Playbook for the Secure Enterprise

CyberSecurity Latest Rundown

Heroes, Big Day on the BYOD front as the much awaited macOS Tahoe 26 arrives. It sounds like Apple's entry into the SUV market, but is not. To be fair, all of the good names in tech have been taken, which explains the name of this very newsletter.
Here's a detailed look at the current cybersecurity landscape for September 16, 2025.

HIGH SEVERITY ITEMS

• 40 npm Packages Compromised in Supply Chain Attack Using bundle.js to Steal Credentials

  Date & Time: 2025-09-16T05:00:00

  A significant software supply chain attack has been identified within the npm registry, compromising over 40 packages. Attackers modified the packages to download and execute malicious code, aiming to steal developer credentials. This incident highlights the critical risk posed by open-source dependencies and the need for stringent code vetting and dependency management in all development pipelines.

  CVE Details: n/a

  Source: thehackernews.com

• Under the Pure Curtain: From RAT to Builder to Coder

  Date & Time: 2025-09-16T12:57:03

  Check Point Research has detailed a campaign using fake job offers to lure victims into installing malware, leading to an eight-stage infection chain. This multi-stage approach is designed to bypass traditional security controls by gradually escalating privileges and deploying payloads. The use of social engineering with professional themes remains a highly effective vector for initial access.

  CVE Details: n/a

  Source: research.checkpoint.com

MEDIUM SEVERITY ITEMS

• Cost-Effective NHI Solutions That Fit Your Budget

  Date & Time: 2025-09-15T21:00:00

  The management of Non-Human Identities (NHIs), such as API keys and service account credentials, remains a significant security challenge in cloud environments. Mismanaged NHIs are a primary target for attackers seeking to move laterally and escalate privileges. This report underscores the need for dedicated solutions to govern and secure these identities to prevent widespread compromise.

  CVE Details: n/a

  Source: entro.security

• The Complete Guide to Google One Tap Login: Everything Developers Need to Know

  Date & Time: 2025-09-15T15:04:07

  This guide discusses modern authentication methods like Google One Tap and WebAuthn passkeys, which are designed to improve user experience and security. While beneficial, improper implementation of these technologies can introduce new security flaws. Security teams need to provide clear guidance to developers on the correct and secure way to integrate these authentication systems into applications.

  CVE Details: n/a

  Source: securityboulevard.com

EXECUTIVE INSIGHTS

• The Convergence of AI, Cloud, and Development Creates New Attack Surfaces

  Date & Time: 2025-09-16

  Today's intelligence reveals a clear trend: the rapid adoption of AI and agile development in cloud environments is outpacing traditional security measures. The push for AI innovation, coupled with the proliferation of Non-Human Identities (NHIs) and complex software supply chains (e.g., the npm attack), creates significant risk. Executives must champion a security-first culture within development teams and invest in modern tools capable of managing cloud-native threats, securing NHIs, and vetting open-source dependencies to prevent these emerging threats from causing major business disruption.

  Source: www.ishir.com, entro.security, thehackernews.com

• Innovation at Velocity: How Fractional Engineering Teams Accelerate AI Roadmaps

  Date & Time: 2025-09-16T07:57:49

  While focused on development, this article highlights the rapid pace of AI integration within enterprises. This acceleration introduces security risks, as new AI models and data pipelines can create unforeseen vulnerabilities and expand the attack surface. Security teams must be embedded within these agile development cycles to ensure that security is not sacrificed for speed.

  CVE Details: n/a

  Source: www.ishir.com

VENDOR SPOTLIGHT

• Spotlight Rationale: Today's critical alert regarding Apple's patch for over 50 vulnerabilities highlights the immense challenge of tracking and prioritizing patches across a diverse enterprise environment. A robust vulnerability management solution is essential to address this risk effectively.

  Threat Context: Apple Rolls Out iOS 26, macOS Tahoe 26 With Patches for Over 50 Vulnerabilities

  Platform Focus: Qualys Vulnerability Management, Detection, and Response (VMDR)

  Qualys VMDR provides a comprehensive solution for identifying, prioritizing, and remediating vulnerabilities like those just patched by Apple. Instead of manually tracking assets and patch status, Qualys automates the discovery of all macOS and iOS devices, detects the specific missing patches, and uses its TruRisk scoring to prioritize the most critical vulnerabilities. This allows security teams to focus remediation efforts on the devices that pose the greatest risk to the organization, ensuring the massive patch release is managed efficiently and verifiably.

  Actionable Platform Guidance: Use Qualys VMDR to immediately identify and report on assets vulnerable to the new Apple security flaws. Create dynamic dashboards and automated reports to track patching progress and ensure compliance with remediation SLAs.

  Source: Qualys Cybersecurity

DETECTION & RESPONSE KIT

• ⚠️ Disclaimer: Test all detection logic in non-production environments before deployment.

