SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals
SEC595Cyber Defense, Artificial Intelligence
SANS Community Benefits
Connect, learn, and share with other cybersecurity professionals
Top of the News
Cisco Flaws Exploited for Backdoor in US Federal Agency’s Systems
The US Cybersecurity and Infrastructure Security Agency (CISA) alongside the UK National Cyber Security Centre (NCSC) is directing federal agencies to take new steps for threat hunting, mitigation, and reporting of persistent malware introduced by the exploitation of flaws in Cisco Firepower and Secure Firewall products with Adaptive Security Appliance (ASA) or Firepower Threat Defense (FTD) software. While investigating suspicious network connections, CISA discovered Line Viper malware and a backdoor called FIRESTARTER on an unnamed Federal Civilian Executive Branch agency's (FCEB's) systems, allowing a threat actor to maintain persistence. "Although Cisco’s patches addressed [the vulnerabilities], devices compromised prior to patching may remain vulnerable because FIRESTARTER is not removed by firmware updates." FCEBs must consult V1: ED 25-03 for mitigation, which includes instructions to collect and submit core dumps to the Malware Next Generation platform, report the submission, and await further direction from CISA. All other organizations are urged to hunt using provided YARA rules against a disk image or core dump, report findings to CISA or the NCSC, and conduct incident response if compromise is confirmed. Cisco's concurrent advisory "strongly recommends reimaging and upgrading the device using the fixed releases," as well as checking for the malicious lina_cs process as an indicator of compromise (IoC).
Cisco first disclosed and released patches for CVE-2025-20333 (CVSS 9.9, buffer overflow allowing remote code execution) and CVE-2025-20362 (CVSS 8.6, missing authorization allowing privilege escalation) in September 2025. At the time the flaws were also added to CISA's Known Exploited Vulnerabilities catalog (KEV) with a 24-hour mitigation deadline for FCEBs; both had reportedly been exploited since May. Nonetheless, exploitation continued, and CISA updated its guidance in November, also warning that several agencies had incorrectly reported vulnerable devices as patched. The products affected, regardless of configuration, are Firepower 1000, 2100, 4100, and 9300 series, and Secure Firewall 200, 1200, 3100, 4200, and 6100 series devices.
Editor's Notes
- Slide 1 of 4
Regardless of if you're a FCEB, read the Emergency Directive for information on both the fixes and FIRESTARTER; there is lots of good stuff here and it’s a quick read. The FIRESTARTER report has links to the YARA rules your threat hunters need. The flaw also exists in unsupported/EOL ASA devices, which means when the discussion stops, just replace them rather than trying to fix them. Beyond applying the updates, CISA requires FCEBs to obtain a core dump and upload it to their Malware Next Generation (MNG) analysis platform to check for evidence of the FIRESTARTER back door. This service is also available to non-FCEBs, so use it. They want you to collect the core dump prior to the update. If detected, at a minimum you need to power cycle the device after the update, and better still, reimage it. Consider power cycling your ASA & FTD devices, not only after the update, but also if you didn't when you previously applied it.
- Slide 2 of 4
This is troubling, as I would imagine most Cisco customers are not going to think that their devices have been compromised to the point where they will need to clean up malware. There is guidance here on how to make this happen, and unfortunately, if you are a Cisco customer outside of the government space, you should probably look into how to search on your own systems.
- Slide 3 of 4
One of the first things that an attacker wants to do after a successful breach is to secure continued access. While easier said than done, management should limit access in such a way that this step trips an alarm. Restricting access is inconvenient, but continuing maintenance can be automated.
- Slide 4 of 4
Excellent analysis on the part of CISA and NCSC. The degree of sophistication and ability to maintain persistence point directly to a nation-state attack. This attack highlights three cybersecurity areas that most organizations struggle with: 1) patch management, 2) asset management, and 3) active monitoring. It’s a good reminder to focus more attention on those.
Slide 1 of 0- Slide 1 of 4
CISA Adds Four CVEs to KEV; All Were Disclosed a Year or More Ago
On Friday, April 24, the US Cybersecurity and Infrastructure Security Agency (CISA) added four CVEs to the Known Exploited Vulnerabilities (KEV) catalog. All four have mitigation deadlines of Friday, May 8, 2026 for Federal Civilian Executive Branch (FCEB) agencies. Two of the vulnerabilities affect SimpleHelp remote support software v5.5.7 and earlier: a critical privilege elevation vulnerability (CVE-2024-57726) and a high-severity arbitrary code execution vulnerability (CVE-2024-57728), both initially disclosed in early January 2025. The third is a high-severity improper limitation of a pathname to a restricted directory vulnerability (CVE-2024-7399) in Samsung MagicINFO 9 Server version prior to 21.1050, initially disclosed in August 2024. The fourth is a high-severity command injection vulnerability (CVE-2025-29635) in D-Link DIR-823X 240126 and 240802 which was disclosed in early 2025. The Akamai Security Intelligence and Response Team (SIRT) recently detected this vulnerability being actively exploited.
