Hello all,
This past week was busy, even into the weekend, with reports of hundreds of companies compromised via Salesloft Drift, Microsoft being forced to reroute traffic stemming from several Red Sea cables being cut, Google dodging a bullet in court and also patching a couple of zero-days in Android, and Cloudflare having blocked the largest DDoS on record. And if that wasn’t enough, this coming Tuesday is Patch Tuesday where Microsoft and a cadre of other vendors unleash their increasingly unstable fixes for defects in their products. As my friend Will says, “fun times.”
Headline NEWS:
- CISA Warns of Android 0-Day. On September first Google released updates to fix 120 vulnerabilities, with two of those being actively exploited zero-days. If you own a Google Pixel, then you should have already been presented with the update. Unfortunately, for most of the Android ecosystem, updates are controlled by the device manufacturers or cellular carriers. A fortunate few will eventually see this security update offered, such as Samsung, Motorola, OnePlus, and a smattering of others. Sadly, the majority of Android based phones never see more than a few stability updates after release, such as a gorgeous Umidigi phone that I had to retire due to a lack of security updates. If you’re like me and have an Android phone that is not receiving security updates, now is the time to retire it and consider a brand that will receive regular security updates throughout its useful life.
- Google Antitrust Ruling comes down mostly in Google’s favor, with the US Government not forcing them to sell off Chrome. However, the ruling provides some bitter-pill requirements that may prove quite hard to swallow. Google must share their hard-won indexing data and user interaction information with other companies. This is akin to forcing Coca Cola to publish their secret formula. In my opinion, this amounts to intellectual property theft. Google is evaluating the 230-page decision and may decide to appeal.
- Google Chrome version 140 came out this week with fixes for six known defects. If you use chrome, update soon.
- Django is a Python based system that helps developers rapidly create web applications by acting as the middleman between the web and the database. A critical vulnerability was recently discovered that requires patching. If you use this, patch quickly.
- Microsoft gives US students a free year of Microsoft 365 Personal. On the surface, this is a phenomenal deal, providing desktop versions of Microsoft’s productivity suite of products. The unknown item is what happens after one year? By then the student will be well immersed into the Microsoft ecosystem, making switching away to other options difficult. There are only two industries that call consumers, “users”. They share a brilliant marketing strategy, offer the product for free until they are hooked, then tell them they must pay. If this was truly benevolence for students from Microsoft, it would be free for their entire term as students.
- Salesloft Drift is a chatbot that integrates with Salesforce and other back-end systems such as Goggle Workspace, Slack, and various cloud storage services. Drift’s OAuth tokens were compromised by a threat actor designated UNC6395 (“GRUB1”). Since these OAuth connections were inherently trusted, Grub got access to anything the OAuth user at the connected organization could access. In many cases it was Salesforce database information. Hundreds of companies had data stolen during the August 8 – 18 crime spree by Grub. The ones that we currently know about are BeyondTrust, Cato Networks, Cloudflare, CyberArk, Google, Palo Alto Networks, PagerDuty, Proofpoint, Salesforce, SpyCloud, Tanium, Tenable, and Zscaler. Depending on what was exfiltrated from the estimated 700 affected organizations, this supply-chain breach could be of the most significant to date, surpassing MOVEit, Snowflake, and SolarWinds.
- SAP S/4HANA Critical Vulnerability. Last month SAP patched a 9.9 CVSS defect that enabled remote code injection, bypassing authentication checks. In other words, a successful threat actor could fully compromise a system, with minimal effort. Active exploitation of the flaw is now underway. Patch immediately.
In Ransomware, Malware, and Vulnerabilities News:
- Hackers Reportedly Demand Google Fire Two Employees, Threaten Data Leak. I’m not sure if I would consider it a back-handed compliment or outright terrorism to have a dirt-bag hacker group demand that my employer fire me and cease any investigation of them. However, I believe that this actual naming of employees is a scary trend that will continue to increase as threat actors become more brazen and closer affiliated with evil organized criminal organizations that have no qualms actually carrying out physical harm to achieve their goals. The rules of the game are changing, and I suspect that a time may soon come where anonymity for the defenders will be required for them to be able to safely perform their jobs.
In Other News Events of Note and Interest:
- CISA, NSA and 19 International Partners Release Shared Vision of Software Bill of Materials for Cybersecurity Guide. It is surprising that it is 2025 and we still don’t have a decent SBOM, or ingredients list, for our various software and hardware systems. Our food and clothing has had ingredient and materials lists for quite some time. If you’ve been in this industry for a while you’ll recall having your Christmas vacation ruined by Log4Shell, a critical remote code execution (RCE) vulnerability that was found in a Java library that was widely used in applications, devices, and cloud systems. You had to search to identify if your enterprise had a vulnerable version anywhere since it was rare to see a list of included libraries in anything. It was no fun. If we’d had a comprehensive list of all included libraries, and dependencies, our jobs would have been significantly simpler. Well, a coalition of international security agencies wants to make that happen. “An SBOM is a formal record detailing the components and supply chain relationships used in building software. SBOMs act as a software “ingredients list” providing organizations with essential visibility into software dependencies, enabling them to identify components, assess risks, and take proactive measures to mitigate vulnerabilities.” I for one applaud this effort and hope it becomes reality quickly.
