The Daily Index — Tuesday, March 4, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

SPYZIE STALKERWARE IS SPYING ON THOUSANDS OF ANDROID AND IPHONE USERS

A phone surveillance operation called Spyzie has compromised more than 500,000 Android devices and thousands of iPhones and iPads. Spyzie suffered a breach due to a vulnerability that impacted the Cocospy and Spyic stalkerware apps. The leaked data includes the emails of Spyzie customers as well as data that was exfiltrated by the apps.

techcrunch.com · 2 min

TLDR InfoSec

ZAPIER SAYS SOMEONE BROKE INTO ITS CODE REPOSITORIES AND MAY HAVE ACCESSED CUSTOMER DATA

Zapier has informed customers that an unauthorized individual accessed specific Zapier code repositories but that there was no production infrastructure or data breach. Notably, the repositories contained some customer data that was inadvertently copied for debugging. Zapier stated that the attacker accessed the repositories because of a 2FA misconfiguration on an employee's account.

theverge.com · 2 min

TLDR InfoSec

EARTH PRETA MIXES LEGITIMATE AND MALICIOUS COMPONENTS TO SIDESTEP DETECTION

Trend Micro's Threat Hunting team analyzed a new technique from the Earth Preta APT group, Earth Preta, and found that its attack chain begins with the IRSetup.exe dropper, which drops a collection of legitimate decoy files and malicious components and opens a decoy PDF. In the background, the malware launches a legitimate EA Origin application to sideload a modified variant of the TONESHELL backdoor that injects shell code via Microsoft Application Virtualization Injector (MAVInject.exe) if ESET anti-malware is detected or directly into the processes if it is not.

trendmicro.com · 5 min

TLDR InfoSec

THE CAT AND MOUSE GAME: EXPLOITING STATISTICAL WEAKNESSES IN HUMAN INTERACTION ANTI-EVASIONS

Sandboxing is a common malware analysis technique that shifts the burden of detection onto attackers who must detect that their malware is executing in a sandbox and then evade malware detection. Researchers from Check Point Research devised a sandbox evasion technique in which their malware emulates a random mouse walk to simulate a human and evade sandbox detection. Check Point Research has provided an in-depth implementation of a counter-evasion algorithm to detect this evasion.

research.checkpoint.com · 8 min

TLDR InfoSec

OPEN SOURCE RESEARCH NOTEBOOKS

Research notebooks such as Jupyter enable open-source investigations by simplifying code experimentation and data analysis. Platforms like Google Colab, which hosts Jupyter Notebooks, offer easy accessibility, security, and replicability for running notebooks online. Notebooks provide a user-friendly way to interact with code, making them valuable research tools.

bellingcat.com · 6 min

TLDR InfoSec

CLOUDSMITH (PRODUCT LAUNCH)

Cloudsmith is an artifact repository that scans dependencies for vulnerabilities, licensing issues, and malware before exposing these packages to developers in their coding environments.

cloudsmith.com

TLDR InfoSec

GOVERNMENTS CAN'T SEEM TO STOP ASKING FOR SECRET BACKDOORS

End-to-end encryption cannot be weakened for authorities without compromising user security. UK and Sweden's anti-encryption initiatives are misguided as criminals will use uncompromised options such as Signal, and the answer lies in transparent, free open source software, leaving fewer places for criminals to hide.

theregister.com · 4 min

TLDR InfoSec

AS SKYPE SHUTS DOWN, ITS LEGACY IS END-TO-END ENCRYPTION FOR THE MASSES

Skype pioneered end-to-end encryption in communication apps, promising unprecedented privacy. Despite governments worldwide finding ways to circumvent this security—through hacking tools such as FinFisher, China's surveillance enhancements, and later NSA access—Skype's revolutionary approach to secure communications laid the groundwork for today's encrypted messaging apps like Signal and WhatsApp.

techcrunch.com · 4 min

TLDR InfoSec

MODERN APPROACH TO ATTRIBUTING HACKTIVIST GROUPS

Checkpoint Research has introduced a novel method for attributing hacktivist groups by employing language-based machine learning models and linguistic analysis to examine thousands of public messages. Its technique integrates topic modeling to reveal key subjects discussed by these groups and stylometric analysis to identify connections between groups based on their writing styles. This strategy shows that many state-sponsored entities disguise themselves as hacktivists, with the analysis effectively linking various hacktivist personas to individual operators and tracking how their focus shifts in response to geopolitical events.

research.checkpoint.com · 18 min

TLDR InfoSec

SECURING LATIN AMERICA IN 2025: HOW AI AND CYBER THREAT INTELLIGENCE ARE RESHAPING THE CYBER SECURITY LANDSCAPE

Latin America is facing an onslaught, with companies experiencing an average of 2,569 attacks per week — nearly 40% higher than the global average of 1,848.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

CISOS SHOULD ADDRESS IDENTITY MANAGEMENT ‘AS FAST AS THEY CAN' SAYS CROWDSTRIKE EXEC

CISOs must enhance identity and access management to avert cyber-attacks.

csoonline.com · 4 min

TLDR InfoSec

BLACK BASTA LEADER ESCAPES FROM COURTROOM IN ARMENIA WHILE AWAITING JUDGE'S DECISION

Oleg Nefedov, leader of the Black Basta ransomware gang, escaped a courtroom in Armenia while awaiting a judge's decision on his detention.

links.tldrnewsletter.com · 2 min