The Daily Index — Tuesday, July 1, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

STABLECOIN PROTOCOL RESUPPLY LOSES $9.6M TO PRICE MANIPULATION EXPLOIT

Decentralized finance (DeFi) protocol Resupply confirmed a security breach in its wstUSR market which resulted in $9.6M in losses. The attacker used a price manipulation exploit to inflate the share price which allowed them to borrow $10M reUSD with minimal collateral. Resupply paused the contracts to prevent further damage upon detection.

cointelegraph.com · 2 min

TLDR InfoSec

ZURICH NON-PROFIT HIT BY RANSOMWARE, SWISS FEDERAL DATA AT RISK

Radix, a Zurich-based non-profit health foundation, was hit by a ransomware attack on June 16. The Sarcoma group released 1.3TB of stolen data after ransom demands failed. The breach affected data from Swiss federal offices that trusted Radix, though attackers didn't access Federal Administration systems directly. Swiss authorities are investigating the attack and warned of potential future phishing campaigns using the stolen data.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

HACKER CONVERSATIONS: RACHEL TOBAC AND THE ART OF SOCIAL ENGINEERING

Rachel Tobac, CEO of SocialProof Security, demonstrates how social engineers exploit psychological principles, such as the principles of urgency, authority, and scarcity, to trick targets into revealing sensitive information or credentials. Her methods involve OSINT research, AI-generated voice clones, background audio effects, and caller ID spoofing to craft convincing stories that bypass human verification. Organizations should enhance identity checks beyond simple data, such as birthdates and addresses, as attackers can easily obtain this information from data brokers to impersonate real customers.

securityweek.com · 8 min

TLDR InfoSec

USING AI TO IDENTIFY CYBERCRIME MASTERMINDS

Sophos researchers created an AI framework that analyzes 11,558 posts from 4,441 individuals across 124 dark web forums, mapping discussions to CVE exploits and MITRE CAPEC patterns. It clusters threat actors by skill, commitment, and activity, identifying 14 "professional" actors (3.9%) with high expertise and a focused approach. This automated method helps threat teams prioritize investigations and reduce manual analysis when spotting key criminals.

news.sophos.com · 6 min

TLDR InfoSec

COMPARING SEMGREP PRO AND COMMUNITY WHITEPAPER

Static Application Security Testing (SAST) is crucial for modern application security. Semgrep has become popular due to its accessible Community Edition. This research compares Semgrep's free and commercial versions, showing that Semgrep Code identifies more findings and achieves better true positive rates than the Community Edition.

doyensec.com · 15 min

TLDR InfoSec

ZERORISC (PRODUCT LAUNCH)

ZeroRISC offers cloud security solutions aimed at ensuring transparency and reliability for data centers, ICS, other OT systems, and IoT devices.

zerorisc.com

TLDR InfoSec

PROFESSIONAL PENTESTER TOOLBOX

The TCM Security team has compiled a list of their favorite tools for external pentests, internal pentests, AD tools, reconnaissance, web app testing, and physical pentesting.

tcm-sec.com · 3 min

TLDR InfoSec

NORDIC'S LARGEST APPLE PREMIUM PARTNER BREACHED, HACKERS CLAIM

The Kraken ransomware group claims to have breached Humac, the Nordic region's largest Apple Premium Partner, stealing financial information, customer data, and employee details. Cybernews verified that the leaked data appears legitimate. The data includes employee records, internal files, and database samples from the retailer, which has over 120 stores across Europe. The breach poses risks - stolen employee data could enable phishing to access Apple support platforms, and customer info could aid fraud.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

CANADA GIVES HIKVISION THE BOOT ON NATIONAL SECURITY GROUNDS

Canada ordered Chinese surveillance company Hikvision to cease operations on national security grounds. The partly state-owned firm is banned from government use, with existing equipment under review. Hikvision called the decision unfounded and said it was geopolitically motivated.

securityweek.com · 3 min

TLDR InfoSec

SINALOA DRUG CARTEL HIRED A CYBERSNOOP TO IDENTIFY AND KILL FBI INFORMANTS

A Sinaloa cartel informant told the FBI in 2018 that the drug gang was paying hackers to spy on federal agents and people working with law enforcement. The hackers could break into phones, hack into Mexico City's security cameras, and track where people went. The cartel used this information to threaten and kill witnesses.

theregister.com · 3 min

TLDR InfoSec

SQUAREX REVEALS THAT EMPLOYEES ARE NO LONGER THE WEAKEST LINK, BROWSER AI AGENTS ARE

SquareX's research indicates that Browser AI Agents are now more vulnerable to cyberattacks than employees due to their limited security awareness and inability to recognize warning signs, such as suspicious links.

hackread.com · 3 min

TLDR InfoSec

JOINT STATEMENT FROM CISA, FBI, DC3, AND NSA ON POTENTIAL TARGETED CYBER ACTIVITY AGAINST U.S. CRITICAL INFRASTRUCTURE BY IRAN

Iranian hackers might target US systems with weak passwords and outdated software, so agencies advise vigilance.

cisa.gov · 1 min

TLDR InfoSec

EUROPOL DISMANTLES $540 MILLION CRYPTOCURRENCY FRAUD NETWORK, ARRESTS FIVE SUSPECTS

Europol dismantled a crypto scam operation involving 'pig butchering' schemes that defrauded over 5,000 victims worldwide of €460 million, leading to five arrests in Spain.

links.tldrnewsletter.com · 4 min