The Daily Index — Tuesday, June 17, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

OVER 8M EXPOSED AFTER MAJOR CAR-SHARING APP BREACH

India's largest ride-sharing app, Zoomcar, has notified the SEC that it suffered a data breach that exposed the data of 8.4M individuals. Zoomcar was notified of this breach when the threat actor contacted certain employees about their unauthorized access. The breached data includes names, phone numbers, car registration numbers, personal addresses, and email addresses, but does not include financial information or plaintext passwords.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

RANSOMWARE GANG EXPLOITS SIMPLEHELP RMM TO COMPROMISE UTILITY BILLING FIRM

The CISA has released an advisory that a path traversal vulnerability in the SimpleHelp Remote Management and Monitoring (RMM) tool is actively exploited. Sophos reported that the DragonForce ransomware gang is chaining this vulnerability with two other vulnerabilities to deploy ransomware across client networks. Following encryption, the threat actors employ a double extortion strategy, demanding a ransom for the data and threatening to leak the stolen data.

infosecurity-magazine.com · 2 min

TLDR InfoSec

CALL STACKS: NO MORE FREE PASSES FOR MALWARE

Elastic's Windows endpoint telemetry analyzes call stacks to identify both the activity and the performer, enhancing malware detection. The call stacks, or "return address stacks," can be manipulated by malware using return address spoofing and stack frame crafting to conceal malicious actions. Elastic enriches these stacks with module information, applies behavioral tagging, and detects sophisticated evasion tactics like SilentMoonwalk call stack spoofing.

elastic.co · 11 min

TLDR InfoSec

INSIDE THE LOCKBIT'S ADMIN PANEL LEAK: AFFILIATES, VICTIMS AND MILLIONS IN CRYPTO

On May 7, an anonymous hacker named "xoxo from Prague" breached LockBit's admin panel and leaked an SQL database containing operational data from December 2024 to April 2025. The leak revealed that LockBit earned approximately $2.3 million from ransom payments during this period, primarily targeting China and the manufacturing sector, while its registration fee claims were grossly inflated at only $10,000 to $11,000. Additionally, the leak disclosed details about 75 affiliates and their connections to other ransomware groups like RansomHUB, HellCat, and Evil Corp, with affiliates adjusting ransom demands to match company revenues and specific geographic targets.

trellix.com · 21 min

TLDR InfoSec

DECEPTION FUNDAMENTALS: THE MISSING PIECE IN YOUR SECURITY STRATEGY

Current deception technologies fail against skilled attackers due to obvious fake assets that don't align with real infrastructure patterns. Attackers exploit legitimate services and trusted channels, like GitHub OAuth flows, for their own deception. Effective deception involves analyzing real asset patterns and deploying fake assets through trusted communication channels, following the formula: Deception Assets + Communication Channels = Desired Effect. The key principle is congruence—attackers engage with deceptions only when found through expected channels, and the assets match their experience, leading to methodical validation that increases their dwell time.

deceptiq.com · 6 min

TLDR InfoSec

THE META AI APP IS A PRIVACY DISASTER

The standalone Meta AI app has a share button that shows users a preview of their posts and then publishes their conversations within the app. However, many users seem unaware of this sharing. Researchers have discovered conversations that include sensitive PII, users requesting aid with committing tax evasion, and other sensitive information. Notably, Meta does not indicate users' privacy settings when they post.

techcrunch.com · 2 min

TLDR InfoSec

270K WEBSITES INJECTED WITH ‘JSF-CK' OBFUSCATED CODE

Nearly 270K websites have been compromised with malicious JavaScript Injectors that are obfuscated using the ‘JSF-ck method.' This method uses six ASCII characters to produce working JavaScript code by relying on JavaScript's type coercion to encode numbers and letters using crafted combinations of the characters. It leads to very long and easy-to-detect code, but is challenging to unobfuscate without specialized tools.

scworld.com · 2 min

TLDR InfoSec

MACOS TAHOE BRINGS A NEW DISK IMAGE FORMAT

macOS Tahoe introduces ASIF (Apple Sparse Image Format), a new disk image format that achieves near-native speeds of 4.8-6.6 GB/s, compared to traditional encrypted sparse images that only reach 100 MB/s on Apple silicon Macs. ASIF images, being intrinsically sparse files in APFS, maintain efficient sizes regardless of the host file system, ideal for virtual machines and high-performance storage. This format can be created exclusively with Tahoe's Disk Utility or diskutil command and is designed to work with macOS Sequoia for mounting. It significantly outperforms existing disk image formats, including sparse bundles, by utilizing a single file for storage.

eclecticlight.co · 12 min

TLDR InfoSec

HACKERS SWITCH TO TARGETING U.S. INSURANCE COMPANIES

Hackers from the Scattered Spider group are targeting U.S. insurance companies by employing social engineering tactics such as phishing and fraudulent calls to deceive employees and infiltrate systems.

bleepingcomputer.com · 2 min

TLDR InfoSec

U.S. SEIZES $7.74M IN CRYPTO TIED TO NORTH KOREA'S GLOBAL FAKE IT WORKER NETWORK

The U.S. confiscated $7.74 million in cryptocurrency connected to North Korean IT workers who used fake identities to gain employment at American companies and funneled money back to North Korea to aid its weapons programs.

links.tldrnewsletter.com · 6 min

TLDR InfoSec

REPORT LINKS LOS POLLOS AND RICHADS TO MALWARE TRAFFIC OPERATIONS

Researchers found that some ad companies, like Los Pollos and RichAds, were secretly helping cybercrime groups spread malware.

hackread.com · 3 min