Friday, August 22, 2025

MikeGPT CyberSecurity

“Playbook for the Secure Enterprise”

It's Friday, Heroes. Time for another blockbluster movie review. Here's a detailed look at the current cybersecurity landscape for August 22, 2025.

Critical Threats

CrowdStrike has detailed a campaign by the China-nexus actor “MURKY PANDA” that abuses cloud service provider (CSP) trusted relationships (DAP/GDAP) to compromise enterprise networks. The actor weaponizes n-day and zero-day vulnerabilities, deploys web shells like Neo-reGeorg, and uses a low-prevalence Linux Golang RAT named “CloudedHope.” This campaign is highly relevant for organizations using CSPs or SaaS B2B models, as it bypasses traditional perimeter defenses by leveraging legitimate, but compromised, partner access.

CVE-2023-3519, CVE-2025-3928 CrowdStrike — MURKY PANDA cloud trusted-relationship threat ↗

Following the leak and exploitation of a SharePoint zero-day, Microsoft has reportedly stopped providing proof-of-concept (PoC) exploit code to Chinese technology firms participating in its security programs. Instead, these firms will only receive written technical details of vulnerabilities. This policy shift aims to curb the premature weaponization of vulnerabilities by threat actors with access to leaked PoC code, potentially altering the vulnerability disclosure and patching landscape.

Security Affairs ↗

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added an unspecified Apple vulnerability affecting iOS, iPadOS, and macOS to its Known Exploited Vulnerabilities (KEV) catalog. This action confirms the vulnerability is being actively exploited in the wild and mandates that Federal Civilian Executive Branch agencies apply patches by a specified deadline. All organizations using affected Apple products are strongly urged to prioritize patching to mitigate immediate risk.

Security Affairs ↗

High Severity

A former developer, Davis Lu (55), has been sentenced to four years in prison for deploying malware with a 'kill-switch' at his previous Ohio-based employer. The malware was designed to activate after his corporate account was disabled, locking employees out of critical systems. This incident serves as a stark reminder of the significant damage that can be caused by insider threats and highlights the need for robust offboarding procedures and activity monitoring for privileged accounts.

Security Affairs ↗

A new interactive demonstration visualizes Google's CaMeL (Capabilities for Machine Learning) security model, designed to defend Large Language Model (LLM) agents against prompt injection attacks by design. The approach, detailed in an associated research paper, represents an ongoing effort to build inherent security into AI agents rather than relying solely on input sanitization. This is relevant for organizations developing or deploying agent-based AI systems, offering a potential architectural defense against a prevalent attack vector.

Reddit /r/netsec ↗

Other Noteworthy

A new interactive demonstration visualizes Google's CaMeL (Capabilities for Machine Learning) security model, designed to defend Large Language Model (LLM) agents against prompt injection attacks by design. The approach, detailed in an associated research paper, represents an ongoing effort to build inherent security into AI agents rather than relying solely on input sanitization. This is relevant for organizations developing or deploying agent-based AI systems, offering a potential architectural defense against a prevalent attack vector.

Reddit /r/netsec ↗

Executive Briefing

AI Agents Need Data Integrity

Bruce Schneier discusses the critical need for data integrity as AI agents become more autonomous and integrated with the web. Drawing a parallel to Tim Berners-Lee's call for a “Magna Carta for the Web,” the analysis suggests that for AI to function reliably and securely, the underlying data it consumes must be trustworthy. This has profound implications for enterprise data governance, threat modeling for AI systems, and the long-term strategic risk of data poisoning attacks.

Schneier on Security · ·
Modern Vehicle Cybersecurity Trends

Kaspersky provides an overview of the evolving cybersecurity landscape for modern vehicles, which are increasingly becoming complex digital devices. The report highlights the expanding attack surface, from infotainment systems to critical safety controls, and the new types of threats facing the automotive industry. For executives, this underscores the growing importance of product security, secure software development lifecycles (SDLC), and managing supply chain risk for connected vehicle components.

