SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals
SEC595Cyber Defense, Artificial Intelligence
SANS Community Benefits
Connect, learn, and share with other cybersecurity professionals
Top of the News
MS Intune Alert from CISA, FBI Domain Seizures Follow Stryker Attack
Following a March 11, 2026 cyberattack that wiped devices at medical technology company Stryker, the US Cybersecurity and Infrastructure Security Agency (CISA) issued an alert urging organizations to harden their endpoint management system configurations, specifically Microsoft Intune, which was reportedly exploited by the attackers to execute the fleet-wide wipe. Microsoft published "Best Practices for Securing Microsoft Intune" on March 14, and CISA endorses their recommendations: 1. Restrict permissions using principles of least privilege, using role-based access control; 2. Enforce conditional access, phishing-resistant MFA, risk signals, and privileged access controls to ensure privileged access is "hard to obtain and hard to reuse;" and 3. Implement Multi Admin Approval restrictions for performing high-impact actions. As of March 19, 2026, the FBI has seized and taken down two websites used by a threat group called Handala, linked with the Iranian Ministry of Intelligence and Security, who claimed the attack, and whose logo appeared on affected devices, according to Stryker employees. Stryker's updates as of this writing indicate that their products, technologies, and communication channels with sales representatives are safe to use, but ordering and distribution is still recovering from disruptions.
Editor's Notes
- Slide 1 of 4
Your MDM/MAM platform is a Tier-0 asset, so treat it like one. Nation-state actors aren't just thinking destruction here, more than likely: they could quietly backdoor endpoints and push them through your own trusted deployment pipeline. If you're on Intune, lock down every path to admin for that system. For Intune and EntraID, use account separation, FIDO2/passwordless, and short token expiration windows for both access and refresh tokens. The same applies if you're running JAMF or FleetDM. And keep a close eye on Ivanti and their MDM/MAM; it's been a consistent vulnerability source over the last few years.
- Slide 2 of 4
When is the last time you checked your MDM/EMM against the provider’s latest best practices? Those tend to get updated when you're not looking. Incorporate the CISA recommendations; phishing-resistant MFA and separation of admin rights may be inconvenient for staff, but it also makes it harder for our adversaries. Give a lot of thought to the two-person rule for sensitive or high-impact operations.
- Slide 3 of 4
In pentesting, clients often want to limit scope to "what the bad guys can get to." This is an excellent reminder that we need to defend — and TEST — in depth!
- Slide 4 of 4
While the guidance is good, an adversary having admin privileges on the application defeats the hardening process. The question at the end of the day is how did the evildoer get the admin credentials necessary to run the application in the first place?
Slide 1 of 0- Slide 1 of 4
Apple Releases First Background Security Improvement
Apple has released the first security update pushed via the "Background Security Improvements" feature, fixing a flaw in WebKit affecting iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1, and macOS 26.3.2. CVE-2026-20643 could allow maliciously crafted web content to bypass the Same Origin Policy due to a cross-origin issue in the Navigation API. Background Security Improvements (BSIs) are lightweight updates for system components "that benefit from smaller, ongoing security patches between software updates." The feature was introduced in version 26.1 of Apple OSes, and once activated through the Privacy & Security settings menu, it will automatically apply incremental patches without requiring a full OS upgrade. Apple notes that "if you choose to turn off this setting, your device will not receive these improvements until they're included in a subsequent software update," and that choosing to remove an installed BSI will remove all BSIs applied since the last baseline OS version update.
Editor's Notes
- Slide 1 of 4
Sometimes it is a good thing when the camel pokes its nose into the tent. Faster automatic patching is a reality in most of the cloud-based apps we use and is badly needed in operating systems. Two obvious key issues for Apple: (1) Assuring and maintaining patch quality, and (2) Avoiding the temptation to mix new features into a security update. Apple has a track record of updates that drive many users nuts because of feature creep and/or UI drift…
- Slide 2 of 4
At first blush, it's easy to miss that this is also a feature in macOS. This update, once downloaded, is installed very quickly, and is essentially invisible except for the reboot. While you'll see the updated OS version when you check the About or Software Update areas under settings, manually installing it or disabling the auto-update is under the Privacy & Security settings on your devices, not Software Update. You may miss the option at first, as security options are after privacy options, so you may need to scroll a bit. Apple's MDM interface allows for reporting and installation of these background security improvements, as well as giving you the option to allow or prevent users from removing these updates.
