This Week In Cybersecurity #20

Supply chain trust, identity abuse, and OT resilience—all on the front line this week

Sep 19, 2025

This week’s shows surfaced a clear pattern: attackers are skipping “big bang” zero-days in favor of abusing trust—OAuth tokens, developer tools, support tickets, and cloud integrations—while boot-level ransomware and factory-floor exploits raise the stakes for OT and national economies.

Below is a category-driven catch-up with extra context for every story so you can see who’s hit, how, why it matters, and where to act first.

Samsung zero-day exploited in the wild
Live exploitation was confirmed after Meta/WhatsApp flagged suspicious activity in August; telemetry and victimology look consistent with spyware operators. Like Apple’s recent Image/Media parsing bugs, this likely requires only a malicious message or file on at-risk Galaxy devices. Enterprises with mixed Android fleets should fast-track MDM enforcement and verify carrier-delivered firmware timelines. Consider temporarily tightening Play Protect and disabling sideloading on high-risk roles.
“If your detection window is days instead of hours, you’re flying blind.” James Azar

Apple patches 50+ iOS/macOS flaws (11 exploited)
The fixes span WebKit, Bluetooth, sandboxing, and AMFI—exactly the surfaces mercenary spyware targets for 0-click or 1-click chains. VDI/kiosk devices and “lab” Macs often lag auto-updates—treat those as priority change windows. Pair the update with a review of MDM restrictions (managed pasteboard, iMessage previews, AirDrop) for executives and diplomats.

Bootkits & Platform Risk

HybridPetya bypasses UEFI Secure Boot (CVE-2024-7344)
ESET’s research shows boot-chain tampering via a Microsoft-signed component, planting code in the EFI partition. Secure Boot on paper isn’t the same as a hardened boot chain in practice—confirm revocation DB updates, firmware policy baselines, and recovery media integrity. Ask EDR/MDR providers to prove visibility into EFI writes and bootloader drift, not just kernel/userland telemetry.

OT/Manufacturing & Critical Infrastructure

Dassault Delmia Apriso RCE (CVE-2025-5086) added to CISA KEV
Delmia Apriso underpins warehousing/production workflows across aerospace, auto, and defense; a deserialization RCE here means attackers can hop from “office IT” to operational logic. Patch by the KEV date (Oct 2 for US agencies) and stage a rollback plan—many factories must schedule downtime. If patch windows are tight, isolate Apriso hosts, restrict deserialization endpoints, and enable command-line auditing to catch hands-on-keyboard activity.
Jaguar Land Rover ransomware—economic knock-on effects
Multi-week outages across the UK/China/India/Slovakia highlight IT/OT coupling: when ERP and MES share tissue, an IT incident becomes a plant shutdown. Tier-2/3 suppliers face 10-day cash cliffs when OEMs stop buying—turn cyber into a supply-chain risk discussion with procurement and finance. Table-top an “island mode” plan to run limited production on clean enclaves while business systems rebuild.
“This isn’t just another ransomware story—it’s an economic security incident for the UK.” James Azar

SaaS, Supply-Chain & Dev Ecosystems

FBI flash: Salesforce data theft at scale (UNC6040/UNC6395)
Threat actors deploy rogue OAuth apps (e.g., “My Ticket Portal”) to exfiltrate accounts/contacts/opportunities and support attachments (a frequent home for secrets and keys). Token sprawl is the real issue—many orgs don’t inventory connected apps or rotate their secrets. Treat 3P SaaS apps like privileged accounts: least privilege scopes, periodic re-consent, and anomaly detection on bulk export APIs.
ShinyHunters’ “1.5B Salesforce records” claim
Even if inflated, the sensitive category is support case data: screenshots, logs, and pasted credentials routinely live there. Assume targeted phishing will follow using perfect-looking context from stolen tickets. Run a secrets hunt across past cases and rotate anything discoverable (API keys, SMTP creds, S3 tokens).
NPM campaign weaponizes TruffleHog for secrets theft

40 trojanized packages self-propagated via compromised maintainer accounts, then executed TruffleHog to rip GitHub/AWS/Snowflake secrets. SBOMs that update nightly will miss “same-day” poisonings—move to build-time SBOM and block new versions without review. Add egress guards from CI/CD runners and alarms on unusual npm post-install behavior.

Malicious VS Code/Open-VSX extensions drain wallets
24 extensions pushed Lumma Stealer, targeting devs with crypto tooling. Lock extension sources (private marketplace allowlists), disable auto-update for risky categories, and require publisher verification for anything touching terminals or browsers. Consider ephemeral dev workspaces to limit secret persistence.
ChatGPT calendar MCP PoC
Researchers showed how a crafted invite can inject a jailbreak into an assistant that’s wired to email/search/storage. Treat agent integrations (MCP, Actions, plugins) like new privileged apps: prompt-screening, output-filtering, and per-capability scoping with detailed audit logs.

