Cipherceval: So here's a fun question for you.
Cipherceval: What do you call a security
Cipherceval: appliance that's supposed to
Cipherceval: protect your entire firewall
Cipherceval: infrastructure, but can be taken
Cipherceval: over by an unauthenticated
Cipherceval: attacker with a single HTTP
Cipherceval: request?
Cipherceval: Because this week, Cisco
Cipherceval: disclosed not one, but two Cvss
Cipherceval: ten point zero vulnerabilities
Cipherceval: in their Secure Firewall
Cipherceval: management center.
Cipherceval: And when that thing that manages
Cipherceval: all of your firewalls is the
Cipherceval: thing that's vulnerable, I don't
Cipherceval: know.
Cipherceval: Red alerts start going off in my head, but that's just a start.
Cipherceval: We've also got a nation state group mass producing AI
Cipherceval: generated malware so fast, the researchers are calling it a
Cipherceval: distributed denial of detection.
Cipherceval: Google just dropped the largest Android security update in
Cipherceval: almost eight years one hundred and twenty nine vulnerabilities,
Cipherceval: including a zero day that CISA has already flagged.
Cipherceval: Chinese state linked hackers are burrowing into South American
Cipherceval: telecom infrastructure with three brand new malware
Cipherceval: families, and LexisNexis, a company that called itself one
Cipherceval: of the largest protectors of private data in the world.
Cipherceval: Uh, well, they got breached
Cipherceval: because their password was
Cipherceval: Lexis1234.
Cipherceval: Yeah, we got a lot to talk about.
Cipherceval: But hey, welcome back to Exploit brokers by Forgebound Research.
Cipherceval: I'm your host, Cipherceval, this is HN episode sixty five.
Cipherceval: As always, I'm sharing information and awareness here.
Cipherceval: Talk to your own security team
Cipherceval: for anything specific to your
Cipherceval: environment.
Cipherceval: If this is your first time here, consider subscribing.
Cipherceval: I know that a lot of my audience who watches isn't subscribed.
Cipherceval: Do me a favor guys.
Cipherceval: If you're on YouTube.
Cipherceval: Now, if you're listening on a
Cipherceval: podcast platform, leave a
Cipherceval: review.
Cipherceval: It genuinely helps other people find the show.
Cipherceval: And again, if you're watching on YouTube, please also smash that
Cipherceval: like button and hit the bell icon because we've got five
Cipherceval: stores today and every single one of them matters.
Cipherceval: Let's get into it.
Cipherceval: All right.
Cipherceval: We're starting with something that should be on every network
Cipherceval: team's radar right now.
Cipherceval: On March fourth, Cisco published a security advisory bundle
Cipherceval: covering forty eight vulnerabilities in their
Cipherceval: firewall product line.
Cipherceval: But two of them are still sitting at the very top of the
Cipherceval: severity scale, and they're the ones we need to talk about.
Cipherceval: The first one is CVE-2026-20079,
Cipherceval: and it's an authentication
Cipherceval: bypass.
Cipherceval: To give some context, the Cisco
Cipherceval: Secure Firewall Management
Cipherceval: Center, or FMC, is the
Cipherceval: centralized control plane that
Cipherceval: manages your entire fleet of
Cipherceval: Cisco firewalls.
Cipherceval: Think of it as the brain.
Cipherceval: It pushes policies, monitors traffic, controls your firewall
Cipherceval: threat, defensive devices.
Cipherceval: Everything runs through the FMC.
Cipherceval: This vulnerability exists because of an improperly
Cipherceval: initialized system process that gets created at boot time.
Cipherceval: An attacker and this is a scary part.
Cipherceval: An unauthenticated attacker, no credentials needed, can send
Cipherceval: specially crafted HTTP requests to the FMC web interface and
Cipherceval: bypass authentication entirely.
Cipherceval: From there, they can execute
Cipherceval: scripts and commands with root
Cipherceval: level access to the underlying
Cipherceval: operating system.
Cipherceval: That's the golden goose of hacking right there.
Cipherceval: Unauthenticated remote root access to the device that
Cipherceval: manages all of your firewalls.
Cipherceval: Now,
Cipherceval: the second one is CVE-2026-20131, and it's a
Cipherceval: completely separate issue.
