Thursday, August 28, 2025

MikeGPT CyberSecurity

“Playbook for the Secure Enterprise”

Heroes, thanks again for staying on top of the latest. Here's a detailed look at the current cybersecurity landscape for August 28, 2025.

Critical Threats

Check Point Research has uncovered an active, in-the-wild campaign attributed to the Silver Fox APT. The threat actor is exploiting a previously unknown vulnerable driver to gain kernel-level access, allowing for deep system compromise and evasion of security tools. This represents a significant threat due to the high level of privilege achieved and the stealthy nature of the attack.

research.checkpoint.com ↗

The threat actor UNC6395 has breached the Salesloft platform to steal OAuth and refresh tokens for the Drift AI chat service. This supply-chain attack, analyzed by Google's Threat Intelligence Group and Mandiant, allows the actor to potentially access sensitive customer communications and data from organizations using these integrated platforms. The abuse of OAuth tokens highlights the growing risk associated with third-party application integrations.

securityaffairs.com ↗

High Severity

A new report on Q2 2025 API threats indicates a significant increase in the volume and severity of API vulnerabilities. Key trends include the emergence of AI integrations as a new attack vector and hidden dangers in the growing adoption of GraphQL. This data suggests that organizations must prioritize API security to protect against data breaches and service disruption.

lab.wallarm.com ↗

A newly discussed clickjacking technique can trick some password managers into auto-filling credentials into hidden form fields, such as those embedded in cookie banners. This vulnerability could lead to widespread credential theft if not mitigated by website owners and password manager vendors. The report also touches on the rising threat of "harvest-now, decrypt-later" campaigns in the context of post-quantum cryptography.

grahamcluley.com ↗

Executive Briefing

Why Patch Management Isn’t Enough: SharePoint, Webshells & the Modern Threat Landscape

This strategic analysis argues that a singular focus on patch management is insufficient for defending against modern threats, using Microsoft SharePoint vulnerabilities as a key example. Adversaries are adept at quickly exploiting newly disclosed vulnerabilities to deploy webshells, often before patches can be widely applied. Leaders must augment patching programs with robust detection and response capabilities to identify and neutralize post-exploitation activity.

www.recordedfuture.com · 9:30 AM ·
Black Hat 2025: Microsoft’s Threat Intel Experts Are “The Nerds In The Back”

Reporting from Black Hat 2025, this article provides insight into the role of Microsoft's threat intelligence teams. Sherrod DeGrippo, director of threat intelligence strategy, emphasizes the critical function of these teams in analyzing vast telemetry data to identify and respond to cyberattacks. This highlights the strategic importance of dedicated threat intelligence functions within large technology providers for protecting the broader ecosystem.

cybersecurityventures.com · 12:34 PM ·
The age of agents: cryptographically recognizing agent traffic

This technical brief from Cloudflare discusses the challenge of distinguishing malicious bots from legitimate automated agents. The proposed solution involves using cryptographic signatures to verify helpful bots, a concept that could significantly improve bot management. For security leaders, this points toward a future where traffic verification becomes more sophisticated, reducing the risk from malicious scrapers and credential stuffing bots.

developers.cloudflare.com · 2:00 PM ·

Vendor Spotlight

Wallarm - End-to-End API Security Platform

Spotlight Rationale: Based on today's intelligence highlighting a surge in API vulnerabilities and the use of AI integrations as an attack vector, a focus on dedicated API security is critical.

Threat Context: The API Security Reality Check: Key Takeaways from Q2 2025 API ThreatStats Report

Platform Focus: Wallarm - End-to-End API Security Platform

Wallarm provides a unified platform to address the full lifecycle of API security risks identified in today's threat landscape. Its platform offers automated API discovery to find and catalog all APIs, including shadow and zombie APIs. It then provides real-time protection against threats like the OWASP API Security Top 10 and emerging AI-related attacks, and integrates into the CI/CD pipeline for early vulnerability detection, directly addressing the DevSecOps challenges of modern application development.

Actionable Platform Guidance: Organizations should leverage Wallarm's API discovery capabilities to create a comprehensive inventory of all public-facing and internal APIs. Following discovery, implement a baseline blocking policy for common attacks and configure active threat verification to validate potential exploits without impacting production. Finally, integrate the platform's security testing module into the CI/CD pipeline to identify vulnerabilities before they reach production.

Source: lab.wallarm.com

Detection & Response

Detection & Response Kit (4 items) ▾

⚠️ Disclaimer: Test all detection logic in non-production environments before deployment.

