Salt Typhoon logged into telecom network gear with stolen credentials in all but one case Talos examined
Cisco Talos's February 2025 analysis of Salt Typhoon's telecom intrusions found the actor used stolen legitimate logins on Cisco devices in all but one case. It then pulled more logins from weakly encrypted router configs and captured TACACS and RADIUS keys, so credentials stored on network gear are the first exposure for defenders to close.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+5
- Incentives40
- Confidence66
F5 fixed eleven NGINX flaws, three of them critical. Each of the three depends on a specific configuration, and SecurityWeek reports that neither F5 nor Juniper mentions exploitation in the wild.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap−10
- Incentives
- Not scored
- Confidence65
CISA sets a September 13 deadline for the MikroTrick RouterOS chain
Federal agencies now have three separate patch deadlines inside twelve days. The lowest-scoring pair of the five flaws added to KEV is the one with a documented 24-day intrusion campaign behind it.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap−10
- Incentives
- Not scored
- Confidence55
CISA says an integer underflow in MikroTik RouterOS web management gives an unauthenticated attacker root with one crafted request on versions below 7.24. No exploitation has been reported, but MikroTik's fix advice sets a 7.23 floor that CISA's own affected range still covers.
Perspective Coverage
3 publishers
- Builder
- Builder 27%
- Operator
- Operator 66%
- Investor
- Investor 7%
Reality
- Evidence64
- Adoption70
- Hype gap+8
- Incentives
- Not scored
- Confidence62
MikroTik published RouterOS fixes in four branches with no CVE and no technical detail. The same upgrade runs a compromise check and writes a critical log entry marking the device Flagged.
Perspective Coverage
3 publishers
- Builder
- Builder 22%
- Operator
- Operator 71%
- Investor
- Investor 7%
Reality
- Evidence76
- Adoption
- Not scored
- Hype gap−40
- Incentives45
- Confidence72
A signed UEFI shell can disable the Secure Boot that trusted it
On a September 10 podcast, Eclypsium researchers walked from vulnerable signed UEFI shells to Fire Ant binaries wearing EDR agent names. The common thread is verification: a defender can check very little of that stack alone.
Publishers:eclypsium.com
Reality
- Evidence30
- Adoption30
- Hype gap+15
- Incentives78
- Confidence45