Friday, September 12, 2025

MikeGPT CyberSecurity

“Playbook for the Secure Enterprise”

Heroes, it's Friday! We made it! Here's a look at the current cybersecurity landscape for September 12, 2025.

Critical Threats

The U.S. CISA has added a critical vulnerability in Dassault Systèmes' DELMIA Apriso manufacturing software to its Known Exploited Vulnerabilities (KEV) catalog. Evidence of active exploitation means organizations using this software face an immediate and significant threat of compromise to their manufacturing operations. Immediate patching is required to mitigate this risk.

CVE-2025-5086 The Hacker News ↗

A new ransomware group named Yurei has been identified after targeting a Sri Lankan food manufacturing company. The group employs a double-extortion model, encrypting files and threatening to leak stolen data, signaling the emergence of a new threat actor in the ransomware landscape.

Check Point Research ↗

Cisco has released patches for multiple high-severity vulnerabilities in its IOS XR software, which is used in carrier-grade routers. These flaws could allow an attacker to bypass software image verification or trigger a denial-of-service (DoS) condition, posing a significant risk to network infrastructure stability and security.

Security Affairs ↗

High Severity

Apple has issued another round of threat notifications to users in France, warning them of potential targeting by sophisticated commercial spyware. This action indicates a persistent, state-sponsored or commercial surveillance campaign against specific individuals, highlighting the ongoing threat of advanced mobile spyware.

SecurityWeek ↗

Researchers are detailing large-scale iMessage phishing campaigns operated by Chinese syndicates using "machine rooms" filled with iPhones. This method allows for mass distribution of malicious spam, posing a widespread threat to Apple users and bypassing traditional email security filters.

Security Boulevard ↗

A security news roundup highlights several noteworthy events, including the discovery of new HybridPetya malware and significant bug bounty payouts for cloud vulnerabilities. These varied incidents underscore the diverse and dynamic nature of the current threat landscape.

SecurityWeek ↗

Analysis shows that a majority of mobile applications silently leak personal user data to third-party services, often without explicit consent. This widespread data leakage through trackers and insecure practices represents a significant and persistent privacy risk for all mobile users.

Security Boulevard ↗

The Security BSides San Francisco 2025 conference has concluded, and video content from the event's presentations is now being published. This provides the broader security community with access to the latest research and insights shared at the conference.

Security Boulevard ↗

Other Noteworthy

The Security BSides San Francisco 2025 conference has concluded, and video content from the event's presentations is now being published. This provides the broader security community with access to the latest research and insights shared at the conference.

Security Boulevard ↗

Executive Briefing

A Cyberattack Victim Notification Framework

This analysis from Bruce Schneier explores the strategic importance of establishing a standardized framework for notifying victims of cyberattacks. For business leaders and CISOs, this is a critical consideration for incident response planning, legal counsel, and public relations, as timely and effective notification can mitigate reputational damage and regulatory penalties.

Schneier on Security · 9:04 PM ·
Trusted Connections, Hidden Risks: Token Management in the Third-Party Supply Chain

Unit 42 highlights the significant but often overlooked risks associated with OAuth token management in third-party software integrations. Executives should be aware that dormant integrations and insecurely stored tokens can create persistent backdoors into their environment, making robust supply chain and API security governance a strategic imperative.

Palo Alto Networks Unit 42 · 11:00 PM ·

Vendor Spotlight

Tenable Exposure Management Platform

Spotlight Rationale: With CISA adding an actively exploited vulnerability (CVE-2025-5086) to its KEV catalog and Cisco patching critical infrastructure flaws, the need for rapid, comprehensive vulnerability and exposure management is paramount. Tenable's platform directly addresses the challenge of identifying and prioritizing these types of critical risks across an organization's attack surface.

