A critical vulnerability, identified as CVE-2025-9242 with a CVSS score of 9.3, has been discovered in WatchGuard Fireware. The flaw allows an unauthenticated, remote attacker to execute arbitrary code on affected devices. Given the role of these devices as network security gateways, a compromise could lead to a complete network breach.
Business Impact
Successful exploitation could result in total loss of confidentiality, integrity, and availability of the network protected by the WatchGuard appliance. Attackers could gain full access to internal networks, steal sensitive data, deploy ransomware, or use the compromised device to launch further attacks.
Recommended Action
Immediately apply the patches released by WatchGuard. If patching is not immediately possible, restrict access to the device's management interface to a trusted network and monitor for any signs of compromise.
New GNU/Linux Rootkit 'LinkPro' Deployed in AWS via Jenkins Vulnerability
Reddit /r/cybersecurity·9:37 AM·CVE-2024-23897
▾
A new Golang-based rootkit named LinkPro has been discovered in a compromised AWS environment. Attackers gained initial access by exploiting a known vulnerability in a Jenkins server (CVE-2024-23897) to deploy a malicious Docker image onto Kubernetes clusters. The rootkit uses eBPF modules to maintain stealth and control over the compromised systems.
Business Impact
This attack demonstrates a sophisticated cloud-native threat. A rootkit like LinkPro can provide attackers with persistent, privileged access to critical cloud infrastructure, enabling data exfiltration, resource hijacking for cryptomining, and lateral movement across cloud environments. The impact on HIPAA-regulated data is severe.
Recommended Action
Patch all Jenkins servers for CVE-2024-23897 immediately. Scan container registries for malicious images and implement runtime security monitoring (e.g., eBPF-based) to detect anomalous behavior within Kubernetes clusters. Review IAM roles and permissions for Jenkins service accounts.
Prosper Discloses Data Breach Impacting 17.6 Million Accounts
securityaffairs.com·11:50 AM
▾
Peer-to-peer lending platform Prosper has disclosed a major data breach affecting over 17.6 million users. Threat actors successfully exfiltrated a significant volume of personal and financial data, including names, IDs, and other sensitive financial details. The scale of this breach poses a substantial risk of identity theft and financial fraud for affected individuals.
Business Impact
The breach triggers significant regulatory scrutiny under GDPR and SOX, likely resulting in heavy fines. The company faces severe reputational damage, loss of customer trust, and potential class-action lawsuits. Operational costs for incident response, customer notification, and credit monitoring will be substantial.
Recommended Action
Prosper users should immediately change their passwords, enable multi-factor authentication, and monitor their financial accounts for suspicious activity. Organizations should use this as a case study to review their own data protection controls and incident response plans for large-scale PII breaches.
Winos 4.0 Hacking Group Expands Operations to Japan and Malaysia
securityaffairs.com·5:35 PM
▾
The threat group behind the Winos 4.0 (ValleyRAT) campaign has expanded its targeting from China and Taiwan to include organizations in Japan and Malaysia. The group uses phishing attacks with malicious PDF documents, disguised as official Finance Ministry communications, to deliver the HoldingHands Remote Access Trojan (RAT).
Business Impact
This expansion indicates the group's growing capabilities and ambition. A successful infection with the HoldingHands RAT can lead to espionage, data theft, and full system control. Organizations in the new target regions, especially in the financial and government sectors, are at high risk.
Recommended Action
Enhance security awareness training to help employees identify sophisticated phishing attempts. Deploy endpoint detection and response (EDR) solutions capable of detecting RAT behavior. Block known indicators of compromise (IoCs) associated with Winos 4.0 at the network perimeter.
Microsoft Reports Russia and China Using AI to Escalate Cyberattacks
SecurityWeek·4:23 PM
▾
According to Microsoft, nation-state actors from Russia and China are increasingly leveraging artificial intelligence to enhance the speed, scale, and sophistication of their cyberattacks against the United States. This includes using AI for crafting more convincing phishing emails, identifying vulnerabilities, and automating attack sequences.
Business Impact
The use of AI by adversaries lowers the barrier to entry for complex attacks and increases the velocity of threats, compressing the time defenders have to respond. This trend will challenge traditional security defenses and require more advanced, AI-driven defensive capabilities.
