The Daily Index — Monday, June 23, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

ATTACK ON OXFORD CITY COUNCIL EXPOSES 21 YEARS OF ELECTION WORKER DATA

Oxford City Council suffered a cyberattack on June 7-8, compromising 21 years of election worker data (2001-2022). The breach affected current and former council officers' personal information. Automated security systems detected and stopped the attack and have since been restored. There is no evidence that suggests data was shared externally or mass-downloaded.

theregister.com · 4 min

TLDR InfoSec

ANUBIS RANSOMWARE LISTS DISNEYLAND PARIS AS NEW VICTIM

The Anubis ransomware group asserts that it has acquired 64GB of data from Disneyland Paris, mostly concerning construction and renovation efforts. They claim to have accessed the files by breaching a partner company and have shared images and videos as evidence. It remains uncertain whether customer data was also compromised. Disneyland Paris has not verified the breach.

hackread.com · 2 min

TLDR InfoSec

CLOUDTRAIL LOGGING EVASION: WHERE POLICY SIZE MATTERS

Researchers from Permiso Security discovered a novel CloudTrail log bypass that abuses differing policy size calculations. AWS' documentation states that whitespace does not count when determining the maximum size of an IAM policy. However, the researchers determined that the policy would fail validation if the whitespace caused the size to exceed 131,072 characters. The researchers discovered that CloudTrail fails to capture full request details for requests in the size range of 102,401 to 131,072.

permiso.io · 7 min

TLDR InfoSec

DO NOT RUN ANY CARGO COMMANDS ON UNTRUSTED PROJECTS

This post highlights two attack vectors by which malicious Rust code could target the cargo system. The first attack vector abuses the fact that a project could remap the `rustc` binary to any arbitrary path, which would compromise any cargo commands. The second attack vector could compromise plugins that don't use the cargo config files, such as `cargo crev`, by defining an alias for that command in the config.toml.

shnatsel.medium.com · 5 min

TLDR InfoSec

DETECTION PITFALLS YOU MIGHT BE SLEEPING ON

This post presents five common Windows detection pitfalls that can lead to gaps in detection. The pitfalls include parameters being able to be called in multiple different ways, & and | causing multiple log entries for a single command, extra whitespace in commands, other forms of command obfuscation, and commands that don't cause process creation events. Each pitfall also includes detection tips to circumvent it.

detect.fyi · 5 min

TLDR InfoSec

AWS ROLLS OUT 3 KEY SECURITY CAPABILITIES AT RE:INFORCE, HELPING CUSTOMERS SIMPLIFY AND SCALE

AWS announced three new security services at re:Inforce conference to address AI-era threats. Security Hub centralizes threat identification and prioritization. Shield proactively analyzes network configurations to prevent attacks like SQL injection and DDoS. GuardDuty Extended Threat Detection now protects container applications, detecting sophisticated multi-stage attack patterns.

aboutamazon.com · 2 min

TLDR InfoSec

MASSIVE 7.3 TBPS DDOS ATTACK DELIVERS 37.4 TB IN 45 SECONDS, TARGETING HOSTING PROVIDER

Cloudflare blocked a record-breaking 7.3 Tbps DDoS attack targeting a hosting provider in May. The 45-second attack delivered 37.4 terabytes from over 122,000 IP addresses across 161 countries.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

IRAN'S GOVERNMENT SAYS IT SHUT DOWN INTERNET TO PROTECT AGAINST CYBERATTACKS

Iran shut down its internet nationwide this week, calling it a "near-total blackout." The government confirmed it ordered the shutdown to protect against Israeli cyberattacks, citing recent hacks on Iranian banks and cryptocurrency exchanges by the pro-Israel group Predatory Sparrow.

techcrunch.com · 3 min

TLDR InfoSec

SCAMMERS USE INFERNO DRAINER TO STEAL $43K FROM COINMARKETCAP USERS

Hackers deceived CoinMarketCap users into linking their crypto wallets to a counterfeit prompt, resulting in the theft of over $43,000 through a tool known as Inferno Drainer, which disseminated a hidden code across the site.

hackread.com · 3 min

TLDR InfoSec

WALMART TO PAY $10M TO SETTLE LAWSUIT OVER MONEY TRANSFER SCAM

Walmart has agreed to pay $10 million to settle FTC allegations that it allowed scammers to exploit its money transfer services between 2013 and 2018, which resulted in hundreds of millions of dollars stolen from customers through fraud schemes.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

RUSSIAN HACKERS BYPASS GMAIL MFA USING STOLEN APP PASSWORDS

Russian hackers impersonated U.S. State Department officials to deceive individuals into providing passwords that allowed them to circumvent Gmail's security measures, specifically targeting experts and critics of Russia.

bleepingcomputer.com · 3 min