Cyber Intelligence Briefing: 01 Sep 2025.

Assured’s CISO reacts:

Attackers are now using AI to make malware smarter and harder to stop. The best defence is to get ahead: strengthen email security, control what scripts and apps can run, limit unnecessary outbound traffic, keep backups safe, and test your defences through regular threat hunting. Here’s some recommended technical controls:

• Implementation via Intune (Endpoint Firewall):
  1. Configure Windows Defender Firewall inbound rule: block outbound connections from suspicious load paths (e.g., the PyInstaller .pif executable) to known domains such as huggingface.co and the specific IP ranges for Hugging Face’s API endpoints.
  2. Apply hash-based blocking (file hash from LameHug sample) using AppLocker or Windows Defender Application Control (WDAC), targeting binaries that attempt to initiate external LLM calls.

• Implementation via GPO (PowerShell logging & AMSI):
  1. Enable Module Logging (registry):
     Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" -Name "EnableModuleLogging" -Value 1
Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging\ModuleNames" -Name "*" -Value "*"

  2. Enable Script Block Logging:
     Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -Value 1


• Implementation via Intune (AppLocker or WDAC):
  1. Create WDAC policy to allow only approved signed binaries. Block execution of unsigned Go-based binaries or unknown Lua script runners (e.g., ollama.exe or the Go-generated PromptLock binary).
  2. Disallow local use of unauthorized LLM tools by denying execution of runtime like Ollama or untrusted LLM runtime executables via a WDAC file path rule.

• Implementation via GPO (File System Auditing):
  1. Enable auditing on sensitive directories (e.g., user Documents, Desktop, Downloads):
     • Apply SACLs to log file changes, creations, deletions in %USERPROFILE%\Documents, %USERPROFILE%\Downloads, and company-shared folders.
  2. Use Windows Event Forwarding: collect security event IDs like 4663 (File accessed) and 4660 (File deleted), and monitor for anomalous spikes indicating automated encryption.

• Implementation via Intune (Device Restrictions & BitLocker):
  1. Set DLP rules to block output of scripts or bulky data files (e.g., Lua scripts or .zip containing sensitive files) to cloud or removable media by defining “Sensitive Files” patterns (.txt, .docx, .xlsx) and locking export pathways.

The risk here is simple. Names, emails and phone numbers are enough to launch convincing phishing campaigns. Lock down CRM access, review who can log in, enable MFA everywhere, and brief staff to expect targeted scams.

For more practical steps, we covered this in our August review: Cyber Intelligence Briefing