Cipherceval: This one is a remote code execution vulnerability caused
Cipherceval: by an insecure deserialization of Java byte streams in the
Cipherceval: FMC's web management interface.
Cipherceval: An attacker sends a crafted
Cipherceval: serialized Java object and the
Cipherceval: system processes it without
Cipherceval: proper validation.
Cipherceval: That gives them arbitrary code
Cipherceval: execution, again with root
Cipherceval: privileges.
Cipherceval: Now, both of these carry a CVSS score of 10.0 out of 10 .
Cipherceval: Both are rated with a scope of
Cipherceval: "Changed", which in cvss terms
Cipherceval: means that exploiting the FMC
Cipherceval: can compromise other components
Cipherceval: under its management, meaning
Cipherceval: your actual firewall devices in
Cipherceval: this case.
Cipherceval: And here's the kicker no workarounds patch.
Cipherceval: Only Cisco has released fixed
Cipherceval: versions, and that's the only
Cipherceval: path forward.
Cipherceval: Now I want to connect this to
Cipherceval: something we talked about last
Cipherceval: episode.
Cipherceval: We covered the Cisco SD-WAN
Cipherceval: vulnerability, CVE-2026-20127,
Cipherceval: where the Five Eyes intelligence
Cipherceval: agencies revealed that an APT -
Cipherceval: A.P.T. - had been exploiting it
Cipherceval: since 2023 for years, quietly on
Cipherceval: network infrastructure that
Cipherceval: doesn't have traditional EDR
Cipherceval: coverage.
Cipherceval: And that's the pattern worth paying attention to.
Cipherceval: Cisco found these new FMC vulnerabilities internally
Cipherceval: during security testing.
Cipherceval: They say there's no evidence of in the wild exploitation yet.
Cipherceval: But as the stack pointed out, we happen to know that Cisco zero
Cipherceval: days get quietly exploited for years before anyone notices.
Cipherceval: The researcher behind CVE-2026-20079, Brandon Sakai,
Cipherceval: was also behind a similar FMC flaw discovered last August.
Cipherceval: These appliances are living on
Cipherceval: the edge, literally and
Cipherceval: figuratively.
Cipherceval: If your organization is running Cisco secure FMC on premises.
Cipherceval: This is the kind of thing worth
Cipherceval: escalating today, not next
Cipherceval: sprint.
Cipherceval: Update your stuff.
Cipherceval: A patch does you no good if it's not installed.
Cipherceval: All right.
Cipherceval: Staying on the nation state theme for a moment, because this
Cipherceval: next story is honestly, it's one of the stranger things that I've
Cipherceval: covered on this show.
Cipherceval: Bitdefender published research on March 5th documenting a
Cipherceval: campaign by APT36.
Cipherceval: That's the Pakistan linked group, also known as Transparent
Cipherceval: Tribe, and they've basically turned AI coding tools into a
Cipherceval: malware assembly line.
Cipherceval: Bitdefender is calling the
Cipherceval: output "vibeware" and the
Cipherceval: strategy behind it is
Cipherceval: "Distributed Denial of Detection."
Cipherceval: Let
Cipherceval: me break that down to give context. Vibe
Cipherceval: coding is that trend where people use large language models like
Cipherceval: Klod, and they use that to write code by describing what they
Cipherceval: want in natural language. Basically
Cipherceval: vibing with an AI to produce software, APT36 has taken
Cipherceval: that concept and applied it to malware and at scale. What
Cipherceval: they're doing is using AI tools
Cipherceval: to rapidly generate malware
Cipherceval: variants across multiple programming
Cipherceval: languages, not just Python
Cipherceval: or C. We're talking niche languages
Cipherceval: like Nim, Zig, and Crystal
Cipherceval: alongside Rust, Go and .NET.
Cipherceval: And
Cipherceval: the reason they're doing this is clever. Most
Cipherceval: EDR products and antivirus engines have weaker behavioral models
Cipherceval: and signature coverages for less common runtimes. By
Cipherceval: porting the same malicious logic
Cipherceval: across multiple languages, they're
Cipherceval: essentially resetting the
Cipherceval: detection baseline every time.