Editor's Notes
- Slide 1 of 3
Perhaps we are identifying and enumerating vulnerabilities faster than the dark economy needs them or can exploit them. That a vulnerability is not immediately exploited does not mean that it will never be exploited. Patching is a very expensive way to achieve necessary software quality. However, at least for the time being, it is all we have. Patch early, patch often, patch late! Perhaps the application of smart tools to coding and testing will reduce the amount of the shoddy software with which we must deal.
- Slide 2 of 3
That these year-old issues were added to the KEV shows enough of these vulnerabilities remain and are being targeted. So, go through your inventory and make sure that you've applied the relevant updates. Note the fix for the impacted D-Link devices is replacement as they are EOL; even so, make sure the management interface remains NOT Internet accessible. Remember: SimpleHelp requires action on the server and endpoints.
- Slide 3 of 3
It’s only been a year since patches were made available; what’s a couple more weeks in the scheme of things to mandate patching? One wonders what becomes of the KEV catalog once Claude Mythos and GPT-5.4-Cyber are more broadly released.
Slide 1 of 0- Slide 1 of 3
The Rest of the Week's News
Fast16 Cyber Sabotage Framework is Older than Stuxnet
Researchers from SentineOne's SentinelLABS have deciphered a cyber sabotage framework they are tracking as “fast16,” which "selectively targets high-precision calculation software, patching code in memory to tamper with results." The core components of fast16 date back to 2005, making it at least five years older than Stuxnet. When the malware propagates across a facility, it will produce "equivalent inaccurate calculations" on all affected systems; the effect could range from tainted research to serious physical damage. The researchers, Vitaly Kamluk and Juan Andrés Guerrero-Saade, initially "set out to trace the earliest sophisticated use of an embedded Lua engine in Windows malware." The existence of fast16 code first emerged in the Shadow Brokers 2017 NSA leak.
Editor's Notes
- Slide 1 of 4
This resets our understanding of how far back this type of state-sponsored covert exploit was developed/deployed. The good news is the SentinelLabs story includes both IoCs and YARA rules to detect the malware. While the signature for the svcmgmt.exe binary was uploaded to VirusTotal about ten years ago, there appear to be almost no detections. Regardless of past categorizations of the malware, we need to find and neutralize fast16 if present.
- Slide 2 of 4
Data modifications are often overlooked in breaches. There are few documented cases in part because they are hard to detect. For example, a breach of an ERP system may not steal data, but instead (or in addition) modify data to subtly disrupt business processes. These changes are often undiscovered as it is difficult to audit the data for accuracy.
- Slide 3 of 4
This really just points out the need for thorough testing of any software with business critical output — including spreadsheets in use — after any/every change. “Low precision” errors are introduced by well-meaning programmers and spreadsheet jockeys all the time.
- Slide 4 of 4
We worry about leakage after a breach, in part, because it is obvious. However, given current practice, the risk of tampering with our data is a greater risk. Restrict "write" access to programs and sensitive data to a single individual or process, e.g., application, database manager, or document management system. Log all changes. Consider version control (we expect it of cloud services).
Slide 1 of 0- Slide 1 of 4
ADT Discloses Data Breach
On April 24, 2026, home security provider ADT confirmed that it experienced a data breach on April 20. The company detected unauthorized access to "certain cloud-based environments" containing data belonging to current and prospective customers, and responded by immediately activating response protocols, "terminating the intrusion, launching a forensic investigation with leading third-party cybersecurity experts, and notifying law enforcement." The data accessed included names, phone numbers, and addresses, with a subset also including dates of birth and the last four digits of Social Security numbers or Tax IDs, and all affected individuals have been notified directly. ADT characterizes the scope of the attack as "limited," and has not verified any threat actor's claims, but the breach listing on Troy Baker's havibeenpwned estimates the affected accounts at 5.5 million.
Editor's Notes
- Slide 1 of 2
This breach is concerning not just because of leaked credentials but also because of possible effects on cameras or other sensors ADT may have access to at affected homes and businesses.
- Slide 2 of 2
While reputation risk is not the factor it used to be, protection, to include customer information, is core to ADT's service offering. The good news is this appears to be a limited breach; they are being transparent and have remediated the issues. And you know me: make sure that you've taken steps to protect your information/identity regardless of who you're sharing that information with. It really is a relief when you get a breach notification that offers protection, and you can say, “thanks, I've got this.”
