The Daily Index — Wednesday, July 16, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

RANSOMWARE GROUP CLAIMS ATTACK ON BELK

The ransomware group DragonForce attacked US department store chain Belk in May, compromising the names and Social Security numbers of customers. The attack disrupted online and physical operations for days, with Belk's website still offline. DragonForce claims to have exfiltrated 156GB of data and made it publicly available, suggesting no ransom was paid.

securityweek.com · 2 min

TLDR InfoSec

EXPLOITED WING FILE TRANSFER BUG RISKS TOTAL SERVER COMPROMISE

The CISA is warning users of a new critical (CVSS 10/10) vulnerability in the Wing FTP software that is under active exploitation. The vulnerability stems from Wing FTP software not sanitizing usernames that contain a NULL byte and then constructing a Lua session file from the username, which can potentially include Lua code after the NULL byte. Huntress and Arctic Wolf have both recorded that they have seen attackers exploiting exposed servers to download and execute malicious files, perform reconnaissance, and install remote monitoring and management software.

therecord.media · 2 min

TLDR InfoSec

WEAPONIZING WINDOWS DRIVERS: A HACKER'S GUIDE FOR BEGINNERS

This article introduces a four-part cybersecurity playbook on analyzing and exploiting Windows kernel drivers. It highlights the rising threat of BYOVD (Bring Your Own Vulnerable Driver) attacks, where attackers exploit legitimate but flawed signed drivers to bypass kernel protections.

securityjoes.com · 10 min

TLDR InfoSec

WHAT IS A DETECTION ENGINEER?

The first part of Zach Allen's Detection Engineering Field Manual introduces the concept of detection engineering, which primarily focuses on detecting when a threat actor circumvents controls. Allen models SOC operations in three loops: Loop 1 identifies assets and utilizes controls to protect them, Loop 2 employs rules to detect threats and responds with containment, and finally, Loop 3 focuses on recovering and learning from incidents. A detection engineer can focus on one loop or all of them and should, at a minimum, possess some coding expertise and a customer-centric mindset.

detectionengineering.net · 7 min

TLDR InfoSec

ENCRYPTING FILES WITH PASSKEYS AND AGE

Typage 0.2.3 introduces passkey-based file encryption using the WebAuthn PRF extension, allowing users to encrypt files that can only be decrypted with biometric authentication or hardware security keys. The implementation creates a new age recipient format (fido2prf) that binds each encrypted file to specific hardware credentials, requiring both the encrypted file and physical access to the authenticator for decryption. Files encrypted on one device can be decrypted on another through synced passkeys. A companion CLI plugin also enables this functionality with FIDO2 hardware tokens outside the browser.

words.filippo.io · 8 min

TLDR InfoSec

ZIP SECURITY (PRODUCT LAUNCH)

Zip Security helps organizations implement security best practices and achieve compliance, while also managing their IT infrastructure to reduce service overhead and costs.

zipsec.com

TLDR InfoSec

META FIXES BUG THAT COULD LEAK USERS' AI PROMPTS AND GENERATED CONTENT

Meta fixed a security bug that allowed users to access other users' private AI prompts and responses by manipulating unique prompt numbers. Security researcher Sandeep Hodkasia discovered the vulnerability in December and received a $10,000 bug bounty. Meta deployed the fix in January after finding no evidence of malicious exploitation of the flaw.

techcrunch.com · 2 min

TLDR InfoSec

THOUSANDS OF AFGHANS WERE MOVED TO THE UK IN A SECRET SCHEME FOLLOWING A DATA LEAK

On Tuesday, it was revealed that in 2022, a British official accidentally leaked data of Afghans who had applied to move to the UK under the Afghan Relocations and Assistance Program (ARAP). ARAP was set up for Afghans who feared reprisal from the Taliban. The impacted individuals are now being notified after a “super injunction” that prohibited discussion of the leak was lifted on Tuesday.

bbc.com · 4 min

TLDR InfoSec

UK LAUNCHES VULNERABILITY RESEARCH PROGRAM FOR EXTERNAL EXPERTS

The UK's NCSC announced the launch of a new Vulnerability Research Initiative (VRI) to partner with external cybersecurity researchers. Researchers who partner with the program will be given objectives to identify flaws in specific projects of interest, assess proposed mitigations, and then disclose the flaws through the “Equities Process” procedure.

bleepingcomputer.com · 2 min

TLDR InfoSec

DOGE DENIZEN MARKO ELEZ LEAKED API KEY FOR XAI

DOGE employee Marko Elez accidentally committed an xAI API key that had access to at least 52 different LLMs, an oversight that raises concerns, as Elez has access to various government databases, including SSNs.

krebsonsecurity.com · 2 min

TLDR InfoSec

ABACUS DARK WEB DRUG MARKET GOES OFFLINE IN SUSPECTED EXIT SCAM

Abacus Market, the largest Western darknet marketplace that facilitated an estimated $300 million in illegal drug transactions, has suddenly gone offline in what appears to be an exit scam where operators vanished with users' escrowed funds.

bleepingcomputer.com · 2 min

TLDR InfoSec

UK PET OWNERS TARGETED BY FAKE MICROCHIP RENEWAL SCAMS

Scammers are tricking UK pet owners with fake emails asking for microchip renewal fees using real pet details stolen from insecure databases.

hackread.com · 3 min