SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals
SEC595Cyber Defense
SANS Community Benefits
Connect, learn, and share with other cybersecurity professionals
Top of the News
Patch Now: F5 BIG-IP Code and Undisclosed Flaws Stolen in Long-Term Breach
On Wednesday, October 15, 2025, network technology and security company F5 disclosed a security incident discovered on August 9, 2025, in which an unspecified nation-state threat actor "maintained long-term, persistent access to, and downloaded files from, certain F5 systems." The period of unauthorized access has not been disclosed. The company's 8-K filing with the US Securities and Exchange Commission (SEC) notes that the US Department of Justice allowed a delay of public disclosure from September 12 to October 15. F5 is a major provider of enterprise cybersecurity, cloud management, and application delivery controllers (ADC) including BIG-IP hardware and software, widely used by government agencies and Fortune 500 companies worldwide. Upon discovery of the attack, F5 activated its incident response protocols, implemented containment actions, engaged cybersecurity experts for support, and contacted federal law enforcement and government partners. Investigation confirmed that the threat actor had long-term access to "the BIG-IP product development environment and engineering knowledge management platform," and during that time exfiltrated BIG-IP source code, information about undisclosed BIG-IP vulnerabilities still being worked on, and "configuration or implementation information for a small percentage of customers." F5's software supply chain, customer relationship management, financial, case support management, and iHealth systems have not been affected, and there is no evidence that the threat actor accessed or modified NGINX source code, F5 Distributed Cloud Services, or Silverline systems. As investigation continues, F5 has rotated credentials and strengthened access controls; automated patch management and inventory; enhanced network security architecture; and hardened their product development environment. F5 urges customers to apply newly released updates for "BIG-IP, F5OS, BIG-IP Next for Kubernetes, BIG-IQ, and APM clients," and offers guidance for threat hunting and monitoring, hardening and remediation, and SIEM integration. While F5 has not observed active exploitation, the potential "imminent threat to federal networks" prompted the US Cybersecurity and Infrastructure Security Agency (CISA) to direct federal civilian agencies to inventory, harden, and patch "BIG-IP F5OS, BIG-IP TMOS, Virtual Edition (VE), BIG-IP Next, BIG-IQ software, and BNK/CNF" by October 22.
Editor's Notes
- Slide 1 of 4
This one is the big bad. Rumors are that F5 was compromised for a year, potentially longer. Until we have more information from F5, I would consider even rolling back the patch. Is that a hot take? Unfortunately there are many unknowns here: Can it even be safer to install software from two years ago, before it was breached? How many vulnerabilities have there been since then? These are internet-facing systems, sometimes behind firewalls. To give you an idea of how severe this is, according to Shodan, 500,000 Public IP addresses have the server header: Server: BigIP. Keep these systems in mind: they include load balancers and VPNs. So far they have issued a CISA announcement, and we have observed key rotation from the company.
- Slide 2 of 4
Remember when you negotiated needing maintenance windows for your F5 equipment? You're gonna need it. It appears the threat actor stole some F5 source code, customer configurations, and undisclosed vulnerability information. There is no evidence that those flaws are being exploited yet, but there's the rub: it's a race condition. Your best move is to apply the update, which addresses the flaws and modified code, as soon as you can get a maintenance window, hoping you're in a High Availability configuration so the impact is minimized. F5 has also published IoCs and updated hardening guides you need. This would be a good time to verify the F5 logs are still getting to your SIEM.
- Slide 3 of 4
F5 states they have external verification that their production source code was not compromised, but they also recommend immediate installs of updates. This one sounds very similar to the SolarWinds hack of 2019, but hopefully was detected and resolved before customers were impacted. Beyond security products, if your IT department uses any F5 application delivery services (especially DNS), make sure they obtain assurances and apply any recommended updates.
- Slide 4 of 4
This is our October surprise. Hopefully as part of the agreement with DoJ, F5 will conduct an after action report discussing the state of security within their environment.
Slide 1 of 0- Slide 1 of 4
Capita Fined £14M Over 2023 Ransomware Attack That Compromised Data of 6.6 Million People
The UK Information Commissioner's Office (ICO) has fined business process outsourcing firm Capita £14 million (US$18.8 million) over a 2023 ransomware attack that exposed personal information of 6.6 million individuals. The initial attack vector appears to have been a drive-by JavaScript download on March 22, 2023, followed by the deployment of Qakbot and Cobalt Strike. Capita failed to take significant containment action for more than two full days after becoming aware of the attack. Although the company was largely operational by April 6, 2023, it was not until mid-June 2023 that they returned to 100 percent uptime. The ICO initially intended to fine Capita £45 million (US$60.5 million), but rolled that figure back after Capita took responsibility for the incident, cooperated with authorities, provided support to victims of the incident, and made security improvements to their systems and operations. The majority of Capita's customers are in the UK and Europe.