Cipherceval: Now,
Cipherceval: here's the part that makes it genuinely weird. The
Cipherceval: malware is bad. Like
Cipherceval: objectively bad. Bitdefender
Cipherceval: found samples where a credential stealer had a placeholder
Cipherceval: instead of an actual command and control server address,
Cipherceval: meaning it could never exfiltrate any data. Another
Cipherceval: tool had a status reporting function that reset its
Cipherceval: own timestamp every time it ran, so the infected host always appeared
Cipherceval: online, regardless of its actual state. These
Cipherceval: kind of bugs are pretty common when you're doing things that
Cipherceval: are syntactically correct but logically unfinished. That
Cipherceval: is AI output. But
Cipherceval: here's the thing, and this is
Cipherceval: what Bitdefender is warning about.
Cipherceval: The
Cipherceval: strategy isn't about quality, it's about volume. APT36
Cipherceval: is producing new malware variants daily. They're
Cipherceval: flooding target environments
Cipherceval: with disposable polyglot
Cipherceval: binaries. And
Cipherceval: the idea is that even if ninety percent of them get caught,
Cipherceval: the remaining ten percent only need to work once. Distributed
Cipherceval: denial of detection overwhelm the defenders not with sophistication,
Cipherceval: but with noise. And
Cipherceval: some of it does work.
Cipherceval: Bitdefender identified a tool
Cipherceval: called LuminousCookies that
Cipherceval: successfully bypassed app bound
Cipherceval: encryption to steal browser
Cipherceval: stored credentials from Chrome
Cipherceval: and Edge.
Cipherceval: It does this by injecting itself
Cipherceval: into the browser's own process
Cipherceval: memory, pretending to be a
Cipherceval: legitimate component to get the
Cipherceval: decryption keys.
Cipherceval: That's not trivial.
Cipherceval: The targets here are Indian
Cipherceval: government networks and
Cipherceval: diplomatic missions, and the
Cipherceval: campaign uses trusted cloud
Cipherceval: platforms for command and
Cipherceval: control.
Cipherceval: Google sheets, slack.
Cipherceval: Discord, Supabase.
Cipherceval: What the security community calls living off trusted
Cipherceval: services, or LOTS that C2 traffic blends right in with
Cipherceval: legitimate API requests.
Cipherceval: Now, if you've been following the show, you know we've been
Cipherceval: tracking this AI-in-offense trend across multiple episodes.
Cipherceval: HN63, covered the Fortigate
Cipherceval: campaign using AI for attack
Cipherceval: planning.
Cipherceval: HN64 covered multiple instances of AI enhanced attacks and
Cipherceval: malware using AI.
Cipherceval: And now we're seeing APT36 take it to the production line.
Cipherceval: The pattern is clear AI isn't making attackers smarter per se,
Cipherceval: it's making them faster and harder to keep up with.
Cipherceval: So let's shift gears into something that affects basically
Cipherceval: everyone watching this.
Cipherceval: On March third, Google released
Cipherceval: its March 2026 Android security
Cipherceval: bulletin, and this one is a
Cipherceval: monster.
Cipherceval: 129 vulnerabilities patched in a single month.
Cipherceval: This is the highest number since
Cipherceval: April 2018, almost eight years
Cipherceval: ago.
Cipherceval: That's not normal.
Cipherceval: The headline vulnerability is
Cipherceval: CVE-2026-21385, a memory
Cipherceval: corruption flaw in an open
Cipherceval: source Qualcomm display driver
Cipherceval: component.
Cipherceval: It's caused by an integer overflow.
Cipherceval: When adding user supplied data
Cipherceval: without checking available
Cipherceval: buffer space.
Cipherceval: And here's what matters it affects 234 Qualcomm chipsets.
Cipherceval: That's not a typo.
Cipherceval: 234 different system on chip
Cipherceval: models from budget devices to
Cipherceval: flagships.
Cipherceval: Google's Threat analysis group discovered this vulnerability
Cipherceval: and reported it to Qualcomm on December 18th, 2025.
Cipherceval: Qualcomm notified device manufacturers on February 2nd,
Cipherceval: 2026, and Google's bulletin says there are indications that
Cipherceval: CVE-2026-21385 may be under limited targeted exploitation.