- Slide 3 of 4
It worked seamlessly on my personal device. For the enterprise device, it was blocked by the installed security application. I guess it boils down to whether one trusts the software vendor, AAPL in this case, pushing background security improvements. My vote: Yes, as we already trust them in providing periodic updates that are simply downloaded and installed. It certainly reduces an attackers window of opportunity.
- Slide 4 of 4
Apple's record of timely and non-disruptive updates is very good. Automatic updates should be the setting of choice for most Apple users. There is a small minority that will only update for a new feature.
Slide 1 of 0- Slide 1 of 4
DarkSword iOS Exploit Kit
Coordinated research published by Google, iVerify, and Lookout describes an iOS exploit kit dubbed DarkSword that since November 2025 has been used by multiple spyware vendors and nation-state operatives to steal sensitive information from vulnerable devices. DarkSword exploits six vulnerabilities to drop three backdoors on vulnerable devices to facilitate exfiltration of sensitive information, including passwords, pictures, messaging app logs, browser histories, and data from Apple's Calendar, Notes, and Health apps. Exploitation requires a targeted iPhone user to visit a maliciously crafted website. DarkSword affects iOS 18.4 through 18.7, which Apple recently estimated accounts for nearly 25 percent of iPhone users. Users are urged to update to the most recent version of iOS. Reports of DarkSword follow close on the heels of the discovery of the Coruna iOS exploit kit.
Editor's Notes
- Slide 1 of 2
This is using six flaws in iOS 18 for this exploit, which is cool yet distressing. Think of DarkSword as the base package others have built upon to take over devices. Don't forget that iOS 18 is the version prior to iOS 26, despite the gap in numbering. Get your iOS 18 holdouts to version 26. Apple is at version 26.3.1 (a), so they're past those new release issues. If you have devices which won't run iOS 26 — it works on iPhone 11s (2019) and newer — replace them. There are features which don't work on devices older than an iPhone 15 Pro, so use that as a carrot.
- Slide 2 of 2
The Coruna exploit kit was more than just an interesting nation-state one-off, it seems. There was another exploit kit using the same iOS exploit vectors, which is somewhat disturbing, as we will probably see more. If you have a macOS or iOS device, keep it patched even if you are not a high-value target. This could be a trend for iOS, that exploits start making their way through exploit markets, but it’s not 100% guaranteed yet. So far, all these attacks are tied to nation-states. High-value targets can run Lockdown mode on devices that they use for sensitive information.
Slide 1 of 0- Slide 1 of 2
The Rest of the Week's News
Ubuntu Desktop 24.04 Privilege Escalation Flaw
The Qualys Threat Research Unit (TRU) is warning of a high severity privilege escalation flaw in components related to the Linux snap daemon, affecting Ubuntu Desktop version 24.04 (Noble Numbat) and later. CVE-2026-3888, CVSS score 7.8, allows an attacker to gain root privileges by re-creating snap's private /tmp directory with malicious payloads after systemd-tempfiles deletes it during automatic cleanup. "During the next sandbox initialization, snap-confine bind-mounts these files as root, allowing the execution of arbitrary code within the privileged context." Users running Ubuntu Desktop 24.04 and later should consult TRU's list of affected versions and immediately upgrade their snapd package to a patched release, and users running older versions should patch as well in case of non-default configurations that could behave similarly to this flaw. Qualys also mentions a race condition in the rm utility potentially allowing arbitrary file deletion as root or privilege escalation, discovered and mitigated during pre-release review of the uutils coreutils package for Ubuntu Desktop 25.10.
Editor's Notes
- Slide 1 of 2
There is increasing traction on Linux desktops, so make sure that you're not only aware of them but also keeping them updated/secured. Exploiting CVE-2026-3888 requires low privileges and no user interaction, but the attack complexity is high and relies on the sequencing of the snapd cleanup/initialization processes over a 10 to 30-day window. The good news is Ubuntu 24.04 LTS, 25.10 LTS and 26.04 LTS all have updated version of snapd which is easily deployed. While you're at it, make sure the uutils coreutils (aka rust-coreutils) package is up to date as well. For the technical details, visit Qualys's snap-confine + systemd-tmpfiles writeup: https://cdn2.qualys.com/advisory/2026/03/17/snap-confine-systemd-tmpfiles.txt
- Slide 2 of 2
Jared Folkins on our team has been harnessing AI to standard Linux packages for testing and is finding piles of vulnerabilities like these. Here's hoping responsible security researchers are well ahead of malicious actors in this space...