Kaspersky Securelist · ·

Vendor Spotlight

Seceon aiSIEM/aiXDR Platform

Spotlight Rationale: The MURKY PANDA threat actor leverages complex, multi-stage attacks that abuse trusted relationships and span from on-premise to cloud environments. Detecting such activity requires a unified view of disparate security signals, which is the core value proposition of an integrated security platform.

Threat Context: China-Nexus Actor 'MURKY PANDA' Exploits Cloud Trusted Relationships

Platform Focus: Seceon aiSIEM/aiXDR Platform

Seceon's platform integrates SIEM, SOAR, and EDR capabilities to address advanced threats that evade traditional point solutions. By correlating events across an organization's entire digital footprint—including cloud services like Entra ID—it can detect anomalous patterns indicative of CSP abuse or lateral movement, as seen in the MURKY PANDA campaign. This approach moves beyond simple signature-based detection to a behavioral model, which is critical for identifying the abuse of legitimate credentials and trusted relationships.

Actionable Platform Guidance: Ingest Microsoft Entra ID audit and sign-in logs into the platform. Create correlation rules and behavioral models that alert on high-risk activities such as 'Add service principal credentials' events, especially when originating from anomalous IP addresses or occurring outside of normal business hours. Use SOAR playbooks to automatically suspend newly modified service principals pending investigation.

Source: Seceon

Detection & Response

Detection & Response Kit (3 items) ▾

⚠️ Disclaimer: Test all detection logic in non-production environments before deployment.

1. YARA Rule for CloudedHope RAT (Template)

rule TPL_GoLang_RAT_CloudedHope { meta: description = "Detects potential indicators of the CloudedHope Golang RAT used by MURKY PANDA. This is a template and requires tuning." author = "Threat Rundown" date = "2025-08-22" reference = "CrowdStrike MURKY PANDA Report" strings: $go_build_id = "Go build ID:" $go_version = /go1\.\d{1,2}/ $c2_string_1 = "/api/v1/register" $c2_string_2 = "/api/v1/tasking" condition: uint32(0) == 0x464c457f and filesize < 15MB and all of them }

2. SIEM Query — Entra ID Service Principal Credential Addition

// Azure/Entra ID Query for KQL (Microsoft Sentinel, etc.) AuditLogs | where Category == "ApplicationManagement" | where OperationName == "Add service principal credentials" | where Result == "success" | extend InitiatingUser = tostring(InitiatedBy.user.userPrincipalName) | extend TargetApp = tostring(TargetResources[0].displayName) | extend TargetAppId = tostring(TargetResources[0].id) | project TimeGenerated, OperationName, InitiatingUser, TargetApp, TargetAppId, AADTenantId | sort by TimeGenerated desc

3. PowerShell Script — Audit Recent Entra ID Role Assignments

# Ensure you have the Microsoft.Graph.Identity.DirectoryManagement module installed # Connect-MgGraph -Scopes "RoleManagement.Read.Directory,Directory.Read.All" # Get assignments made in the last 7 days $dateThreshold = (Get-Date).AddDays(-7) Write-Host "Checking for privileged role assignments in the last 7 days..." Get-MgRoleManagementDirectoryRoleAssignment -Filter "createdDateTime ge $($dateThreshold.ToString('yyyy-MM-ddTHH:mm:ssZ'))" -All | ForEach-Object { $roleDefinition = Get-MgRoleManagementDirectoryRoleDefinition -UnifiedRoleDefinitionId $_.RoleDefinitionId $principal = Get-MgUser -UserId $_.PrincipalId -ErrorAction SilentlyContinue if (-not $principal) { $principal = Get-MgServicePrincipal -ServicePrincipalId $_.PrincipalId -ErrorAction SilentlyContinue } [PSCustomObject]@{ RoleName = $roleDefinition.DisplayName AssignedTo = $principal.DisplayName PrincipalType = $principal.OdataType AssignmentTime = $_.CreatedDateTime } } | Format-Table

This rundown should provide a solid overview of the current threat landscape. Thank you to all our cyberheroes for your diligence and hard work. Stay vigilant!