The Daily Index — Monday, March 31, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

SECURITY FIRM HACKS RANSOMWARE GANG, CRIPPLES OPERATIONS

After discovering a vulnerability on BlackLock's data leak site, Resecurity researchers have been covertly acquiring information since late 2024. The researchers exploited a Local File Inclusion vulnerability to retrieve server-side configuration details and credentials along with plain text server logs, SSH credentials, and command-line histories. Resecurity researchers utilized their position to warn law enforcement and potential victims before leaks occurred.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

NEW UBUNTU LINUX SECURITY BYPASSES REQUIRE MANUAL MITIGATIONS

Researchers at Qualys have discovered three new vulnerabilities in Ubuntu 23.10 and 24.04 that could allow a local attacker to create user namespaces with full administrative privileges. The bypass mechanisms utilize aa-exec, busybox, or LD_PRELOAD. Canonical has shared that they will be treating these vulnerabilities as limitations of a defense-in-depth mechanism and shared recommended hardening steps to address them.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

TCCING IS BELIEVING

Apple has added a new feature called Endpoint Security events for TCC modifications in MacOS 15.4. Exposed with ES_EVENT_TYPE_NOTIFY_TCC_MODIFY flag, this feature allows security tools to detect and possibly override user decisions on granting access to protected resources. The events will provide information on when a TCC permission is granted or revoked, helping users monitor and control access to their system.

objective-see.org · 14 min

TLDR InfoSec

COMPROMISING THREAT ACTOR COMMUNICATIONS

Many threat actors utilize Telegram bots as a method of establishing C2 communication. In this technique, a threat actor creates a new Telegram bot, embeds a token for the bot in their malware and deploys it, then malware then periodically polls Telegram's servers to check for new commands sent to the bot and executes any commands that are sent while relaying the results back to the Telegram server. This post deep dives into a case study in which a malware that was discovered on VirusTotal was hijacked by the author, who discovered data from the malware developer's system which they used for testing.

polygonben.github.io · 12 min

TLDR InfoSec

BROWSER-NATIVE RANSOMWARE MAY BE THE NEXT BILLION-DOLLAR THREAT

Browser-native ransomware could target data stored in browsers, bypassing traditional security measures. This type of ransomware is hard to detect and can lead to severe consequences, such as compromising email services and stealing sensitive company files.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

PROTECTING ANDROID, WINDOWS, AND LINUX DEVICES AGAINST BEING TRACKED VIA THE FIND MY NETWORK

Malicious actors can track Android, Windows, or Linux devices through an Apple Find My network vulnerability using malware that mimics AirTag signals. They can monitor movements remotely, affecting smartphones, computers, smart TVs, etc. Apple has issued patches, and users should disable Bluetooth when not in use and keep devices updated.

kaspersky.com · 5 min

TLDR InfoSec

ZHOU SHUAI: A HACKER'S ROAD TO APT27

Zhou Shuai is a Chinese hacker that first started hacking in his senior year of high school in 1996. Shuai's early motivations as a founding member of Green Army were idealistic as he sought to be a hacktivist vigilante. Shuai eventually ended up becoming more commercial and less idealistic and is now designated as APT27 and sanctioned by the U.S. Department of the Treasury.

nattothoughts.substack.com · 6 min

TLDR InfoSec

RUST ADOPTING FERROCENE LANGUAGE SPECIFICATION

The Rust project has announced that it will adopt the Ferrocene Language Specification (FLS) developed by Ferrous Systems and maintain it as part of the core project.

lwn.net · 2 min

TLDR InfoSec

NORTH KOREA RAMPS UP CYBER OFFENSIVE

North Korea has opened a new research center to focus on AI-powered hacking.

dailynk.com · 1 min