Cipherceval: That language limited targeted
Cipherceval: exploitation is the phrase that
Cipherceval: shows up when we're talking
Cipherceval: about commercial spyware
Cipherceval: vendors, the kind of companies
Cipherceval: that sell surveillance tools to
Cipherceval: governments and those
Cipherceval: governments use them against
Cipherceval: journalists, activists,
Cipherceval: political opponents.
Cipherceval: We've seen this pattern before with NSO groups Pegasus , Intellexa’s
Cipherceval: Predator and others. When
Cipherceval: Google's tag, the threat analysis group, discovers a flaw,
Cipherceval: it's already been exploited in a targeted fashion. It's
Cipherceval: almost always that ecosystem.
Cipherceval: CISA added this to its known Exploited Vulnerabilities
Cipherceval: catalog on March third, giving federal agencies a deadline of
Cipherceval: March twenty fourth to patch.
Cipherceval: Qualcomm declined to say when the earliest known exploitation
Cipherceval: occurred or how many people were affected, which tells you
Cipherceval: something about the sensitivity here beyond the zero day.
Cipherceval: The March update also patches a
Cipherceval: critical system component
Cipherceval: vulnerability.
Cipherceval: CVE-2026-0006 scored at a whopping 9.8 .
Cipherceval: That allows remote code execution without any privileges
Cipherceval: or user interaction.
Cipherceval: Let me say that again remote
Cipherceval: code execution, no privileges
Cipherceval: required.
Cipherceval: No user interaction.
Cipherceval: That's as bad as it gets for mobile operating system.
Cipherceval: That's as bad as it gets for any
Cipherceval: kind of operating system or
Cipherceval: software.
Cipherceval: Now the update is split across two patch levels.
Cipherceval: 2026-03-01 covers 63
Cipherceval: vulnerabilities in the
Cipherceval: framework, system and Google
Cipherceval: Play components.
Cipherceval: 2026-03-05 adds another 66,
Cipherceval: hitting the kernel, Qualcomm,
Cipherceval: ARM, and other hardware level
Cipherceval: components.
Cipherceval: And here's the Android's ecosystem.
Cipherceval: Perennial problem Google releases the patches, but device
Cipherceval: manufacturers control when you actually get them.
Cipherceval: If you're on a pixel, you're probably patched.
Cipherceval: If you're on anything else, it might be weeks or months.
Cipherceval: If you're running an Android device with a Qualcomm chipset,
Cipherceval: which is the vast majority of Android phones out there.
Cipherceval: It's worth checking your patch level, update your stuff,
Cipherceval: especially on your mobile, where the fragmentation problem means
Cipherceval: you can't always assume it's been done for you.
Cipherceval: All right.
Cipherceval: Moving on.
Cipherceval: This next story ties into a
Cipherceval: theme that we've been covering
Cipherceval: for months now the relentless
Cipherceval: targeting of telecommunications
Cipherceval: infrastructure by state
Cipherceval: sponsored actors.
Cipherceval: On March six, Cisco Talos published research on a threat
Cipherceval: cluster they're calling UAT-9244, and the picture they
Cipherceval: paint is deeply concerning.
Cipherceval: To give some context, UAT-9244,
Cipherceval: is a China linked Advanced
Cipherceval: Persistent Threat Group, an apt
Cipherceval: group that has been targeting
Cipherceval: telecom providers in South
Cipherceval: America since at least twenty
Cipherceval: twenty four.
Cipherceval: Talos assesses with high confidence that this cluster is
Cipherceval: closely associated with FamousSparrow and Tropic
Cipherceval: Trooper, both well documented China Nexus, Apt, Apt, or
Cipherceval: advanced persistent threat groups with histories of
Cipherceval: targeting government, telecom and critical infrastructure.
Cipherceval: Now the obvious question is this salt typhoon?
Cipherceval: For those of you who haven't
Cipherceval: followed the Salt Typhoon saga,
Cipherceval: that's the Chinese state
Cipherceval: sponsored group responsible for
Cipherceval: breaching at least nine US
Cipherceval: telecom companies, compromising
Cipherceval: wiretap systems, and more
Cipherceval: recently, being linked to over
Cipherceval: two hundred companies across
Cipherceval: eighty countries.