Musings:
Artificial Intelligence is doing an admirable job automating many entry level positions, resulting in great efficiencies for companies which allows them to reduce staff that would have been doing those functions. However, there’s a growing concern that we are not training up the next generation of mid-level and higher-level people. If you don’t have a reliable system to bring on inexperienced people, and train them through experiential learning, who will fill the positions of the higher-level people when they leave your company or invariably retire? AI may eventually catch up and achieve some level of actual creative thought by the time the great grayout happens, when the gray haired and bearded people retire. But what if it doesn’t?
Keep the shields up!
Viscount Jan Broucinek
Red Dot Security News
Headline NEWS
- CISA Warns of Android 0-Day Use-After-Free Vulnerability Exploited in Attacks
- Google Antitrust Ruling: Company Doesn’t Have to Sell Chrome
- Chrome 140 Released With Fix For Six Vulnerabilities that Enable Remote Code Execution Attacks
- Django Critical Vulnerability Let attackers Execute Malicious SQL Code on Web Servers
- Microsoft gives US students a free year of Microsoft 365 Personal
- Blast Radius of Salesloft Drift Attacks Remains Unclear
- SAP S/4HANA Critical Vulnerability CVE-2025-42957 Exploited in the Wild
Ransomware, Malware, and Vulnerabilities News
- CISA Adds TP-Link and WhatsApp Flaws to KEV Catalog Amid Active Exploitation
- FTC to Question Tech Companies About Risks Around AI Chatbots
- US puts $10M bounty on Russians accused of infra attacks
- Czech cyber agency warns against using services and products that send data to China
- Google denies issuing mass Gmail alert to update passwords
- Cloudflare blocks largest recorded DDoS attack peaking at 11.5 Tbps
- Prolific Russian ransomware operator living in California enjoys rare leniency awaiting trial
- Wireshark 4.4.9 Released With Fix For Critical Bugs and Updated Protocol Support
- Critical 0-Click Vulnerability Enables Attackers to Takeover Email Access Using Punycode
- When Browsers Become the Attack Surface: Rethinking Security for Scattered Spider
- Researchers Warn of MystRodX Backdoor Using DNS and ICMP Triggers for Stealthy Control
- Threat Actors Weaponize HexStrike AI to Exploit Citrix Flaws Within a Week of Disclosure
- BruteForceAI: Free AI-powered login brute force tool
- Threat actors abuse X’s Grok AI to spread malicious links
- Grocers could have refrigeration open to cyberattacks
- Sangoma Patches Critical Zero-Day Exploited to Hack FreePBX Servers
- Iranian Hackers Exploit 100+ Embassy Email Accounts in Global Phishing Targeting Diplomats
- Hackers Scanning Cisco ASA Devices to Exploit Vulnerabilities from 25,000 IPs
- Hackers Leverage Windows Defender Application Control Policies to Disable EDR Agents
- Attackers Are Abusing Malicious PDFs: Here’s How to Spot Them Early
- macOS vulnerability allowed Keychain and iOS app decryption without a password
- Hackers Exploit macOS Security Features to Spread Malware
- Hackers Weaponize Fake Microsoft Teams Site to Deploy Odyssey macOS Stealer
- Hackers May Leverage Raw Disk Reads to Bypass EDR Solutions and Access Highly Sensitive Files
- Hackers Reportedly Demand Google Fire Two Employees, Threaten Data Leak
- Hackers exploited Sitecore zero-day flaw to deploy backdoors
- Hackers Hit 831 Banks and Financial Institutions Worldwide As Dangerous Malware Deployed in Dozens of Android Apps
- Android Security Alert: Google Patches 120 Flaws, Including Two Zero-Days Under Attack
- Infostealers: The Silent Smash-and-Grab Driving Modern Cybercrime
- They know where you are: Cybersecurity and the shadow world of geolocation
- New TinkyWinkey Trojan Targets Windows Systems With Sophisticated Keylogging
- How Chinese State-Sponsored APT Actors Exploit Routers for Stealthy Cyber Espionage
- APT28, aka Fancy Bear, Targets Microsoft Outlook With ‘NotDoor’ Malware
- Malvertising Campaign on Meta Expands to Android, Pushing Advanced Crypto-Stealing Malware to Users Worldwide
- New Phishing Attack Via OneDrive Attacking C-level Employs for Corporate Credentials
- PoC Exploit Released for IIS WebDeploy Remote Code Execution Vulnerability
- Crooks exploit Meta malvertising to target Android users with Brokewell
- Silver Fox Exploits Microsoft-Signed WatchDog Driver to Deploy ValleyRAT Malware
- Silver Fox APT Exploits Signed Windows Driver to Deliver ValleyRAT
- GhostRedirector poisons Windows servers: Backdoors with a side of Potatoes
- TamperedChef infostealer delivered through fraudulent PDF Editor