Editor's Notes
- Slide 1 of 5
We all make mistakes; what we do when they happen matters. Two lessons here: First, respond fully to an incident and don't be afraid to call in help sooner than later. Second, own up to your response, good or bad, take steps to prevent recurrence, and cooperate with regulators. While an insufficient response will likely leave you with an audit finding, subsequent actions will affect the penalty phase. Talk about this in your next tabletop. Know who you can call, to include your regulator.
- Slide 2 of 5
A good reminder that (1) security should be part of all outsourcing selection decisions, and (2) the security team should be staffed, trained, equipped and capable of providing meaningful and timely evaluation of suppliers. The cost was very likely less than the fine, let alone the $30 million or so of hard costs Capita experienced in addition to the fine.
- Slide 3 of 5
It is worth noting the fine is not directly related to the ransomware attack but rather to the series of poor security practises that led to the breach. The ICO's penalty notice is a good read to identify the issues the ICO identified as contributing to the breach and to ensure your organisation does not have the same issues.
- Slide 4 of 5
$18.8M seems like a fairly stiff fine. I mean it’s not $60.5M, the original fine, but nonetheless a sizable amount. Ok, ok, let’s now look at Capita’s 2024 revenue, $3.2B. So the fine equates to less than one percent of their gross revenue. That fine doesn’t look so stiff anymore, does it? I think Capita’s legal team earned their bonus this year.
- Slide 5 of 5
It is not the purpose of fines to destroy the offending enterprise. That is why some regulations specify that fines will be based upon measures of the scale of the enterprise. Penalties should be painful but not destructive.
Slide 1 of 0- Slide 1 of 5
Microsoft Patch Tuesday and End-of-Life for Windows 10 and Other Products
On Tuesday, October 14, Microsoft released updates to address more than 170 vulnerabilities across the company's product lines. Three of the vulnerabilities, a high severity Windows Agere Modem Driver Elevation of Privilege Vulnerability (CVE-2025-24990), a high severity Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (CVE-2025-59230), and a Secure Boot bypass in IGEL OS before 11 (CVE-2025-47827) are being actively exploited. Also on October 14, several Microsoft products reached end-of-life; these include Windows 10, Exchange Server 2016, Exchange Server 2019, Skype for Business 2016, Windows 11 IoT Enterprise Version 22H2, and Outlook 2016. Windows 10 users who are not prepared to upgrade to Windows 11, which in some cases necessitates new hardware, have several options: they can pay $30 for an additional year of security updates, and the fee will be waived if the PC is registered to a Microsoft account. Users could also install a Linux operating system instead.
Editor's Notes
While there's been a lot of talk about Windows 10 EOL, it's easy to overlook the EOL for Office 2016 & 2019 as well as Exchange Server 2016 & 2019. You can purchase Office 2024 if you're not ready for MS 365, but the better move is to look to moving to the cloud versions. With all the flaws/exploits/etc., you're going to need to balance incident response with security of the cloud offering. There are a lot of resources to help get the security right. Look at response time rather than reduction in license cost.
The Rest of the Week's News
European Border Entry/Exit Data System Launches
The Entry/Exit System (EES), which "digitally records the entry and exit of non-EU nationals travelling to 29 European countries for short stays," has begun a six-month gradual implementation that began October 12, 2025, and anticipates full operation by April 10, 2026. The participating countries are all those committed to the Schengen Agreement, and so do not include the Republic of Cyprus and the Republic of Ireland. The system collects passport data, dates and places of entry and exit, facial images, fingerprints, and recorded refusals of entry. Europol may access and search the EES for law enforcement purposes under "strict conditions and procedures, based on case-by-case assessment and supervised by the European Data Protection Supervisor (EDPS)." The Register reports inconsistencies and difficulties in the initial operation of EES self-service machines, including delays in Prague as agents were forced to revert to standard manual border checks.
Editor's Notes
- Slide 1 of 4
This reminds me of a large US government agency that years ago went to smart badges (versus guard eyeballs) for entry, and lines got so long that they had to go back to human guard eyeballing during rush hours — only jet lagged attackers would have been caught… The lesson here is that moving to strong authentication is critical to reach essential security hygiene levels, and rollouts should be thoroughly load tested before deployment.
- Slide 2 of 4
Anyone else having flashbacks of a bumpy rollout of a new IT system? I am reminded of a question my wife asks me, which she learned in her grade-school CS program: what is your low-tech backup? A side question is: how viable is moving to that backup? In this case, the airport wasn't fully prepared to roll back, causing issues. EES enrollment is required for travelers aged 12 and above from non-EU countries when crossing the border into the 29-nation Schengen area, and the enrollment is free and good for three years; be patient and prepared for delays, this will get sorted out.
