Brief #89: DeepSeek AI Breach, TeamViewer Zero-Day, AWS Security Automation

Happy Sunday!

Hope you're enjoying your weekend! While you were busy wrapping up another week, the security world kept spinning with some pretty interesting developments. Here's what caught my attention:

• Apple's M-series processors have a couple of sneaky new vulnerabilities that let attackers steal data right through your browser
• An AWS engineer built something cool - an AI tool that automatically generates security guardrails for Terraform
• A quarter of CISOs are thinking about switching careers due to burnout (we need to talk about this!)

Plus plenty more stories that'll make you go "hmmm..." Grab your favorite Sunday beverage and dive in!

Your feedback shapes Mandos Brief and I'd love to hear your thoughts about the content I share.

INDUSTRY NEWS

TeamViewer Patches Privilege Escalation Vulnerability in Windows Client

• High-severity vulnerability (CVE-2025-0065) with CVSS 7.8 discovered in TeamViewer's Windows applications, allowing local attackers to perform argument injection in 'TeamViewer_service.exe' for privilege escalation.

• Affects multiple versions (11.x through 15.x) of TeamViewer Full Client and Host applications. Fixed in versions 15.62, 14.7.48799, 13.2.36226, 12.0.259319, and 11.0.259318.

• No evidence of exploitation in wild, but TeamViewer has history of being targeted by threat actors for remote access and malware deployment in attacks.

Apple M-Series CPUs Vulnerable to New Side-Channel Attacks FLOP and SLAP

• Researchers discovered two new side-channel vulnerabilities affecting Apple M2/M3/A15/A17 processors, allowing attackers to steal sensitive data through malicious websites using JavaScript or WebAssembly without requiring malware installation.

• The attacks (FLOP and SLAP) exploit flaws in speculative execution implementations to bypass browser sandboxing and steal cross-origin data from Safari and Chrome, including email contents, calendar events, and location history.

• While Apple acknowledged the vulnerabilities reported in March and September 2024, they remain unpatched but claim there is no immediate risk to users. The only current mitigation is disabling JavaScript, which impacts website functionality.

ESXi Ransomware Attackers Exploit SSH Tunneling for Stealth Persistence

• Threat actors are targeting VMware ESXi infrastructure not just for ransomware deployment, but also as network pivot points using SSH tunneling techniques to avoid detection while moving laterally through networks.

• Attackers gain initial access through stolen admin credentials or by exploiting vulnerabilities, then establish persistence using native SSH functionality for remote port-forwarding to C2 servers, taking advantage of ESXi's high uptime.

• ESXi's distributed logging system complicates forensic investigation, but key detection opportunities exist in monitoring syslog files for suspicious activities like SSH service enabling, firewall rule modifications, and unusual port forwarding commands.