TLDR INFORMATION SECURITY 2025-11-21

🎁 Get the gift of SAT

👉 Explore the full platform and chat with Huntress security

experts: see a custom demo

TAMPEREDCHEF MALWARE SPREADS VIA FAKE SOFTWARE INSTALLERS IN ONGOING GLOBAL CAMPAIGN

TamperedChef (aka BaoLoader) distributes JavaScript backdoors through fake software installers signed with fraudulent certificates from shell companies in the US, Panama, and Malaysia. Delivered via malvertising and SEO poisoning targeting searches for PDF editors and product manuals, the malware establishes persistence through scheduled tasks that execute obfuscated JavaScript, which beacons encrypted system data to C2 servers, with primary infections concentrated in US healthcare, construction, and manufacturing sectors. Security teams should implement application allowlisting, monitor for suspicious scheduled tasks executing JavaScript payloads, validate code-signing certificates against threat intelligence, and restrict access to product manuals through authorized channels only.

SOLARWINDS PATCHES THREE CRITICAL SERV-U VULNERABILITIES

SolarWinds patched three critical vulnerabilities in the Serv-U 15.5.2.2.102 file transfer solution that allow attackers with admin privileges to execute arbitrary code: CVE-2025-40549 (path restriction bypass), CVE-2025-40548 (broken access control), and CVE-2025-40547 (logic error). All three flaws are rated medium severity on Windows due to platform-specific differences in privilege and path handling. Organizations using Serv-U should immediately upgrade to version 15.5.3, especially given SolarWinds' history of exploited vulnerabilities with seven flaws already in CISA's KEV catalog.

ANOTHER SALESFORCE-LINKED DATA BREACH HAS SHINYHUNTERS' FINGERPRINTS ALL OVER IT

Salesforce reported a new data breach likely involving the ShinyHunters group, who may have accessed customer data through Gainsight apps connected to Salesforce. Upon discovery, Salesforce revoked access tokens and removed the affected apps. Although no vulnerability was found in Salesforce itself, Google analysts linked the incident to prior token-related attacks.

APPLICATION CONTAINMENT: HOW TO USE RINGFENCING TO PREVENT THE WEAPONIZATION OF TRUSTED SOFTWARE

Ringfencing extends application allowlisting by enforcing granular containment policies on approved software, controlling file access, registry modifications, inter-process communication, and network activity to prevent “living off the land” attacks that weaponize legitimate tools like PowerShell, Office macros, or scripting engines. The technique blocks lateral movement, data exfiltration, and ransomware encryption by restricting applications to only their necessary functions, preventing them from spawning unauthorized child processes or accessing sensitive directories. Implement ringfencing in phases, starting with high-risk applications, use simulation mode to identify legitimate use cases before enforcement, combine with application allowlisting and storage controls, and continuously monitor the unified audit for policy violations.

WHEN UPDATES BACKFIRE: RCE IN WINDOWS UPDATE HEALTH TOOLS

Researchers at Eye Security uncovered a remote code execution flaw in Microsoft's Update Health Tools (KB4023057), traced to abandoned Azure blob storage. Attackers could trigger unintended code execution on vulnerable devices by exploiting predictable blob names and weak message security. Microsoft confirmed the issue, transferred ownership of the exposed blobs, and improved protections in newer tool versions, mitigating risks for most users.

IMDS ABUSED: HUNTING RARE BEHAVIORS TO UNCOVER EXPLOITS

The Instance Metadata Service (IMDS) is a server that runs on cloud VMs (like AWS EC2) to provide short-lived credentials to applications running on them. To detect potential IMDS abuse, establish a baseline of which services frequently access IMDS and then monitor for applications that either access sensitive IMDS paths or access IMDS more frequently than usual. This post applies this methodology to hunting for a vulnerability in pandoc and Clickhouse.

steady the ship. Hear their stories

SECURE (PRODUCT LAUNCH)

Secure.com provides AI-powered Digital Security Teammates (DSTs), autonomous agents that integrate with existing security tools, investigate and triage incidents, automate compliance tasks, and escalate issues.

AZURE-SENTINEL

Cloud-native SIEM for intelligent security analytics for your entire enterprise.

PINACT

pinact is a CLI to edit GitHub Workflow and Composite action files and pin versions of actions and reusable workflows.

IRANIAN APT HACKS HELPED DIRECT MISSILE STRIKES IN ISRAEL AND THE RED SEA

Imperial Kitten (aka Tortoiseshell/TA456) conducted cyber reconnaissance on maritime Automatic Identification System (AIS) tracking data days before Houthi missile strikes on Red Sea shipping in February 2024, demonstrating direct correlation between IRGC-linked cyber espionage and kinetic targeting operations. Amazon's threat intelligence indicates this represents an evolution in hybrid warfare where cyber operations provide target reconnaissance for physical attacks, with the traditional boundaries between digital and kinetic operations dissolving. Security teams should monitor for anomalous access to critical infrastructure location/tracking systems, implement enhanced logging and behavioral analytics on these systems, and coordinate with physical security teams to correlate cyber reconnaissance patterns with potential kinetic threat indicators.

OBSCURE MCP API IN COMET BROWSER BREACHES USER TRUST, ENABLING FULL DEVICE CONTROL VIA AI BROWSERS

SquareX researchers exposed a hidden MCP API (chrome.perplexity.mcp.addStdioServer) in the Comet browser that enables embedded extensions to execute arbitrary local commands without user consent, thereby bypassing decades of established browser security principles. The API is accessible via Comet's Agentic extension, triggered by perplexity.ai, creating a catastrophic third-party risk where a single XSS vulnerability or a compromised Perplexity employee could grant attackers complete device control over all Comet users. Security teams should audit AI browser deployments, demand API disclosure from vendors, require third-party security audits, and ensure users can disable embedded extensions that are currently hidden from extension dashboards.

HOW THE CLASSIC ANIME 'GHOST IN THE SHELL' PREDICTED THE FUTURE OF CYBERSECURITY 30 YEARS AGO

Set decades ahead of its time, "Ghost in the Shell" envisioned a world where cyber-attacks, government-sanctioned hackers, and AI-driven threats are commonplace. It foresaw issues like digital privacy risks, behavioral cyber-profiling, and tech-enabled abuse, ideas that now define modern cybersecurity.

EUROPE IS SCALING BACK GDPR AND RELAXING AI LAWS

ATTACKERS ARE USING “SNEAKY 2FA” TO CREATE FAKE SIGN-IN WINDOWS THAT LOOK REAL

A Phishing-as-a-Service kit called “Sneaky 2FA” enables Browser-in-the-Browser attacks that create fake login pop-ups with convincing address bars using HTML/CSS.

DISGRUNTLED IT WORKER PULLS MASSIVE CYBER STUNT IN HOUSTON

A fired IT contractor, upset about his dismissal, re-entered the Houston Waste Management network, reset 2,500 passwords, and locked thousands of staff out across the US.