The Daily Index — Friday, August 29, 2025

GENERAL

TLDR InfoSec

→ [6]See the key stats

Summary unavailable

exclaimer.com

TLDR InfoSec

TRANSUNION SAYS HACKERS STOLE 4.4 MILLION CUSTOMERS' PERSONAL INFORMATION

Hackers accessed the personal data of over 4.4 million TransUnion customers through a breach in a third-party application, although the credit data itself was not compromised. Stolen information included names, birth dates, and Social Security numbers. This incident is part of a recent wave of major corporate data breaches in the US. Companies like Google and Allianz Life were also affected.

techcrunch.com · 2 min

TLDR InfoSec

SLIDING INTO YOUR DMS: ABUSING MICROSOFT TEAMS FOR MALWARE DELIVERY

Attackers are increasingly using Microsoft Teams for the delivery of malware. Impersonating IT support, they send direct messages or calls from fake or compromised accounts, tricking users into installing remote access tools or running malicious PowerShell payloads. These sophisticated campaigns leverage social engineering, exploit the trust in Teams' internal messaging, and use advanced techniques to steal credentials, maintain persistence, and evade detection. Defenders are advised to remain vigilant for unusual Teams activity and impersonation attempts and to recognize the signs of such malware attacks for improved response and mitigation.

permiso.io · 5 min

TLDR InfoSec

AWS DETECTION ENGINEERING: MASTERING LOG SOURCES FOR THREAT DETECTION

This post provides an overview of how to utilize CloudTrail, VPC Flow Logs, GuardDuty, ALB Logs, and AWS Config for threat detection in AWS. It lists sample alerts for each data source, as well as cross-service alerts, and demonstrates how these alerts can inform automated enforcement actions. Continuous validation is important for ensuring that rules remain consistent with an organization's environment.

links.tldrnewsletter.com · 11 min

TLDR InfoSec

THE AGENTIC THREAT HUNTER

Threat hunting follows the scientific method in which analysts observe logs, develop hypotheses, test the hypotheses, and iterate, but this model is crumbling under the vast amount of logs present in modern environments. To augment security teams, AI agents can be used to monitor vast amounts of logs and develop initial hypotheses to augment security teams. SOCs can begin leveraging agentic AI by developing explicit hypotheses, pairing with AI for investigations, centralizing data in a SIEM or data lake, setting appropriate guardrails for the agents, and then automating repetitive tasks.

dispatch.thorcollective.com · 6 min

TLDR InfoSec

PYGHIDRA-MCP: HEADLESS GHIDRA MCP SERVER FOR PROJECT-WIDE, MULTI-BINARY ANALYSIS

pyghidra-mcp is a headless Model Context Protocol (MCP) server for Ghidra that enables LLMs to perform project-wide analysis across multiple interconnected binaries in a single session, moving beyond traditional single-file reverse engineering. The tool demonstrates ecosystem-aware analysis by tracing function calls across entire application stacks, such as following a file creation operation from notepad.exe through kernel32.dll to ntdll.dll and the Windows kernel. Built for automation and CI/CD integration, pyghidra-mcp leverages Ghidra's project management capabilities to expose entire software ecosystems for AI-powered reverse engineering workflows.

clearbluejar.github.io · 6 min

TLDR InfoSec

STORM-0501 DEBUTS A BRUTAL HYBRID RANSOMWARE ATTACK CHAIN

Storm-0501 has developed a sophisticated hybrid ransomware attack that exploits privileged accounts to move between on-premises and cloud environments, utilizing techniques such as DCSync attacks to gain domain control and leveraging federated domains as backdoors. The threat actor not only encrypts data, but also mass-deletes cloud resources, including backups, creating a "no-win situation" where organizations cannot recover without paying ransom. CISOs should implement least privilege access, audit on-premises environments for cloud migration opportunities, and regularly practice ransomware response playbooks to defend against this brutal attack chain.

csoonline.com · 4 min

TLDR InfoSec

MICROSOFT WORD WILL SAVE YOUR FILES TO THE CLOUD BY DEFAULT

Microsoft will start automatically saving any Word documents in OneDrive. Users will be able to change how new files are created in the Save page in the Word options. The feature was included in the latest Microsoft 365 Insiders Beta Channel update.

bleepingcomputer.com · 2 min

TLDR InfoSec

SKT HIT WITH $97M PENALTY FOR SECURITY LAPSES

South Korea fined SK Telecom 134.8 billion won ($97.2 million) after a SIM data breach exposed the personal data of all customers due to poor security and delayed reporting. The breach affected 23 million users, causing significant financial losses and a decline in SKT's profit and customer base. Authorities ordered audits and improvements as SKT invests heavily in new security systems.

mobileworldlive.com · 2 min

TLDR InfoSec

RANSOMWARE CROOKS KNOCK SWEDISH MUNICIPALITIES OFFLINE FOR MEASLY SUM OF $168K

An attack on Miljödata, a key IT provider for most Swedish municipalities, disrupted HR and reporting systems for over 200 councils.

theregister.com · 2 min

TLDR InfoSec

PASSWORDSTATE DEV URGES USERS TO PATCH AUTH BYPASS VULNERABILITY

There is a high-severity auth bypass in Passwordstate, used by 390K IT professionals, that allows attackers to exploit a malicious URL to access the admin area via the Emergency Access page.

bleepingcomputer.com · 2 min

TLDR InfoSec

GOOGLE PREVIEWS CYBER 'DISRUPTION UNIT' AS U.S. GOVERNMENT, INDUSTRY WEIGH GOING HEAVIER ON OFFENSE

Google plans to create a new cyber "disruption unit" focused on "legal and ethical disruption" of threat campaigns.

cyberscoop.com · 5 min