Playbook for the Secure Enterprise

CyberSecurity Latest Rundown

Heroes. Let's get right to it. In Australia, their Monday is behind them. If they made it, so can the rest of us. Here's a detailed look at the current cybersecurity landscape for Monday, August 18, 2025.

HIGH SEVERITY ITEMS

• Chinese APT Targets Taiwanese Web Hosting Firms

  Date & Time: 2025-08-18T09:33:23

  A Chinese Advanced Persistent Threat (APT) group, tracked as UAT-7237, has been identified targeting web infrastructure and hosting firms in Taiwan. The objective of the campaign is to gain long-term access to high-value downstream targets that use the compromised hosting services. This supply-chain-style attack poses a significant risk to government, technology, and other key sectors in the region.

  CVE Details: n/a

  Source: securityweek.com

OTHER NOTEWORTHY ITEMS

• BSidesSF 2025: Lessons From CISA on Product Security

  Date & Time: 2025-08-17T15:00:00

  A presentation from BSides San Francisco 2025 by Jack Cable highlights key lessons from CISA regarding the product security imperative. The talk provides valuable insights for developers, manufacturers, and security professionals on building more secure products from the ground up. This reflects a growing industry focus on shifting security left in the development lifecycle.

  Source: securityboulevard.com

EXECUTIVE INSIGHTS

• The Rise of Non-Human Identity and Secrets Management as a Core Security Focus

  Date & Time: 2025-08-17T21:00:00

  As data breaches escalate, a strategic shift towards securing Non-Human Identities (NHIs) and secrets is becoming critical for enterprise security programs. NHIs, such as API keys, service accounts, and machine identities, are prime targets for attackers seeking to move laterally and access sensitive data, as seen in sophisticated APT campaigns. Executives should evaluate their organization's maturity in Non-Human Identity and Data Rights (NHIDR) to mitigate this growing attack surface.

  Source: entro.security, entro.security

VENDOR SPOTLIGHT

• Spotlight Rationale: Entro Security is selected due to the increasing relevance of Non-Human Identity (NHI) security, a critical defense layer against sophisticated attacks like the Chinese APT campaign targeting Taiwanese infrastructure, which often relies on compromised service accounts and API keys for persistence and lateral movement.

  Threat Context: Web Hosting Firms in Taiwan Attacked by Chinese APT for Access to High-Value Targets

  Platform Focus: Entro Security - Non-Human Identity and Secrets Security Platform

  Entro Security provides a platform designed to discover, manage, and secure non-human identities and secrets across cloud and on-premise environments. By providing a centralized inventory and enforcing security policies, the platform helps prevent the misuse of service accounts, API keys, and other machine-to-machine credentials. This directly addresses the tactics used by APTs to infiltrate networks through trusted, non-human channels, which often have overly permissive access and are poorly monitored.

  Actionable Platform Guidance: Organizations should leverage such a platform to first gain full visibility of all NHIs and their permissions. Next, implement automated lifecycle management and just-in-time access policies to reduce the attack surface. Finally, integrate with SIEM and SOAR tools to detect and respond to anomalous NHI behavior, such as an API key being used from an unusual geographic location.

  Source: entro.security

DETECTION & RESPONSE KIT

• ⚠️ Disclaimer: Test all detection logic in non-production environments before deployment.

  1. YARA Rule for ERMAC 3.0 Android Trojan

  [copy]

  rule Android_Trojan_ERMAC_3_0 {
  meta:
  description = "Detects strings associated with the leaked ERMAC 3.0 Android banking trojan."
  author = "Threat Rundown"
  date = "2025-08-18"
  reference = "https://securityaffairs.com/?p=181217"
  strings:
  $s1 = "/inject/activity/AutoInjectActivity" ascii
  $s2 = "com.example.cerberus" ascii
  $s3 = "grabbing/card" ascii
  $s4 = "grabbing/bank" ascii
  condition:
  uint32(0) == 0x04034b50 and filesize < 20MB and (2 of ($s*))
  }

  2. SIEM Query — Detecting Potential Web Server Compromise by APT

  [copy]

  // Splunk Search
  source="*firewall*" OR source="*proxy*" (src_ip IN [list_of_your_web_servers]) NOT (dest_ip IN [known_good_destinations])
  | stats count by src_ip, dest_ip, dest_port, user
  | where count > 5 and dest_port NOT IN (80, 443, 53)
  | `comment("This query looks for outbound connections from web servers to non-standard ports and destinations, a potential indicator of C2 activity from a compromised host.")`

  3. PowerShell Script — Check for Xerox FreeFlow Path Traversal Indicators

  [copy]

  # This script checks for suspicious file access patterns in IIS logs that may indicate CVE-2025-8355 exploitation.
  
  $logPath = "C:\inetpub\logs\LogFiles\W3SVC1\*.log"
  $suspiciousPattern = "..\\"
  
  Get-Content -Path $logPath | ForEach-Object {
  if ($_ -match $suspiciousPattern) {
  Write-Warning "Potential Path Traversal attempt found in IIS logs: $_"
  }
  }
  
  Write-Host "Log check complete. Review any warnings above."

  This rundown should provide a solid overview of the current threat landscape. Thank you to all our cyberheroes for your diligence and hard work. Stay vigilant!