The Daily Index — Wednesday, April 16, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

2.6 MILLION IMPACTED BY LANDMARK ADMIN, YOUNG CONSULTING DATA BREACHES

Landmark Admin and Young Consulting have reported major data breaches that affect 2.6 million individuals. A ransomware attack on Landmark via stolen VPN credentials compromised 1.6 million people's sensitive personal data, while a breach at Young Consulting affected 1 million people, exposing names, SSNs, and health information.

securityweek.com · 2 min

TLDR InfoSec

KIDNEY DIALYSIS FIRM DAVITA HIT BY WEEKEND RANSOMWARE ATTACK

DaVita, a major kidney care provider, reported a ransomware attack over the weekend. The firm isolated affected systems, but some operations are still disrupted. DaVita is investigating and has not disclosed which ransomware gangs may be involved or if patient data was stolen.

bleepingcomputer.com · 2 min

TLDR InfoSec

THREAT SPOTLIGHT: HIJACKED AND HIDDEN: NEW BACKDOOR AND PERSISTENCE TECHNIQUE

ReliaQuest discovered a sophisticated attack chain in March 2025 that targeted finance and professional services sectors. It begins with Microsoft Teams phishing but evolves into a novel persistence technique that involves Component Object Model Type Library hijacking. The attack deploys previously unseen malware with a PowerShell backdoor that uses Telegram for command and control, showing similarities to earlier campaigns attributed to the "Storm-1811" threat group known for deploying Black Basta ransomware. To defend against these tactics, organizations should restrict external Microsoft Teams communications, block specific domains at the network edge, and implement various Windows security hardening measures.

reliaquest.com · 12 min

TLDR InfoSec

RED TEAMING WITH SERVICENOW

MDSec, a British cybersecurity consultancy, provides an overview of ServiceNow functionality and ways to abuse it for red team functionality. This post discusses some access vectors, such as the API and login.do endpoint, and details how custom actions, discovery, orchestration, the LDAP listener, and relaying can be abused.

mdsec.co.uk · 10 min

TLDR InfoSec

👉 Get a closer look with a customized demo of Drata

Summary unavailable

try.drata.com

TLDR InfoSec

NETRISE (PRODUCT LAUNCH)

NetRise's Supply Chain Detection and Response (SCDR) platform provides a Software Bill of Materials (SBOM) covering various devices, which improves vulnerability detection and remediation and helps ensure regulatory compliance.

netrise.io

TLDR InfoSec

OPENAI SHIPS GPT-4.1 WITHOUT A SAFETY REPORT

OpenAI launched GPT-4.1 without providing a safety report, deviating from its usual practice of publishing such reports. The omission has raised concerns among safety researchers and former employees, who argue that transparency in AI safety is critical.

au.finance.yahoo.com · 3 min

TLDR InfoSec

NEW SSL/TLS CERTS TO EACH LIVE NO LONGER THAN 47 DAYS BY 2029

The Browser Forum voted to reduce SSL/TLS certificate validity from the current 398 days to just 47 days by 2029. The phased reduction begins in March 2026 with 200-day limits, dropping to 100 days in 2027. Tech giants unanimously supported the change to enhance security by limiting abuse of compromised certificates, though sysadmins worry about increased workload without automation.

theregister.com · 3 min

TLDR InfoSec

MICROSOFT BLOCKS ACTIVEX BY DEFAULT IN MICROSOFT 365, OFFICE 2024

Microsoft announced that it will begin disabling all ActiveX controls in Windows versions of Office 2024 and Microsoft 365 starting later this month. After this change goes into effect, users will see a notification at the top of content that uses ActiveX stating: "BLOCKED CONTENT: The ActiveX content in this file is blocked." ActiveX can be re-enabled via the Trust Center.

bleepingcomputer.com · 2 min

TLDR InfoSec

NEW RESOLVERRAT MALWARE TARGETS HEALTHCARE AND PHARMA ORGS WORLDWIDE

A new malware called ResolverRAT targets healthcare and pharmaceutical organizations through phishing emails with malicious attachments.

csoonline.com · 3 min

TLDR InfoSec

CHINESE ESPIONAGE GROUP LEANS ON OPEN-SOURCE TOOLS TO MASK INTRUSIONS

A Chinese hacking group, UNC5174, uses open-source tools like VShell and WebSockets to hide its malicious activities and blend in with other cybercriminals.

cyberscoop.com · 3 min

TLDR InfoSec

GOOGLE ADDS ANDROID AUTO-REBOOT TO BLOCK FORENSIC DATA EXTRACTIONS

Google is adding a new feature to Android devices that automatically reboots them after three days of inactivity to enhance security by encrypting data more often.

bleepingcomputer.com · 2 min