September 2025 Summaries

A recent widespread NPM supply chain attack, driven by a worm named Shai-Hulud, highlighted the vulnerability of open-source ecosystems as it self-propagated and infected numerous packages, emphasizing the need for immediate threat visibility. The Sysdig Threat Research Team has been closely monitoring this worm and provides real-time intelligence through the Sysdig Threat Intelligence Feed, which offers users actionable insights into emerging threats, including malicious NPM packages. This feed helps security teams quickly identify and respond to potential risks by pinpointing affected workloads and confirming impact, thereby reducing false positives and unnecessary efforts. As supply chain attacks continue to evolve and target repositories like NPM, which is crucial for millions of JavaScript developers, tools like the Sysdig Threat Intelligence Feed become essential for maintaining security and ensuring rapid response to threats.

Runtime insights are pivotal to cloud security, offering real-time visibility into live activity across workloads, identities, and cloud services, thus enabling security teams to prioritize real risks and accelerate responses. Unlike traditional security tools that rely on periodic snapshots and often miss immediate threats, runtime insights reveal active vulnerabilities, misconfigurations, and excessive permissions that could be exploited. They support various cloud security use cases, such as vulnerability management by highlighting which vulnerabilities are actively in use, cloud security posture management by detecting posture drifts in real time, and cloud infrastructure entitlement management by identifying risky permissions. Additionally, they enhance cloud detection and response by allowing teams to spot threats and respond promptly. By providing the real-time context needed to reduce irrelevant alerts and false positives, focus resources on critical risks, and accelerate remediation, runtime insights are essential for securing cloud environments effectively and efficiently.

Sysdig Sage is an AI-driven tool designed to enhance cloud security for Security Operations Center (SOC) teams by transforming raw data into actionable insights through strategic prompts. It aims to alleviate the overwhelming nature of managing alerts and vulnerabilities by prioritizing critical threats and streamlining decision-making processes, thus functioning as a force multiplier for cloud security efforts. By utilizing specific prompts, such as identifying high-severity events or detecting resources with critical vulnerabilities, Sysdig Sage enables security teams to focus on significant issues efficiently. These prompts facilitate quicker responses, compliance checks, and asset visibility, while also aiding in understanding complex queries through natural language explanations. The tool exemplifies how AI can simplify security workflows, making cloud security more accessible and effective.

On September 15, 2025, a supply chain attack was discovered targeting the NPM repository with a self-replicating worm called Shai-Hulud, which has infected approximately 200 packages, including popular ones like @ctrl/tinycolor and several owned by CrowdStrike. This malware executes during the post-install phase of compromised packages, stealing credentials and attempting to exfiltrate data to sites like webhook[.]site, often making private GitHub repositories public. It uses the NPM ecosystem to spread by modifying package.json files to execute malicious scripts and employing tools like Trufflehog to discover sensitive credentials. The Sysdig Threat Research Team has been actively monitoring the worm, noting a slowdown in the spread due to quick responses. Detection and mitigation strategies involve using tools like Falco and Sysdig Secure to monitor for suspicious activities, such as creating new public repositories with specific names, and the importance of runtime threat detection is emphasized to combat the increasing frequency of supply chain attacks.

ZynorRAT is a recently discovered Go-based Remote Access Trojan (RAT) identified by the Sysdig Threat Research Team, designed to operate on both Linux and Windows environments. This malware is notable for its lack of similarity to existing malware families and utilizes Telegram for its command and control (C2) operations, allowing the author to manage and automate actions easily. ZynorRAT's functionalities include file exfiltration, system reconnaissance, screenshot capture, persistence through systemd services, and arbitrary command execution, with its development traced back to a likely Turkish origin. The malware first appeared on VirusTotal in July 2025, with its detection rate decreasing over time, suggesting ongoing refinements to evade detection. Although in its early development stages, ZynorRAT is predicted to eventually be sold on underground markets. The analysis highlights the importance of runtime threat detection as a key defense strategy against evolving threats like ZynorRAT, especially as Linux systems face increasing attention from threat actors.

Sysdig offers a modern approach to vulnerability management designed for cloud-native environments, addressing the limitations of legacy tools that struggle with dynamic infrastructures like containers and Kubernetes. By providing runtime-powered prioritization, Sysdig enables teams to focus on vulnerabilities that truly pose risks by considering factors such as exploitability, exposure, and asset criticality. The platform's AI-guided remediation offers actionable solutions, transforming alerts into clear, step-by-step instructions for developers. This reduces guesswork and enhances the efficiency of addressing security issues. Sysdig's expansive coverage ensures visibility across all environments, from containers to traditional on-premises infrastructure, enabling comprehensive risk management throughout the application lifecycle. The platform also streamlines collaboration between security and development teams by routing context-rich alerts to the right people, thus reducing noise and fostering a shared understanding of risks.