Week of September 15, 2025: npm worm spreads, SonicWall backups breached

Security leaders spent the week of September 15, 2025 tracking a self-replicating npm worm that compromised more than 180 packages, a SonicWall disclosure that attackers brute-forced access to firewall configuration backups, and CISA's detailed malware report on Ivanti EPMM exploitation tied to CVE-2025-4427 and CVE-2025-4428. Google also patched an actively exploited Chrome zero-day, Microsoft and Cloudflare dismantled the RaccoonO365 phishing-as-a-service infrastructure, and Huntress detailed how Akira ransomware affiliates abused plaintext recovery codes to disable EDR protections.

CISA Details Malicious Listener Malware Targeting Ivanti EPMM

CISA published a Malware Analysis Report on September 18, 2025, describing two sets of malware recovered from an organization where threat actors exploited CVE-2025-4427 and CVE-2025-4428 in Ivanti Endpoint Manager Mobile. The report detailed loaders that let attackers inject and run arbitrary code on compromised Ivanti EPMM servers, and it included indicators of compromise plus YARA and SIGMA detection rules. CISA urged organizations to upgrade EPMM to the latest version and treat mobile device management systems as high-value assets with stronger monitoring and access restrictions. (CISA)

CISA Issues Eight ICS Advisories Covering Schneider, Siemens, Hitachi

On September 16, 2025, CISA released eight Industrial Control Systems advisories covering products from Schneider Electric, Hitachi Energy, Siemens, and Delta Electronics, including an OpenSSL vulnerability affecting multiple Siemens industrial products. The advisories detailed current security issues, vulnerabilities, and exploits affecting ICS equipment used across critical infrastructure sectors. CISA encouraged administrators to review the technical details and apply the recommended mitigations to reduce exposure in operational technology environments supporting manufacturing, energy, and utility operations. (CISA)

Self-Replicating 'Shai-Hulud' Worm Hits 180+ npm Packages

A self-replicating worm dubbed Shai-Hulud compromised more than 180 packages on the npm Registry, stealing credentials from developers who ran infected packages and publishing them to a public GitHub repository. The worm used stolen npm and GitHub tokens to inject itself into additional packages maintained by the same developer, continuing the infection cycle, and it used the TruffleHog scanning tool to harvest GitHub, AWS, Google Cloud, Azure, and npm credentials. It also converted private GitHub repositories to public ones with a "-migration" suffix. (Help Net Security)

SonicWall Discloses Brute-Force Breach of Firewall Backup Files

SonicWall disclosed on September 18, 2025 that unknown attackers used brute-force attacks to access its cloud backup service for firewalls, reaching backup firewall preference files for fewer than 5% of its firewall install base. The exposed files contained full firewall configurations, including network settings, routing rules, VPN configuration, and encrypted user credentials, information the company said could make it easier for attackers to exploit the related device. SonicWall disabled the backup feature, launched an investigation with a third-party incident response firm, and notified affected customers with remediation guidance. (Help Net Security)

Google Patches Actively Exploited Chrome Zero-Day CVE-2025-10585

Google released a Chrome stable channel update on September 18, 2025 to fix an actively exploited zero-day vulnerability, CVE-2025-10585, a type confusion flaw in the V8 JavaScript and WebAssembly engine reported by its Threat Analysis Group. The fix shipped in Chrome versions 140.0.7339.185/.186 for Windows and Mac and 140.0.7339.185 for Linux, alongside three other high-severity vulnerabilities. Google did not disclose attack details, and its Threat Analysis Group's involvement suggested the flaw may have been used by state-sponsored actors in targeted attacks. (Help Net Security)

Microsoft and Cloudflare Disrupt RaccoonO365 Phishing-as-a-Service

Microsoft's Digital Crimes Unit and Cloudflare disrupted the RaccoonO365 Phishing-as-a-Service operation, obtaining a court order from the Southern District of New York to seize 338 websites tied to the service that sold subscription-based kits for stealing Microsoft 365 credentials. The kits acted as an adversary-in-the-middle, capturing both passwords and session cookies to bypass multifactor authentication while impersonating brands such as DocuSign, SharePoint, Adobe, and Maersk. Microsoft said the service had earned at least $100,000 through its criminal enterprise before the takedown action disrupted its infrastructure. (Help Net Security)

Akira Ransomware Actors Exploited Plaintext Recovery Codes to Disable EDR

Huntress researchers reported that Akira ransomware affiliates gained access to a security engineer's Huntress console after finding multifactor authentication recovery codes stored in plain text, allowing attackers to log in, close active incident reports, remove isolated systems from containment, and attempt to uninstall EDR agents from compromised endpoints. The incident followed earlier Akira activity exploiting CVE-2024-40766 in SonicWall firewalls after organizations migrated devices without resetting local user credentials. Huntress advised organizations to treat recovery codes with the same sensitivity as privileged account passwords and store them only in encrypted, access-controlled locations. (Help Net Security)