Privacy Aware Bots

A botnet is using privacy as well as CSRF prevention headers to better blend in with normal browsers. However, in the process they may make it actually easier to spot them.

https://isc.sans.edu/diary/Privacy%20Aware%20Bots/31796

Critical Ingress Nightmare Vulnerability

ingress-nginx fixed four new vulnerabilities, one of which may lead to a Kubernetes cluster compromise. Note that at the time I am making this live, not all of the URLs below are available yet, but I hope they will be available shortly after publishing this podcast

https://www.darkreading.com/application-security/critical-ingressnightmare-vulns-kubernetes-environments

https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities

https://kubernetes.io/blog/

FBI Warns of File Converter Scams

File converters may include malicious ad ons. Be careful where you get your software from.

https://www.fbi.gov/contact-us/field-offices/denver/news/fbi-denver-warns-of-online-file-converter-scam

VSCode Extension Includes Ransomware

https://x.com/ReversingLabs/status/1902355043065500145

Critical Next.js Vulnerability CVE-2025-29927

A critical vulnerability in how the x-middleware-subrequest header is verified may lead to bypassing authorization in Next.js applications.

https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware

https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw

https://www.runzero.com/blog/next-js/

Microsoft Trust Signing Service Abused

Attackers abut the Microsoft Trust Signing Service, a service meant to help developers create signed software, to obtain short lived signatures for malware.

https://www.bleepingcomputer.com/news/security/microsoft-trust-signing-service-abused-to-code-sign-malware/

Some New Data Feeds and Little Incident

We started offering additional data feeds, and an SEO spamer attempted to make us change a link from an old podcast episode.

https://isc.sans.edu/diary/Some%20new%20Data%20Feeds%2C%20and%20a%20little%20%22incident%22./31786

Veeam Deserialization Vulnerability

Veeam released details regarding the latest vulnerablity in Veeam, pointing out the insufficient patch applied to a prior deserialization vulnerability.

https://labs.watchtowr.com/by-executive-order-we-are-banning-blacklists-domain-level-rce-in-veeam-backup-replication-cve-2025-23120/

IBM AIX Vulnerablity

The AIX NIM service is vulnerable to an unauthenticated remote code execution vulnerability

https://www.ibm.com/support/pages/node/7186621

thanks Chris Mosby for Spotify comment

Exploit Attempts for Cisco Smart Licensing Utility CVE-2024-20439 CVE-2024-20440

Attackers added last September's Cisco Smart Licensing Utility vulnerability to their toolset. These attacks orginate most likely from botnets and the same attackers are scanning for a wide range of additional vulnerabilities. The vulnerability is a static credential issue and trivial to exploit after the credentials were published last fall.

https://isc.sans.edu/diary/Exploit%20Attempts%20for%20Cisco%20Smart%20Licensing%20Utility%20CVE-2024-20439%20and%20CVE-2024-20440/31782

Legacy Driver Exploitation Through Bypassing Certificate Verification

Ahnlab documented a new type of "bring your own vulnerable driver" vulnerability. In this case, an old driver used by an anit-malware and anti-rootkit system can be used to shut down arbitrary processeses, including security related processeses.

https://asec.ahnlab.com/en/86881/

Synology Vulnerability Updates

Synology updates some security advisories it release last year adding addition details and vulnerable systems.

https://www.synology.com/en-global/security/advisory/Synology_SA_24_20

https://www.synology.com/en-global/security/advisory/Synology_SA_24_24

Python Bot Delivered Through DLL Side-Loading

A "normal", but vulnerable to DLL side-loading PDF reader may be used to launch additional exploit code

https://isc.sans.edu/diary/Python%20Bot%20Delivered%20Through%20DLL%20Side-Loading/31778

Tomcat RCE Correction

To exploit the Tomcat RCE I mentioned yesterday, two non-default configuration options must be selected by the victim.

https://x.com/dkx02668274/status/1901893656316969308

SAML Roulette: The Hacker Always Wins

This Portswigger blog explains in detail how to exploit the ruby-saml vulnerablity against GitLab.

https://portswigger.net/research/saml-roulette-the-hacker-always-wins

Windows Shortcut Zero Day Exploit

Attackers are currently taking advantage of an unpatched vulnerability in how Windows displays Shortcut (.lnk file) details. Trendmicro explains how the attack works and provides PoC code. Microsoft is not planning to fix this issue

https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html

Static Analysis of GUID Encoded Shellcode

Didier explains how to decode shell code embeded as GUIDs in malware, and how to feed the result to his tool 1768.py which will extract Cobal Strike configuration information from the code.

https://isc.sans.edu/diary/Static%20Analysis%20of%20GUID%20Encoded%20Shellcode/31774

SAMLStorm: Critical Authentication Bypass in xml-crypto and Node.js libraries

xml-crypto, a library use in Node.js applications to decode XML and support SAML, has found to parse comments incorrectly leading to several SAML vulnerabilities.

https://workos.com/blog/samlstorm

One PUT Request to Own Tomcat: CVE-2025-24813 RCE is in the Wild

A just made public deserialization vulnerablity in Tomcat is already being exploited. Contributing to the rapid exploit release is the similarity of this vulnerability to other Java deserializtion vulnerabilities.

