The Daily Index — Thursday, May 22, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

VANHELSING RANSOMWARE BUILDER LEAKED ON HACKING FORUM

After a former developer for the Ransomware-as-a-Service operator VanHelsing attempted to sell the source code for the VanHelsing affiliate panel, data leak Tor sites, and builders for the Windows and Linux encryptors, VanHelsing proactively released the source code itself. The leaked source code includes the Windows encryptor, which will require modifications for other threat actors, and the source code for the affiliate panel and blog site, which can be run as is. The data VanHelsing leaked was only a subset of what the former developer attempted to sell, as it did not include any databases or the Linux builder.

bleepingcomputer.com · 3 min

TLDR InfoSec

COINBASE SAYS ITS DATA BREACH AFFECTS AT LEAST 69,000 CUSTOMERS

Coinbase reported that 69,461 customers had personal and financial data stolen during a six-month breach. Hackers bribed support staff, stealing names, addresses, ID documents, account balances, and transaction histories. Despite a $20 million ransom demand, Coinbase refused to pay.

techcrunch.com · 2 min

TLDR InfoSec

WHY RECREATING AN IAM ROLE DOESN'T RESTORE TRUST: A GOTCHA IN ROLE ARNS

In AWS IAM, trust policies reference ARNs in their JSON but reference an underlying, immutable principal ID, so if a role is deleted and recreated, the trust policy will also need to be recreated, even if the ARN is unchanged. This provides a security benefit in that if a role is deleted but the trust policy is unintentionally not updated, the role cannot be stealthily recreated and assume the same level of trust. Users can get around this issue by using a complete account as the principal in a trust policy with a condition block that restricts access to the specific role ARN.

hackingthe.cloud · 4 min

TLDR InfoSec

FORGET IPS: USING CRYPTOGRAPHY TO VERIFY BOT AND AGENT TRAFFIC

In the era of AI agents, not all bot traffic is malicious. Cloudflare proposed two mechanisms for “good bots” to self-identify. The first is HTTP Message Signatures, which adds a Signature-Input header with a signature, validity period, usage tag, and a Signature-Agent header to locate the key. The second option is a new TLS flag, req_mTLS, which allows clients to indicate support for mutual TLS and identify the bot.

blog.cloudflare.com · 10 min

TLDR InfoSec

SECURING CI/CD WORKFLOWS WITH WAZUH

CI/CD pipelines automate software development but introduce security risks like supply chain attacks and misconfigurations. Wazuh, an open-source security platform, enhances CI/CD security through log collection, file integrity monitoring, custom security rules, and more. This post dives into how to use it.

links.tldrnewsletter.com · 5 min

TLDR InfoSec

SECURITY IS A NEGOTIATION PROBLEM

This post reflects on budgeting issues with security products and shares an experience with negotiating vendors down to under 10% of initial quotes. It recommends using Google Ads to uncover competitor concerns and obtain competing quotes while downplaying the proposed solution's value. The post also highlights tactics like applying pressure and providing the sales rep with the hope of a purchase.

securityis.substack.com · 10 min

TLDR InfoSec

M&S WARNS OF £300M DENT IN PROFITS FROM CYBERATTACK

Marks & Spencer expects a £300 million hit to next year's profits from its ongoing cyberattack, partially offset by insurance and cost mitigation. The month-long breach will force online sales offline until July, impacting food availability and operations.

theregister.com · 3 min

TLDR InfoSec

CELLCOM SERVICE DISRUPTION CAUSED BY CYBERATTACK

Summary unavailable

securityweek.com · 3 min

TLDR InfoSec

GOOGLE CHROME WILL BE ABLE TO AUTOMATICALLY CHANGE YOUR BAD PASSWORDS

With user consent, Chrome will soon automatically change weak passwords, helping improve security on supported websites without requiring manual updates.

theverge.com · 2 min

TLDR InfoSec

MICROSOFT DISMANTLES LUMMA STEALER NETWORK, SEIZES 2,000+ DOMAINS

Microsoft and global law enforcement dismantled Lumma Stealer, a significant malware, by seizing over 2,300 web domains to prevent it from accessing infected devices.

hackread.com · 3 min

TLDR InfoSec

RUSSIA TO ENFORCE LOCATION TRACKING APP ON ALL FOREIGNERS IN MOSCOW

Russia intends to require foreign residents in Moscow to install a tracking app on their phones to gather data such as location, fingerprints, and facial images.

bleepingcomputer.com · 2 min