  1. Vendor Platform Configuration - Qualys

  [copy]

  # Actionable Guidance for Qualys VMDR to Address Apple Vulnerabilities
  # Disclaimer: This guidance is based on general platform knowledge.
  # Verify against current Qualys documentation.
  
  # --- Immediate Actions ---
  
  # 1. Initiate an On-Demand Scan with a Targeted Search List
  #    - Navigate to VMDR > Scans > Option Profiles.
  #    - Create a new profile or edit an existing one.
  #    - In the 'Vulnerability Detection' section, select 'Custom'.
  #    - Click 'Add' and search for QIDs (Qualys IDs) related to the new
  #      iOS 26 and macOS Tahoe 26 vulnerabilities as they become available.
  #    - Save the profile and launch a new scan targeting your Apple assets.
  
  # 2. Create a Dynamic Dashboard Widget for Tracking
  #    - Navigate to Dashboards.
  #    - Add a new widget (e.g., 'Vulnerability Count by Severity').
  #    - Use a search query to filter for the new Apple QIDs:
  #      'vulnerabilities.vulnerability.qid: [QID1, QID2, ...]'
  #    - Configure the widget to display data for your macOS and iOS asset tags.
  
  # 3. Configure Automated Patch Deployment (if using Qualys Patch Management)
  #    - Navigate to Patch Management > Jobs.
  #    - Create a new 'Deployment Job'.
  #    - Target assets using an asset tag for vulnerable Apple devices.
  #    - Add the required patches to the job and schedule it for deployment.
  
  # --- Verification Steps ---
  
  # 1. Verify Scan Authentication
  #    - Check scan results to ensure scans on macOS/iOS assets are completing
  #      with authentication. Unauthenticated scans will not detect most vulnerabilities.
  
  # 2. Confirm Dashboard and Report Accuracy
  #    - Cross-reference widget data with raw scan results to ensure filters are correct.
  #    - Manually check a few patched assets to confirm they no longer appear as vulnerable.

  2. YARA Rule for VenomRAT (RevengeHotels Campaign)

  [copy]

  rule Detect_VenomRAT_RevengeHotels {
  meta:
  description = "Detects strings associated with VenomRAT, used by the RevengeHotels group."
  author = "Threat Rundown"
  date = "2025-09-16"
  reference = "https://kasperskycontenthub.com/securelist/?p=117493"
  strings:
  $s1 = "Venom RAT" ascii wide
  $s2 = "PasswordStealer" ascii wide
  $s3 = "-----------------VENOM-----------------" ascii wide
  $s4 = { 2F 48 57 49 44 } // /HWID
  $s5 = "ReverseProxy" ascii wide
  condition:
  uint16(0) == 0x5a4d and 3 of them
  }

  3. SIEM Query — Suspicious npm Package Activity

  [copy]

  # Detects potential data exfiltration from a compromised npm package
  # Tactic: Exfiltration, Command and Control
  # Reference: https://thehackernews.com/2025/09/40-npm-packages-compromised-in-supply.html
  
  (source_category=firewall OR source_category=proxy)
  process_name IN ("node.exe", "npm.exe") OR parent_process_name IN ("node.exe", "npm.exe")
  | where isnotnull(dest_ip) AND NOT dest_ip IN (private_ip_ranges) AND NOT dest_domain IN (known_good_domains)
  | stats count by src_ip, dest_ip, dest_domain, user
  | where count > 10
  | `comment("This query looks for network connections from node or npm processes to non-private, non-whitelisted IP addresses. A high count may indicate a malicious package exfiltrating data.")`

  4. PowerShell Script — Hunt for Suspicious bundle.js Files

  [copy]

  # Hunts for recently created bundle.js files that could be part of an npm supply chain attack.
  # Reference: https://thehackernews.com/2025/09/40-npm-packages-compromised-in-supply.html
  
  $searchPath = "C:\Users\"
  $lookbackDays = 7
  $suspiciousFileName = "bundle.js"
  
  Write-Host "Searching for potentially malicious '$($suspiciousFileName)' files created in the last $($lookbackDays) days in '$($searchPath)'..."
  
  Get-ChildItem -Path $searchPath -Filter $suspiciousFileName -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
  if ($_.CreationTime -gt (Get-Date).AddDays(-$lookbackDays)) {
  Write-Warning "[SUSPICIOUS FIND] Found file: $($_.FullName)"
  Write-Host "   - Created: $($_.CreationTime)"
  Write-Host "   - Size: $($_.Length) bytes"
  # Further actions could include calculating file hash, checking content, etc.
  }
  }
  
  Write-Host "Search complete."

  This rundown should provide a solid overview of the current threat landscape. Thank you to all our cyberheroes for your diligence and hard work. Stay vigilant!