Distracting the Analyst for Fun and Profit

Our undergraduate intern, Tyler House analyzed what may have been a small DoS attack that was likely more meant to distract than to actually cause a denial of service

https://isc.sans.edu/diary/%5BGuest%20Diary%5D%20Distracting%20the%20Analyst%20for%20Fun%20and%20Profit/32308

GitHub s plan for a more secure npm supply chain

GitHub outlined its plan to harden the supply chain, in particular in light of the recent attack against npm packages

https://github.blog/security/supply-chain-security/our-plan-for-a-more-secure-npm-supply-chain/

SolarWinds Web Help Desk AjaxProxy Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVE-2025-26399)

SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.

https://www.solarwinds.com/trust-center/security-advisories/cve-2025-26399

Vulnerabilities in Supermicro BMC Firmware CVE-2025-7937 CVE-2025-6198

Supermicro fixed two vulnerabilities that could allow an attacker to compromise the BMC with rogue firmware.

https://www.supermicro.com/en/support/security_BMC_IPMI_Sept_2025

CISA Reports Ivanti EPMM Exploit Sightings

Two different organizations submitted backdoors to CISA, which are believed to have been installed using Ivanti vulnerabilities patched in May.

https://www.cisa.gov/news-events/analysis-reports/ar25-261a

Lastpass Observes Impersonation on GitHub

Lastpass noted a number of companies being impersonated via fake GitHub repositories in order to trick victims to download Mac malware.

https://blog.lastpass.com/posts/attack-targeting-macs-via-github-pages

Oracle Scheduler Ransomware

Ransomware has been discovered that gained access to systems via an exposed Oracle Database Scheduler service.

https://labs.yarix.com/2025/09/elons-proxima-black-shadow-related-ransomware-attack-via-oracle-dbs-external-jobs/

Help Wanted: What are these odd requests about?

An odd request is hitting a number of our honeypots with a somewhat unusual HTTP request

header. Please let me know if you no what the request is about.

https://isc.sans.edu/forums/diary/Help+Wanted+What+are+these+odd+reuqests+about/32302/

Forta GoAnywhere MFT Vulnerability

Forta s GoAnywhere MFT product suffers from a critical deserialization vulnerability. Forta released

an advisory disclosing the vulnerability on Thursday.

https://www.fortra.com/security/advisories/product-security/fi-2025-012

EDR Freeze

A new tool, EDR Freeze, allows regular users to suspend EDR processes.

https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html

Exploring Uploads in a Dshield Honeypot Environment

This guest diary by one of our SANS.edu undergraduate interns shows how to analyze files uploaded to Cowrie

https://isc.sans.edu/diary/Exploring%20Uploads%20in%20a%20Dshield%20Honeypot%20Environment%20%5BGuest%20Diary%5D/32296

Sonicwall Breach

SonicWall MySonicWall accounts were breached via credential brute forcing

https://www.sonicwall.com/support/knowledge-base/mysonicwall-cloud-backup-file-incident/250915160910330

DeepSeek Bias

Cloudflare found significant biases in code created by the Chinese AI engine DeepSeek. Code for organizations not aligned with China s politics contained significantly more bugs

https://www.washingtonpost.com/technology/2025/09/16/deepseek-ai-security/

Google Chrome 0-day

Google fixed an already-exploited vulnerability in Google Chrome

https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_17.html

CTRL-Z DLL Hooking

Attackers may use a simple reload trick to overwrite breakpoints left by analysts to reverse malicious binaries.

https://isc.sans.edu/diary/CTRL-Z%20DLL%20Hooking/32294

Global Admin in every Entra ID tenant via Actor tokens

As part of September s patch Tuesday, Microsoft patched CVE-2025-55241. The discoverer of the vulnerability,

Dirk-jan Mollema has published a blog post showing how this vulnerability could have been exploited.

https://dirkjanm.io/obtaining-global-admin-in-every-entra-id-tenant-with-actor-tokens/

WatchGuard Firebox iked Out of Bounds Write Vulnerability CVE-2025-9242

WatchGuard patched an out-of-bounds write vulnerability, which could allow an unauthenticated attacker to compromise the devices.

https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00015

NVidia Triton Inference Server

NVIDIA patched critical vulnerabilities in its Triton Inference Server.

https://nvidia.custhelp.com/app/answers/detail/a_id/5691

Why You Need Phishing-Resistant Authentication NOW.

