Darthtech

A Cybersecurity team with 30 years combined experience. Our company specializes in network security, SD-WAN, and Security Camera deployment.

[Darthtech @Darthtech_]

Anthropic opened its strongest cyber models to more vetted teams, including tests of interbank systems.

Not a breach. A preview. If a vendor turns that on inside the bank, the permission is the control.

[Darthtech @Darthtech_]

Korean banks were hit through loan-broker and sales-support side doors. AI may have sped it up. The door was already there.

If a vendor agent can see the loan file, the model is not the control. The permission is.

[Darthtech @Darthtech_]

A coding agent sent local secrets because it could read untrusted context and it already had the keys.

Prompt injection is the trigger. Standing access is the breach.

No full fix for the first. Default-deny is the fix for the second.

[Darthtech @Darthtech_]

Prompt injection that matters: a lead form tells the agent what to do.

Salesforce patched SalesBleed. The pattern is still the risk. If the agent can read untrusted text and act with a staffer’s access, the form is the exploit.

[Darthtech @Darthtech_]

FortiMail zero-day, already exploited. No click required.

If the mail gateway is the front door, patch is step one. Checking what ran before the patch is step two.

[Darthtech @Darthtech_]

TeamViewer: five high-severity fixes. Worst one can bypass session permissions and potentially run code.

Not exploited yet. Update to 15.82.

Yesterday the RMM was fake.

Today the real one still needs a version check.

[Darthtech @Darthtech_]

ClickFix is back inside ChatGPT-search lures.

Google → fake page → paste the “fix” → trojan.

No exploit.

If the paste can run, the delivery mechanism does not matter.

[Darthtech @Darthtech_]

New RAT: fake Microsoft Store page → RMM tools → hijacked PC.

No exploit required.

If unapproved remote-support software can run, the second stage is already paid for.

Default-deny is the control. Alerts are the autopsy.

[Darthtech @Darthtech_]

CISA added two Citrix NetScaler RCE bugs to KEV over the weekend. Already exploited.

If that’s how staff get in after 5, patch this week.

Then ask what ran inside if the box was hit first.

Gateway last Friday. Citrix this Monday. Same question.

[Darthtech @Darthtech_]

CISA deadline today: two Check Point gateway/VPN and management flaws already exploited.

If that box is how staff get in after hours, patch is step one.

Forensic look is step two.

“Can unapproved tools run inside if the gateway was owned?” is still the question.

[Darthtech @Darthtech_]

ClickFix doesn’t need malware.
It needs permission to run.

Fake “verify” page → staffer pastes PowerShell → ransomware.

Training won’t catch every paste.
Default-deny will.

If the Run dialog can execute whatever a webpage copied, the exam question writes itself.

[Darthtech @Darthtech_]

Trusted tools yesterday. Trusted login screen today.
Microsoft disrupted EvilTokens — AI phishing that hijacked 12,000+ Microsoft inboxes across 10,000+ orgs.
No exploit. The user approved the prompt.
Phishing-resistant MFA for anyone who can reset accounts.
#Identity #ZeroTrust

[Darthtech @Darthtech_]

New Windows backdoor, old trick.

TASK#STOMP uses PowerShell, scripts, and scheduled tasks already on the machine — then steals documents and Wi-Fi passwords.

AV asks “is this bad?” Default-deny asks “is this approved — and what can it do?”

Trusted tools are still the foothold.

[Darthtech @Darthtech_]

NCUA gives credit unions 72 hours to report a cyber incident.

The clock starts when you reasonably believe it happened. Not when your investigation ends.

A vendor notice that member data was exposed can start it.

Lean teams: know who files, and how, before the bad day.

#NCUA

[Darthtech @Darthtech_]

92% of credit unions run security with fewer than 3 people.

Average breach impact: $8.2M. That's 40% above the financial industry average.

Mean time to detection: 278 days. Big banks catch it in 233.

Lean teams don't need more alerts. They need fewer things that can go wrong.

[Darthtech @Darthtech_]

CISA gave federal agencies until Sept 22 to patch CVE-2026-81963 and CVE-2026-85880.

Both are privilege escalation to SYSTEM. Both are already being exploited.

Your bank isn't a federal agency. The deadline doesn't apply to you - the risk does.

#PatchTuesday #ZeroTrust

[Daniel Dean @firstgreendean]

“We have backups” is not the same as “we’re back Tuesday.”

New recovery data: only 4 of 800 clients came close to a 24–48 hour ransomware RTO — and only partial. Full recovery took weeks.

Identity fell first. Most backups were tied to the same directory.

#Ransomware #ZeroTrust

[Darthtech @Darthtech_]

iOS 27: Siri AI can see your screen and app context. MDM can restrict it.

Don’t day-one update every work phone. Pilot first.
New AI is useful. Uncontrolled AI on a work phone is not.

#iOS27 #MDM

[Darthtech @Darthtech_]

Staged rollout exists for this reason.

In a small bank:
1–2 less-critical servers + one workstation per department first. The rest in 2–7 days.

September patches can break RDS. “Patch everything today” is not a plan.

Ringfencing buys you time during that window.
#PatchTuesday

[Darthtech @Darthtech_]

Print servers don’t get the attention endpoints do.
PaperCut flaws were just used — with AI agents — against 395 organizations.

If print software can reach file shares or run with extra rights, it is not a side system. It is a foothold.

Patch it. Then constrain it.
#ZeroTrust