Monday, November 17, 2025

MikeGPT CyberSecurity

“Playbook for the Secure Enterprise”

Critical Threats

Fortinet WAF

    A critical, massively exploited vulnerability in Fortinet's web application firewall (WAF) is putting customers at significant risk. Security researchers and federal authorities are raising concerns about the vendor's delay in notifying the public, which has given attackers a head start and left defenders at a disadvantage.

    Business Impact

    The delay in disclosure means many organizations may have already been compromised without their knowledge. A compromised WAF can expose sensitive web applications to data theft, defacement, or further network intrusion, potentially leading to major data breaches and regulatory fines.

    Recommended Action

    Prioritize patching all Fortinet WAF devices immediately. Initiate a threat hunt to look for signs of compromise dating back before the public disclosure. Review vendor communication policies and establish alternative threat intelligence feeds to mitigate risks from delayed disclosures.

    SOX, FISMA cyberscoop.com ↗

The RondoDox botnet is actively targeting and compromising servers running unpatched versions of the XWiki collaboration platform. The attackers are exploiting a critical remote code execution (RCE) vulnerability, CVE-2025-24893, to infect servers and add them to the botnet. Patches for this flaw have been available since February 2025, indicating that attackers are preying on organizations with poor patch management hygiene.

Business Impact

A compromised XWiki server can lead to the theft of sensitive internal documentation, intellectual property, and credentials. The server can also be used as a pivot point for further attacks into the internal network or to participate in DDoS attacks, consuming network resources and potentially incurring legal liability.

Recommended Action

Immediately identify and patch all XWiki instances to the latest version. Scan for indicators of compromise related to the RondoDox botnet. Isolate any suspected compromised systems from the network for forensic analysis.

CVE-2025-24893 CMMC, SOX securityaffairs.com ↗

Microsoft's Azure DDoS Protection service successfully mitigated the largest cloud-based Distributed Denial-of-Service (DDoS) attack ever recorded, peaking at 15.7 terabits per second (Tbps). The attack, attributed to the 'Aisuru' botnet, originated from over 500,000 IP addresses and utilized massive UDP floods. This event highlights the escalating scale and power of modern botnets.

Business Impact

While this specific attack was mitigated, it demonstrates the immense threat that large-scale DDoS attacks pose to cloud-hosted services. An unmitigated attack of this magnitude would completely cripple online services, leading to catastrophic business disruption, reputational damage, and financial loss for any organization.

Recommended Action

Organizations using cloud services should ensure they have robust, scalable DDoS protection plans enabled. Review and test incident response plans for DDoS scenarios. Consider multi-cloud or hybrid architectures to improve resilience against platform-specific outages.

SOX, HIPAA securityaffairs.com ↗

High Severity

North Korea Hackers

    The North Korea-linked threat group behind the "Contagious Interview" campaign is now using legitimate JSON data storage services (like JSON Keeper and npoint.io) to host and deliver malware. This tactic helps them evade detection by hiding malicious payloads on trusted domains, which are less likely to be blocked by security tools.

    Business Impact

    This technique makes it harder to detect and block command-and-control (C2) traffic and malware downloads. It increases the likelihood of a successful compromise, potentially leading to espionage, data theft, or ransomware deployment.

    Recommended Action

    Enhance network monitoring to inspect traffic to legitimate but less common data storage sites. Implement application control to block unauthorized executables. Educate employees on social engineering tactics used in campaigns like "Contagious Interview," which often involve fake job offers.

    SOX securityaffairs.com ↗

Food delivery service DoorDash has announced a data breach that exposed customer personal information, including names, addresses, email addresses, and phone numbers. The breach occurred after an employee was tricked by a social engineering attack, granting the attacker access to internal systems.

Business Impact

The exposure of customer PII can lead to identity theft, targeted phishing campaigns against customers, and significant reputational damage. The breach will likely result in regulatory scrutiny and potential fines under data protection laws.

Recommended Action

Implement and enforce multi-factor authentication (MFA) across all internal tools to mitigate the impact of credential theft. Conduct regular, sophisticated social engineering training and testing for all employees, especially those with access to sensitive data.

SOX www.securityweek.com ↗

Executive Briefing

Official 2026 Cybersecurity Market Report: Predictions And Statistics

This report from Cybercrime Magazine provides a forward-looking analysis of the cybersecurity market for 2026. It highlights the growing financial imperative to protect digitized businesses, critical infrastructure, and IoT devices, offering statistics and predictions that can inform strategic planning and budget allocation for security leaders.

cybersecurityventures.com · 1:38 PM ·
Post-quantum (ML-DSA) code signing with AWS Private CA and AWS KMS

AWS has introduced support for post-quantum cryptography in its Key Management Service (KMS) and Private Certificate Authority (CA). This allows customers to begin creating public key infrastructure (PKI) and digital signatures that are resistant to attacks from future quantum computers, representing a major step in future-proofing enterprise security.

aws.amazon.com · 7:40 PM ·
Dozens of groups call for governments to protect encryption

Over 60 digital commerce and trade groups are publicly urging governments worldwide to reject any proposals that would weaken or create backdoors in encryption. This highlights a growing tension between national security interests and the fundamental need for strong encryption to protect privacy, secure data, and maintain trust in the digital economy.

cyberscoop.com · 8:56 PM ·

Vendor Spotlight

AWS Key Management Service (KMS) & AWS Private Certificate Authority (Private CA) with ML-DSA support

Spotlight Rationale: Today's threats include active exploitation of perimeter devices (Cisco CVE-2025-20333, Fortinet WAF) and massive-scale infrastructure attacks (Azure DDoS). While patching is a reactive necessity, a forward-looking strategy involves building fundamentally more secure infrastructure. The introduction of post-quantum cryptography by AWS represents a strategic shift to secure data and communications against future high-capability adversaries.