- Critical Next.js Framework Vulnerability Let Attackers Bypass Authorization
- The Resurgence of IoT Malware: Inside the Mirai-Based Botnet Campaign
- Netskope Windows Client Vulnerability Enables Privilege Escalation via Rogue Server
- QNAP Vulnerability Let Attackers Bypass Authentication and Access Unauthorized Files
- New Cephalus Ransomware Leverages Remote Desktop Protocol to Gain Initial Access
- Amazon disrupts Russian APT29 hackers targeting Microsoft 365
- Lazarus Group Expands Malware Arsenal With PondRAT, ThemeForestRAT, and RemotePE
- Woman loses thousands of dollars to romance scammer posing as astronaut in distress, police in Japan say
- Ukrainian Network FDN3 Launches Massive Brute-Force Attacks on SSL VPN and RDP Devices
- Fraudster stole over $1.5 million from city of Baltimore
- Britain’s JLR hit by cyber incident that disrupts production, sales
- New Automated Extortion Software Is So Devious You Won’t Believe It
- Middletown, OH cybersecurity issues likely a ransomware attack
- Ransomware hits Orleans Parish Sheriff’s computers
- Pennsylvania AG Office says ransomware attack behind recent outage
- Bridgestone Americas confirms cyber attack at some facilities
- Misconfigured Server Leaks 378GB of Navy Federal Credit Union Files
- Massive database containing identity info on 252 million people leaked online – here’s what we know
- Columbia University confirms hack stole Social Security numbers, health info of 870,000
- Fresh AT&T data breach allegedly affects 24M users
- com discloses recent data breach via file transfer app
- US delivery company hit in data breach with full names, SSNs and medical info of thousands exposed online
- OnTrac data breach exposes 40,000 customer’s personal information
- Salesloft Takes Drift Offline After OAuth Token Theft Hits Hundreds of Organizations
- Google warns that mass data theft hitting Salesloft AI agent has grown bigger
- More Cybersecurity Firms Hit by Salesforce-Salesloft Drift Breach
- Cloudflare hit by data breach in Salesloft Drift supply chain attack
- The impact of the Salesloft Drift breach on Cloudflare and our customers
- TransUnion joins wave of companies hit by Salesforce-linked attacks
- Palo Alto Networks data breach exposes customer info, support cases
- SaaS giant Workiva discloses data breach after Salesforce attack
- Zscaler data breach exposes customer info after Salesloft Drift compromise
- Supply-chain attack hits Zscaler via Salesloft Drift, leaking customer info
- WordPress Woes Continue Amid ClickFix, TDS Threats
Other News Events of Note and Interest
- Cool Tool: CrystalDiskInfo 9.7.2
- Spam Email Creator Has No Regrets 31 Years Later
- CISA, NSA and 19 International Partners Release Shared Vision of Software Bill of Materials for Cybersecurity Guide
- NIST Enhances Security Controls for Improved Patching
- Europe’s Jupiter supercomputer hits exascale threshold
- Google hit with $3.5 billion fine from European Union in ad-tech antitrust case
- Microsoft Warns Of Azure Cloud Service Disruption After Cables Cut In Red Sea
- Anguilla: The Caribbean island making millions from the AI boom
- Anthropic will start training its AI models on chat transcripts
- AI Scientists May Have Discovered LLMs’ Light-Bulb Moment
- A new research project is the first comprehensive effort to categorize all the ways AI can go wrong, and many of those behaviors resemble human psychiatric disorders.
- Apple Plans AI Search Engine for Siri to Rival OpenAI; Google-Siri Talks Advance
- Forcing Google to share secrets isn’t competition
- Amazon’s Starlink Rival, Project Kuiper, Demos 1 Gigabit Downloads
- WinBoat is a new Linux app to run Windows apps with “seamless integration”
- OpenSSH: Post-Quantum Cryptography
- Microsoft kills one of its productivity services, here is what you need to know
- Microsoft 365 now offers deeper integration with OneDrive in Windows
- Microsoft employee confirms Windows 11 may never fix a key internet feature for office PCs
- Microsoft is retiring some Graph components
- Microsoft says recent Windows updates cause app install issues
- Microsoft announces one of the most anticipated Windows updates to date
- Microsoft patches annoying Event Viewer bug in Windows 11
- Microsoft explains in detail how it is improving next gen Windows 11 drivers
- Microsoft now enforces MFA on Azure Portal sign-ins for all tenants
- Microsoft simplifies Azure VM security, here’s how
- You can’t download and install Windows 11 25H2 yet as Microsoft delays ISO release date
- Windows 11 SSD Crashing Issues May Be Linked to Pre-Production Firmware Sent to Reviewers; Retail Units Likely Unaffected