Cybersecurity Morning Rundown

Heroes. Here we are, smack in the middle of an NFL season, but the bad guys won't take any time off. So neither will we. Here's a detailed look at the current cybersecurity landscape for September 5, 2025.

The NFL Is Back

Now, during an NFL game, the lead referee wears a white hat, but the rest of the crew wears black hats. The Editorial Staff of this publication isn't keen on conspiracies, but what if this one is operating in plain sight? How do we know the white-hatted referee hasn't been compromised and isn't acting on the influence of the black hats? We know the refs communicate with NFL C2 during the game...so where in the supply chain are the refs compromised?

Critical Threats

IT threat evolution in Q2 2025. Mobile statistics

kasperskycontenthub.com · 9:00 AM

▾

Kaspersky has released its quarterly threat report for Q2 2025, focusing on the mobile threat landscape. The report details statistics on malware, adware, and other potentially unwanted software, providing crucial data for understanding emerging attack vectors against mobile endpoints. This intelligence is vital for organizations to adjust their mobile device management (MDM) and security policies.

kasperskycontenthub.com ↗

Behind the Salesforce OAuth Drift Breach

www.centraleyes.com · 7:15 AM

▾

A string of cyberattacks affecting major companies like Palo Alto Networks and Zscaler has been traced back to an issue with Salesforce's ecosystem, specifically related to OAuth token management. The analysis clarifies this was not a direct hack of Salesforce, but rather a breach involving interconnected third-party applications, highlighting the significant risks of identity and access management in complex SaaS environments. This incident underscores the critical need for robust security over service accounts and API integrations.

www.centraleyes.com ↗

France’s CNIL fined Google $379M and Shein $175M for breaching cookie rules

securityaffairs.com · 7:28 AM

▾

France's data protection authority, CNIL, has levied massive fines against Google (€325M) and Shein (€150M) for non-compliant cookie consent practices. These enforcement actions represent a significant financial penalty for data privacy violations under GDPR. They serve as a stark reminder for all organizations of the severe consequences of failing to adhere to regional data protection regulations.

securityaffairs.com ↗

My Take non-medical Hippocratic Oaths

Today's commentary: One of the articles below suggests a Hippocratic Oath for developers.

It's ridiculous on its face as there are no bug-free products, and the fact is risk appetite varies from all parties. In addition, there is too much incentive to put dev cycles into a hyperspeed cadence with modern tool sets.

The smart approach is to keep your side of the street clean. Assume the code is flawed and build in your security layers as such. If it helps you sleep better, the code has always been flawed, so nothing there has changed. But your options have.

High Severity

DarkBard: The “Evil Twin” of Google Bard

blog.barracuda.com · 5:39 PM

▾

A new malicious AI tool named DarkBard has emerged on cybercrime forums, modeled as a dark counterpart to Google's Bard AI. This tool is designed to assist threat actors in crafting sophisticated phishing emails, generating malware code, and identifying vulnerabilities. The rise of such tools lowers the barrier to entry for less-skilled attackers and enhances the capabilities of advanced adversaries.

blog.barracuda.com ↗

Innovations in Managing Non-Human Identities

entro.security · 9:00 PM

▾

The proliferation of APIs, service accounts, and machine-to-machine communication has created a massive, often unmanaged, attack surface of Non-Human Identities (NHIs). This analysis discusses the growing risks associated with NHIs, such as hardcoded secrets and overly permissive tokens, which are increasingly targeted by attackers. Effective management of these identities is now a crucial component of a modern security strategy.

entro.security ↗

Airline Disruption Recovery — How Agentic Identity Keeps Travel on Track

www.strata.io · 8:34 PM

▾

This article explores the use of AI agents to manage airline flight disruptions, but highlights the core challenge of identity verification for these automated systems. Ensuring that an AI agent has the correct, limited permissions to access passenger data and rebook flights is a complex identity and access management problem. Misconfigurations could lead to data breaches or fraudulent activity, demonstrating the security challenges of scaling AI in customer-facing roles.

www.strata.io ↗

The Developer’s Hippocratic Oath in the Age of AI

securityboulevard.com · 3:30 PM

▾

This opinion piece argues for a renewed sense of ethical responsibility for software developers, especially when creating and implementing AI systems. It proposes a modern 'Hippocratic Oath' where developers take ownership of the code they ship, ensuring it is secure, ethical, and not harmful. This is increasingly important as AI-powered tools can be misused for malicious purposes, as seen with tools like DarkBard.

securityboulevard.com ↗

Executive Briefing

The Rise of Malicious AI and Non-Human Identity Threats

Today's intelligence reveals two converging strategic threats: the weaponization of AI and the exploitation of non-human identities (NHIs). The emergence of tools like 'DarkBard' democratizes advanced cybercrime, while incidents like the Salesforce OAuth breach show how compromised NHIs (API keys, tokens) can lead to widespread supply-chain attacks. Leaders must prioritize investments in both AI-threat detection and robust NHI security platforms to manage this evolving risk landscape, as unmanaged machine identities represent a significant and often invisible vector for enterprise breaches.

blog.barracuda.com · ·

Vendor Spotlight

Entro Security - Non-Human Identity (NHI) Security Platform

Spotlight Rationale: The current threat landscape is dominated by identity-related breaches, particularly those involving machine or non-human identities. The Salesforce OAuth breach and the analysis on managing NHIs highlight a critical, often overlooked, attack surface. Entro Security is selected for its direct focus on securing these non-human identities, which are at the core of modern application and cloud infrastructure.

