The Daily Index — Wednesday, March 26, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

NEW WINDOWS ZERO-DAY LEAKS NTLM HASHES, GETS UNOFFICIAL PATCH

ARCOS Security found a vulnerability in all Windows versions that discloses NTLM hashes. It requires users to open a malicious file in Windows Explorer. ARCOS is offering a free, unofficial microcode patch until Microsoft issues an official patch.

bleepingcomputer.com · 2 min

TLDR InfoSec

NUMOTION DATA BREACH IMPACTS NEARLY 500,000 PEOPLE

Numotion, a mobility solutions provider, faced a data breach impacting about 500,000 customers last year. Hackers accessed employee emails from September to November 2024, risking exposure of personal, financial, and medical information.

securityweek.com · 2 min

TLDR InfoSec

MANAGE AUTHORIZATION WITHIN A CONTAINERIZED WORKLOAD USING AMAZON VERIFIED PERMISSIONS

Amazon Verified Permissions provides a mechanism for centralizing application authorization. This post from AWS provides four different deployment models for using Amazon Verified Permissions in containerized applications with various tradeoffs regarding resource use and authorization granularity: as an API Gateway external from a cluster, within the Kubernetes ingress controller, as a sidecar proxy, and within the application container directly.

aws.amazon.com · 6 min

TLDR InfoSec

MEASURING THE SUCCESS OF YOUR ADVERSARY SIMULATIONS

This post outlines how to measure the success of Adversary Simulation or Red Teaming exercises, focusing on three key goals: test controls, defensive enlightenment, and professional courtesy. Test Controls involves collaboration where testers validate expected security measures and share findings with defenders to enhance understanding and improve defenses. Testers should maintain professional courtesy throughout this process by being available, cleaning up data and tools, and acting transparently and humbly.

trustedsec.com · 7 min

TLDR InfoSec

CONTINUOUS TRAIL

Threat models should be updated throughout software development. It is important to maintain trust zones, threat actors, connections, and security assumptions, as well as tracking components, sensitive data, and controls after systems stabilize. This post provides practical advice for incorporating threat modeling into all SDLC phases, adapting models to organizational needs, and identifying security risks early.

blog.trailofbits.com · 8 min

TLDR InfoSec

DETECTION STUDIO (WEB APP)

Detection Studio is a playground that allows for converting Sigma detection rules to SIEM-specific languages entirely in the browser.

detection.studio

TLDR InfoSec

CHARM SECURITY (PRODUCT LAUNCH)

Charm prevents scams before they occur by analyzing human vulnerability exposure and customer risk patterns and by providing actionable insights and tailored mitigation strategies.

charmsecurity.com

TLDR InfoSec

THERE ARE PERHAPS 10,000 REASONS TO DOUBT ORACLE CLOUD'S SECURITY BREACH DENIAL

A hacker claims to have breached Oracle Cloud's login servers, stealing about six million records. Several security firms confirm the data's authenticity, with three customers verifying the leaked information. Although Oracle denies the breach, experts caution about potential cybersecurity risks.

theregister.com · 3 min

TLDR InfoSec

AFTER DDOS ATTACKS, BLIZZARD ROLLS BACK HARDCORE WOW DEATHS FOR THE FIRST TIME

Blizzard will now allow character resurrections in World of Warcraft Classic's Hardcore mode if players die due to DDoS attacks. This policy change comes after repeated server disruptions that targeted the popular OnlyFangs guild. Players now have a fail-safe if they are targeted by these attacks.

arstechnica.com · 4 min

TLDR InfoSec

SEMRUSH IMPERSONATION SCAM HITS GOOGLE ADS

Criminals are targeting Semrush to steal Google account credentials and access data like Google Analytics and Search Console. Malicious ads are impersonating Semrush to trick users into revealing sensitive information, posing a major threat to individuals and businesses.

malwarebytes.com · 4 min

TLDR InfoSec

CRUSHFTP WARNS USERS TO PATCH UNAUTHENTICATED ACCESS FLAW IMMEDIATELY

CrushFTP has a security flaw that allows unauthorized access - update v11.3.1+ resolves this flaw.

bleepingcomputer.com · 2 min

TLDR InfoSec

HACKERS ARE USING MICROSOFT'S .NET MAUI TO SPREAD ANDROID MALWARE

Cybercriminals are misusing Microsoft's .NET MAUI tool to spread Android malware, tricking users by hiding malicious code in seemingly legitimate apps.

hackread.com · 2 min

TLDR InfoSec

300 ARRESTED IN CRACKDOWN ON CYBERCRIME RINGS IN AFRICA

Over 300 suspects were arrested in Africa for cybercrimes that targeted businesses and individuals in an Interpol-led crackdown called Operation Red Card.

securityweek.com · 2 min