Weekly Intelligence Briefing: 12 March 2025

The Short Version (For Busy People)

Hello there! It's been another eventful week in the world of digital security. We've translated the usual techno-babble into something approaching plain English, so you can understand what's actually going on and what you need to do about it.

🇨🇳 State-Backed Hackers: They've Been Busy

Chinese government-supported hackers have been rather active lately:

Network equipment compromised: They've planted hidden backdoors in Juniper networking devices (the boxes that make your internet work)
Power grid access: One group maintained access to the US electric grid for nearly a year (quite persistent, aren't they?)
New hacker alliance: Security experts are warning about China, Russia, Iran, and North Korea potentially sharing hacking techniques (like an evil study group)
Legal action: 12 Chinese hackers were charged for breaking into the US Treasury (a bit late, but it's something)

🔧 Microsoft's Monthly Security Fixes: Extra Large Edition

Microsoft released their March security updates, and it's a big one:

Over 50 security issues fixed, including several that hackers are already using right now
Six actively exploited flaws (meaning hackers found them before fixes were available)
Seven publicly known but not yet exploited flaws (essentially a countdown to exploitation)
Serious issues in Remote Desktop (that thing you use to access work computers from home)
Problems with how Windows handles files that could let attackers run whatever code they want

🏭 Infrastructure & Business Systems at Risk

Some concerning developments for critical systems:

Industrial control software flaws: Vulnerabilities in ICONICS Suite, which controls industrial equipment
City declares emergency: Mission, Texas declared an emergency after a cyber incident threatened to expose sensitive personal information
VMware under attack: Increased scanning activity targeting VMware's cloud connection tools
Machines outnumber humans: Computer identities now outnumber human users by 7-to-1, creating major security headaches (the machines aren't taking over yet, but they are multiplying)

What You Actually Need to Do

🚨 Do These Today (Really, Today)

Update Windows immediately - Install Microsoft's March updates to fix serious security holes
Check your network equipment - Particularly Juniper devices, as they're being targeted
Update Zoom - Yes, your video calls could be compromised without updates
Check any WordPress websites - Multiple backdoors are spreading across thousands of sites

⚠️ Do These This Week

Review VMware systems - If you're using VMware's cloud tools, they need extra attention
Update industrial control systems - If you use ICONICS software, patch it now
Audit your digital identities - Especially automated accounts and system identities
Consider anti-surveillance tools - The new open-source Rayhunter tool helps detect unwanted mobile surveillance

🔔 Get These on Your Calendar

Review file security - Especially for systems containing sensitive data
Check web server security - Look for suspicious activity in your website logs
Assess password manager security - In light of recent password manager breaches
Update fraud prevention - Investment scams alone cost businesses $5.7B last year

What's Actually Happening Out There

Government-Backed Hackers

They're getting more coordinated and persistent:
- Chinese hackers maintained access to the US electric grid for 300 days
- Security agencies warn about countries sharing hacking techniques
- Sophisticated backdoor deployments targeting essential infrastructure

The Cost of Cybercrime

The financial impact continues to grow:
- Total fraud losses reached $12.5 billion in 2024
- Investment scams accounted for $5.7 billion of that total
- A $150 million theft linked to the 2022 LastPass breach
- Cryptocurrency exchange executive arrested for money laundering

Essential Services Under Threat

The systems we rely on daily face increasing risks:
- Persistent threats to power grid systems
- Vulnerabilities in industrial control software
- Local government services compromised
- Remote work tools facing serious security flaws

Special Focus: Too Many Machine Identities

This week, researchers reported that digital machine identities (automated accounts, service accounts, API keys, etc.) now outnumber human users by seven to one. This creates massive security challenges.

Why You Should Care: Unlike humans, machines don't attend security training, don't worry about getting fired for mistakes, and don't feel guilty about poor security practices. They just do exactly what they're programmed to do—which becomes a problem when hackers re-programme them.

What To Do About It:
- Create an inventory of all machine identities in your organisation
- Implement proper access controls for all automated systems
- Remove unnecessary permissions from system accounts
- Regularly check and update security certificates
- Monitor for unusual behaviour in automated systems

Startling Stat of the Week

This week's "well that's concerning" award goes to: 41.1% of Microsoft's March patches fixed flaws that would allow attackers to run their own code on your systems. Nearly half of all security fixes were for vulnerabilities that could give attackers complete control. No pressure.

As always, if you need help implementing any of these recommendations or just want to vent about the never-ending security challenges, we're here. Reach out at intelligence@isoserious.com.

