TLDR INFORMATION SECURITY 2025-11-25

🎁 TLDR readers get $200 with code ZTWTLDR26

SHADOWPAD MALWARE ACTIVELY EXPLOITS WSUS VULNERABILITY FOR FULL SYSTEM ACCESS

Threat actors are actively exploiting CVE-2025-59287, a critical deserialization RCE flaw in Microsoft WSUS (patched last month), to deploy ShadowPad malware with SYSTEM privileges. The attack chain uses PowerCat for initial shell access, then certutil/curl to download ShadowPad, which persists via DLL side-loading through a legitimate ELAN binary (ETDCtrlHelper.exe). Exploitation accelerated after public PoC release. Patch immediately and audit WSUS exposure.

CRITICAL 7 ZIP VULNERABILITY WITH PUBLIC EXPLOIT REQUIRES MANUAL UPDATE

CVE-2025-11001 is a directory traversal RCE flaw (CVSS 7.0) in 7-Zip's symbolic link handling that allows arbitrary code execution when users extract malicious ZIP files. A public PoC exploit is available, and Microsoft is tracking active weaponization. It was fixed in version 25.00, but 7-Zip lacks auto-update capability, leaving widespread unpatched installations. Inventory all Windows systems with 7-Zip versions below 25.01 and immediately push updates via Intune or deployment scripts.

COX ENTERPRISES DISCLOSES ORACLE E-BUSINESS SUITE DATA BREACH

Hackers exploited a previously unknown vulnerability in Oracle E-Business Suite to breach Cox Enterprises' network, exposing personal information of nearly 9,500 people. The attack, linked to the Cl0p ransomware group, went unnoticed for weeks and resulted in data being published on the dark web. Cox is offering free identity monitoring, but did not specify which personal data was exposed. It will continue its investigation.

A REVERSE ENGINEER'S ANATOMY OF THE MACOS BOOT CHAIN & SECURITY ARCHITECTURE

The macOS boot process on Apple Silicon is anchored in hardware-level security. It begins with an immutable Boot ROM that uses cryptographic hardware keys fused into silicon to validate and decrypt critical boot components. A layered chain of trust is established, where each boot stage verifies the next using strict signature checks and hardware root keys, preventing execution of unauthorized code. Apple's custom extensions to the Arm architecture provide pointer authentication, branch target enforcement, and a secure execution environment with isolated privilege levels. The Secure Enclave acts as an independent computer managing cryptographic keys, enforcing anti-replay protections, and mediating sensitive data access via a mailbox interface. These mechanisms robustly defend against rollback, replay, and tampering attacks throughout the boot chain.

ALL PATHS LEAD TO YOUR CLOUD: A MAPPING OF INITIAL ACCESS VECTORS TO YOUR AWS ENVIRONMENT

AWS initial access vectors can be categorized into two classes: service exposure (Lambda, EC2, ECR, and DataSync misconfigurations that enable public access) and access by design (Cognito, IAM, and IoT misconfigurations in services intended for access control). 97% of organizations still use IAM users despite best practices recommending roles. 84% use Cognito with potential self-registration risks. ECR repositories are enumerable by any AWS account holder. Security teams should audit resource-based policies for wildcard principals, enforce ExternalId for cross-account role assumptions, disable Cognito self-registration where unnecessary, and validate OIDC trust policy conditions include proper sub/aud claims.

PRACTICAL RESOURCES FOR DETECTION ENGINEERS

Detection engineering is a proactive threat-hunting specialization that applies software engineering processes to detect attackers. Prospective detection engineers should choose a domain to focus on, such as cloud workload security, cloud application security, cloud misconfigurations, endpoint security, network security, IAM, or insider threat. This blog post includes a list of blog posts, videos, and books that both starters and pros could benefit from.

RUNLAYER (PRODUCT LAUNCH)

Runlayer provides a secure control layer for enterprise AI, monitoring access and usage, and blocking threats in real time. It supports the Model Context Protocol for safe, compliant AI transformation across environments.

PROWLER

Prowler is an open-source security tool for AWS, Azure, GCP, and Kubernetes for performing security assessments, audits, incident response, compliance, continuous monitoring, hardening, and forensics readiness. It includes CIS, NIST 800, NIST CSF, CISA, FedRAMP, PCI-DSS, GDPR, HIPAA, FFIEC, SOC2, GXP, Well-Architected Security, ENS, and more.

MAGNET

Magnet is a purple-team telemetry and simulation toolkit.

SHAI-HULUD RETURNS: OVER 300 NPM PACKAGES INFECTED VIA FAKE BUN RUNTIME WITHIN HOURS

Over 300 NPM packages were poisoned via compromised maintainer accounts that injected a fake Bun runtime preinstall script that deploys a 10MB obfuscated JavaScript payload to steal credentials. The malware uses TruffleHog for local secret scanning. It exfiltrates NPM tokens and cloud credentials (AWS/GCP/Azure) via rogue GitHub Action runners named SHA1HULUD, and achieves worm-like propagation by republishing infected packages using stolen tokens. High-impact packages affected include @zapier/zapier-sdk (2.6M weekly downloads), posthog-node, and @asyncapi/specs. Teams should audit dependencies for setup_bun.js/bun_environment.js files, rotate any potentially exposed credentials, and pin package versions to known-good releases.

GOOGLE ENABLES PIXEL-TO-IPHONE FILE SHARING VIA QUICK SHARE, AIRDROP

Google has enabled Quick Share interoperability with Apple AirDrop on Pixel 10 devices. The feature was implemented in Rust to eliminate memory-safety vulnerabilities. NetSPI penetration testing confirmed no data leakages. The system uses direct device-to-device connections via AirDrop's “Everyone for 10 minutes” mode without server intermediaries. However, users must manually verify recipient devices to avoid accidental sharing with nearby strangers. Security teams should note that this expands the cross-platform attack surface for social-engineering file transfers.

NEW RADZARAT SPYWARE POSES AS FILE MANAGER TO HIJACK ANDROID DEVICES

RadzaRat is an Android RAT masquerading as a file manager with complete AV evasion (0/66 on VirusTotal) and keylogging capabilities. The malware uses free infrastructure (Render.com and a Telegram bot) and persistence mechanisms that prevent termination and survive reboots. The APK has been openly distributed and actively sold on underground forums by developer 'Heron44' since November 8. Security teams should implement behavioral detection and app vetting policies, as signature-based defenses are currently ineffective against this threat targeting credentials and financial data.

AI TEDDY BEAR FOR KIDS RESPONDS WITH SEXUAL CONTENT AND ADVICE ABOUT WEAPONS

FoloToy's GPT-4o-powered “Kumma” teddy bear spontaneously introduced sexual content, BDSM topics, and dangerous household advice during testing, prompting OpenAI to revoke the developer's API access.

146,000 IMPACTED BY DELTA DENTAL OF VIRGINIA DATA BREACH

Delta Dental of Virginia notified approximately 146,000 individuals after a security breach of an email account exposed personal information.

IBERIA DISCLOSES SECURITY INCIDENT TIED TO SUPPLIER BREACH

Iberia experienced a data breach due to a supplier hack.