The Daily Index — Wednesday, April 9, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

FLAW IN ESET SECURITY SOFTWARE USED TO SPREAD MALWARE FROM TODDYCAT GROUP

A threat actor known as ToddyCat has exploited a vulnerability in ESET's antivirus scanner. The vulnerability could allow privileged attackers to plant a malicious DLL and execute it through the antivirus scanner. The attackers in this campaign are using a tool dubbed TCDSB, which seems to be an extension of EDRSandBlast, to alter key components of the OS and disable alerts.

therecord.media · 2 min

TLDR InfoSec

OCC EMAIL SYSTEM BREACH DESCRIBED AS ‘STUNNING, SERIOUS'

On February 11, the OCC, the US's banking regulator, discovered unusual activity between a system admin account and user mailboxes. Unknown attackers had accessed over 150,000 emails since June 2023. Security analyst David Shipley called the intrusion "massively serious," posing a potential threat to national banking infrastructure. The OCC, which regulates all national banks, has hired third-party cybersecurity experts for a full investigation while asserting that its security controls meet or exceed NIST standards.

csoonline.com · 3 min

TLDR InfoSec

CLOUD INCIDENT READINESS: KEY LOGS FOR CLOUD INCIDENTS

This post ranks key logs for cloud incident readiness as must-have, should-have, and nice-to-have for Microsoft, AWS, and Google. It uses real-life incident response cases to highlight the importance of enabling and retaining the right logs for security monitoring and analysis.

invictus-ir.com · 6 min

TLDR InfoSec

COMBINING DLL SIDELOADING AND SYSCALLS FOR EVASION

This article examines DLL Sideloading and using Direct Syscalls as evasion techniques to bypass Antivirus and EDR solutions by loading malicious DLLs via legitimate applications. Using hijacking and Direct Syscalls, the author shows how to create and execute a malicious DLL that evades static detection and executes shellcode on a victim machine. Elastic YARA rules and Havoc C2 are used for generating and testing shellcode, enhancing evasion against security defenses.

medium.com · 4 min

TLDR InfoSec

GAMAREDON CAMPAIGN ABUSES LNK FILES TO DISTRIBUTE REMCOS BACKDOOR

Cisco Talos is tracking an ongoing campaign targeting users in Ukraine with malicious LNK files that resemble war-related files to eventually download the Remcos backdoor. The LNK files run a PowerShell command to launch a decoy file and download the second-stage zip file containing the backdoor. The second stage payload then uses DLL side-loading to execute the Remcos payload. Cisco believes that this campaign is associated with Gamaredon.

blog.talosintelligence.com · 7 min

TLDR InfoSec

FIVE VPN APPS IN THE GOOGLE PLAY AND APP STORE HAD LINKS TO CHINESE MILITARY

A joint investigation by the Tech Transparency Project and the Financial Times found that at least five VPN apps present in both the App Store and Google Play store had links to a company associated with the Chinese military. Three of the apps have racked up more than a million downloads. The five apps cited were Turbo VPN, VPN Proxy Master, Thunder VPN, Snap VPN, and Signal Secure VPN (unaffiliated with the messaging app).

9to5mac.com · 2 min

TLDR InfoSec

ENHANCING CLOUD SECURITY IN AI/ML: THE LITTLE PICKLE STORY

Python pickles are a serialization format that is commonly used in AI/ML workflows in Python. Pickles that come from unsafe sources can result in arbitrary code execution due to invalidated object loading, corrupt models, exposure of sensitive data, or lead to sensitive information disclosure due to a lack of encryption. One strategy for scanning pickle files using static code analysis is to generate a list of all Python libraries that are used in your environment, validate any pre-built rules in existing static code analysis tooling, and write custom rules in tools like Semgrep to identify pickling and unpickling methods.

aws.amazon.com · 4 min

TLDR InfoSec

WHATSAPP FOR WINDOWS FLAW COULD LET HACKERS SNEAK IN MALICIOUS FILES

A security flaw (CVE-2025-30401) in WhatsApp for Windows allowed hackers to send malicious files to users, posing a risk to those interacting with attachments. The vulnerability could trick users into opening harmful code disguised as harmless files. To stay safe, users should update WhatsApp to version 2.2450.6 or later and be cautious when opening file attachments.

hackread.com · 2 min

TLDR InfoSec

MEDUSA RANSOMWARE CLAIMS NASCAR BREACH IN LATEST ATTACK

The Medusa ransomware gang targeted NASCAR, demanding a $4 million ransom and threatening to release internal data if unpaid.

hackread.com · 2 min

TLDR InfoSec

AWS ROLLS OUT ML-KEM TO SECURE TLS FROM QUANTUM THREATS

AWS has implemented ML-KEM, a post-quantum algorithm, to strengthen TLS connections against potential quantum computing threats.

bleepingcomputer.com · 2 min

TLDR InfoSec

HELLCAT RANSOMWARE HITS 4 FIRMS USING INFOSTEALER-STOLEN JIRA CREDENTIALS

HellCat ransomware hit four companies in the US and Europe by exploiting stolen Jira credentials obtained through infostealer malware.

hackread.com · 3 min