The Daily Index — Tuesday, July 8, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

EU BORDER SYSTEM HAS THOUSANDS OF CRITICAL VULNERABILITIES

Thousands of vulnerabilities were discovered in the Schengen Information System II (SIS II), which is used by EU border agencies to track illegal migrants and suspected criminals. An audit by the European Data Protection Supervisor (EDPS) found that the system contained an excessive amount of accounts with administrative privileges, was vulnerable to hacker overload and unauthorized access, and that 69 external employees had access without proper clearance. The EDPS found no evidence of a breach but warned that a breach could be catastrophic.

mezha.media · 2 min

TLDR InfoSec

CMS NOTIFIES 103K MEDICARE BENEFICIARIES ABOUT UNAUTHORIZED ACCOUNT CREATION

The HHS Centers for Medicare and Medicaid Services (CMS) was recently alerted that Medicare.gov accounts had been created for 103K individuals without their knowledge. The investigation determined that the accounts were created using information gathered from external sources. The unknown threat actor could use their access to view the user's Medicare beneficiary ID, coverage start date, birth date, and zip code.

hipaajournal.com · 2 min

TLDR InfoSec

THE GPS LEAK NO ONE TALKED ABOUT: UFFIZIO'S SILENT EXPOSURE

DeepSpecter exposed a five-year data breach involving Uffizio's GPS fleet management platform, leaking sensitive data from police, ambulances, and critical infrastructure across 12 countries. Despite claims of GDPR compliance and CVE disclosure, the exposure persisted through global resellers, underscoring that regulatory compliance alone does not provide adequate security protection.

reporter.deepspecter.com · 8 min

TLDR InfoSec

ROLES HERE? ROLES THERE? ROLES ANYWHERE: EXPLORING THE SECURITY OF AWS IAM ROLES ANYWHERE

AWS IAM Roles Anywhere is a method for authenticating to AWS using certificates signed by a configured trust anchor. By default, the Roles Anywhere policy does not include any conditions, and any role attached to it could be assumed by any request signed by any trust anchor in that region. Unit 42 recommends specifying an ARN using conditions in the default policy, utilizing ACM-PCA for the trust anchor, and adhering to the principle of least privilege.

unit42.paloaltonetworks.com · 12 min

TLDR InfoSec

HIJACKING AMAZON EVENTBRIDGE FOR LAUNCHING CROSS-ACCOUNT ATTACKS

Attackers exploit AWS EventBridge's cross-account features using six MITRE ATT&CK attack patterns: establishing persistent backdoors via check-in events, creating bidirectional command and control channels, conducting reconnaissance by capturing all events, exfiltrating data in small chunks disguised as telemetry, lateral movement exploiting trust relationships, and exploiting vulnerable Lambda functions for unintended AWS API calls. These bypass traditional controls and evade detection because EventBridge PutEvents API calls aren't logged in CloudTrail. Defenses include Service Control Policies, specific event patterns, input validation, and monitoring CloudWatch for unusual activities.

developer.squareup.com · 14 min

TLDR InfoSec

Get a demo

Summary unavailable

fortra.com

TLDR InfoSec

“NO HONOR AMONG THIEVES”: M&S HACKING GROUP STARTS TURF WAR

DragonForce and RansomHub, two major ransomware groups behind attacks on UK retailers like M&S and Harrods, are engaged in a turf war that could increase cyber risks for companies. The conflict began after DragonForce rebranded as a "cartel" and attacked RansomHub's site, potentially leading to double extortion of victims.

arstechnica.com · 4 min

TLDR InfoSec

PHISHING PLATFORMS, INFOSTEALERS BLAMED AS IDENTITY ATTACKS SOAR

Identity-based cyberattacks increased 156% due to advanced phishing kits such as Tycoon 2FA and info-stealing malware. Phishing-as-a-service platforms, which cost $200-$300 monthly, make sophisticated attacks accessible, now comprising 59% of security investigations, often resulting in business email compromise (BEC) and ransomware.

theregister.com · 6 min

TLDR InfoSec

POLICE IN BRAZIL ARREST A SUSPECT OVER $100M BANKING HACK

Brazilian police have arrested João Roque, an employee of C&M, for allegedly selling his credentials to hackers. This breach facilitated a cyberattack that diverted $100 million from Brazil's PIX payment system and impacted several financial institutions with fake transactions in a single night. Authorities have since frozen $50 million in assets and are pursuing four more suspects.

securityweek.com · 2 min

TLDR InfoSec

CALL OF DUTY TAKES PC GAME OFFLINE AFTER MULTIPLE REPORTS OF RCE ATTACKS ON PLAYERS

The makers of Call of Duty: World War 2 took the PC game offline after reports of hackers taking over players' computers during matches.

cyberscoop.com · 2 min

TLDR InfoSec

AT&T AGREED TO A $177 MILLION SETTLEMENT FOR DATA BREACHES OCCURRING IN 2019 AND 2024

AT&T has agreed to pay $177 million to settle lawsuits related to two major data breaches in 2019 and 2024, which exposed the personal and call data of millions of current and former customers.

hackread.com · 1 min

TLDR InfoSec

QANTAS IS BEING EXTORTED IN RECENT DATA-THEFT CYBERATTACK

Qantas suffered a cyberattack that exposed the data of 6 million customers, with police investigating and the attackers seeking extortion.

bleepingcomputer.com · 2 min