Threat Digest: Cisco ISE Zero-Day and Linux Flaws

Top Stories

Cisco ISE zero-day becomes the immediate priority

Cisco is warning that a maximum-severity vulnerability in Identity Services Engine (ISE) is being exploited in attacks, according to BleepingComputer.

ISE can sit on a critical authentication and network-access path. Security teams should treat internet-accessible, partner-accessible, and administrator-facing interfaces as high-priority assets. Confirm the affected versions and available mitigations in Cisco’s security advisory before making production changes.

SparroWocky malware used in government espionage activity

Chinese threat actors are using SparroWocky malware in government-focused espionage attacks. Government agencies, diplomatic organizations, contractors, and other high-value targets should review recent endpoint and identity activity for signs of targeted compromise.

Hunt for newly created services, scheduled tasks, unusual outbound connections, credential-access activity, and persistence mechanisms that do not match approved software deployment.

CHOSEN BRICK targets Windows environments

Iranian hackers are using CHOSEN BRICK Windows malware to spy on targets. Organizations with sensitive intellectual property, government relationships, or regional exposure should prioritize endpoint telemetry and outbound network review.

The practical risk is not limited to malware discovery. A successful implant can provide a foothold for credential theft, surveillance, lateral movement, and long-term access.

Windows 11 update causes domain trust and login problems

The Windows 11 KB5124008 update is breaking domain trust for some users. Microsoft has also published a workaround for related Windows domain login and authentication issues.

IT teams should distinguish update-related authentication failures from malicious activity. Capture affected device names, domain-controller events, update status, and trust relationship errors before changing machine or domain credentials.

Malware forces Chrome and Edge extensions

Malware is bypassing browser checks to force-install Chrome and Edge extensions. Unauthorized extensions can alter browsing, collect data, redirect traffic, or create persistence.

An extension that appears on multiple endpoints without an approved software-change record should be treated as a security event until proven otherwise.

AI-powered data breach report reaches Spain’s data authority

Spain’s data protection authority has received its first report involving an AI-powered data breach. The development highlights a growing incident-response requirement: organizations must account for automated systems that can process, expose, or transfer sensitive information at scale.

Security and privacy teams should document which AI systems handle regulated or confidential data, what external services they contact, and how prompts, outputs, files, and logs are retained.

Radaris loses domains amid privacy dispute

Data broker Radaris has lost domains in a privacy dispute. The case illustrates continuing legal and regulatory pressure on personal-data aggregation businesses.

Organizations should include third-party data brokers and enrichment providers in privacy reviews, vendor assessments, data-subject request workflows, and data-retention controls.

Critical Vulnerabilities

Five Linux kernel vulnerabilities rated CVSS 9.8

The supplied vulnerability records identify five Linux kernel issues with CVSS 9.8 ratings. They affect storage-related components including Fibre Channel, NVMe target TCP, NVMe authentication, and NVMe multipath.

The supplied records do not mark these five vulnerabilities as known exploited vulnerabilities. That does not make them low priority. Storage servers, virtualization hosts, SAN-connected systems, NVMe targets, and remotely reachable Linux infrastructure should receive an expedited exposure assessment.

Cisco ISE exploitation risk

The Cisco ISE issue is the highest operational priority because the supplied reporting identifies exploitation in attacks. Organizations should not wait for evidence of compromise before applying the vendor’s fix or mitigation.

Review the relevant Cisco advisory and preserve authentication, administrative, and network-access logs before making changes where possible.

What Defenders Should Do Today

1. Inventory Cisco ISE immediately. Record versions, deployment roles, management interfaces, authentication interfaces, exposure paths, and administrative access sources. Apply Cisco-provided fixes or mitigations according to the vendor guidance.

2. Investigate ISE activity. Review administrative logins, configuration changes, authentication anomalies, unexpected network-access decisions, new accounts, and connections from unusual source addresses.

3. Identify Linux systems using affected functionality. Search asset inventories and package data for qla2xxx, NVMe target TCP, NVMe authentication, and NVMe multipath usage. Include storage appliances, hypervisors, database hosts, and specialized infrastructure.

4. Patch kernels through approved channels. Obtain updates from the operating-system maintainer, validate the kernel version in staging, and schedule reboots for systems that require them. If patching is delayed, restrict unnecessary exposure to NVMe target services and storage-management interfaces.

5. Review storage telemetry. Investigate kernel crashes, malformed or oversized NVMe traffic, abnormal authentication timeouts, unexpected namespace changes, request-ring errors, and suspicious storage-management activity.

6. Validate the Windows workaround. Test Microsoft’s domain-login workaround in a controlled environment. For devices affected after KB5124008, collect domain-controller and endpoint evidence before repairing trust relationships or rolling back changes.