Threat Context: Critical CVE-2025-5086 in DELMIA Apriso Actively Exploited, CISA Issues Warning

Platform Focus: Tenable Exposure Management Platform

Tenable provides a unified view of an organization's attack surface, enabling security teams to discover and assess vulnerabilities like CVE-2025-5086 and the new Cisco IOS XR flaws. Its prioritization capabilities help teams focus on the most critical threats that are actively exploited or pose the greatest risk to business operations, moving beyond simple CVSS scores to provide actionable, risk-based context.

Actionable Platform Guidance: Based on available documentation, no immediate automated actions or verification steps were identified. Please contact the vendor for detailed implementation support for today's specific threats.

Source: Tenable Cybersecurity

Detection & Response

Detection & Response Kit (4 items) ▾

⚠️ Disclaimer: Test all detection logic in non-production environments before deployment.

1. Vendor Platform Configuration - Tenable

# Tenable Platform Guidance for CVE-2025-5086 & Cisco IOS XR Flaws # 1. Initiate Scans: # - In your Tenable.io or Tenable.sc console, prioritize new external and internal vulnerability scans for assets running Dassault Systèmes DELMIA Apriso and Cisco IOS XR software. # - Ensure your vulnerability scan templates are configured to use the latest plugin sets to detect CVE-2025-5086 and the newly disclosed Cisco vulnerabilities. # 2. Prioritize with VPR: # - Use Tenable's Vulnerability Priority Rating (VPR) to identify instances of CVE-2025-5086. A high VPR score, especially with the 'Actively Exploited' tag, indicates the highest priority for remediation. # - Create dashboards and reports filtered for these specific vulnerabilities to track remediation progress. # 3. Further Action: # - The provided actionable guidance status is SUCCESS with 0 immediate actions. # - This guidance is a best effort. Please contact Tenable for detailed implementation support and specific plugin information.

2. YARA Rule for Yurei Ransomware

rule Ransomware_Win_Yurei_Generic { meta: description = "Detects potential indicators associated with the Yurei ransomware group." author = "Threat Rundown" date = "2025-09-12" reference = "https://research.checkpoint.com/?p=31891" strings: $note1 = "HOW_TO_RECOVER_YOUR_FILES.txt" ascii wide $note2 = "All your important files have been encrypted by Yurei." $ext = ".yurei" condition: (uint16(0) == 0x5a4d) and filesize < 2MB and (1 of ($note*) or $ext at (filesize - 6)) }

3. SIEM Query — Detecting Potential Data Exfiltration (Double Extortion)

# Splunk SPL Query (index=proxy OR index=firewall) action=allowed | stats sum(bytes_out) as total_bytes_out by src_ip, dest_ip | where total_bytes_out > 100000000 # Threshold: 100MB, adjust as needed | iplocation dest_ip | where Country != "Your_Country_Name" | lookup known_good_destinations dest_ip OUTPUT | where isnull(known_good_destinations) | sort - total_bytes_out

4. PowerShell Script — Check for DELMIA Apriso IoCs (CVE-2025-5086)

# This script provides a framework to check for potential IoCs related to CVE-2025-5086. # Specific file paths/names are placeholders and must be updated with actual intelligence. $suspiciousFilePaths = @( "C:\Program Files\Dassault Systemes\DELMIA Apriso\webapps\Apriso\suspicious.jsp", "C:\Windows\Temp\exploit.exe" ) $computers = Get-Content -Path .\servers.txt # List of servers running Apriso foreach ($computer in $computers) { Write-Host "Checking $computer..." if (Test-Connection -ComputerName $computer -Count 1 -Quiet) { foreach ($path in $suspiciousFilePaths) { if (Invoke-Command -ComputerName $computer -ScriptBlock { Test-Path -Path $using:path }) { Write-Warning "[ALERT] Suspicious file found on $computer at path: $path" } } } else { Write-Error "Could not connect to $computer." } }

This rundown should provide a solid overview of the current threat landscape. Thank you to all our cyberheroes for your diligence and hard work. Stay vigilant!