The Daily Index — Friday, January 26, 2024 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

MOTHER OF ALL BREACHES REVEALS 26 BILLION RECORDS: WHAT WE KNOW SO FAR

A massive data leak, known as the Mother of all Breaches (MOAB), has exposed over 26 billion records from numerous previous breaches. It has data from platforms like LinkedIn, Twitter, Weibo, and Tencent. The leaked dataset contains a staggering 12 terabytes of information and is likely the largest ever discovered. While it mainly consists of information from past data breaches, it is believed to also contain new data that has not been published before.

cybernews.com · 3 min

TLDR InfoSec

MEXICAN BANKS AND CRYPTOCURRENCY PLATFORMS TARGETED WITH ALLAKORE RAT

A financially motivated threat actor is targeting Mexican banks and cryptocurrency trading entities with a modified version of the AllaKore RAT. The RAT payload allows the threat actors to send stolen banking credentials and authentication information to a command-and-control server for financial fraud. Based on the large number of Mexico Starlink IPs used in the campaign and the addition of Spanish-language instructions to the modified RAT payload, the threat actor is believed to be based in Latin America.

blogs.blackberry.com · 10 min

TLDR InfoSec

GOOGLE ACCOUNT MISCONFIG LETS ANY GMAIL ACCOUNT CONTROL YOUR CLUSTER

Orca has discovered a new vulnerability, dubbed Sys:All, which impacts an estimated 250,000 GKE clusters. Orca researchers said that the vulnerability stems from a misunderstanding whereby users believe that the system:authenticated group in GKE includes only verified and deterministic identities as opposed to any Google authenticated account. This means that any Google user can obtain an OAuth bearer token and utilize it to authenticate to the GKE cluster and obtain any overly permissive permissions granted to the system:authenticated group.

thehackernews.com · 4 min

TLDR InfoSec

MIDNIGHT BLIZZARD: GUIDANCE FOR RESPONDERS ON NATION-STATE ATTACK

Microsoft has released more information about the nation-state attack on its corporate infrastructure as well as guidance on how to respond to such attacks. The threat actor employed techniques such as password spray attacks, malicious use of OAuth applications, collection via Exchange Web Services, and the use of residential proxy infrastructure to obfuscate their activity. Microsoft also offers detection and hunting guidance for identifying similar attack tactics and techniques.

microsoft.com · 10 min

TLDR InfoSec

ARCTIC WOLF HAS OBSERVED A NEW LOADER, DUBBED “CHERRYLOADER”, WRITTEN IN GO USED IN RECENT INTRUSIONS

Arctic Wolf Labs has discovered a new loader called "CherryLoader" that is written in Go and has been used in recent intrusions. This loader allows threat actors to swap exploits without recompiling code. Arctic Wolf has provided technical analysis and indicators of compromise related to CherryLoader.

arcticwolf.com · 7 min

TLDR InfoSec

FRANCE FINES AMAZON €32 MILLION OVER INTRUSIVE EMPLOYEE SURVEILLANCE

France’s privacy watchdog CNIL has fined Amazon €32 million due to invasive employee surveillance that it argues violates GDPR. Amazon utilizes its barcode scanning system to track interruptions of as little as one minute and requires employees to justify any breaks. Amazon says that it may appeal the ruling.

engadget.com · 3 min

TLDR InfoSec

BLACKWOOD HACKERS HIJACK WPS OFFICE UPDATE TO INSTALL MALWARE

The Blackwood hacking group has been using advanced malware called NSPX30 to conduct cyberespionage attacks against companies and individuals since at least 2018. The group's activities align with Chinese state interests. Its targets are located in China, Japan, and the United Kingdom. Blackwood has been delivering the malware through the update mechanisms of legitimate software, including WPS Office, Tencent QQ, and Sogou Pinyin.

bleepingcomputer.com · 3 min

TLDR InfoSec

NEW HAMPSHIRE ROBOCALL KICKS OFF ERA OF AI-ENABLED ELECTION DISINFORMATION

A recent robocall in New Hampshire marks the first instance of AI-generated audio disinformation targeting American voters. The proliferation of AI systems and the relative ease with which a person can be mimicked using deepfake technology means that the New Hampshire robocall is probably indicative of what is to come over the course of the 2024 election.

cyberscoop.com · 7 min

TLDR InfoSec

MALICIOUS NPM PACKAGES EXFILTRATED HUNDREDS OF DEVELOPER SSH KEYS VIA GITHUB

Two malicious npm modules, warbeast2000 and kodiak2k, were found to have garnered over 1500 downloads on npm before being removed. The malicious packages ran a post-install script that searched for SSH keys and then uploaded them to a GitHub repository.

thehackernews.com · 2 min

TLDR InfoSec

SEC TWITTER HACK BLAMED ON SIM SWAP ATTACK

The SEC confirmed that the recent X hack was the result of a "SIM swap" attack - scammers tricked cellphone provider staff into giving them control of the account’s registered phone number.

bitdefender.com · 3 min

TLDR InfoSec

YOUR REFERRAL LINK - https://tldr.tech/infosec?ref=2613930

Summary unavailable

tldr.tech