Cyber Intelligence Briefing: 22 September 2025

Assured’s CISO reacts:

Recent examples of the transport sector facing business interruption:

• Seattle Tacoma Airport: The victim of a ransomware attack by Rhysida. The Port of Seattle’s website, along with check-in systems used by many airlines at SeaTac, were taken offline.
• WestJet, Hawaiian, and Quantas airlines were all attacked within three weeks.
• The March 2025 Heathrow power outage. The incident caused the shutdown of the airport for 16 hours, highlighting the issue and need for resiliency.
• Russia’s Aeroflot airline targeted by pro-Ukrainian hackers in July 2025. The motivation behind this attack is very different to that in the MUSE incident.

On September 16, it was reported that RTX’s Collins Aerospace was awarded a NATO contract. This announcement was very recent, so I believe it unlikely that this was connected. It’s unlikely that an attacker could target them that quickly unless they had access for a period of time and laid dormant.

My advice in light of this incident is to be prepared:

• Know your critical apps.
• Contractual SLAs with the supplier aren’t enough – ultimately the customer owns the risk when it fails.
• In the event of an incident, ensure you have resilience including alternative systems. It might even option in the short-term. Ensure staff are trained on this.
• Exercise exec-level crisis response to walk through operational decision-making and PR/external comms. There was strong lock-down on messaging from Collins, which suggests they have procedure to manage this.
• Be clear on the definition of a ‘minimum viable company’ when restoring. What is good enough in a crisis?

Assured’s CISO reacts:

The flaw arose because the system did not properly validate whether an Actor token originated from the same tenant as the one being accessed. This gap allowed an attacker to generate an Actor token in their own tenant (such as a test or non-target environment) and reuse it to impersonate any user, including global administrators, in other tenants.

Considerations:

• These tokens bypassed standard security controls: they were not subject to conditional access policies, nor were they subject to MFA.
• The victim tenant did not receive actionable logs reflecting the creation or use of Actor tokens.
• Much of what might have been exfiltrated could have been done without leaving obvious traces in the target tenant’s logs

Calm the nerves…

The press has been going heavy on this but please note:

• The exploit requires use of Azure AD Graph (graph.windows.net) rather than only Microsoft Graph. If none of your applications/services used the legacy Azure AD Graph API, the attack surface is smaller (though not necessarily zero)
• Microsoft fixed/mitigated the issue. Within a few days of the vulnerability being reported, a fix was deployed globally. Further mitigations included restricting applications from requesting these Actor tokens for Azure AD Graph.
• Microsoft’s telemetry (internal monitoring) has stated that no evidencewas found of exploitation in the wild, so far.

Just in case: