The Daily Index — Thursday, January 23, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

IPANY VPN BREACHED IN SUPPLY-CHAIN ATTACK TO PUSH CUSTOM MALWARE

South Korean VPN provider IPany was breached in a supply-chain attack that deployed a custom SlowStepper malware. The attackers breached the IPany development environment and added their custom SlowStepper malware to the VPN installation. The SlowStepper C2 malware supports commands that gather system information, fetch and run files from the C2 server, enumerate and exfiltrate files, run Python-based spyware tools, run shell commands, execute syscalls, and delete files or directories.

bleepingcomputer.com · 2 min

TLDR InfoSec

ZENDESK'S SUBDOMAIN REGISTRATION EXPOSED TO PHISHING, PIG BUTCHERING SCAMS

A security vulnerability in Zendesk's subdomain registration feature allows cybercriminals to conduct phishing and investment scams. CloudSEK researchers discovered that attackers can create fake subdomains resembling legitimate brands to deceive victims. This poses a significant risk as attackers can send convincing phishing emails and manipulate users into sharing sensitive information or funds.

hackread.com · 2 min

TLDR InfoSec

HOW TO USE TEMPORARY ACCESS PASS (TAP) WITH INTERNAL GUEST USERS

TAP is a Microsoft Entra ID solution that provides users with temporary passwordless access so one of the other permanent passwordless mechanisms can be configured. Previously, TAP would not work for guest users as they would generally need to authenticate with a remote provider. This blog post shows how to enable the newly released Entra ID TAP for internal guests feature.

techcommunity.microsoft.com · 3 min

TLDR InfoSec

TRACKING CLOUD-FLUENT THREAT ACTORS: BEHAVIORAL IOCS

Behavioral IOCs attempt to enrich a traditional IOC by correlating multiple events to add context for more robust detections. This post introduces the concept of behavioral IOCs in cloud environments and provides an example of how Wiz developed IOCs for a specific threat actor. It recommends beginning with a piece of identifying information about a threat actor or tactic and then iteratively mapping out unique parameters or other identifiers to detect that threat actor to the IOC.

wiz.io · 11 min

TLDR InfoSec

SECURING INHERITED CLOUD: TOP LESSONS

Security professionals often get invited late to cloud projects, causing panic over potential vulnerabilities. To secure these environments, follow a playbook with steps like gaining access, implementing least privilege access, enabling MFA, and conducting a compromise assessment. By following the steps in this blog post, you can take control, address security concerns, and protect valuable data in cloud projects effectively.

googlecloudcommunity.com · 6 min

TLDR InfoSec

FEDISECFEEDS (WEB APP)

FediSecFeeds searches CVE data in infosec.exchange and ioc.exchange instances. The output can be fetched via GitHub's API.

fedisecfeeds.github.io

TLDR InfoSec

TERRAFORM S3 BACKEND SETUP: SKIP THE TABLE

Terraform makes use of lock files to ensure that multiple users are not modifying a state file simultaneously. Prior to version 1.10, users who were using the S3 backend required a DynamoDB table to store the lock file. As of the newly released version 1.10, Terraform can make use of S3 conditional writes to utilize S3 for both state file and lock file storage.

kieranlowe.io · 3 min

TLDR InfoSec

TELEGRAM CAPTCHA TRICKS YOU INTO RUNNING MALICIOUS POWERSHELL SCRIPTS

Threat actors are tricking Telegram users into running malicious PowerShell scripts by pretending to be a captcha or verification system. This tactic exploits the news around Silk Road founder Ross Ulbricht to lure victims into downloading malware. Users should be cautious and avoid running any unfamiliar commands on their devices to avoid falling victim to such attacks.

bleepingcomputer.com · 4 min

TLDR InfoSec

TRUMP ADMINISTRATION DISBANDS DHS BOARD INVESTIGATING SALT TYPHOON HACKS

The Trump administration disbanded the Cyber Safety Review Board investigating the Salt Typhoon hacks, causing concern among cybersecurity experts about the impact on national security.

csoonline.com · 3 min

TLDR InfoSec

WINDOWS 11 24H2 NOW ALSO OFFERED TO ALL ELIGIBLE WINDOWS 10 PCS

Windows 11 24H2 is now available to all eligible Windows 10 PCs via Windows Update.

bleepingcomputer.com · 2 min

TLDR InfoSec

DOJ DELETES CHINA-LINKED PLUGX MALWARE OFF MORE THAN 4,200 US COMPUTERS

The DOJ and FBI removed Chinese-linked PlugX malware from over 4,200 U.S. computers.

therecord.media · 4 min