- Slide 3 of 4
"Strict conditions and procedures," supervised by a "supervisor(y)" agent or agency, may be well short of a warrant issued by a magistrate. This is a procedure paid for by travelers, in the interest of the state, that would have been prohibitively expensive in the absence of modern technology.
- Slide 4 of 4
Stuff happens, no new IT system is error free. Couple that with 27 nations implementing on their own terms, and there will be glitches. That said, anyone think the database hosting a person’s biometric identifiers isn’t a high priority target for nation-states? Yeah, didn’t think so.
Slide 1 of 0- Slide 1 of 4
CISA Adds Critical Adobe Experience Manager Vulnerability to KEV
The US Cybersecurity and Infrastructure Security Agency (CISA) has added a critical (CVSS 10.0) misconfiguration vulnerability that could lead to remote code execution in Adobe Experience Manager (CVE-2025-54253) to the Known Exploited Vulnerabilities (KEV) catalog. The flaw has a mitigation deadline of November 5, 2025. The vulnerability affects Adobe Experience Manager (AEM) Forms on JEE versions 6.5.23.0 and earlier. Adobe addressed the vulnerability with unexpected updates in August 2025; at that time, proof-of-concept code for the vulnerability had been made public. Users are urged to update to version 6.5.0-0108 or newer as soon as possible.
Editor's Notes
- Slide 1 of 2
The hotfix covers CVE-2025-49533, arbitrary code execution, CVSS score 10.0; CVE-22025-54254, arbitrary file system read, CVSS score 8.6; and CVE-2025-54253, struts development mode enabled in admin UI, CVSS score 10.0. The hotfix can only be applied to AEM 6.5.23.0. AEM 6.5.18.0-6.5.22.0 is also impacted and needs to be manually updated to 6.5.23.0 before you can apply the hotfix. If you're on an earlier version, you need to update to a supported version first.
- Slide 2 of 2
I find it strange that a vulnerability with a CVSS score of 10 and a patch available since August is given three weeks for users to patch. But hey, now it’s part of the KEV database.
Slide 1 of 0- Slide 1 of 2
SAP Patches Critical NetWeaver Vulnerabilities and 12 Other Flaws
On Tuesday, October 14, SAP released updates to address 13 vulnerabilities, including a critical (CVSS 10.0) deserialization issue in SAP NetWeaver AS Java. The vulnerability (CVE-2025-42944) could be exploited to achieve arbitrary command execution. According to the description in NIST's National Vulnerability Database CVE listing, "an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious payload to an open port. The deserialization of such untrusted Java objects could lead to arbitrary OS command execution, posing a high impact to the application's confidentiality, integrity, and availability." Users are urged to update as soon as possible.
Editor's Notes
- Slide 1 of 2
The fix from SAP for CVE-2025-42944 — insecure deserialization flaw, a variant on untrusted input needing to be validated, CVSS score 10.0 — includes a broad fix by adding a JVM-wide filter (jdk.serialfilter) that prevents dedicated classes from being deserialized, rather than a narrower fix that would need updating as other issues are discovered. Beyond updating your SAP instance, review the SAP recommended security configurations guide to make sure that you're properly secured.
- Slide 2 of 2
Another vulnerability with a CVSS score of 10. Not yet on the KEV, but given the critical nature of the vulnerability, go ahead and patch now.
Slide 1 of 0- Slide 1 of 2
Known Cisco Vulnerability Exploited to Deploy Rootkit
Threat actors have been exploiting a known vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software. Cisco released an advisory about and updates for the high severity stack-based buffer overflow issue in late September 2025. The vulnerability could be exploited to create denial-of-service conditions or execute code as root user by sending a maliciously-crafted SNMP package to a vulnerable device. Researchers at Trend Micro have observed threat actors exploiting the vulnerability (CVE-2025-20352) to deploy root kits on unpatched devices. The researchers write, "the operation primarily impacted Cisco 9400, 9300, and legacy 3750G series devices, with additional attempts to exploit a modified Telnet vulnerability (based on CVE-2017-3881) to enable memory access. The operation targeted victims running older Linux systems that do not have endpoint detection response solutions, where they deployed Linux rootkits to hide activity and evade blue-team investigation and detection."
Editor's Notes
- Slide 1 of 2
Now this one is not the typical one. This appears to be Cisco IOS and IOS XE, which is the core Enterprise product, not SMB this time. Rootkits on that platform are a cause for alarm. 3750G is a fairly old but still-deployed switch. Your enterprise should never expose SNMP Services, but most people still use SmartInstall in places, so I have no hope. Ensure your switch management is not connected to the internet. Best I can say.
- Slide 2 of 2
Researchers at Trend Micro dubbed this "Operation Zero Disco" because it set a password which contained the word disco. Trend Micro has published a set of IoCs for you to hunt for. A recurring theme here is compromising Linux systems that lack EDR, or lack fully functional EDR. Now is a good time to make sure that you're deploying an EDR system to your Linux systems and that it's fully responsive to modern threats. You may need to upgrade some systems and/or change EDR solutions to achieve that.