Slide 1 of 0- Slide 1 of 2
CISA KEV Adds Microsoft SharePoint Vulnerability with March 21 FCEB Mitigation Deadline
A high-severity deserialization of untrusted data vulnerability in Microsoft SharePoint (CVE-2026-20963) is being actively exploited. The vulnerability was initially disclosed on January 13, and Microsoft addressed the flaw in the January 2026 Patch Tuesday release. The vulnerability can be exploited to achieve remote code execution and affects multiple versions of SharePoint. Updates are available for SharePoint Server 2016, 2019, and Subscription Edition; SharePoint Server 2007, SharePoint Server 2010, and SharePoint Server 2013 are also affected, but are no longer supported and no updates are available for those versions. The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on March 18 with a three-day mitigation window for Federal Civilian Executive Branch (FCEB) agencies: they have until Saturday, March 21 to address the issue in their systems.
Editor's Notes
- Slide 1 of 2
That due date is tomorrow, which is like wow, until you notice the update came out two months ago. Go check quick to make sure that update was deployed to your SharePoint Server 2019, Subscription Edition, and Enterprise Server 2016 environments. Back when the flaw was discovered and the fix provided, Microsoft said the likelihood of exploit was low, so don't be hard on folks if they didn't apply the patch, just tell them the likelihood has changed and we need to address this now. The flaw is exploitable by an unauthenticated attacker and requires no user interaction. Make sure you need to have that local SharePoint Server environment versus leveraging the Microsoft 365 service, and if you're continuing, make sure that you're staying on the current version.
- Slide 2 of 2
CISA’s cracking the whip on FCEB agencies by giving a tight three-day mitigation deadline. With a patch being available since January, it only seems reasonable.
Slide 1 of 0- Slide 1 of 2
CISA KEV Adds Cisco Secure Firewall Management Center Vulnerability with March 22 FCEB Mitigation Deadline
A critical deserialization of untrusted data vulnerability in Cisco Secure Firewall Management Center (FMC) Software (CVE-2026-20131) is being actively exploited. The flaw allows an unauthenticated remote attacker to execute arbitrary Java code as root on an affected device. According to Amazon threat intelligence researchers, the vulnerability has been exploited by the Interlock ransomware group since January 2026. Cisco released an update to address the vulnerability on March 4, 2026, and has updated that advisory to reflect the fact that it is being actively exploited. The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on March 19, with a three-day mitigation window for Federal Civilian Executive Branch (FCEB) agencies: they have until Sunday, March 22 to address the issue in their systems.
Editor's Notes
- Slide 1 of 2
Any Firewall Management system, application, or interface should be put on a specific segment that only allows for management of the device through that interface. It should be a firewall and secured, but it should also be kept up to date with security fixes. If you can upgrade your devices, you should. Some of the devices must be in lockstep with the products they manage to ensure defense-in-depth with these systems.
- Slide 2 of 2
Another short response window from CISA, and this was added to the KEV March 19 (yesterday). Note the fix came out March 4, so you couldn't have applied the update before then. While the Interlock gang focuses on attacking schools and government agencies, it's not safe to assume they're the only ones attempting to exploit the flaw, so you want to apply it. Beyond the update, make sure that you're limiting access to your firewall management systems, particularly not exposing them to the internet.
Slide 1 of 0- Slide 1 of 2
Vulnerabilities in IP KVM Switches
Researchers at Eclypsium have detected nine vulnerabilities affecting IP KVM (Keyboard, Video, Mouse over Internet Protocol) devices that could be exploited to compromise networks. The devices allow users to "control multiple computers with a single set of peripherals," accessing machines at the BIOS/UEFI level, or as Eclypsium put it, "below the operating system, below EDR, below every security control you have deployed." The vulnerabilities affect four different products: GL-iNet's Comet RM-1; Angeet/Yeeso's ES3 KVM; Sipeed's NanoKVM; and JetKVM. Of the four vulnerabilities in GL-iNet's Comet RM-1, fixes are being planned for two: a high-severity insufficient verification of firmware authenticity flaw (CVE-2026-32290) and a high-severity missing authentication for critical function flaw (CVE-2026-32291). Two other vulnerabilities — a critical improper restriction of excessive authentication attempts flaw (CVE-2026-32292) and a medium-severity improper certificate validation issue (CVE-2026-32293) — are addressed in Comet RM-1 v1.8.1 BETA. Fixes are not available for the two vulnerabilities in Angeet/Yeeso's ES3 KVM: a critical missing authentication for critical function flaw (CVE-2026-32297), and a high-severity OS command injection flaw (CVE-2026-32298). A high-severity missing authentication for critical function flaw (CVE-2026-32296) in Sipeed NanoKVM is fixed in NanoKVM v2.3.1 and NanoKVM Pro 1.2.4. A high-severity insufficient update verification issue (CVE-2026-32294), and a critical improper restriction of excessive authentication attempts issue (CVE-2026-32295) are addressed in JetKVM version 0.5.4.
