Security. In focus.

Drupal security advisory (AV25-617) - Canadian Centre for Cyber Security

Hackers Obfuscated Malware With Verbose AI Code

Hackers used AI-generated code to obfuscate malware in a phishing campaign. The attackers disguised the malicious code within a vector image file, using business-related language and terms to evade detection. Despite the complexity and verbosity of the AI-generated code, Microsoft detected and blocked the campaign using existing security methods.

Iranian cyber group targets European companies with fake job offers

An Iranian cyber group named Nimbus Manticore, also known as MuddyWater, has been targeting European defense, telecom, and aerospace companies with fake job offers. According to a report by HackRead and research by Check Point Research, the group uses sophisticated malware to infiltrate these companies' networks. By enticing employees with deceptive job opportunities, Nimbus Manticore gains access to sensitive data and intellectual property, enabling espionage and potential operational disruptions. The advanced malware employed allows the group to evade detection and conduct prolonged malicious activities. This targeted cyber-espionage campaign poses significant risks to the security and confidentiality of sensitive data within these industries. Additionally, it raises concerns about potential disruptions to critical infrastructure. To mitigate these risks, employee training on recognizing phishing attempts and implementing robust network security protocols is recommended.

Man arrested in connection with airport cyber-attacks

• A man in his forties was arrested in West Sussex in connection with a cyber-attack on Collins Aerospace, which caused disruption at several European airports, including Heathrow.
• The arrest was made by the National Crime Agency (NCA) as part of an ongoing investigation into the cyber incident.
• The cyber-attack led to significant flight delays due to the failure of Collins Aerospace’s baggage and check-in software, forcing some airlines to use manual methods.
• The arrested man was released on bail after being detained on suspicion of Computer Misuse Act offences.
• Collins Aerospace is rebuilding its check-in software system after a failed attempt to relaunch it on Monday.
• The US company’s parent, RTX Corporation, has expressed appreciation for the NCA’s assistance in the matter.
• Heathrow Airport has deployed extra staff to assist passengers, but flights continue to experience delays.
• The EU’s cyber-security agency confirmed that ransomware was used in the attack, which is a common tactic to disrupt systems and demand ransom payments in cryptocurrency.
• The cyber-attack was discovered on Friday night, causing ongoing disruptions at airports in Brussels, Dublin, and Berlin, with some effects persisting into the following week.
• Cyber-attacks in the aviation sector have surged by 600% over the past year, highlighting the growing threat of organized cyber-crime gangs.

Technical Analysis of Zloader Updates www.zscaler.com/blogs/sec…

Zloader (a.k.a. Terdot, DELoader, or Silent Night) is a Zeus-based modular trojan that emerged in 2015. Zloader was originally designed to facilitate banking, but has since been repurposed for initial access, providing an entry point into corporate environments for the deployment of ransomware. Following an almost two-year hiatus, Zloader reemerged in September 2023 with significant enhancements to its obfuscation techniques, domain generation algorithm (DGA), anti-analysis techniques and network communication, along with a stealthier approach to infections.

Operation Rewrite: Chinese-Speaking Threat Actors Deploy BadIIS in a Wide Scale SEO Poisoning Campaign unit42.paloaltonetworks.com/operation…

In March 2025, we uncovered a search engine optimization (SEO) poisoning campaign. Based on the infrastructure and linguistic artifacts discovered, we assess with high confidence that a Chinese-speaking threat actor operates this campaign. We call this “Operation Rewrite” in reference to the English translation of one of the object names in the threat actor’s code.

We track this cluster of activity as CL-UNK-1037. Our analysis revealed infrastructure and architectural overlaps with the publicly tracked “Group 9” threat cluster and the “DragonRank” campaign.

To perform SEO poisoning, attackers manipulate search engine results to trick people into visiting unexpected or unwanted websites (e.g., gambling and porn websites) for financial gain. This attack used a malicious native Internet Information Services (IIS) module called BadIIS. This module intercepts and alters web traffic, using legitimate compromised servers to serve malicious content to visitors. The compromised web server then acts as a reverse proxy — an intermediary server getting content from other servers and presenting it as its own.

GitHub moves to tighten npm security amid phishing, malware plague www.theregister.com/2025/09/2…

René-Corail also described changes that he hopes will strengthen security. Many existing authentication methods will be removed “in the near future,” including legacy classic tokens and one-time passwords for two-factor authentication (2FA). Token lifetimes will also be shortened, with a switch to trusted publishing and 2FA-enforced local publishing by default.