Government & Public Sector

Vietnam credit bureau & Panama finance ministry breaches
Expect fraud waves (credit applications, tax scams) leveraging verified PII. Agencies often publish “we weren’t hit operationally,” but the data fuels months of downstream abuse—plan customer comms and monitoring now. Coordinate with national CERTs for takedown and sinkhole options.
Uvalde ISD ransomware halts classes
K-12 remains “target-rich, resource-poor.” If your district added Chromebooks, LMS, and VoIP, but not immutable backups and landline fallbacks, you’ve multiplied outage risk. Pre-stage offline lesson plans and carve-out a tiny, clean network for attendance/payroll continuity.

Nation-State & Espionage

APT41/Wicked Panda phishing with VS Code Remote Tunnel
Malware-light persistence via developer tooling evades AV; defenders must watch identity events (new tunnels, anomalous device registrations) and admin consent logs. Train help desk to challenge developer “emergency access” requests.
APT43 uses ChatGPT to forge military IDs
AI lowers the cost of believable lures; content quality is no longer a tell. Layer browser isolation and attachment sandboxing for policy staff and defense contractors.
Ukraine DDoS vs Russia’s election infra
A symbolic op with escalation risks; expect Russian counter-ops and narrative warfare. For multinationals in the region, revisit comms continuity and legal exposure.
China Great Firewall leak (500–600 GB) & 1-hour breach rule (draft)
The dump exposes censorship mechanics and export programs; analyze only in isolated VMs to avoid booby-trapped files. Beijing’s one-hour rule signals heavy inbound pressure and could foreshadow shorter global reporting clocks—practice IR + counsel + comms handoffs.
SEO poisoning (Ghost RAT) targeting Chinese speakers
Malvertising/SEO pages impersonate Telegram/Chrome/DeepL to deliver RATs with anti-analysis tricks. Block ad-driven downloads, prefer vendor-signed stores, and detonate installers in sandboxes.

Policy, Oversight & Enforcement

CISA doubles down on CVE program
The roadmap points to more funding and broader participation; expect pressure on vendors to supply machine-readable data and on operators to close patch cycles faster. Start aligning CMDB/SBOM fields with CVE/CVSS automation.
DHS IG: CISA retention incentives mismanaged ($138M)
Governance lapses undercut hiring/retention just as workload spikes; agencies should ring-fence cyber HR funds with real metrics and audits. For contractors, anticipate stricter reporting on staffing incentives.
NSC signals unapologetic offensive cyber
Expect more disruption ops against botnets, laundering rails, and RaaS affiliates—use takedown IOCs to purge residual footholds. Offensive pressure only works if enterprises fix basics: MFA, segmentation, backups.
“The status quo isn’t working. Cybercrime is a $6 trillion economy—and it’s bleeding us dry.” James Azar
CISA delays critical-infra reporting rule to May ’26
Industry bought time—use it to automate incident evidence collection so reporting doesn’t steal hours from response. Map “reportable” events to detections and pre-draft legal comms.
SonicWall config backups accessed via MySonicWall
Treat all stored configs as compromised—reset cloud tokens, rotate PSKs/certs, and re-harden management interfaces (IP allowlists, MFA). Monitor for rules/objects drift across fleets.
Breach Forums admin resentenced (PomPomPurin)
Law-enforcement pressure on data-broker hubs continues; expect copycats. Update playbooks for faster breach data validation and takedown requests.
AI security M&A: CrowdStrike + Pangea; Check Point + Lakera
Platforms are racing to absorb AI-security: expect roadmap consolidation and faster agentized detections—but also integration churn. Plan for overlapping capabilities and contract realignments.

Fast Action List

Patch priority: Samsung Android; Apple iOS/iPadOS/macOS; Delmia Apriso (CVE-2025-5086).
Identity & SaaS: Revoke/rotate Salesforce OAuth; least-privilege scopes; scan support tickets for secrets and rotate them.
Dev & CI/CD: Pin npm versions; build-time SBOM; block suspicious post-install; restrict VS Code/Open-VSX to approved publishers.
OT resilience: Segment IT/OT; pre-stage offline runbooks; test “island mode” production.
AI integrations: Treat MCP/agents as privileged apps with prompt filtering, DLP, and full audit.
Public sector & K-12: Immutable/offline backups, phishing-resistant MFA, and analog comms fallbacks.

Use the weekend to knock out the patches, rotate the OAuth tokens you’ve been avoiding, and walk your team through one OT-isolation drill. Map your trust graph—who (and which integrations) can touch what—and turn that into guardrails you can enforce Monday morning. As always…

Stay Cyber Safe.