The Daily Index — Friday, July 18, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

UAP CONFIRMS RANSOMWARE ATTACK, PERSONAL DATA AND EMAIL CORRESPONDENCE EXPOSED

Clive Palmer's United Australia Party (UAP) posted a notice on its website that it suffered a data breach due to a ransomware attack. The party has stated that any individual who has interacted with the party may have had their data exposed, but it cannot conclusively determine which individuals were affected or what data was stolen. The stolen data may include email addresses, phone numbers, identity records, banking records, employment history, and any emails or attachments sent to or received from the party.

cyberdaily.au · 3 min

TLDR InfoSec

NEW TELEMESSAGE SGNL FLAW IS ACTIVELY BEING EXPLOITED BY ATTACKERS

TeleMessage SGNL, a Signal clone used by US government agencies, has an exposed /heapdump endpoint (CVE-2025-48927) that dumps 150MB memory snapshots containing usernames, passwords, and session data with no authentication required. Attackers are actively exploiting this flaw - CISA added it to the KEV catalog on July 14 and mandated federal agencies patch or stop using the software by July 22. Over 11 IPs have directly targeted this vulnerability, while 2,000+ IPs have scanned Spring Boot Actuator endpoints in the past 90 days, indicating widespread reconnaissance activity.

hackread.com · 3 min

TLDR InfoSec

THE LINUXSYS CRYPTOMINER

This post dives into Linuxsys, a cryptominer exploiting CVE-2021-41773 in a long-running campaign since 2021. Attackers use compromised legitimate websites for stealthy malware distribution and evasion, and the vulnerability remains actively exploited with dozens of daily attempts.

vulncheck.com · 5 min

TLDR InfoSec

WHY IS PREVENTATIVE SECURITY SO DIFFICULT?

Security teams should shift from endless vulnerability scanning and detection to preventative tools that stop issues at the source, like using supply chain security tools instead of just identifying vulnerabilities after deployment. Most security vendors focus on data collection and pattern detection rather than systemic prevention, leaving organizations to fix the identified problems manually. The strategy requires getting engineering teams to adopt preventative controls early in development workflows, rather than overwhelming them with vulnerability reports and SLAs that force reactive responses.

kanenarraway.com · 10 min

TLDR InfoSec

AUTOMATED FUNCTION ID DATABASE GENERATION IN GHIDRA ON WINDOWS

This post demonstrates how to automate function identification in stripped Windows binaries using Ghidra's Function ID databases, which work similarly to IDA Pro's FLIRT signatures to match known library functions against decompiled code. The approach involves extracting object files from static libraries (.lib files), importing them into Ghidra projects, and generating function signature databases that automatically rename generic function labels with actual library function names like OpenSSL functions. This technique significantly accelerates reverse engineering by eliminating manual function analysis, allowing security researchers to focus on vulnerability discovery rather than spending time identifying what each function does.

blog.mantrainfosec.com · 3 min

TLDR InfoSec

ICOUNTER (PRODUCT LAUNCH)

The iCOUNTER platform can act as an early warning system that identifies threats specific to the customer and its ecosystem, while also providing intelligence that enables rapid containment and recovery after an attack has taken place.

icounter.com

TLDR InfoSec

GOOGLE FINDS CUSTOM BACKDOOR BEING INSTALLED ON SONICWALL NETWORK DEVICES

Hackers (UNC6148) are compromising end-of-life SonicWall Secure Mobile Access appliances using leaked administrator credentials. The attackers install "Overstep" backdoor malware that deletes log entries, hindering forensic investigation, which means the attack method and vulnerabilities exploited remain unknown.

arstechnica.com · 3 min

TLDR InfoSec

TRUMP ADMINISTRATION TO SPEND $1B ON OFFENSIVE HACKING OPERATIONS

As part of Trump's One Big Beautiful Bill, $1B has been allocated for offensive hacking operations. These funds can be used for carrying out attacks using 0-days and installing spyware, but also for everyday expenses such as infrastructure and intelligence gathering. Critics note that the bill slashes funding from defensive operations such as the CISA, potentially leaving the U.S. unable to defend itself.

techcrunch.com · 2 min

TLDR InfoSec

VMWARE FLAWS THAT EARNED HACKERS $340,000 AT PWN2OWN PATCHED

Broadcom has patched VMware vulnerabilities from Pwn2Own Berlin 2025, where researchers earned $340,000+ exploiting critical bugs in ESXi and Workstation, allowing code execution.

securityweek.com · 2 min

TLDR InfoSec

POLICE SHUT DOWN 100 SERVERS TIED TO RUSSIAN NONAME057(16), ARREST 2

Operation Eastwood, a coordinated international law enforcement effort led by Europol, shut down over 100 servers belonging to the Russian pro-Putin DDoS group NoName057(16), arrested two individuals, and issued seven international arrest warrants targeting the group's 4,000+ members who conducted politically motivated attacks against Ukrainian and NATO-supporting websites.

hackread.com · 2 min