CERT Polska

The other reads any file off the server.

Cert Polska says it couldn't reach Dayforce, so there's no word on a fix yet.

Payroll holds your employees' bank details, so ask Dayforce in writing whether these are fixed in your environment.

Five, just selecting a model in Unsloth Studio ran Python code from that model's repository before the model itself even loaded.

Now that was, like, left behind as an artifact, right? So how does that-- how did you discover that? How does that, like, play into, um, h-having that there, what does that allow you as someone in your role or even a, a defender? Like, what does that give them the ability to do?

Well, in, in this particular case, I wanna say that we were blessed, uh, with, uh, tons of different indicators that, um, CERT Polska, they did a, a very good job at-

Yeah

... um, really nailing them down and sort of describing what is it that they saw.

This is them essentially adding some firmware security.

I, I will say a- al- although, uh, CERT Polska and us have a, probably have a opinion on it, the flag doesn't mean you're compromised for sure.

It means it's running in a state that's not 100% recognized.

And I think everyone would agree that if you ever have that status, you gotta assume [chuckles] you're compromised, and that means a lot of things.

So I would say this is a, a, a good step to take when you have these sorts of issues in a router or a routing device.

Yep.

Um, CERT Polska gave a few other IoCs.

They said look for a highly privileged user named Ops on the device.

Yeah.

So CERT Polska discovered unknown threat actors exploiting two distinct flaws to seize control of vulnerable devices.

And they're doing this without any authentication whatsoever.

Zero authentication.