https://lab.wallarm.com/one-put-request-to-own-tomcat-cve-2025-24813-rce-is-in-the-wild/ CVE-2025-24813

CSS Abuse for Evasion and Tracking

Attackers are using cascading stylesheets to evade detection and enable more stealthy tracking of users

https://blog.talosintelligence.com/css-abuse-for-evasion-and-tracking/

Mirai Bot Now Incorporating Malformed DrayTek Vigor Router Exploits

One of the many versions of the Mirai botnet added some new exploit strings attempting to take advantage of an old DrayTek Vigor Router vulnerability, but they got the URL wrong.

https://isc.sans.edu/diary/Mirai%20Bot%20now%20incroporating%20%28malformed%3F%29%20DrayTek%20Vigor%20Router%20Exploits/31770

Compromised GitHub Action

The popular GitHub action tj-actions/changed-files was compromised and leaks credentials via the action logs

https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised

ruby-saml authentication bypass

A confusion in how to parse SAML messages between two XML parsers used by Ruby leads to an authentication bypass in saml-ruby.

https://github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentials/

GitHub Fake Security Alerts

Fake GitHub security alerts are used to trick package maintainers into adding OAUTH privileges to malicious apps.

https://www.bleepingcomputer.com/news/security/fake-security-alert-issues-on-github-use-oauth-app-to-hijack-accounts/

File Hashes Analysis with Power BI

Guy explains in this diary how to analyze Cowrie honeypot file hashes using Microsoft's BI tool and what you may be able to discover using this tool.

https://isc.sans.edu/diary/File%20Hashes%20Analysis%20with%20Power%20BI%20from%20Data%20Stored%20in%20DShield%20SIEM/31764

Apache Camel Vulnerability

Apache released two patches for Camel in close succession. Initially, the vulnerability was only addressed for headers, but as Akamai discovered, it can also be exploited via query parameters. This vulnerability is trivial to exploit and leads to arbitrary code execution.

https://www.akamai.com/blog/security-research/march-apache-camel-vulnerability-detections-and-mitigations

Juniper Patches Junos Vulnerability

Juniper patches an already exploited vulnerability in JunOS. However, to exploit the vulnerability, and attacker already needs privileged access. By exploiting the vulnerability, an attacker may completely compromised the device.

https://supportportal.juniper.net/s/article/2025-03-Out-of-Cycle-Security-Bulletin-Junos-OS-A-local-attacker-with-shell-access-can-execute-arbitrary-code-CVE-2025-21590?language=en_US

AMI Security Advisory

AMI patched three vulnerabilities. One of the, an authentication bypass in Redfish, allows for a complete system compromise without authentication and is rated with a CVSS score of 10.0.

https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025003.pdf

Log4J Scans for VMWare Hyhbrid Cloud Extensions

An attacker is scanning various login pages, including the authentication feature in the VMWare HCX REST API for Log4j vulnerabilities. The attack submits the exploit string as username, hoping to trigger the vulnerability as Log4j logs the username

https://isc.sans.edu/diary/Scans%20for%20VMWare%20Hybrid%20Cloud%20Extension%20%28HCX%29%20API%20(Log4j%20-%20not%20brute%20forcing)/31762

Patch Tuesday Fallout

Yesterday's Apple patch may re-activate Apple Intelligence for users who earlier disabled it. Microsoft is offering support for users whos USB printers started printing giberish after a January patch was applies.

https://www.macrumors.com/2025/03/11/ios-18-3-2-apple-intelligence-auto-on/

https://learn.microsoft.com/en-us/windows/release-health/status-windows-10-22h2#usb-printers-might-print-random-text-with-the-january-2025-preview-update

Adobe Updates

Adobe updated seven different products, including Adobe Acrobat. The Acrobat vulnerability may lead to remote code execution and Adobe considers the vulnerablities critical.

https://helpx.adobe.com/security/security-bulletin.html

Medusa Ransomware

CISA and partner agencies released details about the Medusa Ransomware. The document includes many details useful to defenders.

https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a

Zoom Update

Zoom released a critical update fixing a number of remote code execution vulnerabilities.

https://www.zoom.com/en/trust/security-bulletin/

FreeType Library Vulnerability

https://www.facebook.com/security/advisories/cve-2025-27363

Microsoft Patch Tuesday

Microsoft Patched six already exploited vulnerabilities today. In addition, the patches included a critical patch for Microsoft's DNS server and about 50 additional patches.

https://isc.sans.edu/diary/Microsoft%20Patch%20Tuesday%3A%20March%202025/31756

Apple Updates iOS/macOS

Apple released an update to address a single, already exploited, vulnerability in WebKit. This vulnerability affects iOS, macOS and VisionOS.

https://support.apple.com/en-us/100100

Expressif Response to ESP32 Debug Commands

Expressif released a statement commenting on the recent release of a paper alledging "Backdoors" in ESP32 chipsets. According to Expressif, these commands are debug commands and not reachable directly via Bluetooth.

https://www.espressif.com/en/news/Response_ESP32_Bluetooth