Slide 1 of 0- Slide 1 of 2
UK Biobank Data Listed for Sale Online
Personal health data of more than 500,000 UK Biobank volunteers is being sold online. Biobank is a biomedical research database that comprises genome sequences, detailed bloodwork results, data gathered from scans and monitors, and details about lifestyles and habits. The organization says it is "the world’s most detailed study for tracking the long-term health of people as they age." Biobank volunteers had agreed to make their data available for research. The de-identified information is used by more than 22,000 researchers around the world, and participating researchers are prohibited from "publish[ing] any material which could lead to the identification (inadvertent or otherwise) of an individual." The breach has been traced to researchers at three participating institutions, and their access to Biobank data has been suspended. Biobank is temporarily suspending access to all their data while they put more stringent protection measures in place.
Editor's Notes
This is deidentified data, which is good, and Biobank revoked access to the researchers who misused their access to the information. The EULA required the data to be used in a closed, cloud-based research system hosted in the UK, and they are working to fix the means by which the research data was exfiltrated from this closed environment. It's a good idea to check systems where you have restrictions for unanticipated workarounds. It's a red flag if you hear users mentioning stupid or ineffective controls. Whether that indicates an exploitable weakness or restriction preventing the intended use case, a non-threatening follow-up conversation is appropriate to validate, understand, and remedy the concerns.
Itron and Medtronic Breached
Two major suppliers of technology for utilities and medicine, respectively, have disclosed cyberattacks, both filing form 8-K with the US Securities and Exchange Commission (SEC). Itron is based in the US state of Washington and offers services and technology to support utilities and infrastructure for energy, water, gas, transportation, and other resources, counting over 8,000 utilities and cities in more than 100 countries among its clients. Itron activated its cybersecurity response plan on April 13, 2026 upon being notified of unauthorized third-party access to its systems, and also notified law enforcement and engaged external advisors "to assess, mitigate, remediate, and contain the unauthorized activity." Since removing the unauthorized access, Itron has not observed any further such activity in its corporate or customer-hosted systems. The company reports that its contingency plans and backup systems have allowed operations to continue, and anticipates that direct costs will be reimbursed by insurers, stating that the incident is unlikely to have a material impact. Medtronic is a medical technology company headquartered in Galway, Ireland, and Minneapolis, Minnesota, and is the largest medical device company in the world by revenue, exceeding Johnson & Johnson, Medline Industries, Siemens Healthineers, and Stryker. Medtronic disclosed on April 24 that its corporate IT systems were accessed by an unauthorized third party, prompting the company to contain the access, activate incident response protocols, and begin investigation and remediation with external cybersecurity experts. The company will notify and offer support services to any individuals whose personal information may have been accessed. There has been no identified impact to products, patient safety, connections to customers, manufacturing and distribution, financial reporting systems, or service to patients. Medtronic does not expect the incident to materially impact its business or financials.
Editor's Notes
Itron says they were "notified" that they were hacked, but no details are provided, nor are they providing details about the attack. Their actions hint to a data breach rather than ransomware. While it's great that someone let them know they had an issue, and I wish them luck with their recovery, we all need to be certain we can detect our own issues, to include dark web monitoring. Not sure I want to sit in a board meeting and say, “Someone else, not sure who, will let us know if we have a problem.”
Canada’s First SMS Blasters Confiscated, Operators Arrested
On March 31, 2026, Canadian authorities arrested three men and confiscated three SMS blasters, believed to be the first known use of this technology in Canada. As described in the Toronto Police Service (TPS) press release, "an SMS blaster works by mimicking a legitimate cellular tower," intercepting mobile traffic by tricking devices in range to connect to the SMS blaster instead, allowing attackers to send "fraudulent text messages that appear to come from trusted organizations," including links for conducting SMS phishing. A TPS investigation dubbed "Project Lighthouse" began in November 2025, and led to the discovery of vehicles operating SMS blasters in multiple locations in the Greater Toronto Area. Detective Sergeant Lindsay Riddell estimated that tens of thousands of devices had connected to the blaster, causing over 13 million network disruptions in legitimate cell tower connections, potentially impacting access to 911 services. TPS seized "a large quantity of electronic evidence" in addition to the blasters themselves, and arrested two suspects; the third suspected conspirator turned himself in to the police three weeks later. TPS credits the work of the Coordinated Cyber Centre within its Intelligence Unit, as well as assistance from the Royal Canadian Mounted Police (RCMP) National Cybercrime Coordination Centre, RCMP’s Ontario Division, York Regional Police, Hamilton Police Service, and financial institutions and telecommunications providers. The press release reminds the public to never follow links or share personal information in unexpected text messages, to be wary of messages requesting payment, to access known apps and type trusted websites directly, and to report fraud incidents to the police.