New EDR-Freeze tool uses Windows WER to suspend security software www.bleepingcomputer.com/news/secu…

A new method and proof-of-concept tool called EDR-Freeze demonstrates that evading security solutions is possible from user mode with Microsoft’s Windows Error Reporting (WER) system.

The technique eliminates the need of a vulnerable driver and puts security agents like endpoint detection and response (EDR) tools into a state of hibernation.

By using the WER framework together with the MiniDumpWriteDump API, security researcher TwoSevenOneThree (Zero Salarium) found a way to suspend indefinitely the activity of EDR and antivirus processes indefinitely.

Major Cyber Threat Detection Vendors Pull Out of MITRE Evaluations Test www.infosecurity-magazine.com/news/cybe…

However, MITRE’s Clancy said he is in close contact with the three vendors and believes he knows the reasons that made them pull out of this year’s test.

First, as the vendors said in their statements, taking part in MITRE ATT&CK Evaluations program requires a resource-intensive commitment, suggesting that the time and personnel dedicated to it are lost on other projects.

Then, Clancy said that the team behind the test strives to make it harder every year and conceded they may have pushed it too far this year.

“Each year, we want to design a test that’s harder than the year before in order to drive the whole industry forward, since the test can offer an opportunity for vendors to upgrade their products in preparation for the test and once they get the results. And sometimes, we don’t get the balance quite right,” he explained.

Researchers Earn $150,000 for L1TF Exploit Leaking Data From Public Cloud www.securityweek.com/researche…

Last month, the academics reported L1TF Reloaded (PDF), a vulnerability that combines L1TF and half-Spectre to bypass commonly deployed software mitigations and leak sensitive data from the hypervisor and a co-tenant on Google Cloud.

“Using a novel technique based on pointer chasing through the host and guest, we leak all information required to manually perform two-dimensional page table walks in software; with this, we can translate arbitrary virtual guest addresses to host physical addresses, enabling the leakage of any byte in the memory of the victim via L1TF,” the academics note.

Paper at openreview.net/pdf

CISA Shares Lessons Learned from an Incident Response Engagement www.cisa.gov/news-even…

CISA began incident response efforts at an FCEB agency after the agency identified potential malicious activity through security alerts generated by the agency’s endpoint detection and response (EDR) tool. CISA discovered cyber threat actors compromised the agency by exploiting CVE-2024-36401 in a GeoServer about three weeks prior to the EDR alerts. Over the three-week period, the cyber threat actors gained separate initial access to a second GeoServer via the same vulnerability and moved laterally to two other servers.

Cloudflare mitigates new record-breaking 22.2 Tbps DDoS attack www.bleepingcomputer.com/news/secu…

Cloudflare has mitigated a distributed denial-of-service (DDoS) attack that peaked at a record-breaking 22.2 terabits per second (Tbps) and 10.6 billion packets per second (Bpps).

The latest DDoS incident, also volumentric, lasted 40 seconds and is by far the largest ever mitigated.

• The U.S. Secret Service dismantled a large network of SIM servers and SIM cards in the New York area that was enabling anonymous threats and potentially telecom attacks.
• The operation happened just before the UN General Assembly, with forensic analysis showing possible connections to nation-state actors and known criminal groups.
• Over 300 SIM servers and 100,000 SIM cards were seized; the investigation remains ongoing.
• Multiple agencies participated due to the risk of major disruption to New York’s telecommunications infrastructure.

Source

CISA has added two critical vulnerabilities in the Zabbix enterprise monitoring solution (CVE-2022-23131 and CVE-2022-23134) to its Known Exploited Vulnerabilities Catalog. These flaws—found in Zabbix Web Frontend—allow attackers to bypass authentication and gain admin privileges, potentially letting them execute arbitrary commands and compromise the monitored network. The vulnerabilities affect all supported versions before 5.4.8, 5.0.18, and 4.0.36, especially when SAML Single-Sign-On is enabled.

Proof-of-concept code is publicly available, and CISA warns that the vulnerabilities are being exploited in the wild. Patches are available, and agencies are directed to apply them within two weeks as per federal directives. Organizations should urgently update Zabbix Web Frontend to the fixed versions to mitigate risk.

Source

• Date of Incident (ET): Not known
• Date of Disclosure/Publication (ET): Sept. 23, 2025

Summary: Chinese-speaking threat actor deploys BadIIS malware via SEO poisoning, redirecting traffic and planting web shells in East and Southeast Asia.

Source

• Date of Incident (ET): June 24, 2025
• Date of Disclosure/Publication (ET): Sept. 23, 2025

Summary: ShadowV2 botnet exploits misconfigured AWS Docker containers, deploying Go-based malware for DDoS-for-hire using HTTP/2 Rapid Reset.