Cipherceval: Salt Typhoon has been the dominant telecom threat story
Cipherceval: for over a year.
Cipherceval: Now, Talos explicitly addresses this, and their answer is
Cipherceval: careful: while UAT-9244 and Salt Typhoon share the same target
Cipherceval: profile, they could not establish a solid connection
Cipherceval: between the two clusters.
Cipherceval: That's responsible attribution,
Cipherceval: acknowledging the overlap while
Cipherceval: being honest about the limits of
Cipherceval: their evidence.
Cipherceval: What makes this campaign
Cipherceval: interesting, technically, is the
Cipherceval: tool set UAT-9244 is using three
Cipherceval: previously undocumented malware
Cipherceval: families that cover the full
Cipherceval: spectrum of an enterprise
Cipherceval: environment.
Cipherceval: First - TernDoor - a windows back door.
Cipherceval: It's a variant of CrowDoor, which itself is a variant of
Cipherceval: SparrowDoor from FamousSparrow.
Cipherceval: That lineage is clear.
Cipherceval: It uses DLL side loading through
Cipherceval: a legitimate executable, loading
Cipherceval: a malicious DLL that decrypts
Cipherceval: and executes the final payload
Cipherceval: in memory.
Cipherceval: Classic.
Cipherceval: Now it's been refined over multiple iterations, though.
Cipherceval: Next or second, we see - PeerTime - a Linux backdoor that
Cipherceval: communicates using a BitTorrent based peer to peer protocol.
Cipherceval: This is significant because peer to peer C2 makes it much harder
Cipherceval: for defenders to block or track.
Cipherceval: It's compiled for multiple architectures, including ARM , AARCH,
Cipherceval: PowerPC and MIPs, which tells you it's designed to run on
Cipherceval: embedded systems and network appliances, routers, switches, edge
Cipherceval: devices, things that don't have EDR agents. Next
Cipherceval: or third - BruteEntry - a Golang based brute force scanner that
Cipherceval: turns compromised Linux systems and edge devices into what's
Cipherceval: called operational relay boxes or orbs. These
Cipherceval: scan and brute force Tomcat,
Cipherceval: Postgres, and SSH servers
Cipherceval: expanded the attack surface
Cipherceval: from within the target's own
Cipherceval: network. Basically,
Cipherceval: they're turning compromised
Cipherceval: infrastructure into a
Cipherceval: launching pad for further attacks.
Cipherceval: They're
Cipherceval: pivoting laterally or and sometimes vertically. If
Cipherceval: they can get more access through
Cipherceval: some of those lateral attacks.
Cipherceval: Now,
Cipherceval: the combination of all three
Cipherceval: windows endpoints, Linux servers
Cipherceval: and edge devices all simultaneously
Cipherceval: compromised is what
Cipherceval: makes this particularly dangerous
Cipherceval: for telecom environments.
Cipherceval: These companies run massive mixed networks.
Cipherceval: If an attacker has footholds on
Cipherceval: every layer, detection and
Cipherceval: containment becomes
Cipherceval: exponentially harder.
Cipherceval: And this is the broader pattern that we keep seeing.
Cipherceval: Telecom companies are prime
Cipherceval: targets because of what they
Cipherceval: carry call records, metadata,
Cipherceval: and in some cases, the
Cipherceval: infrastructure used for lawful
Cipherceval: intercept, specifically
Cipherceval: wiretaps.
Cipherceval: Whoever controls the telecom
Cipherceval: backbone can potentially surveil
Cipherceval: an entire country's
Cipherceval: communications.
Cipherceval: All right.
Cipherceval: The last story.
Cipherceval: Let's close the story out with a story that.
Cipherceval: Well, honestly, this one made me shake my head.
Cipherceval: Not because of the sophistication of the attack.
Cipherceval: Quite the opposite.
Cipherceval: So on March third, a threat
Cipherceval: actor operating under the name
Cipherceval: FulcrumSec publicly claimed
Cipherceval: responsibility for breaching
Cipherceval: LexisNexis legal and
Cipherceval: professional.
Cipherceval: That's the legal, data and
Cipherceval: analytics division of RELX
Cipherceval: Group, one of the largest
Cipherceval: information companies in the
Cipherceval: world.
