The Daily Index — Thursday, January 30, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

ENGLOBAL SAYS HACKERS ACCESSED SENSITIVE PERSONAL DATA DURING CYBERATTACK

US engineering firm ENGlobal reported that hackers accessed sensitive personal information during an attack in November 2024. ENGlobal did not disclose details of what data was accessed. The filing also implied that the attack may have involved ransomware and that some systems were offline for six weeks.

techcrunch.com · 1 min

TLDR InfoSec

ADVERSARIAL MISUSE OF GENERATIVE AI

This blog post from Google Threat Intelligence Group explores how state-sponsored threat actors attempted to misuse Google's AI assistant Gemini. The research found that while threat actors from countries like Iran, China, North Korea, and Russia used Gemini for tasks like research, coding, and content generation, with Iranian actors being the heaviest users, they have not developed novel capabilities or successfully bypassed security controls. The report concludes that while AI can be a useful tool for threat actors, it has not yet proven to be the game-changer some feared, though Google emphasizes continued vigilance through robust security measures and responsible AI development practices.

cloud.google.com · 27 min

TLDR InfoSec

OUTSMARTING AI-POWERED CYBER ATTACKS: A 2025 PLAYBOOK FOR REAL-TIME ENDPOINT DEFENSE

AI-powered cyber threats are rapidly increasing, with 67% of phishing attacks using AI in 2024. Adversaries are targeting endpoints months in advance, using generative AI to scale attacks. Organizations are struggling to keep pace, taking 277 days on average to identify and contain breaches. This post dives into how companies can deal with these threats.

links.tldrnewsletter.com · 9 min

TLDR InfoSec

STATIC SOURCE CODE SECURITY SCANNING TOOLS EVALUATION BENCHMARK

This benchmark framework aims to evaluate static application security testing (SAST) tools. It provides objective criteria for organizations to select appropriate tools, focusing exclusively on static code analysis while excluding dynamic testing methods and non-code scanning tools.

insbug.medium.com · 11 min

TLDR InfoSec

ONE STEP AHEAD IN CYBER HIDE-AND-SEEK: AUTOMATING MALICIOUS INFRASTRUCTURE DISCOVERY WITH GRAPH NEURAL NETWORKS

Palo Alto's Unit 42 has observed that threat actors often reuse infrastructure. Using a Graph Neural Network, Unit 42 has demonstrated that it can discover new malicious infrastructure before it is weaponized. The post walks through three case studies where the team was able to apply this technique.

unit42.paloaltonetworks.com · 12 min

TLDR InfoSec

FRENOS (PRODUCT LAUNCH)

Frenos is an AI-native platform designed to assess, prioritize, and protect mission-critical environments without the risk of causing operational disruption. Customers are shown exactly which combinations of TTPs and vulnerabilities can pose the greatest risk to their specific setup and then provided with tailored recommendations for reducing risks.

frenos.io

TLDR InfoSec

LETSENCRYPT IS ENDING SUPPORT FOR EXPIRATION NOTIFICATION EMAILS

LetsEncrypt has announced that it will be ending support for sending certificate expiration notices on June 4. It made this decision as retaining emails creates a privacy risk for LetsEncrypt and sending expiration emails costs LetsEncrypt tens of thousands of dollars per year and complicates their infrastructure. At this point, LetsEncrypt is confident in the automated renewal tools that the community has built.

letsencrypt.org · 2 min

TLDR InfoSec

MGM AGREES TO PAY $45 MILLION TO VICTIMS OF 2019 DATA BREACH AND 2023 RANSOMWARE ATTACK

MGM Resorts will pay $45 million to settle class action lawsuits stemming from two cyberattacks in 2019 and 2023 that exposed the personal data of over 37 million customers. The 2023 ransomware attack cost MGM $100 million in damages. Affected customers could receive up to $75 each after legal fees.

therecord.media · 2 min

TLDR InfoSec

HOW WE KEPT THE GOOGLE PLAY & ANDROID APP ECOSYSTEMS SAFE IN 2024

Google worked to keep the Google Play and Android app ecosystems safe in 2024 by investing in AI-powered threat detection and privacy enhancements. It prevented millions of policy-violating apps from being published and banned thousands of bad developer accounts. Google also introduced new security features like enhanced fraud protection and app badging to help users find trustworthy apps easily.

security.googleblog.com · 7 min

TLDR InfoSec

SOLANA PUMP.FUN TOOL DOGWIFTOOL COMPROMISED TO DRAIN WALLETS

Hackers compromised DogWifTools on Windows, draining users' wallets on the Solana blockchain.

bleepingcomputer.com · 3 min

TLDR InfoSec

OPERATION TALENT: FBI SEIZES NULLED.TO, CRACKED.TO, SELLIX.IO, AND MORE

The FBI seized cybercrime forums Nulled.to and Cracked.to along with marketplaces Sellix.io and StarkRDP.io in Operation Talent, which targeted illegal online activities.

hackread.com · 3 min

TLDR InfoSec

LAZARUS GROUP USES REACT-BASED ADMIN PANEL TO CONTROL GLOBAL CYBER ATTACKS

The Lazarus Group, a North Korean threat actor, uses a web-based admin panel built with React and Node.js to control global cyber attacks.

links.tldrnewsletter.com · 2 min