Editor's Notes
- Slide 1 of 4
That these are mobile devices hints they can be in any location; it also highlights the difficulty of tracking and stopping the attacks as well. Hat tip to Project Lighthouse/TPS & RCMP. We need to remind users to beware of unexpected text messages, and be doubly careful clicking any included links. Investigate settings where messages from unknown senders are filed/marked as spam. When in doubt, contact the sender via a known good communication channel rather than the number or web site included in the message.
- Slide 2 of 4
With any form of *ishing, the best protection is to simply 'stop and think.' Take that moment to resist clicking on that link or responding to a payment request, and never ever share your login information.
- Slide 3 of 4
Legacy telecom protocols are still a problem, and the more easily the technology is acquired, the bigger the problem will be. Traditional SMS is a very weak protocol, as it is just the standard caller ID system. Spoofing is trivially easy. Hopefully we can start to deprecate some of this technology at some point.
- Slide 4 of 4
As hardware gets cheaper and more general — i.e., software configurable — in application, the cost of these attacks will fall and their rate increase.
Slide 1 of 0- Slide 1 of 4
FCC's Router Ban Now Includes Portable Hotspots
The US Federal Communications Commission (FCC) has clarified that the agency's ban on routers made outside the country includes mobile hotspots. While the FCC made no formal announcement, it did add information to the "Is my device a consumer-grade router under the National Security Determination?" section on an FAQ page dedicated to the ban. The section clarifies that "consumer-grade portable or mobile MiFi Wi-Fi or hotspot devices for residential use [and] LTE/5G CPE devices for residential use" are considered consumer grade routers. Mobile phones with hotspot capabilities do not fall under the designation. Companies that manufacture mobile hotspots will be required to apply for an exemption if they wish to import and sell devices that have not received prior governmental approval. The device ban applies to consumer-grade devices, but industrial, enterprise, and military equipment are not subject to the ban.
Editor's Notes
- Slide 1 of 3
This is an update to the FCC's "FCC Covered List" which is a list of communications equipment that is deemed to pose a risk to the national security of the US. The idea is to ban devices which have hidden nefarious purposes; it also helps pave the way for consumer device labeling and certification, such as the US Cyber Trust Mark. Regardless of this, make sure you're qualifying and selecting known, good, supported devices. If the conversation starts with price or availability from a questionable source or brand, back up and look more closely; these are likely not a bargain in the long run.
- Slide 2 of 3
I am watching this one closely to better understand how the determination of hotspot and router is made. Most devices can be configured as routers. Most cellular devices have hotspot capabilities. Removing that caveat, you would also need to consider how many actual hotspots are needed by critical infrastructure items and other support services like city police and fire. If we are being very serious about this, I would expect massive subsidies to promote the offset of costs for building onshore or nearshore.
- Slide 3 of 3
Glad I've got mine. Since my iPad is Wi-Fi-only, I sometimes use my iPhone as a hotspot to connect it to the Internet. I also have a travel router for use in guest rooms, hotel rooms, and cruise ships. Typical? (This generation never had to crawl under the hotel bed with alligator clips.)
Slide 1 of 0- Slide 1 of 3
Chinese National Extradited to US from Italy to Face Charges Related to HAFNIUM Campaign
Authorities in Italy have extradited a Chinese national to the US to face charges of wire fraud, aggravated identity theft and unauthorized access to protected computers. Xu Zeiwei appeared in US District Court in Houston, Texas on Monday, April 27, 2026. A November 2023 indictment alleges that Xu had a role in cyber intrusions that were part of the HAFNIUM campaign, which infected thousands of machines worldwide, and intrusions targeting COVID-19 research. The HAFNIUM campaign exploited vulnerabilities in Microsoft Exchange Server. The indictment also alleges that while working at a company called Shanghai Powerock Network Co. Ltd., Xu was directed by intelligence services in the People's Republic of China (PRC) to conduct these operations. Xu was arrested in Milan in July 2025. Xu's alleged accomplice, Zhang Yu, remains at large.
Editor's Notes
- Slide 1 of 2
Another win for international law enforcement cooperation, but who is HAFNIUM? HAFNIUM is also known as Silk Typhoon or APT40 (2021 Exchange Server breach, 2022 Tarrask Malware) — they were in the news in March 2025 when 12 members were charged with attacks on the Treasury and other US Government agencies, which lead to Xu's arrest in Italy last July. If convicted, he faces 77 years in prison. This is another case where you want to consider carefully: it's 2026, what services are you running on premises versus hosted? Look at hosted/cloud services as a partnership, allowing your team to focus on fewer, manageable controls, rather than a one-and-done.
- Slide 2 of 2
In certain countries the relationship between national authorities and private companies is symbiotic. The extradition is a cold reminder that certain freedoms (travel) can be lost once you start doing the government's bidding.
Slide 1 of 0- Slide 1 of 2