CYBER THREATCAST

Patch and inspect exposed edge routers now, especially Ruckus and ASUS devices, because China-linked UAT-7810 is compromising unpatched edge devices to expand the LapDogs Operational Relay Box proxy network. Cisco Talos reports the group is deploying LONGLEASH, DOGLEASH, and JARLEASH for proxying, remote command execution, and server management, while QPulse also describes China-nexus UAT-7810 exploiting n-day router flaws to grow the same relay infrastructure. Organizations with internet-facing routers should prioritize known-vulnerability remediation, remove unmanaged devices from exposure, and look for signs of proxying or remote command execution on edge equipment.

Update and monitor Roundcube mail servers immediately, with U.S. and Canadian universities taking priority. Proofpoint reports suspected Chinese-linked operators tracked as UNK_MassTraction are exploiting Roundcube CVE-2024-42009 through phishing-triggered XSS that runs when a message is opened and delivers the IceCube stealer. University security teams, especially those supporting physics and engineering departments, should treat suspicious Roundcube mail activity as potentially credential- or data-theft related and investigate opened phishing messages against affected servers.

Disable remote web management on Tenda networking products and check for exposure on UDP port 7329. Researchers disclosed a hidden Tenda router firmware backdoor that can bypass authentication and grant administrative access through the web management interface, with exploitation reportedly observed in the wild and a public Nmap NSE script automating detection and exploitation. Network teams should identify affected Tenda devices, restrict management access, and apply vendor or CERT-recommended mitigations where available; organizations with HP DeskJet printers should also review exposure because a separate unpatched flaw can expose sensitive admin information.

Force password resets and tighten monitoring for accounts tied to the third-party email platform used by the five Japanese ISPs affected by KDDI’s breach. KDDI said attackers exploited a zero-day in that platform before the vendor knew of the flaw, exposing email addresses and passwords for more than 12 million people. Providers and downstream organizations should assume exposed credentials may be reused elsewhere, block suspicious access, deploy or review endpoint detection coverage where applicable, and notify regulators and users in line with their obligations.

Update affected AI coding assistants and restrict agent write permissions when opening untrusted repositories. Wiz disclosed GhostApproval, a symlink-based vulnerability class affecting tools including Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, and Windsurf, where a malicious repository can trick an agent into writing outside the intended workspace, including adding an attacker SSH key to ~/.ssh/authorized_keys. Development teams using AI agents should apply available vendor fixes, review confirmation dialogs carefully, and avoid granting agents broad filesystem or command access for unfamiliar codebases.