Recommended Action
Security leaders should evaluate and invest in AI-powered defensive tools for threat detection, phishing analysis, and automated response. Prioritize security awareness programs that educate users on AI-generated social engineering tactics.
Google Gemini AI Reportedly Auto-Dials 911 Without User Consent
Reddit /r/netsec·5:12 PM
▾
A report indicates that the Google Gemini AI application on an Android device initiated a 911 emergency call without any user prompt or consent during a text-based chat. The app allegedly handed off the call function to the core Google app, bypassing user interaction and creating a potentially dangerous situation by misusing emergency services.
Business Impact
This functional flaw represents a significant safety and liability risk. Unintended emergency calls can strain public resources and could prevent legitimate calls from getting through. For enterprises using Android devices, this could lead to policy violations and disruptions.
Recommended Action
Organizations using Android devices with the Gemini app should be aware of this issue. Consider disabling the app or its permissions pending a fix from Google. Users should review app permissions, particularly those related to phone and emergency call functions.
Weekly Vulnerability Roundup: 140 Exploits Publicly Available for Recently Disclosed Flaws
Cyble·2:21 PM
▾
Cyble researchers tracked 996 new vulnerabilities in the past week alone, with 74 rated as critical. Alarmingly, over 140 of these vulnerabilities already have a public Proof-of-Concept (PoC) exploit, dramatically increasing the likelihood of active attacks by lowering the technical skill required for exploitation.
Business Impact
The rapid release of PoC exploits shortens the window for defenders to patch systems. This 'patch gap' exposes organizations to significant risk of breach from both sophisticated and low-skilled attackers. This is a critical operational risk for teams managing HIPAA and SOX compliance.
Recommended Action
Prioritize patching based on the availability of a PoC exploit, not just the CVSS score. Vulnerability management programs must be agile and able to respond within hours or days, not weeks, to these high-risk threats.
Multiple Password Managers Vulnerable to Clickjacking Attacks
CERT/CC·11:46 AM
▾
CERT/CC has issued a vulnerability note (VU#516608) detailing how multiple browser-extension password managers are susceptible to clickjacking attacks. These attacks can trick users into unknowingly interacting with the password manager's UI elements embedded in a malicious page, potentially exposing sensitive information.
Multiple Password Managers Vulnerable to Clickjacking Attacks
CERT/CC·11:46 AM
▾
CERT/CC has issued a vulnerability note (VU#516608) detailing how multiple browser-extension password managers are susceptible to clickjacking attacks. These attacks can trick users into unknowingly interacting with the password manager's UI elements embedded in a malicious page, potentially exposing sensitive information.
Following the release of Amazon Bedrock API keys, AWS has published critical security guidance for their implementation and management. With generative AI services becoming central to business operations, securing the API keys that control access to these powerful models is paramount. Improperly secured keys can lead to significant financial loss through fraudulent usage, data exfiltration, or model manipulation. This guidance provides a security framework for organizations building on Bedrock.
Spotlight Rationale: Today's intelligence highlights the critical risk of compromised non-human identities, as demonstrated by the **LinkPro rootkit** attack which exploited a vulnerable Jenkins server ([CVE-2024-23897](https://nvd.nist.gov/vuln/detail/CVE-2024-23897)) and the AWS guidance on securing **Bedrock API keys**. Entro Security specializes in Non-Human Identity (NHI) Security, directly addressing this attack vector.
Entro Security provides a platform to discover, manage, and secure the lifecycle of machine identities like API keys, tokens, and service account credentials. By providing a centralized inventory and context around each NHI—such as its permissions, usage patterns, and associated vulnerabilities—the platform helps prevent the initial access and privilege escalation seen in the LinkPro attack. It directly operationalizes the principles outlined in the AWS Bedrock security guidance by enabling secrets scanning, posture management, and detection of anomalous NHI behavior.
Actionable Platform Guidance: Use the Entro platform to continuously scan code repositories, cloud configurations, and CI/CD pipelines for exposed secrets like Jenkins credentials or Bedrock API keys. Create automated policies to enforce least-privilege access for service accounts and set up alerts for high-risk NHIs that are over-privileged, inactive, or associated with vulnerable applications. Prioritize remediation for NHIs linked to publicly-exposed services like the Jenkins server in the LinkPro incident.
