A (0:00)

Cybersecurity Today would like to thank Meter for their support in bringing you this podcast. Meter delivers a complete networking stack, wired, wireless and cellular in one integrated solution that's built for performance and scale. You can find them at meter.com CST Microsoft patches Windows Admin center flaw that could enable tenant wide compromise gootloader returns Anthropic quietly patches three MCP vulnerabilities and voidlink may mark the first real wave of AI generated malware. This is Cybersecurity Today. I'm your host Jim Love. Microsoft is warning customers to update Windows Admin center in Azure after disclosing a flaw that could let attackers pivot to from local admin access on one system into tenant wide control through the platform's management and single sign on mechanisms. Microsoft assigns the vulnerability a CVSS base score of 7.5 that places it in the high severity category and that rating reflects the potential impact and not how easy the flaw is to exploit. The attack complexity is rated high, meaning an attacker must already have local administrator privileges and and invest effort in preparing the attack. But Microsoft warns the consequences of a successful exploit could be severe. According to the advisory, an attacker could exploit the flaw by sending a specially crafted HTTPs request to the Windows Admin center head node. If successful, they could gain local administrator privileges across the WAC managed machines within a tenant. This vulnerability is also rated as a scope change, meaning it could allow attackers to cross trust boundaries and interact with other tenant applications and content. The good news is most customers should already be protected as Windows Admin center is configured for automatic updates by default in Azure. For environments where automatic updates are disabled, administrators need to manually update the Admin center extension through the Azure portal. Microsoft says there are no configuration only mitigations that will fully address the risk without applying the patch. It's worth checking and being certain that auto updates are enabled or that you've added the patch. This is the kind of vulnerability that isn't easy to exploit, but if it is exploited, it hands attackers control of the management plane, where even a single foothold can quickly turn into something much larger. After a seven month pause, the goot loader operation is active again and it's significantly upgraded. How it Hides its payloads Gootloader is a malware loader typically used for initial access. It's designed to trick users into running a malicious JavaScript file disguised as a legitimate document. Once it's executed, it pulls down additional malware and often opens the door for ransomware or hands on keyboard attacks. Later in the intrusion the campaign resurfaced last November, according to researchers at Huntress Labs. At that point, Gutloader was already experimenting with malformed zip files, but those early samples were relatively simple, with file name mismatches and extraction errors that analysts could still work around. What researchers are seeing now is far more deliberate. According to recent analysis from Expel, Gut Loader's delivery mechanism has been redesigned specifically to evade detection and crash analysis tools. Instead of a normal archive, the malware is delivered as a malformed zip created by concatenating hundreds, sometimes up to a thousand zip archives. This exploits the way zip parsers read file structures from the end of a file, and the archive also uses a deliberately truncated end of central directory record that's missing mandatory bytes, causing many security tools to fail outright when trying to analyze it. Additional tricks include randomized disk number fields that make tools expect non existent multi disk archives and metadata mismatches between zip headers and directory entries. Each download is also unique, defeating signature based detection. To further complicate inspection, the zip arrives as an XOR encoded blob that is decoded and repeatedly appended on the victim's system until it reaches full size, bypassing network based scanning. When fully reconstructed and extracted, the result is a familiar payload, an archived jscript file that launches Gut Loader and establishes initial access. Now, researchers say there are practical ways to reduce risk blocking execution of Wscript.exe and Cscript.exe for downloaded content where JavaScript execution isn't required. That single control could stop Gut Loader from launching its initial loader even if a malformed zip is successfully extracted. Beyond that, basic defenses still matter. DNS filtering can help block access to newly registered or known malicious domains. Endpoint monitoring should watch for unexpected script execution or JavaScript spawning. PowerShell and user awareness remains important, particularly around downloads reached through search results rather than trusted sources. These steps don't eliminate the threat altogether, but they raise the bar, breaking the delivery chain before bootloader can do what it's designed to do. Gain that first foothold. Anthropic has quietly patched flaws in its official Git MCP server after researchers showed that they could be chained into remote code execution using prompt