Cipherceval: LexisNexis provides research tools, legal databases, and risk
Cipherceval: management solutions used by law firms, government agencies and
Cipherceval: corporations across one hundred and fifty countries.
Cipherceval: According to FulcrumSec's disclosure, initial access was
Cipherceval: gained on February 24th by exploiting a React2Shell
Cipherceval: vulnerability in an unpatched react front end application.
Cipherceval: React2Shell, for those who are unfamiliar, is a known
Cipherceval: vulnerability class in react applications that can allow
Cipherceval: server side code execution through the front end.
Cipherceval: The attacker says this
Cipherceval: vulnerability has been sitting
Cipherceval: there unpatched for months
Cipherceval: despite knowing exploits being
Cipherceval: publicly available.
Cipherceval: But here's where it gets painful.
Cipherceval: Once inside, the attacker found
Cipherceval: that compromised ECS task
Cipherceval: containers.
Cipherceval: That's an Amazon Elastic
Cipherceval: Container Service role that had
Cipherceval: been granted read access to
Cipherceval: essentially everything.
Cipherceval: The production Redshift data
Cipherceval: warehouse, 17 VPC databases, AWS
Cipherceval: Secrets Manager and the
Cipherceval: company's Qualtrics survey
Cipherceval: platform.
Cipherceval: A single task role with keys to the Kingdom that is super level,
Cipherceval: super root level access.
Cipherceval: And that's kind of one of the principles that is usually
Cipherceval: supposed to be practiced.
Cipherceval: The least privilege idea.
Cipherceval: The RDS master password?
Cipherceval: Oh man.
Cipherceval: Lexis1234 I'm going to say that again.
Cipherceval: The master password for a
Cipherceval: database at one of the world's
Cipherceval: largest legal data companies was
Cipherceval: Lexis1234.
Cipherceval: Security by obscurity does not work.
Cipherceval: They might as well have not put a password at all, and neither
Cipherceval: does security by "I'll change the password later."
Cipherceval: That doesn't work either.
Cipherceval: The exfiltrated data reportedly
Cipherceval: includes 3.9 million database
Cipherceval: records across five hundred and
Cipherceval: thirty six redshift tables and
Cipherceval: four hundred and thirty plus VPC
Cipherceval: database tables.
Cipherceval: Around four hundred thousand
Cipherceval: cloud user profiles with names,
Cipherceval: emails, phone numbers, and job
Cipherceval: functions.
Cipherceval: Twenty one thousand enterprise
Cipherceval: customer accounts, law firms,
Cipherceval: universities, government
Cipherceval: agencies fifty three plaintext
Cipherceval: AWS Secrets Manager entries and
Cipherceval: one hundred and eighteen user
Cipherceval: accounts with dot gov email
Cipherceval: addresses belonging to federal
Cipherceval: judges, Department of Justice
Cipherceval: attorneys, SEC staff and federal
Cipherceval: court clerks.
Cipherceval: LexisNexis is used in a lot of places now.
Cipherceval: LexisNexis has confirmed the
Cipherceval: breach, but is characterizing
Cipherceval: the data as "mostly legacy deprecated data from prior to 2020."
Cipherceval: They say no Social Security
Cipherceval: numbers, active passwords or
Cipherceval: financial information was
Cipherceval: compromised.
Cipherceval: And look, maybe that's accurate.
Cipherceval: But as FulcrumSec, pointed out in their rather editorial
Cipherceval: disclosure, which definition of "customer data" excludes 400,000
Cipherceval: named individuals with email addresses and phone numbers?
Cipherceval: I'm pretty sure the definition includes that.
Cipherceval: Now, this is also not the first breach for LexisNexis.
Cipherceval: Last year, a separate incident
Cipherceval: through a compromised GitHub
Cipherceval: account exposed personal data
Cipherceval: belonging to over three hundred
Cipherceval: and sixty four thousand
Cipherceval: individuals, including Social
Cipherceval: Security numbers.
Cipherceval: Two breaches in two years for a company that positions itself as
Cipherceval: one of the largest protectors of private data in the world.
Cipherceval: The cover up is always worse
Cipherceval: than the crime, but in this
Cipherceval: case, the crime itself is pretty
Cipherceval: rough.
