The Daily Index — Monday, June 2, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

INTERLOCK RANSOMWARE DEPLOYS NEW NODESNAKE RAT IN UK ATTACKS

The Interlock ransomware group has deployed a Remote Access Trojan (RAT) called NodeSnake in attacks on two UK universities over two months. NodeSnake enables attackers to control infected computers, access files, monitor activity, and install additional malware while remaining undetected. It emerged in September 2024 and previously targeted large organizations in North America and Europe. Interlock now focuses on educational institutions and local governments, possibly to steal intellectual property and test new attack methods.

hackread.com · 2 min

TLDR InfoSec

NEW LINUX FLAWS ALLOW PASSWORD HASH THEFT VIA CORE DUMPS IN UBUNTU, RHEL, FEDORA

Two race condition vulnerabilities (CVE-2025-5054 and CVE-2025-4598) in Linux dump handlers enable local attackers to steal password hashes and sensitive data from crashed privileged processes. These flaws affect apport in Ubuntu and systemd-coredump in Red Hat and Fedora, allowing attackers to exploit SUID programs via timing attacks that replace crashed processes with malicious ones to access core dumps. Organizations can mitigate risk by disabling core dumps for SUID binaries with "echo 0 > /proc/sys/fs/suid_dumpable" until patches are applied.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

DEMONSTRABLY SECURE SOFTWARE SUPPLY CHAINS WITH NIX

Nix enables secure software supply chains by providing verifiable proofs of the sources that produced a final product, removing the need for restrictive air-gapped environments. It tracks all dependencies to their source code through fixed-output derivations and exports these sources, typically a few GB, to an offline system for integrity proof by rebuilding everything from scratch. This method lets developers use modern tools and workflows while ensuring the cryptographic supply chain verification needed by agencies like CISA, BSI, and ANSSI for critical systems.

nixcademy.com · 7 min

TLDR InfoSec

DANABOT TAKEDOWN SHOWS HOW AGENTIC AI CUT MONTHS OF SOC ANALYSIS TO WEEKS

U.S. authorities have dismantled DanaBot, a Russian malware operation that infected 300,000+ systems and caused $50+ million in damage. The takedown showcased agentic AI's cybersecurity capabilities. Autonomous threat detection and real-time analysis were used to accelerate investigations and enable swift law enforcement action against sophisticated cyber threats.

links.tldrnewsletter.com · 7 min

TLDR InfoSec

WIRELESS PIVOTS: HOW TRUSTED NETWORKS BECOME INVISIBLE THREAT VECTORS

Even well-configured enterprise Wi-Fi networks that use EAP-TLS can be compromised via wireless pivots targeting trusted devices connecting to untrusted networks outside the corporate perimeter. Attackers capture probe requests from corporate devices, set up rogue access points mimicking home networks (like Thomson routers), crack Wi-Fi passwords via WPA handshake captures, and use tools like Responder to intercept NetNTLM hashes from mDNS/LLMNR broadcasts. Once cracked, these hashes provide internal credentials for accessing cloud services like Office 365, illustrating that the security boundary extends beyond the corporate network to any location where trusted devices connect.

thexero.co.uk · 9 min

TLDR InfoSec

courses and certifications

Summary unavailable

sans.org

TLDR InfoSec

UNBOUND (PRODUCT LAUNCH)

Unbound's AI Gateway product connects to commonly used AI tools to surface usage patterns and provide model routing, real-time protection, and usage analytics.

getunbound.ai

TLDR InfoSec

POLICE TAKES DOWN AVCHECK SITE USED BY CYBERCRIMINALS TO SCAN MALWARE

International law enforcement seized AVCheck, one of the largest counter-antivirus services cybercriminals used to test whether their malware could evade commercial antivirus software before deployment. The operation, which involved U.S., Dutch, and other agencies, also took down related crypting services Cryptor.biz and Crypt.guru that helped obfuscate malware to make it undetectable. The takedown was part of Operation Endgame and disrupted a key component of the cybercriminal ecosystem that allowed ransomware groups to refine their attacks against security systems.

bleepingcomputer.com · 2 min

TLDR InfoSec

RANSOMWARE KINGPIN “STERN” APPARENTLY IDED BY GERMAN LAW ENFORCEMENT

German police have identified "Stern," the enigmatic leader of the notorious Trickbot cybercrime cartel, as 36-year-old Russian Vitaly Kovalev. Trickbot attacked thousands of victims, including hospitals, stealing hundreds of millions over six years. Kovalev was previously sanctioned under different aliases, but his connection to "Stern" remained hidden until now.

arstechnica.com · 5 min

TLDR InfoSec

META STOPPED COVERT OPERATIONS FROM IRAN, CHINA, AND ROMANIA SPREADING PROPAGANDA

Meta disrupted propaganda campaigns from Iran, China, and Romania that misled users with fake accounts and AI-generated images.

securityaffairs.com · 2 min

TLDR InfoSec

BILLIONS OF COOKIES UP FOR GRABS AS EXPERTS WARN OVER SESSION SECURITY

93.7 billion stolen cookies are for sale online, with 7-9% still active and exploitable by cybercriminals for account access.

theregister.com · 3 min

TLDR InfoSec

VICTORIA'S SECRET HIT BY OUTAGES AS IT BATTLES SECURITY INCIDENT

Victoria's Secret responded to a cybersecurity incident that disrupted its website and online orders by shutting down its website, pausing some in-store services, and collaborating with third-party experts to restore operations.

techcrunch.com · 2 min