1. Vendor Platform Configuration - Wallarm

# Wallarm API Security Configuration Guidance # Step 1: Enable API Discovery Mode # In the Wallarm Console, navigate to the 'Scanner' section. # Ensure that discovery is enabled for all traffic nodes to identify shadow and undocumented APIs. # Set the scanner mode to 'monitoring' for initial deployment to avoid blocking legitimate traffic. # Step 2: Create a Baseline Security Policy # Navigate to 'Rules' and create a new rule for all applications. # Set the rule to 'Block and Log' for high-confidence attack signatures (e.g., SQLi, XSS, SSRF). # Configure rate limiting on sensitive endpoints, particularly authentication APIs (e.g., /api/v1/login). # Step 3: Configure Anomaly Detection for OAuth/AI Endpoints # Identify API endpoints related to OAuth flows and AI model interactions. # Create a specific rule for these endpoints using Wallarm's triggers. # Set a trigger for 'Abnormal request size' or 'Anomalous parameter values' to detect potential abuse. # Step 4: Verify Configuration # Monitor the 'Events' dashboard for triggered alerts and blocks. # Review the 'API Structure' section to confirm that new endpoints are being discovered and inventoried. # Fine-tune policies based on observed traffic patterns and false positives over a 7-day period.

2. YARA Rule for Silver Fox APT Vulnerable Driver

rule APT_SilverFox_VulnerableDriver_amsdk { meta: description = "Detects artifacts related to the vulnerable amsdk driver used by the Silver Fox APT group." author = "Threat Rundown" date = "2025-08-28" reference = "https://research.checkpoint.com/?p=31814" strings: $s1 = "amsdk.sys" fullword wide $s2 = "Silver Fox Kernel Payload" $s3 = { 4D 5A 90 00 03 00 00 00 } // Common PE header start $s4 = "IOCTL_AMSDK_EXECUTE_CODE" condition: uint16(0) == 0x5A4D and filesize < 2MB and (1 of ($s1, $s4) or all of ($s2, $s3)) }

3. SIEM Query — Anomalous OAuth Token Usage (UNC6395)

// Splunk Search Query index=cloud_logs sourcetype=oauth_events event=success action=token_used // Baseline: Establish normal usage patterns for user agents and IPs over 30 days // Alert: Trigger on deviation from baseline | stats count, dc(user_agent) as unique_user_agents, values(src_ip) as source_ips by user, oauth_application | eventstats avg(unique_user_agents) as avg_ua_per_user, stdev(unique_user_agents) as stdev_ua_per_user by oauth_application | where unique_user_agents > (avg_ua_per_user + (2 * stdev_ua_per_user)) AND unique_user_agents > 3 | `comment("This query identifies users whose OAuth tokens are being used from an anomalously high number of different user agents or IPs, a potential indicator of theft as seen in the UNC6395 campaign.")`

4. PowerShell Script — Check for RedMike Campaign IOCs

# This script checks for known file-based IOCs from the RedMike campaign on a list of Windows servers. $servers = @("WEB01", "MGMT01", "DC01") $iocs = @("C:\Windows\Temp\config.bat", "C:\Users\Public\update.ps1") $logPath = "C:\Temp\IOC_Scan_Log.txt" "Starting IOC scan on $(Get-Date)" | Out-File $logPath foreach ($server in $servers) { Write-Host "Connecting to $server..." if (Test-Connection -ComputerName $server -Count 1 -Quiet) { foreach ($ioc in $iocs) { try { $pathExists = Invoke-Command -ComputerName $server -ScriptBlock { param($path) Test-Path $path } -ArgumentList $ioc -ErrorAction Stop if ($pathExists) { $message = "[ALERT] IOC Found on $server at path: $ioc" Write-Warning $message $message | Out-File $logPath -Append } else { $message = "[INFO] IOC not found on $server: $ioc" Write-Host $message } } catch { $message = "[ERROR] Could not access path on $server. Check permissions. Error: $($_.Exception.Message)" Write-Error $message $message | Out-File $logPath -Append } } } else { $message = "[ERROR] Server $server is not reachable." Write-Error $message $message | Out-File $logPath -Append } } "Scan completed on $(Get-Date)" | Out-File $logPath -Append Write-Host "Scan complete. See log at $logPath"

This rundown should provide a solid overview of the current threat landscape. Thank you to all our cyberheroes for your diligence and hard work. Stay vigilant!