Read Time: 8 minutes

Brought to you by:

Howdy friends!

Writing from the Texas Cyber Security Council annual conference where I got to moderate a panel today that was a fun one, we did a live incient response scenario on stage and have the audience throw tomatoes at us when we got things wrong. We did a good job being just dumb enough to spark lots of great discussions.

Hope you’re all having a better month now that we don’t have to be so cybersecurity aware as October. Back to blissful ignorance. So much so, we decided to go ahead and take Microsoft down for the day to give you all a break. You earned it.

🎤 Something I said: Massive Binance Hack, Freezers Hacked, Rogue AI Agents & the ARTEX Docker Warning and Mmore

🔖 Something I read: OpenAI’s new cyber products announcements

Rough week to be an MSP. Wednesday afternoon somebody got into multiple cloud-hosted ScreenConnect consoles and used the console's own run-command feature to push a second, attacker-controlled ScreenConnect client and a toolkit Huntress calls SCKit to every machine in reach. Huntress counted 288 endpoints across 48 orgs in 90 minutes, a third of them in the first ten. ConnectWise says it found no ScreenConnect vulnerability and no compromise of its own infrastructure, and it switched off five third-party extensions across about 400 partner environments as a precaution. The likely door is one of those, RMM+, where a couple of versions accepted a blank access key if the admin never set one. That skips ScreenConnect's accounts, roles and MFA entirely.

The kit sits on the infected box waiting for a technician to connect, then tries to hop onto that tech's workstation, steal their console session, and push itself to every endpoint the tech can reach. Huntress hasn't seen that hop work yet (every attempt in the logs they've recovered failed), but the code is there, and it looks LLM-written for what it's worth. What code isn’t now, eh? This is the second worm-flavored rogue ScreenConnect campaign Huntress has chased since September. If you run ScreenConnect, triage suspect machines with EDR or another out-of-band tool, since connecting over ScreenConnect is exactly the trigger, and go read your run-command history even if nothing alerted. Some hosts reinfected the moment isolation was lifted, so clean before you reconnect. (read more here and here)

With the rise of AI pentesting, a lot of people are wondering if it’s as good as a human. A human can get tired and miss something. An agent won’t, but it could over-rank a finding because it can’t speak to the client and get more context.

Written by a pentester of 12 years who now builds Intruder's AI pentester, this comparison covers why it doesn't follow a strict methodology, how coverage really compares, and where each approach has the edge. (read more)

*Sponsored

And the other big RMM had it worse. Sunday, researcher Sean Bales dropped 33 N-central zero-days on GitHub with working proof-of-concept code, chained into unauthenticated RCE and root on the server. He told Infosecurity Magazine he never reported any of them to N-able. N-able pulled hosted N-central offline Monday, told on-prem customers to shut their servers down, and shipped a hotfix Tuesday covering seven CVEs that also turns off the built-in remote control for now. N-able says it saw scanning tied to the PoC but no confirmed customer compromise.

Then late Wednesday Bales published two more exploit sets that he says work against that patched build. Per Huntress's read of the code, one is unauthenticated root on the N-central server, and the other lets anyone who can reach the server run commands as SYSTEM on the Windows endpoints it manages. There's no fix. If you're on-prem, take it offline again or cut its internet access even if you patched, and know that IP allowlisting won't save you because agents check in on the same endpoints. Hosted customers, watch N-able's status page. This lands on top of August's "god-mode" bug and September's CVSS 10 exploited zero-day. N-able's CEO says publishing exploit code first hands attackers a head start, and Bales argues it forces vendors to fix things fast. Either way, MSPs are the ones running their business with the RMM unplugged this week. (read more here, here and here)

Since Tuesday, somebody has been logging into 4,837 real developers' GitHub accounts and using their write access to plant a CI secret stealer, per Aikido Security. They opened harmless-looking docs pull requests in 61,000+ repos to test access, and at least 1,806 actually ran the payload. They push the stealer straight to the default branch, let Actions run it, then revert within seconds and delete the run and its logs, so scanning your current code finds nothing. It grabs every repo secret, cloud creds, registry tokens and AI provider keys, then tries to turn CI identity into longer-lived cloud access. The testing framework webdriverio got hit, through its bot account. Interesting to read the GitHub issues handling it.

The hijacked accounts overlap with October's GhostAction wave, so a lot of those tokens apparently never got revoked, and one victim says a leaked GitHub CLI token was the way in. At least 50 of the accounts publish packages to npm, PyPI, Go, Packagist or crates, which is the follow-on wave to worry about. If any of the probe PRs show up in your org from Nov 10 on, treat that account as owned. If the payload ran, rotate everything that workflow could touch and then hunt for new cloud access keys and tampered trust relationships, because the stealer plants persistence that survives rotation. (read more here and here)

Is “SELECT * FROM users” in an agent prompt an attack? In a support chatbot it probably is, but in a coding agent it's usually the job. Arcjet trained separate prompt injection models for each case. Himalia 1 handles strict detection for general use and is free to try now, while Thebe 1 for coding agents and Carme 1 for autonomous security agents are in early access. (read more)

*Sponsored

Barracuda patched two ESG bugs on Nov 2, and three days later watchTowr showed how they can chain an auth bypass lets you restore a crafted config backup without logging in, and a timezone value inside that backup later runs as root. By Monday Barracuda confirmed exploitation against a small number of customers, and CISA added both to KEV with a Nov 13 federal deadline.