Threat Context: Behind the Salesforce OAuth Drift Breach, Innovations in Managing Non-Human Identities

Platform Focus: Entro Security - Non-Human Identity (NHI) Security Platform

Entro provides a specialized platform to discover, manage, and secure the entire lifecycle of non-human identities like API keys, service accounts, tokens, and certificates. In the context of the Salesforce breach, such a platform could have identified the misconfigured or overly permissive OAuth tokens that enabled the attacks. By providing a centralized inventory and enforcing security policies (e.g., rotation, least-privilege), Entro helps organizations close the security gaps created by sprawling, interconnected cloud services and prevent similar supply-chain attacks.

Actionable Platform Guidance: Implement the Entro platform to continuously scan code repositories, cloud configurations, and secret managers to build a comprehensive inventory of all NHIs. Prioritize remediation for identities with excessive permissions, those that are inactive, or those stored insecurely. Establish automated workflows for secret rotation and lifecycle management to minimize the window of opportunity for attackers.

Source: entro.security

Detection & Response

Detection & Response Kit (4 items) ▾

⚠️ Disclaimer: Test all detection logic in non-production environments before deployment.

1. Vendor Platform Configuration - Entro Security

# Entro Security - Initial Configuration & Hardening Steps

# Step 1: Connect Data Sources for Discovery
# - Integrate with your primary Cloud Service Providers (AWS, Azure, GCP).
# - Connect to all source code management systems (GitHub, GitLab).
# - Integrate with CI/CD pipelines (Jenkins, CircleCI) and Secret Managers (HashiCorp Vault, AWS Secrets Manager).

# Step 2: Run Initial Discovery Scans
# - Initiate a full scan across all connected sources to build the NHI inventory.
# - Review the dashboard for initial findings, focusing on publicly exposed secrets and hardcoded keys.

# Step 3: Establish Governance Policies
# - Define policies for secret rotation (e.g., all high-privilege keys must rotate every 90 days).
# - Create rules to detect overly permissive IAM roles associated with service accounts.
# - Set up alerts for secrets that are not managed by an approved secrets manager.

# Step 4: Integrate with SIEM/SOAR
# - Configure the Entro integration with your SIEM (e.g., Splunk, Sentinel).
# - Forward high-severity alerts, such as 'Exposed Secret Detected' or 'Anomalous NHI Activity', to trigger automated response playbooks in your SOAR.

# Step 5: Verify & Monitor
# - Regularly review the NHI inventory for new, unmanaged identities.
# - Monitor policy compliance from the main dashboard and address violations promptly.

2. YARA Rule for Malicious AI Tool Artifacts

rule Detect_DarkBard_Tool_Strings {
meta:
description = "Detects potential artifacts or strings associated with the malicious AI tool DarkBard, used for generating phishing and malware."
author = "Threat Rundown"
date = "2025-09-05"
reference = "https://blog.barracuda.com/content/barracuda-blog/us/en/2025/09/04/darkbard-evil-twin-google-bard"
strings:
$s1 = "DarkBardGen Alpha"
$s2 = "--mode:evasive_phish"
$s3 = "--generate_poly_malware"
$s4 = "Generated by DarkBard AI"
condition:
2 of ($s*)
}

3. SIEM Query — Anomalous OAuth Application Activity

// Splunk SPL Query to detect a spike in token grants or unusual permissions for a specific OAuth application
// Relevant for threats like the Salesforce OAuth breach

index=cloud_logs sourcetype=salesforce:event OR sourcetype=okta
(event_type="app.oauth2.token.grant" OR event_type="api_event")

// Baseline: Calculate average and standard deviation of token grants per app over the last 30 days
| eventstats avg(grant_count) as avg_grants, stdev(grant_count) as stdev_grants by oauth_app_name

// Compare today's activity to the baseline
| stats count as today_grants by oauth_app_name, avg_grants, stdev_grants, user, permissions_granted

// Alert if today's grants are more than 3 standard deviations above the average
| where today_grants > (avg_grants + (3 * stdev_grants)) AND today_grants > 50

| table oauth_app_name, user, today_grants, avg_grants, permissions_granted
| rename oauth_app_name as "Suspicious Application", user as "Affected User", permissions_granted as "Permissions"

4. PowerShell Script — Scan for Hardcoded Secrets in Config Files

# Scans specified directories for common secret patterns in configuration files.
# Useful for identifying Non-Human Identity risks.

$searchPath = "C:\inetpub\wwwroot", "C:\ProgramData\Application\Config"
$patterns = @(
'"api_key"\s*:\s*"[a-zA-Z0-9_\-]{32,}"',
'"client_secret"\s*:\s*"[a-zA-Z0-9_\-]{32,}"',
'(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}' # AWS Key ID
)

$regex = $patterns -join '|'

Write-Host "Scanning for hardcoded secrets in specified paths..."

foreach ($path in $searchPath) {
if (Test-Path $path) {
Get-ChildItem -Path $path -Recurse -Include *.config, *.json, *.yml, *.xml | ForEach-Object {
if (Select-String -Path $_.FullName -Pattern $regex -Quiet) {
Write-Warning "Potential secret found in: $($_.FullName)"
Select-String -Path $_.FullName -Pattern $regex | Select-Object LineNumber, Line
}
}
} else {
Write-Host "Path not found: $path"
}
}

Write-Host "Scan complete."

This rundown should provide a solid overview of the current threat landscape. Thank you to all our cyberheroes for your diligence and hard work. Stay vigilant!