Thursday, September 11, 2025

MikeGPT CyberSecurity

“Playbook for the Secure Enterprise”

Heroes, here's a detailed look at the current cybersecurity landscape for September 11, 2025.

Critical Threats

Microsoft released its September Security Update, addressing over 80 vulnerabilities across its product suite, including Windows, Office, and Azure. The patch includes fixes for critical flaws, such as a CVSS 10.0 bug in Azure and a publicly disclosed SMB privilege escalation vulnerability, requiring immediate attention from administrators.

NSFOCUS ↗

Researchers at Permiso have discovered a novel obfuscation technique named “Inboxfuscation” that abuses Microsoft Exchange inbox rules. This method uses Unicode characters to evade detection and can be used for data exfiltration, posing a stealthy threat to enterprise email security.

Security Boulevard ↗

Google has patched a critical use-after-free vulnerability in its Chrome browser that could potentially lead to arbitrary code execution. The flaw poses a significant risk to users, as exploitation could occur by tricking a user into visiting a malicious website, highlighting the importance of timely browser updates.

SecurityWeek ↗

For the second time in two years, Senator Ron Wyden is calling for a federal investigation into Microsoft's cybersecurity practices. The request alleges that persistent weaknesses in Microsoft's software ecosystem are leaving federal agencies, critical infrastructure, and corporations vulnerable to major cyberthreats.

Security Boulevard ↗

High Severity

The previously dormant ChillyHell malware targeting macOS has re-emerged with updated evasion techniques. The malware is capable of bypassing security checks and maintaining persistence, posing a renewed and stealthy threat to Apple users.

HackRead ↗

Oligo Security has disclosed a vulnerability in Apple CarPlay that could allow remote attackers to compromise the system without user interaction. This flaw could lead to driver distraction and potential surveillance, highlighting growing security risks in connected vehicle technologies.

SecurityWeek ↗

CERT/CC has published a vulnerability note (VU#974249) detailing two local security flaws in Sunshine for Windows. These vulnerabilities could allow a local attacker to execute arbitrary code and escalate privileges on affected systems, requiring patching for users of the software.

CERT/CC ↗

Executive Briefing

How Mitsubishi-Nozomi Deal Will Boost OT Cyber Capabilities

Mitsubishi Electric's acquisition of OT cybersecurity firm Nozomi Networks for $883 million signals a major industry move to integrate industrial control systems with advanced threat detection. This strategic partnership aims to enhance security for critical infrastructure by combining operational technology insights with specialized cybersecurity defenses.

Healthcare InfoSecurity · 8:24 PM ·
Apple Details Enhanced Security Features for App Development in Xcode

Apple has released new documentation for developers on enabling enhanced security features within Xcode, including the adoption of hardware memory tagging. This guidance encourages a "secure by default" development posture, aiming to mitigate entire classes of vulnerabilities at the code level before applications are deployed.

Apple Developer · 6:57 PM ·

Detection & Response

Detection & Response Kit (3 items) ▾

⚠️ Disclaimer: Test all detection logic in non-production environments before deployment.

1. YARA Rule for "Inboxfuscation" Artifacts

rule Detect_Suspicious_Unicode_In_Exchange_Rules { meta: description = "Detects potential 'Inboxfuscation' techniques using non-standard Unicode characters in email rule artifacts." author = "Threat Rundown" date = "2025-09-11" reference = "https://securityboulevard.com/?p=2069156" strings: // Look for rule structures containing Unicode characters outside of common language sets $unicode_homoglyph = /\u[2-9][0-9A-F]{3}/ nocase $rule_action_forward = "ForwardTo" wide ascii $rule_action_redirect = "RedirectTo" wide ascii condition: all of them }

2. SIEM Query — Hunting for Anomalous Exchange Inbox Rules

// Splunk Example: Detect creation of new forwarding rules to external domains index=m365 sourcetype="o365:management:activity" Workload=Exchange Operation=New-InboxRule | spath input=Parameters | search Parameters.ForwardTo=* AND NOT Parameters.ForwardTo IN (*"internal-domain.com") | stats count by UserId, ClientIPAddress, Parameters.Name, Parameters.ForwardTo | rename UserId as User, ClientIPAddress as Source_IP, Parameters.Name as Rule_Name, Parameters.ForwardTo as Forwarding_Address

3. PowerShell Script — Audit Exchange Inbox Rules

# This script audits all mailboxes for forwarding rules pointing to external domains. # Ensure you have the ExchangeOnlineManagement module installed and are connected. $mailboxes = Get-Mailbox -ResultSize Unlimited $suspiciousRules = @() foreach ($mailbox in $mailboxes) { $rules = Get-InboxRule -Mailbox $mailbox.UserPrincipalName foreach ($rule in $rules) { if ($rule.ForwardTo -or $rule.ForwardAsAttachmentTo -or $rule.RedirectTo) { # Combine all forwarding-type recipients into one list $recipients = $rule.ForwardTo + $rule.ForwardAsAttachmentTo + $rule.RedirectTo foreach ($recipient in $recipients) { if ($recipient -notlike "*@yourdomain.com") { # Replace with your internal domain $suspiciousRules += [PSCustomObject]@{ Mailbox = $mailbox.UserPrincipalName; RuleName = $rule.Name; Description = $rule.Description; Recipient = $recipient; } } } } } } if ($suspiciousRules) { Write-Host "Found suspicious external forwarding rules:" $suspiciousRules | Format-Table } else { Write-Host "No suspicious external forwarding rules found." }

This rundown should provide a solid overview of the current threat landscape. Thank you to all our cyberheroes for your diligence and hard work. Stay vigilant!