TLDR INFORMATION SECURITY 2025-09-23

START PEN-TESTING ON YOUR TERMS.

MALICIOUS PYPI PACKAGES DELIVER SILENTSYNC RAT

Threat actors uploaded two malicious packages, sisaws and secmeasure, to PyPI that typosquat legitimate libraries and deliver the SilentSync RAT. This malware is downloaded from Pastebin and maintains persistence through registry keys, crontab modifications, or launch agents, depending on the operating system. SilentSync communicates with a hardcoded C2 server at 200.58.107[.]25 over HTTP and steals browser data, including credentials, history, autofill data, and cookies from Chrome, Brave, Edge, and Firefox while also enabling remote command execution and file exfiltration.

GITHUB'S REPUTATION BEING EXPLOITED BY BAD ACTORS TO DISTRIBUTE MALWARE

A security researcher explains how they discovered a macOS malware campaign spreading through SEO and GitHub links disguised as a legitimate app. The GitHub page appears legit, featuring a demo and an install command for Terminal. This command downloads malware and clears all xattrs. The page also hosts a dmg with an obfuscated osascript that executes a second script to remove quarantine and run stackprep.

STELLANTIS DETECTS BREACH AT THIRD-PARTY PROVIDER FOR NORTH AMERICAN CUSTOMERS

Automaker Stellantis disclosed that a third-party service provider's platform that supports North American customers was breached. Stellantis stated that the exposed data included only basic contact information and not financial information.

UNMASKING AKIRA: THE RANSOMWARE TACTICS YOU CAN'T AFFORD TO IGNORE

Based on ZenSec's analysis of over 30 Akira ransomware incidents from 2023 to 2025, the group primarily exploits SSL VPN vulnerabilities (Cisco ASA, SonicWall, and WatchGuard) through missing MFA and unpatched CVEs, then leverages Veeam backup system vulnerabilities for privilege escalation and credential harvesting. Akira operates as a double-extortion group, stealing data via tools like WinSCP and Rclone (often within 3 hours), then encrypting systems at the hypervisor level while using AnyDesk for persistent access. The group targets backup infrastructure for destruction, publishes stolen data via Tor-based leak sites using torrent links, and demonstrates a playbook-driven approach similar to the defunct Conti ransomware operation.

WHY CONTINUOUS PROFILING IS THE FOURTH PILLAR OF OBSERVABILITY

Early profilers focused mainly on CPU and needed manually compiled binaries, which caused high performance overhead. Today, profiling has a lower impact and offers diverse signals that can be automatically collected continuously. OpenTelemetry introduced a new category for continuous profiling and considers adding it as a fourth pillar.

HOW TO AUTOMATICALLY DISABLE USERS IN AWS MANAGED MICROSOFT AD BASED ON GUARDDUTY FINDINGS

Automatically disabling compromised user accounts helps organizations reduce attack fallout. This tutorial demonstrates how to utilize GuardDuty for detecting suspicious activity, triggering an AWS Step Function to retrieve user information, and subsequently disabling the account in AWS Directory Service for Microsoft AD. The last step can also be done on a domain-joined EC2 instance if an organization doesn't use AWS Managed AD.

and best practices for your fleet. Read the ebook (PDF, ungated)

MICROSOFT-VULNERABLE-DRIVER-BLOCK-LISTS

Microsoft no longer provides the vulnerable driver block list in a browsable web page, making it harder to access directly. Instead, the list is only available as a downloadable ZIP file, which complicates its use in SIEM products for lookups and other functions. This project automates the download, extraction, and parsing of the ZIP file, converting the data into CSV and JSON formats for seamless integration with SIEM and security tools.

REGAL

Regal is a linter and language server for the Rego policy language.

TOOLHIVE

Toolhive provides a method to quickly deploy MCP servers that run in isolated containers for added security.

MICROSOFT ENTRA ID FLAW ALLOWED HIJACKING ANY COMPANY'S TENANT

Security researcher Dirk-jan Mollema found a critical flaw that combined undocumented "actor tokens" from Microsoft's legacy Access Control Service with a bug in the deprecated Azure AD Graph API. This flaw allowed complete takeover of any Microsoft Entra ID tenant with Global Admin rights. The attack exploited unsigned actor tokens that bypass security, generate no audit logs, and stay valid for 24 hours without revocation, letting attackers impersonate users. Microsoft patched the vulnerability CVE-2025-55241 within nine days of disclosure in July. The flaw highlights ongoing risks from legacy authentication systems lacking modern security controls.

FBI WARNS BAD ACTORS ARE SPOOFING THE IC3 CYBERCRIME REPORTING WEBSITE

The FBI warns that cybercriminals are creating fake versions of its Internet Crime Complaint Center (IC3) website to steal personal information from victims attempting to report cyber crimes. The spoofed sites use misspelled URLs, alternative domains, and poor graphics to trick users into entering sensitive data, including names, addresses, phone numbers, and banking information. Users should verify they're on the official IC3 site by ensuring the URL is exactly "www.ic3.gov" with HTTPS and avoid clicking on sponsored search results that may redirect to fraudulent sites.

TELECOM EXEC: SALT TYPHOON INSPIRING OTHER HACKERS TO USE UNCONVENTIONAL TECHNIQUES

AT&T's CISO states hackers use Salt Typhoon's tactics like targeting unprotected platforms, exploiting logging gaps, and using legitimate tools for "living off the land" attacks. The Chinese group's success has inspired threats to target weak spots beyond traditional security, with attackers chaining exploits due to stronger defenses, prompting innovation.

TEEN SUSPECT SURRENDERS IN 2023 LAS VEGAS CASINO CYBERATTACK CASE

A teenage suspect linked to 2023 cyberattacks on MGM Resorts and Caesars surrendered to Las Vegas police, facing six felony charges, including extortion and identity theft.

MOZILLA NOW LETS FIREFOX ADD-ON DEVS ROLL BACK BAD UPDATES

Mozilla has introduced a new rollback feature that allows Firefox extension developers to revert to previously approved versions when critical bugs occur, with users automatically receiving the rolled-back version within 24 hours through Firefox's update mechanism.

AI FORENSICS HELP EUROPOL TRACK 51 CHILDREN IN GLOBAL ONLINE ABUSE CASE

Europol led an international operation across 18 countries using AI-driven forensic tools to analyze over 5,000 pieces of child exploitation material, resulting in the identification of 51 child victims and 60 suspects facing criminal proceedings.