Stay secure,

ISO Serious

Critical Security Tasks

Patch Critical Systems

Immediately apply security updates for Windows, Zoom, and Juniper devices to address known vulnerabilities

Review Machine Identity Management

Audit and implement stronger controls for machine identity management to reduce security risks

Enhance Infrastructure Monitoring

Implement continuous monitoring for critical infrastructure systems to detect potential state-sponsored intrusions

Update Fraud Prevention Measures

Review and strengthen anti-fraud measures with particular focus on investment scam prevention

Patch Critical Microsoft Vulnerabilities

Apply latest Microsoft security updates to address six actively exploited zero-day vulnerabilities

WordPress Security Audit

Check WordPress installations for malicious backdoors and implement monitoring for third-party dependencies

Review Password Management Security

Assess password manager security practices in light of the LastPass breach implications

Deploy Surveillance Detection

Consider implementing Rayhunter tool to detect potential cellular surveillance in sensitive areas

Apply Microsoft March Patches

Prioritize the deployment of patches for the six zero-day vulnerabilities in Microsoft's March update

Monitor VMware HCX

Implement enhanced monitoring for VMware HCX API endpoints and review access logs for suspicious activity

Update SCADA Systems

Review and patch ICONICS Suite installations to address newly discovered vulnerabilities

Enhance Web Security

Review web server logs for common webshell probe attempts and ensure proper security controls are in place

Deploy March 2025 Security Updates

Prioritize the deployment of patches for the six critical vulnerabilities and seven zero-day flaws across all affected systems

Review Windows NTFS Security

Assess and strengthen NTFS security configurations, particularly focusing on systems that handle sensitive data or virtual hard disk files

Audit Remote Desktop Services

Evaluate and update Remote Desktop Services configurations to mitigate risks from the critical RCE vulnerabilities CVE-2025-24035 and CVE-2025-24045

Chinese State Actors and Critical Infrastructure Threats Dominate Cybersecurity Concerns

News and Analysis

This week revealed significant developments in state-sponsored cyber threats and critical infrastructure vulnerabilities. Most notably, Chinese hackers were found deploying backdoor malware on Juniper routers, while a separate investigation showed that China's Volt Typhoon hackers maintained access to the US electric grid for 300 days, demonstrating persistent threats to critical infrastructure.

Major security updates were released across multiple platforms. Microsoft addressed a Windows Kernel zero-day vulnerability that had been exploited since 2023, while Zoom patched four high-severity vulnerabilities. The FTC reported that fraud losses reached $12.5 billion in 2024, with investment scams accounting for $5.7 billion of the total.

In the realm of machine identities, a concerning trend emerged as machine identities were reported to outnumber humans, increasing security risks seven-fold. This development highlights the growing complexity of managing digital identities and securing automated systems in modern infrastructure.

Major Cybersecurity Incidents and International Intelligence Developments

Security Research

This week saw significant developments in international cyber relations and major security breaches. Former CISA Director Jen Easterly highlighted concerns about a potential new 'China, Russia, Iran, and North Korea intelligence sharing' alliance, suggesting a shift in global intelligence cooperation. This development coincided with the US Department of Justice's indictment of 12 Chinese hackers, including members of the Silk Typhoon group responsible for the US Treasury breach.

Microsoft's March Patch Tuesday revealed six actively exploited zero-day vulnerabilities, while thousands of WordPress sites were compromised with four distinct backdoors. In cryptocurrency-related developments, federal investigators linked a $150 million cyberheist to the 2022 LastPass breach, and Indian authorities arrested the co-founder of Garantex, a cryptocurrency exchange sanctioned for money laundering.

On the defensive front, the EFF introduced Rayhunter, an open-source tool for detecting IMSI catchers, demonstrating growing efforts to counter surveillance technologies.

Cybersecurity Week: VMware Vulnerabilities and Microsoft Patches

Threat Intelligence

This week saw significant developments in vulnerability management and threat detection. Microsoft's March Patch Tuesday addressed 51 vulnerabilities, including six zero-day exploits. While only six vulnerabilities were rated critical, the presence of actively exploited vulnerabilities demands immediate attention from system administrators.

Security researchers observed increased scanning activity targeting VMware Hybrid Cloud Extension (HCX) API endpoints, potentially indicating preparation for exploitation attempts. Meanwhile, the City of Mission, Texas declared a local state of emergency following a severe cybersecurity incident threatening to expose sensitive personal information and health records.

In infrastructure security, researchers identified multiple vulnerabilities in ICONICS Suite, a SCADA software widely used in operational technology applications. Additionally, security teams reported ongoing probes for common webshell URLs, highlighting the persistent threat of web-based attacks.

Microsoft's March 2025 Patch Tuesday Addresses Critical Vulnerabilities

Vendor Updates

Microsoft's March 2025 Patch Tuesday release addressed 56 CVEs, including six critical vulnerabilities and seven zero-day flaws. According to Tenable's analysis, remote code execution (RCE) vulnerabilities accounted for 41.1% of the patches, while elevation of privilege (EoP) vulnerabilities made up 39.3%. Notable fixes included CVE-2025-26633, a security feature bypass in Microsoft Management Console that was actively exploited, and CVE-2025-24985, a RCE vulnerability in Windows Fast FAT File System Driver.

The update included critical patches for Windows Remote Desktop Services (CVE-2025-24035 and CVE-2025-24045) with CVSSv3 scores of 8.1. Multiple vulnerabilities in Windows NTFS were addressed, including CVE-2025-24993, a RCE vulnerability that was exploited in the wild. Microsoft Access also received attention with CVE-2025-26630, a zero-day vulnerability that was publicly disclosed before patching.

The comprehensive patch release covered multiple Microsoft products and services, including .NET, Azure services, Office applications, and various Windows components. The high number of zero-day vulnerabilities and actively exploited flaws highlights the increasing sophistication of cyber threats targeting Microsoft systems.

Serious Intelligence Weekly