Malicious, True Positive - Suspicious, True Positive - No Business Impact, and False Positive.

SECURING MODEL CONTEXT PROTOCOL (MCP) WITH TELEPORT AND AWS

MCPs pose security issues like poor auditing, insecure credentials, and excessive privileges. Teleport offers a Unified Identity Framework, giving each MCP a unique cryptographic identity with dynamic credentials, fine-grained access, and thorough logging. This post covers deploying and securing MCP access to a database.

DETECTING ADCS PRIVILEGE ESCALATION

Active Directory Certificate Service (ADCS) is used in Active Directory environments to manage certificates for systems, users, applications, and more, and provides a variety of potential privilege escalation vectors. ADCS logging is not enabled by default and must be enabled via certsrv. This post demonstrates how to create and test KQL alerts for a common privilege escalation technique.

MALICIOUS PDF GENERATOR

The repository contains ten variations of malicious PDF files that include phone-home features. These can be used with Burp Collaborator or Interact.sh.

GHBUSTER

ghbuster is a tool from Datadog that detects suspicious GitHub users and repos using heuristics. The tool analyzes patterns like coordinated star manipulation, commits from unlinked emails, users with only forked repositories, and accounts with minimal community activity to flag threat actors weaponizing trust in the open-source ecosystem. It provides a command-line interface with modular detection rules and requires a GitHub API token.

FINCH

Finch is a fingerprint-aware TLS reverse-proxy that inspects TLS handshakes and HTTP requests to extract JA3, JA4, JA4H, and Akamai HTTP/2 fingerprints, then evaluates them against hot-reloadable rules.

VIRUSTOTAL FINDS HIDDEN MALWARE PHISHING CAMPAIGN IN SVG FILES

VirusTotal discovered a phishing campaign using SVG files with embedded JavaScript to impersonate Colombia's judicial system, delivering malware through fake government portals. The campaign used 44 unique SVG files that evaded all antivirus engines but were detected by VirusTotal's AI Code Insight feature, which also uncovered 523 additional samples dating back to August. The malicious SVGs create convincing fake judicial portals with progress bars and security tokens, while secretly downloading ZIP archives containing malware to victims' systems.

GOOGLE FINED $3.5 BILLION FOR BREACHING EU'S ANTITRUST LAWS

The EU fined Google €2.95 billion for abusing its dominant position in advertising tech by favoring its AdX exchange since 2014. This is Google's fourth major EU antitrust penalty, totaling nearly €10 billion over ten years. Google has 60 days to suggest compliance or risk divestment. It plans to appeal.

CZECH CYBER AGENCY NUKIB FLAGS CHINESE ESPIONAGE RISKS TO CRITICAL INFRASTRUCTURE

Czech cybersecurity agency NUKIB warned of increasing risks from Chinese-linked technologies in vital sectors such as energy, healthcare, transport, and government, citing APT31's attacks on Czech ministries. The agency pointed out risks from Chinese devices like IP cameras, PV inverters, smart meters, phones, cars, and AI models that can send data to or be controlled remotely from China. NUKIB stressed that Chinese laws give authorities broad powers to access data and force private companies to cooperate in state-led spying, urging Czech organizations to implement proper protections against these cyber threats.

WAYMO SAYS IT WON'T SURRENDER CAMERA FOOTAGE WITHOUT A FIGHT

Waymo co-CEO Tekedra Mawakana announced the company will "challenge, limit, or reject" law enforcement requests for robotaxi camera footage that lack valid legal processes like warrants, as each vehicle's 29 cameras create privacy concerns about potential surveillance misuse.

BRIDGESTONE CONFIRMS CYBERATTACK DISRUPTING NORTH AMERICAN PLANTS

Tire manufacturing giant Bridgestone confirmed a cyberattack disrupted operations at multiple North American facilities, including plants in South Carolina and Quebec.

QANTAS CUTS EXECUTIVE BONUSES BY 15% AFTER A JULY DATA BREACH

Australian airline Qantas cut executive bonuses by 15% after a July cyberattack linked to Scattered Spider compromised the data of 5.7 million customers through a third-party call center platform.