Slide 1 of 0- Slide 1 of 2
Faulty Jeep Software Update Made Vehicles Stop Working; Fix Released
An update for Jeep infotainment system pushed out on Friday, October 10, 2025, was found to be causing the vehicles to cease operating. The issue affected Jeep Wrangler 4xe hybrids. The faulty update caused the vehicles to lose power while being driven. The update was pulled after reports of problems started coming in. Jeep parent company Stellantis released a fix and will reimburse customers for related expenses they may have incurred as a result of the problematic update, including towing and diagnostic fees. The Ars Technica article notes that Friday afternoon is a less-than-ideal time to push out an update.
Editor's Notes
- Slide 1 of 3
The root cause appears to be insufficient regression testing of the initial update. Given that the flawed update caused vehicles to cease operating immediately, it's a good reason to not apply vehicle updates while driving. Jeep has pushed out a fix to the flawed update which appears to be more fully tested; you may want to wait until after the weekend to apply it, particularly if you've got adventures planned. If you've applied the flawed update, your vehicle systems may need to be restarted more than once to restore normal operation. You may wish to consult with your dealer as they're going to have the latest on fixes/workarounds; the flawed behavior is sure to ruin your day.
- Slide 2 of 3
Lots of obvious “don’t do this…” lessons from this one. I’ve always been a fan of the “eat your own dog food” rule — maybe if developers had to drive Jeeps, denial-of-service-laden updates would be noticed before customer rollout — or at least would never come out on Friday!
- Slide 3 of 3
It seems as though Stellantis needs to invest more into QA software engineers, and perhaps more field testing of their updates.
Slide 1 of 0- Slide 1 of 3
Geostationary Satellites Have Been Broadcasting Unencrypted Sensitive Data
Researchers from UC San Diego and the University of Maryland found that "geostationary satellite communication ... [broadcasts] a shockingly large amount of sensitive traffic ... unencrypted, including critical infrastructure, internal corporate and government communications, private citizens’ voice calls and SMS, and consumer Internet traffic from in-flight Wi-Fi and mobile networks." Using an $800 satellite receiver, the researchers were able to retrieve and examine unencrypted signals that resolved to sensitive data. The researchers have been warning the various entities whose data are being broadcast, unprotected; many have taken steps to encrypt those data.
Editor's Notes
- Slide 1 of 3
Some of the most interesting systems to pentest are those less commonly considered: satellite systems, processes depending on cell networks, badge readers, the C-suite's residences and OSINT footprints, smart anythings, HVAC systems, everything offshore, etc.
- Slide 2 of 3
Encryption of satellite traffic is a challenge, as adding encryption to older birds is problematic. Your best bet is to use end-to-end encryption when sending data outside your network, regardless of transmission media, rather than assuming it's protected. Even on non-satellite communication, use encryption for sensitive communications, to include cellular. Remember, while iMessage is encrypted, Android RCS is not.
- Slide 3 of 3
It is likely that some of the originators of this traffic are not even aware that it is moved via these satellites. We call it the "cloud" because it is opaque. Safety of the path is not reliable. Encryption of any sensitive traffic at the source should be the default.
Slide 1 of 0- Slide 1 of 3
Follow-up: PowerSchool Hacker Sentenced; Asahi Investigates Data Theft
A Massachusetts district judge has determined a sentence of four years in prison and 3 years of supervised release for Matthew Lane, who pleaded guilty to unauthorized access to protected computers, cyber extortion conspiracy, cyber extortion, and aggravated identity theft related to late-2024 cyberattacks against an unnamed telecommunications company and an educational software provider believed to be PowerSchool. This included the theft of personal data belonging to millions of teachers and children. Lane must also pay over $14 million in restitution plus a $25,000 fine. Asahi Group Holdings, Ltd. has updated its notice of a cyberattack first announced on September 29, 2025 and disclosed to be ransomware on October 3. The company is continuing to restore its systems, and states that investigation has "identified the possibility that personal information may have been subject to unauthorized data transfer." Asahi will notify any affected parties and comply with laws protecting personal information as investigation continues. "The impact of this incident on our systems is limited to those managed in Japan."
Editor's Notes
Regardless of the likelihood of Lane paying the $14 million in restitution, given that he impacted 9.5 million teachers and 62.4 million students, the fine is consistent with PowerSchool's claim of a $14 million loss rather than the impact on the teachers and students. If you're impacted by the incident, make sure that you're taking matters into your own hands, implementing ID/Credit monitoring and restoration for yourself and your kids. Having that in place has become as important as teaching them to balance their accounts; watch for fraud and (hopefully) budget.