Source

Fifty Years of Open Source Software Supply-Chain Security cacm.acm.org/practice/…

The contours of the problems in software supply-chain security have not changed in half a century because they are fundamental. There are no easy answers in computer security; software supply-chain security is no exception. The best we can aim to do is keep improving our defenses, and many promising reinforcements are not yet universally deployed. This article aims to highlight promising approaches that should be more widely used as well as point out areas where more work is needed.

Ransomware attack linked to museum break-in and theft of golden exhibits www.theregister.com/2025/09/2…

Dozens of French museums fell victim to a ransomware attack in August 2024, and the nation’s Natural History Museum copped another attack in July 2025.

The Museum’s systems were so damaged that it reportedly cancelled an exhibition.

Last week the Museum discovered that thieves had broken into its minerals display section by using an angle grinder to cut through a door, before wielding a blowtorch to open a case containing gold specimens worth about $705,000.

French media report the heist was possible because the July cyberattack broke the Museum’s alarms and video surveillance systems.

Verified Steam game steals streamer’s cancer treatment donations www.bleepingcomputer.com/news/secu…

BlockBlasters is a 2D platformer that was available on Steam for almost two months, between July 30 and September 21. The game was safe until August 30, when a cryptodrainer component was added.

Published by developer Genesis Interactive and no longer on Steam, the retro-styled game was a free-to-play title promising fast-paced action on responsive controls, and had a few hundred ‘Very Positive’ reviews on the gaming platform.

Crypto investigator ZachXBT told BleepingComputer that the attackers appear to have stolen a total of $150,000 from 261 Steam accounts.

Stellantis detects breach at third-party provider for North American customers www.reuters.com/sustainab…

Stellantis detected unauthorized access to a third-party service provider’s platform that supports its North American customer service operations, the company said in a statement on Sunday. The automaker said the incident, which is under investigation, exposed only basic contact information and did not involve financial details or sensitive personal data. Stellantis did not specify how many customers were affected.

Nimbus Manticore Deploys New Malware Targeting Europe research.checkpoint.com/2025/nimb…

Check Point Research is tracking a long‑running campaign by the Iranian threat actor Nimbus Manticore, which overlaps with UNC1549, Smoke Sandstorm, and the “Iranian Dream Job” operations. The ongoing campaign targets defense manufacturing, telecommunications, and aviation that are aligned with IRGC strategic priorities. Nimbus Manticore’s recent activity indicates a heightened focus on Western Europe, specifically Denmark, Sweden, and Portugal. The threat actor impersonates local and global aerospace, defense manufacturing, and telecommunications organizations.The threat actor uses tailored spear‑phishing from alleged HR recruters directing victims to fake career portals. Each target receives a unique URL and credentials, enabling tracking and controlled access of each victim. This approach demonstrates strong OPSEC and credible pretexting.

How to Gain Control of AI Agents and Non-Human Identities thehackernews.com/2025/09/h…

“We’ve got hundreds of service accounts and AI agents running in the background. We didn’t create most of them. We don’t know who owns them. How are we supposed to secure them?”

Every enterprise today runs on more than users. Behind the scenes, thousands of non-human identities, from service accounts to API tokens to AI agents, access systems, move data, and execute tasks around the clock.

They’re not new. But they’re multiplying fast. And most weren’t built with security in mind.

A verified summary of cyber events disclosed or reported within the past 48 hours (Sept. 20–22, 2025 ET).

