The Daily Index — Thursday, March 13, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

TATA TECHNOLOGIES' DATA LEAKED BY RANSOMWARE GANG

Summary unavailable

techcrunch.com · 3 min

TLDR InfoSec

PREVIOUSLY UNIDENTIFIED BOTNET TARGETS UNPATCHED TP-LINK ARCHER HOME ROUTERS

Cato Networks has detected a new botnet named Ballista that is targeting unpatched TP-Link Archer routers using the CVE-2023-1389 exploit. Researchers suggest the hacker is likely from Italy and that the botnet is in its early stages, with evolving malware capabilities. Unlike other DDoS-for-hire botnets, Ballista's malware can also execute arbitrary commands on remote systems.

therecord.media · 3 min

TLDR InfoSec

AZURE'S WEAKEST LINK? HOW API CONNECTIONS SPILL SECRETS

Binary Security found undocumented Azure API Connections enabling privilege escalation. With Reader permissions, attackers can GET requests to backend resources like Key Vaults, Defender ATP, and third-party services such as Jira and Salesforce.

binsec.no · 15 min

TLDR InfoSec

COPYOBJECTION: FENDING OFF RANSOMWARE IN AWS

Attackers are using SSE-C to encrypt objects in ransomware attacks on AWS accounts. Jesse Griggs established a test environment to measure the alert response time through CloudWatch and how quickly Lambda could block the attacker or disable SSE-C. He noted alerts took about 6 minutes to arrive, while automated responses occurred immediately.

redcanary.com · 6 min

TLDR InfoSec

BEYOND THE HOOK: A TECHNICAL DEEP DIVE INTO MODERN PHISHING METHODOLOGIES

This article explores modern phishing techniques, from basic HTML pages to those that bypass multi-factor authentication. It covers attack methods such as Browser-in-the-Browser (BITB), Attacker-in-the-Middle (AITM), and WebRTC, as well as infrastructure considerations for hosting and delivery. Phishing has evolved with sophisticated techniques using cloud provider domains, making detection harder. Effective defense requires multi-layered approaches combining technical controls and human awareness.

blog.quarkslab.com · 31 min

TLDR InfoSec

CISA WORKER SAYS 100-STRONG RED TEAM FIRED AFTER DOGE CANCELLED CONTRACT

CISA's 100-member penetration testing team was terminated after Trump's DOGE unit canceled their contract, leading to cuts in another red team. The election security group EI-ISAC also shut down due to funding loss, raising concerns about cyberattack vulnerabilities.

theregister.com · 3 min

TLDR InfoSec

IN-DEPTH TECHNICAL ANALYSIS OF THE BYBIT HACK

Bybit experienced the largest cryptocurrency theft ever, totaling $1.4 billion, when attackers compromised a developer machine and injected malicious JavaScript into Safe{Wallet} UI, altering what signers saw. This off-chain attack tricked signers into approving a delegatecall that replaced the proxy implementation with the attackers' code, giving them control over all funds. The Lazarus group from North Korea executed this sophisticated attack by exploiting human verification vulnerabilities and the lack of human-readable formats for complex smart contract operations in the EIP-712 standard.

nccgroup.com · 11 min

TLDR InfoSec

RESEARCH UNVEILS THAT MORE THAN 110,000 IOS APPS LEAK SECRETS

Over 110,000 iOS apps leak secrets, including sensitive data like cloud storage keys. Most apps expose at least one hardcoded secret, risking user breaches. Apple's App Store does not check for these vulnerabilities, underscoring the need for better security practices.

links.tldrnewsletter.com · 8 min

TLDR InfoSec

FAKE REDDIT AND WETRANSFER PAGES ARE SPREADING STEALER MALWARE

A criminal operation is spreading malware through fake Reddit and WeTransfer pages using the Lumma stealer.

moonlock.com · 4 min

TLDR InfoSec

CHINESE VOLT TYPHOON HACKERS INFILTRATED US ELECTRIC UTILITY FOR NEARLY A YEAR

Chinese hackers from the Volt Typhoon group breached a US electric utility in Massachusetts for over 300 days, collecting sensitive operational data.

hackread.com · 2 min

TLDR InfoSec

FACEBOOK DISCLOSES FREETYPE 2 FLAW EXPLOITED IN ATTACKS

Facebook disclosed a FreeType 2 vulnerability that could allow arbitrary code execution in all versions up to 2.13, with reports of active exploitation in attacks.

bleepingcomputer.com · 2 min