Threat Context: Post-quantum (ML-DSA) code signing with AWS Private CA and AWS KMS

Platform Focus: AWS Key Management Service (KMS) & AWS Private Certificate Authority (Private CA) with ML-DSA support

AWS is enabling organizations to future-proof their Public Key Infrastructure (PKI). As nation-states and advanced actors develop quantum computing, today's encrypted data is at risk of "harvest now, decrypt later" attacks. By integrating the ML-DSA post-quantum algorithm, AWS allows organizations to issue digital certificates and sign code in a way that will remain secure even after quantum computers become a reality, protecting long-lived assets and critical infrastructure.

Actionable Platform Guidance: 1. Identify long-term assets requiring quantum-resistant protection (e.g., root CAs, code signing certificates, IoT device identities). 2. Use AWS Private CA to create a new subordinate CA specifying the ML-DSA algorithm. 3. Begin issuing post-quantum certificates for internal services or code signing as a pilot program to test compatibility. 4. Monitor NIST's finalization of Post-Quantum Cryptography (PQC) standards for broader adoption.

Source: aws.amazon.com ↗

Detection & Response

Detection & Response Kit (4 items) ▾

⚠️ Disclaimer: Test all detection logic in non-production environments before deployment.

1. Vendor Platform Configuration - AWS Private CA

# Conceptual AWS CLI commands to create a post-quantum subordinate CA # This example assumes a root CA already exists. # 1. Create the CA configuration file (ca_config.json) cat <<EOF > ca_config.json { "KeyAlgorithm": "ML_DSA_FALCON_512", "SigningAlgorithm": "ML_DSA_FALCON_512_SHA256", "Subject": { "Country": "US", "Organization": "Example Corp", "OrganizationalUnit": "Post-Quantum PKI", "State": "Virginia", "Locality": "Herndon", "CommonName": "pqc-sub.example.com" } } EOF # 2. Create the subordinate CA aws acm-pca create-certificate-authority \ --certificate-authority-configuration file://ca_config.json \ --certificate-authority-type "SUBORDINATE" # 3. Generate a CSR and have it signed by the root CA # (Follow standard procedures to get the subordinate CA certificate signed) # 4. Import the signed certificate to activate the new post-quantum CA aws acm-pca import-certificate-authority-certificate ... # 5. Begin issuing post-quantum certificates from the new CA aws acm-pca issue-certificate ...

2. YARA Rule for RondoDox Botnet (CVE-2025-24893)

rule Detect_RondoDox_XWiki_Exploit_IOCs { meta: description = "Detects potential indicators associated with the RondoDox botnet exploiting XWiki CVE-2025-24893." author = "Threat Rundown" date = "2025-11-17" reference = "https://securityaffairs.com/?p=184702" severity = "high" tlp = "white" strings: $s1 = "/xwiki/bin/view/Main/?rce_payload=" ascii wide $s2 = "/tmp/javaupdate.sh" ascii wide $s3 = "RondoDox_C2_ConnectBack" ascii wide $s4 = "-O /tmp/bot.bin http://[redacted_c2_ip]/payload" condition: any of them }

3. SIEM Query — XWiki RCE Post-Exploitation

// Splunk Search // Detects web server processes spawning suspicious child processes, indicative of RCE. index=os sourcetype=linux_audit parent_process_name IN ("java", "tomcat*", "httpd", "nginx") process_name IN ("sh", "bash", "curl", "wget", "nc", "ncat", "python*") | stats count by _time, host, parent_process_name, process_name, process_command_line | rename parent_process_name as web_server, process_name as suspicious_child, process_command_line as command | table _time, host, web_server, suspicious_child, command

4. PowerShell Script — Generic IOC File Scanner

# This script scans for specific file IOCs on a list of Windows hosts. # Note: RondoDox primarily targets Linux-based XWiki servers, but this can be adapted for second-stage payloads on Windows systems. $computers = "localhost", "SERVER01", "WKSTN01" $iocs = @( "C:\Windows\Temp\payload.exe", "C:\Users\Public\update.dll" ) foreach ($computer in $computers) { if (Test-Connection -ComputerName $computer -Count 1 -Quiet) { Write-Host "Scanning $computer..." -ForegroundColor Yellow foreach ($ioc in $iocs) { try { if (Test-Path -LiteralPath "\\$computer\$($ioc.Replace(':', '

STIX 2.1 Threat Intelligence Bundle

))" -ErrorAction Stop) { Write-Host "[ALERT] IOC Found on $computer: $ioc" -ForegroundColor Red } } catch { # Handle access denied or other errors Write-Warning "Could not access path on $computer: $ioc" } } } else { Write-Warning "Could not connect to $computer." } }

This rundown should provide a solid overview of the current threat landscape. Thank you to all our cyberheroes for your diligence and hard work. Stay vigilant!