The recent compromise of a number of high-profile npmjs.com accounts has yet again shown how dangerous a simple phishing email can be.

https://isc.sans.edu/diary/Why%20You%20Need%20Phishing%20Resistant%20Authentication%20NOW./32290

S1ngularity/nx Attackers Strike Again

A second wave of attacks has hit over a hundred npm-related GitHub repositories. The updated payload implements a worm that propagates itself to other repositories.

https://www.aikido.dev/blog/s1ngularity-nx-attackers-strike-again

ChatGPT s Calendar Integration Can Be Exploited to Steal Emails

ChatGPT s new MCP integration can be used, via prompt injection, to affect software connected to ChatGPT via MCP.

https://www.linkedin.com/posts/eito-miyamura-157305121_we-got-chatgpt-to-leak-your-private-email-activity-7372306174253256704-xoX1/

Apple Updates

Apple released major updates for all of its operating systems. In addition to new features, these updates patch 33 different vulnerabilities.

https://isc.sans.edu/diary/Apple%20Updates%20Everything%20-%20iOS%20macOS%2026%20Edition/32286

Microsoft End of Life

October 14th, support for Windows 10, Exchange 2016, and Exchange 2019 will end.

https://support.microsoft.com/en-us/windows/windows-10-support-ends-on-october-14-2025-2ca8b313-1946-43d3-b55c-2b95b107f281#:~:text=As%20a%20reminder%2C%20Windows%2010,one%20that%20supports%20Windows%2011.

https://techcommunity.microsoft.com/blog/exchange/t-9-months-exchange-server-2016-and-exchange-server-2019-end-of-support/4366605

Phishing Targeting Rust Developers

Rust developers are reporting similar phishing emails as the emails causing the major NPM compromise last week.

https://github.com/rust-lang/crates.io/discussions/11889#discussion-8886064

Samsung Patches 0-Day

Samsung released its monthly updates for its flagship phones fixing, among other vulnerability, an already exploited 0-day.

https://security.samsungmobile.com/securityUpdate.smsb

Web Searches For Archives

Didier observed additional file types being searched for as attackers continue to focus on archive files as they spider web pages

https://isc.sans.edu/diary/Web%20Searches%20For%20Archives/32282

FBI Flash Alert: Salesforce Attacks

The FBI is alerting users of Salesforce of two different threat actors targeting Salesforce. There are no new vulnerabilities disclosed, but the initial access usually takes advantage of social engineering or leaked data from the Salesdrift compromise.

https://www.ic3.gov/CSA/2025/250912.pdf

VSCode Cursor Extensions Malware

Koe Security unmasked details about a recent malicious cursor extension campaign they call White Cobra.

https://www.koi.security/blog/whitecobra-vscode-cursor-extensions-malware

BSides Augusta

https://bsidesaugusta.org/

DShield SIEM Docker Updates

Guy updated the DShield SIEM which graphically summarizes what is happening inside your honeypot.

https://isc.sans.edu/diary/DShield%20SIEM%20Docker%20Updates/32276

Again: Sonicwall SSL VPN Compromises

The Australian Government s Signals Directorate noted an increase in compromised Sonicwall devices.

https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/ongoing-active-exploitation-of-sonicwall-ssl-vpns-in-australia

Website Keystroke Logging

Many websites log every keystroke, not just data submitted in forms.

https://arxiv.org/pdf/2508.19825

BASE64 Over DNS

The base64 character set exceeds what is allowable in DNS. However, some implementations will work even with these invalid characters.

https://isc.sans.edu/diary/BASE64%20Over%20DNS/32274

Google Chrome Update

Google released an update for Google Chrome, addressing two vulnerabilities. One of the vulnerabilities is rated critical and may allow code execution.

https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_9.html

Ivanti Updates

Ivanti patched a number of vulnerabilities, several of them critical, across its product portfolio.

https://forums.ivanti.com/s/article/September-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-and-Neurons-for-Secure-Access-Multiple-CVEs

Sophos Patches

Sophos resolved authentication bypass vulnerability in Sophos AP6 series wireless access point firmware (CVE-2025-10159)

https://www.sophos.com/en-us/security-advisories/sophos-sa-20250909-ap6

Apple Introduces Memory Integrity Enforcement

With the new hardware promoted in yesterday s event, Apple also introduced new memory integrity features based on this new hardware.

https://security.apple.com/blog/memory-integrity-enforcement/