The Daily Index — Thursday, March 6, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

NEW ELEVEN11BOT BOTNET INFECTS 86K DEVICES FOR DDOS ATTACKS

Eleven11bot has infected over 86,000 devices. The botnet consists mostly of webcams and Network Video Recorders that use common, weak, or default admin credentials. GreyNoise has published a list of IPs that are associated with botnets.

bleepingcomputer.com · 2 min

TLDR InfoSec

RANSOMWARE THUGS THREATEN TATA TECHNOLOGIES WITH LEAK IF DEMANDS NOT MET

Tata Technologies reportedly suffered a ransomware attack by Hunters International. The gang claims to have stolen 730,160 files (1.4 TB) and has threatened to release them next Monday if no ransom is paid.

theregister.com · 3 min

TLDR InfoSec

THOUSANDS OF WEBSITES HIT BY FOUR BACKDOORS IN 3RD PARTY JAVASCRIPT ATTACK

Attackers exploited a third-party JavaScript file to inject four backdoors into 1,000 WordPress websites. The attack involved uploading malicious plugins, injecting SSH keys, and executing remote commands.

links.tldrnewsletter.com · 4 min

TLDR InfoSec

DYNAMIC APPLICATION SECURITY TESTING (DAST)

DAST can scan dynamic web applications for vulnerabilities. Using tools like ZAPROXY, testers can simulate attacker perspectives, identifying weaknesses through manual and automated scans such as spidering and active scanning to improve web application security.

medium.com · 4 min

TLDR InfoSec

CELLEBRITE ZERO-DAY EXPLOIT USED TO TARGET PHONE OF SERBIAN STUDENT ACTIVIST

In this post, Amnesty International investigates the exploit, techniques, and delivery mechanisms used by Cellebrite to target the Android phones of Serbian student activists. The exploit targeted core Linux kernel USB drivers, potentially affecting over a billion Android devices. Evidence shows an attempt to install a mysterious Android app after the phone was unlocked using Cellebrite.

securitylab.amnesty.org · 34 min

TLDR InfoSec

RAD SECURITY (PRODUCT LAUNCH)

Rad Security is an AI-driven defense platform that enhances operational efficiency for security teams and facilitates safe AI use in organizations.

radsecurity.ai

TLDR InfoSec

NEARLY 10% OF EMPLOYEE GEN AI PROMPTS INCLUDE SENSITIVE DATA

Harmonic, an AI data security company, revealed that 8.5% of employee prompts to popular LLMs included sensitive data. Harmonic's report showed that 46% of submitted sensitive data included billing and authentication data, 27% included employee PII and payroll data, and 15% included legal and financial data. Employees who enter sensitive data to free tiers of LLMs may be inadvertently leaking data, as the report demonstrated that 54% of sensitive prompts were entered on ChatGPT's free tier.

csoonline.com · 6 min

TLDR InfoSec

LOCKED OUT, DROPBOXED IN: WHEN BEC THREATS INNOVATE

Invictus IR identified a threat actor who established persistence by leveraging a third-party mail client to phish contacts. The attack was initiated with a seemingly legitimate Dropbox invoice that directed the victim to a phishing page, where their credentials were harvested. The attacker used these credentials to log into the eM Client mail client, register accounts with Dropbox and WeTransfer, and spam contacts with fake invoices to compromise additional victims.

invictus-ir.com · 6 min

TLDR InfoSec

AMAZON VERIFIED PERMISSIONS NOW SUPPORTS THE CEDAR JSON ENTITY FORMAT

Amazon Verified Permissions (AVP) is a service that manages permissions and provides fine-grained authorization for customer-built applications. AWS has now added support to AVP for the same JSON format that the Cedar SDK supports.

aws.amazon.com · 1 min

TLDR InfoSec

CHINA-LINKED APT SILK TYPHOON TARGETS IT SUPPLY CHAIN

The China-backed APT Silk Typhoon targets global IT supply chains by exploiting IT solutions and cloud app vulnerabilities.

securityaffairs.com · 3 min

TLDR InfoSec

US SANCTIONS IRANIAN ADMINISTRATOR OF NEMESIS DARKNET MARKETPLACE

The US imposed sanctions on an Iranian person for managing the illegal Nemesis Market, a darknet platform for drug and cybercrime trading.

securityweek.com · 2 min

TLDR InfoSec

FORMER TOP NSA CYBER OFFICIAL: PROBATIONARY FIRINGS ‘DEVASTATING' TO CYBER, NATIONAL SECURITY

Countering Chinese hacking of critical infrastructure will require top-level cybersecurity talent at the NSA and other agencies.

cyberscoop.com · 2 min