Editor's Notes
Hat tip to Paul and Raynaldo for some cool research. These are really inexpensive KVM devices (about $30), and as such, you may wish to scan for them as they could have been deployed without a lot of oversight or process. Not only did researchers from Eclypsium discover these flaws and have CVEs created, they also worked with US-CERT to reach out to the vendors to disclose the vulnerabilities. The vulnerability overview table in the article reflects the manufacturer’s response to those disclosures; consider that for making future purchases if you're using these types of devices. Also consider what level of governance and approval you want for inexpensive IoT types of devices, because a resulting incident will likely cost more than the enterprise device option.
Data Breaches: Aura, Navia, Intuitive
Digital safety services company Aura says that a "phone phishing attack" resulted in the compromise of 900,000 records, the majority of which are from a marketing contact list that originated with a company Aura acquired in 2021. The list includes 35,000 current and former Aura customers. Compromised data include names, email addresses, physical addresses, and phone numbers. Washington-based employee benefits administrator Navia Benefit Solutions has notified Maine's Attorney General of a data security breach that compromised information belonging to nearly 2.7 million individuals. The incident was detected on January 23, 2026; the intruders appear to have accessed the data between December 22, 2025 and January 15, 2026. Comprised data include names, email addresses, birth dates, Social Security numbers, phone numbers, and health plan information. Robotic surgery instrument manufacturer Intuitive has disclosed that a phishing attack compromised "information from certain internal IT business applications." Intuitive stresses that their network infrastructure is segmented, noting that "the networks and infrastructure that support our internal IT business applications, our manufacturing operations, and our da Vinci and Ion platforms and digital products are separate." Hospital customer networks are also separate from Intrusive networks. In a statement regarding the incident, Intrusive writes, "the information accessed was obtained from an employee’s compromised access into Intuitive’s internal business administrative network. It includes some customer business and contact information, as well as Intuitive employee and corporate data."
Editor's Notes
- Slide 1 of 3
The Intuitive attack used stolen credentials, raising the question of why they weren't using phishing-resistant MFA. Social engineering attacks still work, just ask Aura — you really need to get to not just MFA, but phishing-resistant MFA. The good news is most applications and services have provisions for MFA, and you just need implement them.
- Slide 2 of 3
Phishing as the initial attack vector is still highly, highly successful. What an adversary does from that initial foothold is dependent on one’s cybersecurity program. In each of these cases they were successful.
- Slide 3 of 3
Phishing attacks exploit reusable credentials. The lesson for the rest of us is that reliance on such credentials is reckless. There are implementations of strong authentication that are much more convenient than passwords.
Slide 1 of 0- Slide 1 of 3
Official Nordstrom Email Distributed Crypto Scam
Nordstrom customers have reported receiving cryptocurrency scam emails sent from an official corporate marketing email address. Screenshots show a message prompting the recipient to send cryptocurrency to specified addresses within two hours, promising to return double the deposited amount as part of a St. Patrick's Day promotion. A follow-up email assures customers that the previous message was unauthorized and should be disregarded, and that "Nordstrom will never ask customers to transact or otherwise transfer funds using cryptocurrency." A source known to BleepingComputer alleges that Nordstrom suffered a security breach through Okta SSO, which allowed the attacker to access the company's Salesforce Marketing Cloud and send the emails. Even when an email appears to come from an official address, users should not trust communications that attempt to induce a sense of urgency or contain suspicious errors, such as a heading reading "Normstrom" in this case.
Editor's Notes
- Slide 1 of 3
The email came from nordstrom[@]eml.nordstrom.com, and was sent via the Salesforce Marketing Cloud which will let it pass most spam filters, so it's likely your users saw it, and we're reliant on them detecting this was a bogus message. This one should fall into "if it looks too good to be true..." as well as having other issues mentioned. Remind users to double check promotions with the company's official website or social media; it's still a good idea for users to be wary of messages involving cryptocurrency.
- Slide 2 of 3
The adage, “Stop, Think, Act” seems appropriate here. Unfortunately, that useful adage seems to fall by the wayside when it comes to email or text messages.
- Slide 3 of 3
If it appeals to one of the Seven Deadly Sins, curiosity, or urgency it is probably bait. This one appeals to both greed and urgency.
Slide 1 of 0- Slide 1 of 3