injection. The component is Anthropic's MCP Server Git, part of the Model Context Protocol ecosystem that lets AI tools talk to Git repos Using natural language security, researchers at Sciata found three vulnerabilities a repository path validation bypass at CVE2025 68145, an unrestricted Gitinit capability at CVE2025 68143 and an argument injection in git diff and git checkout cve2025 68144 and the fact is, these three vulnerabilities are important. As Yarden Poret, a researcher at Sayada, told the Register, agentic systems break in unexpected ways when multiple components interact. Each MCP server might look safe in isolation, but combine two of them git and file system in this case and you get a toxic combination. He was careful to add that there's no indication that the attackers have exploited the bugs in the wild. But with MCP growing in importance as a way to integrate AI models into practical use, the way in which they seem so vulnerable is important, and this is what is referred to as an indirect attack or prompt injection. The attacker plants instructions somewhere in the AI driven IDE that will read them a web page, a GitHub issue. That's the indirect prompt injection step. The model follows the hidden instructions and uses git MCP tools plus a second tool, the file system MCP server. It uses git tools like clean and smudge filters that run shell commands during normal git operations. And when those filters trigger the script runs and you have code execution on the host running the agent, the individual CVEs matter because they remove the safety rails that are supposed to constrain the agent. CVE2025 68145 lets an attacker escape the intended repository path restriction. CVE2025 68143 lets the agent initialize repos anywhere on the file system. And finally, CVE2025 68144 lets crafted arguments overwrite or delete files by passing unsanitized parameters into the git operations. Anthropic fix includes removing the gitinit tool entirely. Sciata reported the bugs in June and Anthropic fixed them in December. The issues affect default deployments of MCP server git prior to 2025. 12.18 Sayada did say there's no indication the bugs were exploited in the wild, but the bigger point is the pattern. Each tool can look safe by itself, but become dangerous when an agent can chain them together. Last week we talked about voidlink as a sophisticated malware framework targeting Linux based cloud servers. This week, new research from Checkpoint Research adds a much more troubling dimension. Voidlink appears to be one of the first clearly documented cases of advanced malware authored almost entirely by artificial intelligence. Check Point says voidlink represents a break from earlier example of AI assisted malware, which were usually tied to inexperienced threat actors or simple rewrites of existing open source tools. In contrast, they say Void Lake shows evidence of structured engineering, including documented development, sprints and coding guidelines, suggesting deliberate, disciplined design rather than simple experimentation. What makes this discovery unusual is how early it happened. Researchers believe they caught Void Link largely by chance after a compiled test version was uploaded to VirusTotal very early in development. One recovered artifact, timestamped December 4, roughly a week after the project appears to have begun, shows the framework already functional, with more than 88,000 lines of code. That early submission gave the defenders a rare look inside the project that likely would have been far harder to analyze once it was fully operational. Check Point notes that while the project was presented as a 30 week engineering effort, the available evidence suggests it was built much faster, highlighting how AI can dramatically compress development timelines for even complex malware. And despite the listings of various teams in the documents, it's quite likely, according to Checkpoint, that this was actually done with AI and perhaps a single individual. So the concern isn't just speed, it's also originality and technical innovation. This wasn't a remix of known tools, it was a custom framework produced at scale. This doesn't mean that AI written malware is suddenly everywhere, but voidlink shows what happens when capable developers use AI as a force multiplier, shrinking the time between concept and deployment and leaving defenders with far less warning than they might be used to. We put a link to the Checkpoint paper in our show notes. Check tech newsday.com or CA under Podcasts and we've reached out to Check Point to see if we can get an interview for our weekend show. And that is our show and we'd like to thank Meter for their support in bringing you this podcast. Meter delivers full stack networking infrastructure, wired, wireless and cellular to leading enterprises. Working with their partners, Meter designs, deploys and manages everything required to get performant, reliable and secure connectivity in your space. They design the hardware, the firmware, build the software, manage deployments and run support. It's a single integrated solution that scales from branch offices to warehouses to large campuses, all the way to data centers. Book a demo@meter.com CST that's M E T E R.com CST I'm your host Jim Love. Thanks for listening.