Defender's Corner

Researchers at FortiGuard Labs have identified a Linux backdoor called ClingSTUN that targets home routers and network devices from brands including D-Link, TP-Link, Tenda, Ivanti, and others, turning infected devices into hidden proxies for attackers, according to SecurityWeek.

The malware spreads by exploiting known, unpatched vulnerabilities — meaning most infections are preventable.

What you should do: Log in to your home router's admin panel (usually found at 192.168.1.1 or 192.168.0.1 in your browser) and check for a firmware update. If your router model is no longer receiving updates from the manufacturer, consider replacing it. Routers are not set-and-forget devices. If yours is more than five years old and the manufacturer has stopped supporting it, it is effectively an open door.

For Cybersecurity Awareness Month, Cisco Talos researchers published a practical guide to frustrating attackers before they reach their goals, and it is worth reading for anyone responsible for a network, according to Talos Intelligence.

Two ideas stand out for non-enterprise readers. First, restrict which accounts can log into your most sensitive systems and set alerts for any unauthorised attempts — most attackers rely on tools that work against default configurations, and small deviations can stop them cold.

Second, consider honeypot accounts: decoy email addresses with no real users. Any message sent to them is almost certainly malicious, giving you early warning before a real attack lands. No special software required — just a mailbox nobody legitimate would ever contact.

Every secure website uses a digital certificate — a credential issued by a Certificate Authority (CA) that tells your browser the site is legitimate and that your connection is encrypted. Cloudflare has announced it is launching a public CA, free for any website, that will support both current encryption and next-generation post-quantum security standards, according to Dark Reading.

If you run a website, this means free, automatically renewed certificates hardened against future quantum computing threats — with no technical rebuild required. For everyday readers, the practical benefit is more websites maintaining valid, up-to-date certificates, which means fewer "your connection is not secure" warnings caused by expired credentials.

Keep an eye on Cloudflare's CA announcement for availability updates.

The JadePuffer attack succeeded in part because credentials were accidentally posted to a public GitHub page. This is more common than most organisations realise — developers commit API keys, passwords, and service account details to public repositories regularly, often without knowing it.

A free tool called GitGuardian's Public Monitoring scans public GitHub repositories for exposed secrets and alerts you when it finds them. For a broader sweep, truffleHog is a free, open-source tool that scans repository history for credentials — including content that was edited out but remains in the commit log.

What to do: Run a search of your organisation's public GitHub repositories for your domain name, service account names, or any known credential prefixes. Rotate anything that appears. Then set up automated scanning so it never gets this far again.

The Salt Typhoon breach — covered in today's Compliance section — gave Chinese government hackers access to call records, call timing, location data, and in some cases live audio and texts from nine major US telecoms. If you are a Verizon, AT&T, or Lumen customer, your metadata may have been collected.

The FCC's Salt Typhoon resource page at fcc.gov lists confirmed carriers and guidance on what was accessed. Check whether your carrier is on the list, then review whether you were in any circle of communication with senior government contacts — that was the targeting focus.

More broadly: if you have sensitive conversations by phone, consider switching to an end-to-end encrypted messaging app such as Signal for those exchanges. Encrypted messaging is outside the scope of what Salt Typhoon collected.

CISA has published new guidance on cyber deception — the practice of setting digital traps to catch attackers before they cause serious damage, as covered by Dark Reading.

The idea is simpler than it sounds. Create a file on your network called something like passwords.xlsx and configure an alert to fire the moment anyone opens it. A legitimate employee will probably never touch it. An attacker who has already found their way in almost certainly will — because it looks like exactly what they came for.

CISA's guide also covers "honey users" — decoy accounts in your user directory that no real person ever logs into. Any login attempt on one of them is an immediate red flag.

These techniques require no expensive software. A single decoy file or account, properly monitored, gives you an early warning system that many commercial tools cannot match. Read CISA's full guidance here and consider starting with one honey file this week.

The fake LastPass Authenticator campaign, detailed by SecurityWeek, used SEO tricks to push a malicious download page near the top of search results. Victims who searched for a legitimate security tool found a convincing fake instead.

The fix here is not a new tool — it is a habit. Before downloading any software, go directly to the official website by typing the address yourself, or use the link from the vendor's verified social media profile. Never trust a download that came from a search result alone, even if it appears at the top.

LastPass is a password manager — software that stores and organises your login credentials securely. If you use one, download it only from lastpass.com directly.

What to do: Bookmark the official download pages for any security software you use regularly. One extra step now is considerably easier than removing a kernel-level malware driver later.

CISA (the US Cybersecurity and Infrastructure Security Agency) is retiring its weekly vulnerability bulletins on 28 September, shifting focus to its Known Exploited Vulnerability (KEV) Catalogue — a curated list of flaws that attackers are actively using in real attacks, per Dark Reading.

The reasoning is sound: vulnerability disclosures are surging (Microsoft recently disclosed close to 1,000 in a single monthly update), but the subset attackers actually exploit remains small. Chasing every CVE is a losing game. Prioritising the ones in the KEV list is not.

What you should do: Bookmark CISA's KEV Catalogue. Check it weekly. If any software you run appears on it, treat that patch as urgent — this list only includes vulnerabilities with confirmed real-world exploitation.

A scam variant flagged by security researcher Bruce Schneier is worth knowing about: attackers are framing malware downloads inside fake CAPTCHA prompts, according to Schneier on Security.

The setup looks like a routine "prove you're human" check — the kind you see on login pages everywhere. Instead of ticking boxes, the fake version asks you to run a command or download a file to "verify" yourself. That file is malware.

The rule is simple: a real CAPTCHA never asks you to download anything or run a command. If a verification prompt on any website asks you to do either of those things, close the tab immediately.

What you should do: Treat any CAPTCHA that asks for a download or a keyboard shortcut as an attack. Share this with anyone who uses the internet less cautiously than you do.

The Revolut breach is a reminder that personal data — once out — gets reused. Fraudsters who hold your name, address, and email are far better equipped to craft convincing follow-up scams.

Have I Been Pwned is a free, widely trusted tool run by security researcher Troy Hunt. Enter your email address and it checks it against hundreds of known data breaches to tell you whether your details have already been leaked and from where.

If your email appears in a breach, change the password for that account immediately, enable two-factor authentication (a second verification step beyond your password), and be extra sceptical of any emails that reference your personal details. Familiarity is not proof of legitimacy.