Latest / Daily DefSec Brief / Cyber Security News for September 25 2026 - Daily DefSec Brief
Transcript
- Jerry: Can you hear that? That's the sound of open AI hacking someone new with impunity. It'll no doubt be on my list to talk about in a few months. This is the daily Def Sec brief for Friday, September twenty-fifth, twenty twenty six. We made it to the weekend, everybody. One, a ransomware affiliate Microsoft called Storm2570 has been behind KULIN, Dragon Force, Anubis, and BERT attacks. And whatever encrypted the network at the end, the work before it looked the same. It installed several remote access tools, renamed MeshAgent to look like the victim's own software, copied the Active Directory database, added Defender exclusions, and used S5 CMD and R clone to copy data out to attacker controlled cloud storage. That's the part you can catch before any payload runs. So go hunt for remote access tools you didn't deploy. Two, SolarWinds observability self-hosted has two flaws in it that let an attacker run code on it without logging in. One needs a configuration SolarWinds calls non-default and insecure, and the other needs a specific communications mode. Upgrade it, the fix shipped on Tuesday. Three, a botnet called Carbonado is taking over Docker hosts whose API answers on port 2375 with no authentication. It starts with a privileged container. To reach a host, plants its own SSH key, and installs an AI agent framework called Hermes that takes orders over Telegram and collects AI API keys and SSH credentials it finds. Take the Docker API off the network. By the way, researchers found this operation in the Docker registry it used for updates, which had no authentication either. four. The domain thirdparty.com has been a stand in address in developer docs, tuscode, and AI agent skills for years. The way example.com is, except it was never reserved. Somebody got a hold of it, and since at least June it's shown Windows visitors a fake Cloudflare check that puts a PowerShell command in the clipboard and asks them to run it. It's referenced in more than 1700 public repositories, so search yours for thirdparty.com and swap in example.com instead. Five, the operators behind Maxync, a MacSDaler, now keep its next set of commands in the description of a public iCloud calendar event. The malware feeds the calendar event straight into the shell, which runs the commands hidden in its description. It goes after browser passwords and cookies, the keychain and SSH, AWS, Kubernetes, and Git configs. It persists through launch agents and global git hooks, so hunt your Macs for new ones. Six, anyone on the same network as a ViewSonic Viewboard smartboard can grab a picture of whatever on the screen, install an app from a link they choose, and chain that into running code, all without logging in. Search CC couldn't reach ViewSonic, so there's no fix yet. Put your viewboards on their own network segment. seven. Australia's Prime Minister says an open AI research agent got into the Services Australia Medicare statistics portal in June and read files that weren't public. In a separate case, AI agents that Cloudflare blocked on the health agency's website fetch the same file from the agency's pre production server instead. I think the second one is a the more useful half of the story for most of us. Give your pre-production web servers the same controls as production. Eight. Someone has been offering desktop apps for three big US payroll platforms that don't make desktop apps. The installer quietly sets up Screen Connect for unintended access with its banner and tray icon switched off. And the only thing a person running payroll sees is a genuine Microsoft.net installer finishing normally. The download pages sat behind the hosting site's bot check, so automated scanners never saw them. Allow only your own screen connect servers and block the rest. If you do only one thing today, hunt for and set up alerts for remote access tools that you didn't deploy. Thanks for watching. Sources are in the show notes. Like, subscribe and share the show with a friend. I'm Jerry Bell and the daily DeathSec Brief will be back on Monday.