⚠️ Disclaimer: Test all detection logic in non-production environments before deployment.
1. Vendor Platform Configuration - Entro Security
# Actionable Guidance for an NHI Security Platform (e.g., Entro)
# 1. Connect Data Sources:
# - Integrate with your SCM (GitHub, GitLab) to scan for hardcoded secrets.
# - Connect to your Cloud Provider (AWS, Azure, GCP) to inventory service principals and keys.
# - Integrate with CI/CD tools (Jenkins, CircleCI) to detect secrets in build logs.
# 2. Create Discovery & Classification Policies:
# - Policy Name: "Detect Exposed Jenkins Credentials"
# - Scope: All connected SCM and CI/CD sources.
# - Pattern: Use built-in or custom regex for Jenkins API tokens and credentials.
# - Action: Tag as 'Critical Risk' and create a high-priority alert.
# 3. Implement Anomaly Detection Rules:
# - Rule Name: "Anomalous API Key Usage"
# - Logic: Alert when an API key (e.g., Bedrock key) is used from a new/unauthorized IP range, region, or service.
# - Threshold: Trigger on first occurrence.
# 4. Verification:
# - Run a historical scan to find existing exposed secrets.
# - Confirm that new commits with secrets trigger an immediate alert.
2. YARA Rule for HoldingHands RAT (Winos 4.0)
rule Winos_HoldingHands_RAT {
meta:
description = "Detects indicators associated with the HoldingHands RAT used by the Winos 4.0 group."
author = "Threat Rundown"
date = "2025-10-19"
reference = "https://securityaffairs.com/?p=183580"
severity = "high"
tlp = "white"
strings:
$s1 = "HoldingHands" ascii wide
$s2 = "ValleyRAT" ascii wide
$s3 = "Winos 4.0" ascii wide
$s4 = "Finance Ministry" ascii wide // String from decoy PDF
condition:
2 of ($s*)
}
// Splunk Query Example
index=os sourcetype="linux_audit" (process_name="java" OR parent_process_name="java") process_name IN ("docker", "wget", "curl", "sh", "bash")
// Filter for Jenkins user or process path
| search user="jenkins" OR process_path="*/jenkins/*"
// Look for suspicious command line arguments like downloading and executing scripts
| search process_command IN ("*| sh", "*| bash", "*curl -sL*", "*wget -qO-*", "*docker run*")
| table _time, host, user, parent_process_name, process_name, process_command
| sort -_time
4. PowerShell Script — Hunt for Winos 4.0 PDF Lures
<#
.SYNOPSIS
Scans user directories for suspicious PDF files matching Winos 4.0 TTPs.
#>
$userFolders = Get-ChildItem -Path C:\Users -Directory | Where-Object { $_.Name -ne 'Public' -and $_.Name -ne 'Default' }
foreach ($folder in $userFolders) {
$scanPath = Join-Path -Path $folder.FullName -ChildPath "Downloads"
if (Test-Path $scanPath) {
Write-Host "Scanning $scanPath..."
Get-ChildItem -Path $scanPath -Filter "*.pdf" -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
# Simple check for keywords in filename. A real implementation would check metadata or content.
if ($_.Name -like "*Finance*" -or $_.Name -like "*Ministry*") {
Write-Warning "[POTENTIAL IOC] Found suspicious PDF: $($_.FullName)"
}
}
}
}
Write-Host "Scan complete."
This rundown should provide a solid overview of the current threat landscape. Thank you to all our cyberheroes for your diligence and hard work. Stay vigilant!
Cookie Notice
We use essential cookies to provide our cybersecurity newsletter service and analytics cookies to improve your experience.
About STIX 2.1: Structured Threat Information eXpression (STIX) is the machine language of cybersecurity. This bundle contains validated threat objects, indicators, and relationships that can be directly imported into your SIEM, TIP, or security orchestration platform.
Usage: Download or copy the JSON below and import it directly into your threat intelligence platform, SIEM, or security orchestration tools for automated threat detection and response.