7. Audit browser extensions. Compare Chrome and Edge extension inventories against approved baselines. Remove unauthorized extensions, restrict installation through enterprise policy, and investigate endpoints where extensions appeared without user approval.

8. Hunt for targeted malware activity. In high-value environments, search for newly created services, scheduled tasks, unsigned binaries, unusual parent-child process chains, credential-access behavior, and outbound connections associated with SparroWocky or CHOSEN BRICK investigations.

9. Review identity and remote-access logs. Correlate identity-provider, VPN, domain-controller, endpoint, and network data for anomalous authentication patterns. Separate update-related failures from suspicious login activity, but do not dismiss repeated failures without investigation.

10. Confirm response readiness. Verify incident-response contacts, endpoint-isolation procedures, emergency patching workflows, privileged-access controls, and offline or otherwise protected backups. Teams reviewing privileged-access hygiene may also consider a managed password manager such as Try 1Password →.

For additional preparation guidance, see this security audit checklist.

Technical Notes

Check Linux kernel and storage-module exposure

Use local checks as an initial triage step. Package and module names vary by distribution and kernel build.

uname -a
cat /etc/os-release

# Loaded storage-related modules
lsmod | grep -E 'qla2xxx|nvmet|nvme'

# Kernel messages related to the affected subsystems
journalctl -k --since "24 hours ago" \
  | grep -Ei 'qla2xxx|nvmet|nvme|I/O error|use-after-free|general protection|Oops|BUG'

# Identify NVMe devices and multipath state
lsblk
nvme list 2>/dev/null
multipath -ll 2>/dev/null

A clean result does not establish that a host is unaffected. Check installed kernel packages, booted versus installed versions, service configuration, and whether the system exposes NVMe target functionality.

Review Linux network exposure

Identify listening services and restrict storage protocols to approved networks.

ss -lntup
ss -lntup | grep -Ei '4420|nvme|iscsi'
sudo nft list ruleset

Do not assume a port match alone identifies a vulnerable service. Confirm the owning process and compare its configuration with the affected kernel functionality.

Audit Chrome and Edge extension inventories

For managed endpoints, collect extension IDs from enterprise-management telemetry where available. On a local Windows system, review browser policy and profile locations without modifying them during evidence collection.

# Review browser-related policy keys
Get-ItemProperty `
  -Path 'HKLM:\SOFTWARE\Policies\Google\Chrome' `
  -ErrorAction SilentlyContinue

Get-ItemProperty `
  -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Edge' `
  -ErrorAction SilentlyContinue

# Search common extension directories
Get-ChildItem "$env:LOCALAPPDATA\Google\Chrome\User Data" `
  -Directory -Recurse -ErrorAction SilentlyContinue |
  Where-Object { $_.Name -match '^[a-z]{20}$' }

Get-ChildItem "$env:LOCALAPPDATA\Microsoft\Edge\User Data" `
  -Directory -Recurse -ErrorAction SilentlyContinue |
  Where-Object { $_.Name -match '^[a-z]{20}$' }

Treat forced installation policies, unfamiliar extension IDs, unsigned helper applications, and extension changes that lack a software-deployment record as investigation leads.

Windows domain trust triage

Capture the current state before attempting repair:

whoami
hostname
systeminfo | Select-String 'OS Name|OS Version|Hotfix'

Test-ComputerSecureChannel -Verbose
nltest /sc_query:CONTOSO

Replace CONTOSO with the organization’s actual domain. Compare affected endpoints with unaffected devices, Windows update history, domain-controller logs, and the timing of trust failures. Apply Microsoft’s documented workaround only after validating it in the organization’s environment.

Preserve evidence during Cisco ISE investigation

At minimum, preserve:

• Administrative and authentication logs
• Configuration-change history
• Network-access and RADIUS activity
• Recent account and privilege changes
• Management-interface source addresses
• Relevant firewall, VPN, and identity-provider events
• System timestamps and time-synchronization status

Export logs to a controlled repository before retention limits or remediation actions remove useful evidence. Teams needing a practical starting point can also review this Windows digital forensics guide.

Prioritization Summary

Priority 1: Cisco ISE. Active exploitation makes Cisco’s advisory, exposure review, mitigation, and compromise assessment urgent.

Priority 2: Internet- or partner-reachable Linux storage systems. The five CVSS 9.8 kernel vulnerabilities require rapid inventory and patch assessment, particularly where NVMe target services or specialized storage paths are exposed.

Priority 3: Targeted malware hunting. Government, diplomatic, critical-infrastructure, and other high-value organizations should investigate SparroWocky and CHOSEN BRICK-related activity.

Priority 4: Endpoint and identity stability. Validate the Windows workaround, investigate KB5124008-related trust failures, and audit browser extensions for unauthorized installation or persistence.

Priority 5: Data governance. Review AI-enabled data processing and third-party data-broker relationships as both security and privacy risks.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.