Wednesday, August 13, 2025

MikeGPT CyberSecurity

“Playbook for the Secure Enterprise”

Heroes, late breaking critical news. Here's a detailed look at the current cybersecurity landscape for August 14, 2025.

Critical Threats

CISA has added vulnerabilities in Microsoft Internet Explorer, Microsoft Office Excel, and WinRAR to its Known Exploited Vulnerabilities (KEV) catalog. This action confirms active exploitation in the wild, making these vulnerabilities a top priority for patching. Federal agencies are mandated to patch these flaws, and all organizations are strongly urged to do so immediately to prevent potential compromise.

Multiple, see KEV catalog for specifics. securityaffairs.com ↗

High Severity

Researchers have demonstrated a novel downgrade attack against Microsoft Entra ID that can circumvent FIDO-based multi-factor authentication. The attack tricks users into authenticating with a weaker method, exposing them to phishing and session hijacking. This highlights a potential weakness in even strong authentication implementations and requires organizations to review their Entra ID configurations for resilience against such attacks.

bleepingcomputer.com ↗

Microsoft's August 2025 Patch Tuesday addresses over 100 vulnerabilities, including a critical remote code execution (RCE) flaw in the Windows Graphics Component. This vulnerability, tracked as CVE-2025-50165, could allow an unauthenticated attacker to execute code over the network. Immediate patching is recommended to mitigate the significant risk posed by this and other high-severity flaws in the release.

CVE-2025-50165 techrepublic.com ↗

A new attack vector uses malicious Google Calendar invitations to compromise smart home ecosystems. By tricking users into accepting a poisoned invite, attackers can potentially gain control of connected devices. This highlights the expanding attack surface of IoT and the need for user awareness regarding unsolicited calendar events from unknown sources.

grahamcluley.com ↗

Microsoft has opened registration for its Ignite 2025 conference, a key event for security professionals to learn about new strategies and technologies, particularly in the context of AI-driven security. This is a valuable opportunity for professional development and staying current with industry trends.

microsoft.com ↗

NIST is holding a webinar focused on helping small businesses defend against phishing attacks. This event provides accessible, expert guidance on one of the most common cyber threats, offering practical advice for organizations with limited security resources.

nist.gov ↗

🟡 MEDIUM SEVERITY ITEMS

🔵 LOW SEVERITY ITEMS

Other Noteworthy

Microsoft has opened registration for its Ignite 2025 conference, a key event for security professionals to learn about new strategies and technologies, particularly in the context of AI-driven security. This is a valuable opportunity for professional development and staying current with industry trends.

microsoft.com ↗

NIST is holding a webinar focused on helping small businesses defend against phishing attacks. This event provides accessible, expert guidance on one of the most common cyber threats, offering practical advice for organizations with limited security resources.

nist.gov ↗

Executive Briefing

BSidesSF 2025: Fake Hires, Real Threats: When Background Checks Aren’t Enough

This research highlights the growing threat of sophisticated infiltration via fraudulent hiring, where threat actors bypass traditional background checks to gain insider access. Leaders should consider enhancing vetting processes and implementing zero-trust principles to mitigate the risk of malicious insiders who are not who they claim to be.

securityboulevard.com · ·
How to Build, Optimize, & Manage AI on Google Kubernetes Engine

As enterprises increasingly leverage AI, the underlying infrastructure's security and efficiency become paramount. This analysis provides a strategic overview of using GKE for AI workloads, emphasizing the need for robust infrastructure expertise to secure and manage these complex, high-value environments effectively.

fairwinds.com · ·

Vendor Spotlight

Vendor

Vendor: Microsoft

Microsoft is a dominant provider of operating systems, cloud services (Azure, Microsoft 365), and security solutions. Their products are a frequent target for threat actors due to their widespread deployment.

Microsoft is central to this week's threat landscape. The August Patch Tuesday release addresses over 100 vulnerabilities, including the critical RCE flaw CVE-2025-50165. Additionally, a new downgrade attack targeting Microsoft Entra ID's FIDO implementation requires immediate attention and configuration review from administrators.

Source: Microsoft Security Response Center

Detection & Response

Detection & Response Kit (3 items) ▾

⚠️ Disclaimer: Test all detection logic in non-production environments before deployment.

1. YARA Rule for Potentially Malicious WinRAR Archives (KEV Related)

rule Suspicious_WinRAR_KEV_2025_08 { meta: description = "Detects WinRAR archives with characteristics seen in exploits. Related to CISA KEV update." author = "Threat Rundown" date = "2025-08-14" reference = "https://securityaffairs.com/?p=181110" strings: $rar_header = { 52 61 72 21 1A 07 00 } // Rar! header $exploit_pattern = "cmd.exe /c" nocase $js_pattern = /<script\s*language=\"JScript.Encode\">/ nocase condition: $rar_header at 0 and ($exploit_pattern or $js_pattern) }

2. SIEM Query — Detect Anomalous Entra ID Sign-in after FIDO Downgrade Attempt

// Platform: Microsoft Sentinel / Azure Log Analytics SigninLogs | where ResultType == 50126 // MFA requirement satisfied by claim in the token (potential bypass indicator) | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), make_set(AuthenticationMethod), count() by UserPrincipalName, IPAddress, Location, AppDisplayName | where count() > 1 and array_length(set_AuthenticationMethod) > 1 | extend FidoUsed = set_AuthenticationMethod has "FIDO2 security key" | extend WeakAuthUsed = set_AuthenticationMethod has "Password" | where FidoUsed == 'false' and WeakAuthUsed == 'true' | project StartTime, EndTime, UserPrincipalName, IPAddress, Location, AppDisplayName, set_AuthenticationMethod | sort by StartTime desc

3. PowerShell Script — Check for Patch Tuesday KB for CVE-2025-50165

# NOTE: Replace 'KB5042XXX' with the actual KB number for your OS version from Microsoft's update guide. $kb_to_check = "KB5042XXX" $computers = Get-Content -Path .\servers.txt # List of computer names in a file foreach ($computer in $computers) { if (Test-Connection -ComputerName $computer -Count 1 -Quiet) { try { $hotfix = Get-HotFix -Id $kb_to_check -ComputerName $computer -ErrorAction Stop Write-Host "[+] PATCHED: $computer has $kb_to_check installed." } catch { Write-Host "[-] VULNERABLE: $computer is MISSING $kb_to_check." -ForegroundColor Red } } else { Write-Host "[!] UNREACHABLE: $computer could not be contacted." -ForegroundColor Yellow } }

This rundown should provide a solid overview of the current threat landscape. Thank you to all our cyberheroes for your diligence and hard work. Stay vigilant!