European airport disruptions from third-party ransomware attack * Incident date (ET): Sept. 20–22, 2025 * Disclosure (ET): Sept. 22, 2025 * Summary: A ransomware incident at a third-party provider disrupted Collins Aerospace MUSE systems, causing check-in issues at Heathrow, Brussels, and Berlin airports. Flight safety systems were not affected. * Source: https://www.reuters.com/business/aerospace-defense/eu-agency-says-third-party-ransomware-behind-airport-disruptions-2025-09-22/ ## Turla piggybacks Gamaredon compromises (Ukraine) * Incident date (ET): Jan.–Feb. 2025 * Disclosure (ET): Sept. 22, 2025 * Summary: Turla deployed malware on systems initially compromised by Gamaredon, demonstrating sequential exploitation and operational overlap targeting Ukraine. * Source: https://www.securityweek.com/turla-and-gamaredon-working-together-in-fresh-ukrainian-intrusions/ ## SonicWall cloud backup incident * Incident date (ET): Mid-September 2025 * Disclosure (ET): Sept. 17, 2025 (updated Sept. 22, 2025) * Summary: Threat actors accessed encrypted firewall backup files for fewer than five per cent of SonicWall customers via brute-force. SonicWall advised immediate password resets and configuration reviews. * Source: https://www.sonicwall.com/support/knowledge-base/mysonicwall-cloud-backup-file-incident/250915160910330 ## Microsoft Entra ID token validation flaw patched (CVE-2025-55241) * Incident date (ET): N/A * Disclosure (ET): Sept. 22, 2025 (details published); patch issued July 17, 2025 * Summary: Microsoft patched a cross-tenant token validation issue that could have enabled admin impersonation. No evidence of active exploitation. * Source: https://thehackernews.com/2025/09/microsoft-patches-critical-entra-id.html ## macOS campaign delivers AMOS (Atomic) stealer * Incident date (ET): Ongoing through Sept. 2025 * Disclosure (ET): Sept. 22, 2025 * Summary: A macOS-focused campaign uses SEO poisoning and fake GitHub repositories to distribute the AMOS infostealer, with password-manager users among targets. * Source: https://www.securityweek.com/widespread-infostealer-campaign-targeting-macos-users/ ## Fortra GoAnywhere MFT critical RCE (CVE-2025-10035) * Incident date (ET): N/A * Disclosure (ET): Sept. 19–22, 2025 * Summary: A CVSS 10.0 deserialisation flaw in the License Servlet enables command injection. Fortra urges immediate updates to GoAnywhere 7.8.4 / SR 7.6.3 and removal of public Admin Console access. * Sources: https://www.securityweek.com/fortra-patches-critical-goanywhere-mft-vulnerability/ https://thehackernews.com/2025/09/fortra-releases-critical-patch-for-cvss.html ## Jaguar Land Rover cyberattack disrupts production * Incident date (ET): Early Sept. 2025 * Disclosure (ET): Sept. 22, 2025 * Summary: A cyberattack halted production at Jaguar Land Rover’s U.K. facilities for nearly three weeks, with significant supplier impacts. * Source: https://www.wired.com/story/jlr-jaguar-land-rover-cyberattack-supply-chain-disaster/ ## DPRK (Lazarus cluster) deploys BeaverTail and InvisibleFerret * Incident date (ET): Campaign observed since May 2025 * Disclosure (ET): Sept. 21, 2025 * Summary: North Korean actors used ClickFix-style phishing lures to deliver BeaverTail stealer and InvisibleFerret backdoor against cryptocurrency and retail targets. * Source: https://www.thehackernews.com/2025/09/dprk-hackers-use-clickfix-to-deliver.html ## MalTerminal — GPT-4-powered malware proof of concept * Incident date (ET): N/A (research finding) * Disclosure (ET): Sept. 20, 2025 * Summary: SentinelOne described “MalTerminal,” a PoC that uses GPT-4 to generate ransomware and reverse shells at runtime; no evidence of in-the-wild use. * Source: https://www.thehackernews.com/2025/09/researchers-uncover-gpt-4-powered.html ## ShadowLeak prompt-injection issue resolved * Incident date (ET): N/A (research finding) * Disclosure (ET): Sept. 20, 2025 (public report); responsibly disclosed June 18, 2025; fixed early Aug. 2025 * Summary: Radware detailed an indirect prompt-injection technique that could exfiltrate Gmail data via ChatGPT’s Deep Research agent; the issue has been addressed. * Source: https://www.thehackernews.com/2025/09/shadowleak-zero-click-flaw-leaks-gmail.html

Apple’s iPhone 17 cameras blend hardware and computational photography to push smartphone imaging further. This article explains what Apple really means by “8× optical-quality zoom” and why the iPhone Air’s “four cameras” are actually software-defined fields of view, helping buyers set realistic expectations.

kiledjian.com/2025/09/2…

UNC1549 Hacks 34 Devices in 11 Telecom Firms via LinkedIn Job Lures and MINIBIKE Malware thehackernews.com/2025/09/u…

An Iran-nexus cyber espionage group known as UNC1549 has been attributed to a new campaign targeting European telecommunications companies, successfully infiltrating 34 devices across 11 organizations as part of a recruitment-themed activity on LinkedIn.

“The group operates by posing as HR representatives from legitimate entities to engage employees, then compromises them through deployment of a MINIBIKE backdoor variant that communicates with command-and-control (C2) infrastructure proxied through Azure cloud services to bypass detection,” the company said in a report shared with The Hacker News.

Original at catalyst.prodaft.com/public/re…