The precondition is reaching the admin interface, and Barracuda had to correct its own advisory mid-week on whether a login was required (it isn't). If yours faces the internet, patch today and look for signs someone beat you to it, since a patch won't evict anyone who already has root. This is the same appliance line Barracuda told customers to rip out and replace in 2023 after a China-nexus crew owned them, so it has earned the extra paranoia. (read more here and here)

France formally pinned last month's supermarket fridge sabotage on Iran's IRGC this week, which surprised me. I had guessed either young threat actor flexing on a discord, or Russia. On the night of Oct 11-12, attackers got into the remote management software for refrigeration controllers at roughly 700 French stores and cranked them to 50°C (122°F) overnight, which meant spoiled food everywhere and at least 15 fires. Paris prosecutors named the IRGC-linked cyber unit Shahid Kaveh, pointing to Farsi and Iranian IP addresses in the evidence, and asked for international arrest warrants for its leader and two deputies.

A few days earlier CISA, FBI, HHS, USDA and DOT put out a joint fact sheet saying the targeting is global and telling operators to get refrigeration controllers off the public internet. If you have anything in the cold chain (grocery, food distribution, pharma, blood storage), these controllers are OT that nobody inventories as OT. (read more here and here)

Krebs is back at it, and he’s after Qilin, the busiest ransomware affiliate program going, with at least 365 claimed victims in the last three months. Brian followed its admin "Haise" back through a decade of sloppy opsec. A 2022 application to the RAMP forum (which the FBI seized in January) referenced an older Telegram handle. That handle traced to a 2020 forum persona, that persona registered with a mail.ru address, and that address shows up in last year's breach of Russia's own government services portal. End of the chain: a 36-year-old named Aleksey Yakovtsev in St. Petersburg.

This is an attribution with no charges attached, and he didn't answer Krebs's calls or emails. He's in Russia, so don't expect an arrest, but getting named has a way of making affiliates nervous and vacation plans smaller. Flight records say he mostly bounces between St. Petersburg and Sochi anyway. (read more)

Malbear Labs stumbled on an open directory holding an attacker's entire workspace: 70+ session transcripts of a jailbroken DeepSeek agent spending more than two weeks inside an unnamed European telecom and 13 organizations hosted in its data centers and cloud. The operator mostly typed short nudges in Chinese like "go on," and the agent picked the targets, picked the bugs, and wrote its own replacement tunneling tools when the first ones got blocked. They’re just like me for real. The vuln that got them in was a Cisco BroadWorks flaw patched back in August, which CISA added to KEV this week.

Important! Every vuln it used was old and boring, including default creds on an ancient Oracle database behind a hospital records system, which is how Malbear says it reached millions of patient records (nobody else has verified that number). The agent was loud too, with lots of fast scanning and failed logins. The fixes are the same boring list they've always been. (read more)

Railway's October breach now has a lot more info out. The attacker broke out of Railway's build isolation, moved through internal systems, and decrypted environment variables for up to about 100,000 workspaces, and the queries they ran were specifically hunting AI provider keys. Railway now estimates those stolen keys ran up roughly $740K in unauthorized AI usage, and thinks they got resold to people doing model distillation.

Railway first told customers it couldn't refund spend on compromised keys, and has since said it will cover what the AI providers won't, per The Hacker News. Same theme as the GitHub stealer above: AI keys are now worth breaching a whole platform for, and most people find out they needed a spend alert when the bill shows up. Rotate anything you had stored on Railway before Oct 22, and put hard spend caps on your AI provider accounts while you're in there. (read more here and here)

Every app you publish from Grok's Build mode gets its own grok.me subdomain, and subdomains end up in passive DNS. Claroc pulled the list, and of 37,571 live apps, 35,578 (94.7%) opened for anyone with no sign-in. Most were games and calculators, but they estimate 650 to 800 held private data, like an ICU patient's briefing, a hospital roster of 3,500+ staff, and a timesheet app with every employee's plaintext password sitting in its JavaScript. 24 of the open apps were built by SpaceXSI and X staff themselves, including a confidential new-hire onboarding plan and a sales territory map of 594 accounts. (read more)

Another four-digit Patch Tuesday. Microsoft fixed nearly 1,100 CVEs, 63 of them critical, which puts it past 5,100 patches this year when a year ago it averaged around 100 a month. You won’t believe what Microsoft credits for the jump…

Exactly one (1) is known exploited… an Outlook bug where opening a crafted message file leaks your NTLMv2 hash, which an attacker can then use to impersonate you. That fix ships through Office updates, so make sure that channel actually moved.

The more useful numbers came from Ivanti's Chris Goettl in Krebs's writeup: of roughly 95,000 CVEs across all vendors this year, 217 have landed in KEV, and 44% of the exploited ones sit in edge devices and IT management or remote access tools. So, the stuff at the top of this newsletter. Keep Windows on its normal cadence and spend your urgency on the boxes that face the internet and hold the keys to everything else. (read more here and here)

Fortinet's November drop came with eight critical advisories across FortiOS, FortiManager, FortiAnalyzer and FortiSASE, several of them unauthenticated code execution on the management side, and none marked exploited at publication. The one I'd move first is a FortiClient bug where visiting a malicious webpage can get code running on the endpoint (coverage says it needs FortiPAM features enabled, so check whether that's you). A year ago this week we were all dealing with FortiWeb's silently patched zero-day, so I wouldn't wait for the exploited tag on the management-plane ones either. (read more)

Chrome's sixth zero-day of the year is a use-after-free in its XML handling that a malicious page can use to run code inside the sandbox. It's exploited in the wild and now in CISA KEV. Google shipped the fix in Chrome 157 on Nov 9, Edge and the other Chromium browsers need their own updates, and the fix only lands once you restart the browser, so go close those 140 tabs. (read more)

Community was foundational in launching and propelling my career. Community is the only reason I can stand being in Texas during the summer months. Community is the point. Today, I invite you to embrace discomfort on the road to a more vulnerable you.

Stay safe, Matt Johansen
@mattjay