The Daily Index — Friday, September 1, 2023 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

HACKERS FORCE SHUTDOWN OF TWO KEY ASTRONOMICAL OBSERVATORIES

The International Gemini Observatory, a key player in global astronomical research, has temporarily halted astronomical operations following a cyberattack. The culprits and their motives remain unknown.

gizmodo.com · 3 min

TLDR InfoSec

500K IMPACTED BY DATA BREACH AT FASHION RETAILER FOREVER 21

Fashion retailer Forever 21 has started informing more than 500,000 individuals that their personal information was compromised in a data breach earlier this year. There are suggestions that Forever 21 engaged in communication with the attackers and that a ransom might have been paid.

securityweek.com · 2 min

TLDR InfoSec

AND DATA THEFT

An open-source .NET-based information stealer malware dubbed SapphireStealer is being used by multiple entities to enhance their capabilities and spawn their own bespoke variants. This blog post dives into how this malware operates, which organizations seem to be using it to steal data, and the different variants that have been brought to light.

blog.talosintelligence.com · 15 min

TLDR InfoSec

ISOLATION FRAMEWORK

The blog post covers the basics of Windows containers, breaks down its file system isolation framework, reverse-engineers its main mini-filter driver, and details how it can be utilized and manipulated by a bad actor to bypass EDR products in multiple domains.

deepinstinct.com · 10 min

TLDR InfoSec

USING LLMS TO REVERSE JAVASCRIPT VARIABLE MINIFICATION

A blog post introducing a technique to reverse minified JS using LLMs while keeping the semantics intact. The technique involves utilizing webcrack, plugins that reverse lossless minification, and then having an LLM generate a name for the variable based on its function in the code.

thejunkland.com · 3 min

TLDR InfoSec

AUTOMATE GOVERNANCE OF SOFTWARE DEVELOPMENT

Fianu Labs raises $2 million in seed funding to bring governance to every software release. It does this by maintaining a continuous audit trail of every code change from creation to release.

finance.yahoo.com · 2 min

TLDR InfoSec

HOW THE FBI NUKED QAKBOT MALWARE FROM INFECTED WINDOWS PCS

This article goes in-depth about how the FBI nuked Qakbot malware from infected Windows PCs. The FBI dismantled the Qakbot botnet by seizing the attacker's server infrastructure and creating a special removal tool that uninstalled the Qakbot malware from infected devices. Qakbot was distributed through phishing campaigns that utilize a variety of lures, including reply-chain email attacks.

bleepingcomputer.com · 5 min

TLDR InfoSec

MALWAREBYTES LAYS OFF 100 EMPLOYEES AHEAD OF BUSINESS SPLIT

Cybersecurity giant Malwarebytes this week laid off 100 employees as it prepares for a major restructuring that will see the business split into two.

techcrunch.com · 3 min

TLDR InfoSec

BARRACUDA THOUGHT IT DROVE 0-DAY HACKERS OUT. IT WAS WRONG

Although Barracuda believed they drove out the Chinese state hackers who accessed their Email Security Gateway, it now appears they were able to evade the expellers.

arstechnica.com · 5 min

TLDR InfoSec

PROGRAM

Apple is inviting researchers to join the iPhone Security Research Device Program, which allows them to work with Apple directly in discovering vulnerabilities while still receiving bounty payments.

appleinsider.com · 1 min

TLDR InfoSec

UTILITIES

The DoE has launched a competition for rural utility providers to receive $8.9 million in aid for improving cyber defenses. The program is split into three phases where utilities will describe the resources they need, plan how to acquire and implement those resources, and then implement them. The deadline for the first phase is November 29.

cyberscoop.com · 2 min