Cipherceval: All right, let's bring it home.
Cipherceval: Five stores this week and the through line connecting all of
Cipherceval: them is infrastructure trust.
Cipherceval: We trust our firewall management consoles, our mobile operating
Cipherceval: systems, our telecom backbones, our legal data providers.
Cipherceval: And this week, every single one
Cipherceval: of those trust boundaries got
Cipherceval: tested.
Cipherceval: Here are the five things to be
Cipherceval: aware of coming out of the
Cipherceval: episode.
Cipherceval: Number one, network security
Cipherceval: appliances are high value
Cipherceval: targets.
Cipherceval: The Cisco FMC vulnerabilities
Cipherceval: follow the same pattern as the
Cipherceval: SD Wan disclosure from the
Cipherceval: previous episode.
Cipherceval: If the management plane of your security infrastructure is
Cipherceval: compromised, well, everything downstream is at risk.
Cipherceval: Keeping management interfaces
Cipherceval: off untrusted networks and
Cipherceval: patching immediately.
Cipherceval: That's the baseline.
Cipherceval: Next number two, AI is changing
Cipherceval: the economics of malware, not
Cipherceval: the sophistication.
Cipherceval: APT36 Vibeware campaign shows
Cipherceval: that the real threat from AI
Cipherceval: assisted malware isn't
Cipherceval: brilliance.
Cipherceval: Its volume.
Cipherceval: Detection teams may need to
Cipherceval: rethink their approach to handle
Cipherceval: floods of low quality, polyglot
Cipherceval: variants, rather than a few high
Cipherceval: quality implants.
Cipherceval: Then. Number three, mobile
Cipherceval: patching remains the ecosystem's
Cipherceval: Achilles heel.
Cipherceval: One hundred and twenty nine
Cipherceval: vulnerabilities in one Android
Cipherceval: update, including an actively
Cipherceval: exploited Qualcomm zero day
Cipherceval: across two hundred and thirty
Cipherceval: four chipsets.
Cipherceval: Google can release patches, but manufacturers and carriers
Cipherceval: control the timeline.
Cipherceval: Check your patch level and keep devices updated.
Cipherceval: It's the simplest thing that makes the biggest difference.
Cipherceval: Then number four telecom targeting is not slowing down.
Cipherceval: UAT-9244 demonstrates that China aligned actors continue
Cipherceval: investing in multi-platform telecom compromise toolkits.
Cipherceval: Windows, Linux and edge devices simultaneously.
Cipherceval: Peer to peer, P2P command and control and orb based expansion
Cipherceval: makes these intrusions exceptionally difficult to
Cipherceval: detect and to contain.
Cipherceval: Lastly, number five, cloud security basics still matter
Cipherceval: more than anything.
Cipherceval: The LexisNexis breach wasn't
Cipherceval: caused by a zero day or an
Cipherceval: advanced attack.
Cipherceval: It was an unpatched application, an overly permissive IAM role,
Cipherceval: and a weak password.
Cipherceval: The fundamentals least privilege, patch management,
Cipherceval: credential hygiene remain the most impactful things any
Cipherceval: organization can do.
Cipherceval: And that's gonna do it for HN65.
Cipherceval: As always, I'm sharing information and awareness here,
Cipherceval: not specifically telling you what to do in your environment.
Cipherceval: Talk to your security team for your specific situation.
Cipherceval: However, if you found this
Cipherceval: episode useful, please share it
Cipherceval: with someone who needs to hear
Cipherceval: it.
Cipherceval: A colleague, a friend, your IT team.
Cipherceval: The more people who are aware of
Cipherceval: what's happening out there, the
Cipherceval: harder it becomes for bad
Cipherceval: actors.
Cipherceval: And that's really what this show is about.
Cipherceval: We're all in this together.
Cipherceval: If you're not already
Cipherceval: subscribed, hit that subscribe
Cipherceval: button on YouTube or follow us
Cipherceval: on your podcast platform of
Cipherceval: choice.
Cipherceval: Leave a review if you can.
Cipherceval: It genuinely helps.
Cipherceval: Stay vigilant, stay curious, and update your stuff.
Cipherceval: I'll catch you in the next one.