The Daily Index — Thursday, October 16, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

CYBER GIANT F5 NETWORKS SAYS GOVERNMENT HACKERS HAD 'LONG-TERM' ACCESS TO ITS SYSTEMS, STOLE CODE AND CUSTOMER DATA

F5 Networks revealed that government-backed hackers accessed its systems for an extended period, stealing source code and customer data. The intrusion impacted key product development areas and exposed sensitive customer configurations. While F5 acted to contain the breach and released security patches, over 1,000 companies, including many Fortune 500 firms, may be at risk.

techcrunch.com · 3 min

TLDR InfoSec

CHINESE HACKERS LEVERAGE GEO-MAPPING TOOL TO MAINTAIN YEAR-LONG PERSISTENCE

Reliaquest researchers uncovered a Chinese hacking campaign that targeted critical infrastructure across Asia and North America. The attackers used spear phishing to access the networks, then downloaded geo-mapping malware that disguised itself as a software component. The malware masked its network traffic to blend in with routine traffic and managed to avoid detection for at least 12 months.

cybersecuritynews.com · 2 min

TLDR InfoSec

LLM HONEYPOT VS. CRYPTOJACKING: UNDERSTANDING THE ENEMY

Mario Candela used Beelzebub's LLM network honeypot to detect cryptojacking malware that collected system data, then stopped other miners and started XMR mining via c3pool. The operation earned around $4,126 from 20 XMR across 95 servers. Attackers used 'validator/qwerty' credentials for initial access, then changed root passwords and established persistence. Security experts should note the value of LLM honeypots for behavioral analysis and coordinated disruption, as the author neutralized the threat by reporting the wallet to c3pool, which removed all infected miners.

beelzebub.ai · 3 min

TLDR InfoSec

BLIND ENUMERATION OF GRPC SERVICES

Adversis developed grpc-scan to automate service discovery on gRPC endpoints when reflection is disabled and documentation is minimal, exploiting how different gRPC implementations return distinct error codes (UNIMPLEMENTED vs NOT_FOUND) to differentiate between non-existent services and valid services with invalid methods. The tool systematically tests thousands of service/method combinations using common naming patterns and leverages HTTP/2 multiplexing for efficient scanning, revealing common security anti-patterns like legacy services with weaker authentication, method proliferation where newer methods bypass security checks, and "internal" services exposed on public endpoints. Security professionals should recognize that gRPC's opacity often creates a false sense of security through obscurity, and should implement proper service inventory management, consistent authentication across all service versions, and network segmentation rather than relying on undocumented APIs for protection.

adversis.io · 3 min

TLDR InfoSec

UNLOCKING LLM JAILBREAKS: DECONSTRUCTING PLINY'S PROMPT AND ADVANCED EVASION TECHNIQUES

Pliny the Liberator is a well-known LLM jailbreaker who shares their jailbreaking prompts on GitHub. Pliny's prompts make use of several techniques to effectively jailbreak LLMs, such as instruction prioritization, obfuscation and redirection, guardrail negation, cognitive overload, contextual misdirection, task tunneling, tonal misdirection, and output quantity bias. This post steps through each technique and showcases how the prompt utilizes it.

blog.gopenai.com · 6 min

TLDR InfoSec

STREAMLINING VULNERABILITY RESEARCH WITH THE IDALIB RUST BINDINGS FOR IDA 9.2

This post presents three Rust-based IDA Pro 9.2 plugins that leverage Binarly's idalib bindings for automated vulnerability research. rhabdomancer identifies potentially insecure API function calls with severity tiers, haruspex extracts decompiled pseudocode for static analysis tools like Semgrep, and augur organizes string-related code for analysis. The tactical approach focuses on scale and automation, with these headless tools achieving blazing-fast analysis (processing 350KB binaries in under 3 seconds) while integrating with existing vulnerability research workflows through IDE compatibility and static analysis tool chains. Security researchers should adopt this methodology of combining reverse engineering automation with static analysis pipelines.

hnsecurity.it · 5 min

TLDR InfoSec

ONELEET (PRODUCT LAUNCH)

Oneleet combines attack surface management with code scanning to identify forgotten assets, expose services, and uncover vulnerabilities before they enter production.

oneleet.com

TLDR InfoSec

5CA DENIES THIRD-PARTY ZENDESK PLATFORM WAS CAUSE OF DISCORD BREACH

Third-party provider 5CA has publicly denied responsibility for the Discord breach that exposed 5.5 million users' data, including over 70,000 government IDs, contradicting Discord's initial claims that blamed 5CA's Zendesk systems. The breach was carried out by Scattered LAPSUS$ Hunters who gained 58 hours of access starting September 20, stealing 1.6TB of data, including support tickets and partial payment information for 580,000 users. Security professionals should note the discrepancy between the hacker group's claim of 521,000 age-verification tickets versus Discord's reported 70,000 exposed government IDs, highlighting the importance of independent breach assessments and avoiding premature attribution in incident response.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

ANATOMY OF AN ATTACK: THE "BLACKSUIT BLITZ" AT A GLOBAL EQUIPMENT MANUFACTURER

Unit 42 assisted a manufacturer targeted by Ignoble Scorpius (BlackSuit ransomware) after attackers used voice phishing to steal VPN credentials, then executed DCSync attacks to compromise domain controllers and exfiltrate 400GB of data before deploying ransomware across 60 VMware ESXi hosts. The incident response strategy involved rapidly expanding Cortex XDR visibility from 250 to 17,000 endpoints and using automated containment through Cortex XSOAR to stop lateral movement, while implementing critical defenses including MFA enforcement, network segmentation, and EFSRPC blocking. Security professionals should prioritize proactive multi-layered defenses, including robust endpoint visibility, automated response capabilities, and strict access controls, as this case demonstrates how a single compromised credential can escalate to a $20 million ransom demand without proper preventive measures.

unit42.paloaltonetworks.com · 4 min

TLDR InfoSec

DISMANTLING A CRITICAL SUPPLY CHAIN RISK IN VSCODE EXTENSION MARKETPLACES

Over 550 sensitive secrets, including AWS and GitHub tokens, were exposed in public VSCode extensions. This was primarily due to insecure file handling, which attackers could exploit to push malicious updates and launch supply chain attacks. In response, platforms revoked compromised tokens, notified publishers, and improved scanning.

wiz.io · 7 min

TLDR InfoSec

CET. Don't miss it.

Summary unavailable

go.veeam.com

TLDR InfoSec

CAPITA FINED £14M AFTER 58-HOUR DELAY EXPOSED 6.6M RECORDS

Capita was fined £14 million for a cyberattack in 2023 that exposed the data of 6.6 million people, caused a 58-hour response delay, and involved significant security failures affecting hundreds of organizations.

theregister.com · 2 min