The Daily Index — Tuesday, November 4, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

CISA: HIGH-SEVERITY LINUX FLAW NOW EXPLOITED BY RANSOMWARE GANGS

CISA has added a 2024 use-after-free vulnerability to the known exploited vulnerabilities (KEV) list after it was observed being exploited by ransomware gangs. The vulnerability results from a decade-old flaw in the netfilter:nf_tables kernel component and can be abused by local attackers to escalate privileges to root.

bleepingcomputer.com · 2 min

TLDR InfoSec

ANDROID APPS MISUSING NFC AND HCE TO STEAL PAYMENT DATA ON THE RISE

Zimperium researchers discovered over 760 malicious Android apps exploiting Near-Field Communication (NFC) and Host Card Emulation (HCE) to steal payment data through NFC relay attacks, showing dramatic growth since April 2024. These apps impersonate trusted financial institutions and trick users into setting them as default NFC payment handlers, then use command-and-control servers to relay card terminal requests and exfiltrate EMV data to Telegram channels. The campaign has targeted over 20 institutions globally using 70+ C2 servers, primarily focusing on Russian banks but also affecting European banks, Brazilian institutions, and services like Google Pay.

securityaffairs.com · 2 min

TLDR InfoSec

YOU'LL NEVER SEE ATTRITION REFERENCED IN AN RCA

Public incident reports intentionally omit staff attrition as a contributing factor to reassure customers that issues are being resolved, since mentioning workforce issues could undermine confidence and create liability. Internal analyses also rarely consider attrition, focusing instead on technical details rather than organizational factors that increase system vulnerability. Attrition is like smoking and lung cancer - it's a risk factor that heightens the likelihood of failures without being necessary or sufficient on its own.

surfingcomplexity.blog · 2 min

TLDR InfoSec

MOSIP ON AWS: TECHNICAL DEEP DIVE EXPLORING ARCHITECTURE, IMPLEMENTATION, AND DEPLOYMENT MODELS

AWS and Atos developed a cloud-based digital identity platform using MOSIP, addressing security challenges with multi-layered defenses like AWS Shield, WAF, CloudFront, segmented VPCs, and dedicated CloudHSM. It offers four hybrid deployment models for data sovereignty, from fully cloud to on-premises, with security controls such as data encryption, role-based access via OAuth2, and monitoring through GuardDuty and CloudWatch. Security teams should evaluate hybrid cloud architectures for sensitive government systems, implement defense-in-depth with hardware security modules, and use Infrastructure-as-Code for consistent security controls.

aws.amazon.com · 8 min

TLDR InfoSec

CAN'T HIDE IN 3D

Time-Terrain-Behavior (TTB) mapping can be used to transform logs and security events into a 3D landscape to create a visual threat landscape. The x-axis is set as the terrain layer and measures how many different tools detected an entity, the y-axis measures how many different time periods an entity was active in, and the z-axis measures how many different actions an entity performs. This post works through applying this methodology to the Splunk BOTS v2 scenario.

dispatch.thorcollective.com · 10 min

TLDR InfoSec

Untitled entry

Summary unavailable

delltechnologies.com

TLDR InfoSec

USING GHIDRA TO PATCH MY KEYBOARD'S FIRMWARE

In this post, a researcher demonstrates firmware reverse engineering on the Epomaker Galaxy100 keyboard using Ghidra to bypass VIA configuration limitations and modify key mappings. The technical approach involved extracting firmware via DFU mode (Fn+L+Esc), setting up proper memory mapping in Ghidra for ARM Cortex-M3 architecture, locating USB HID keycode tables through pattern matching, and directly patching binary offsets to swap function key layers. Security professionals can apply these techniques for embedded device analysis, firmware modification workflows, and understanding how consumer hardware implements bootloader protections and keycode handling mechanisms.

packet.delivery · 16 min

TLDR InfoSec

REFLECTIZ (PRODUCT LAUNCH)

Reflectiz provides an agentless web exposure management platform that detects third-party tools and code risks, de-obfuscates suspicious JavaScript, and gives organizations centralized visibility and control over website activity and security compliance.

reflectiz.com

TLDR InfoSec

CHINA-LINKED HACKERS EXPLOITED LANSCOPE FLAW AS A ZERO-DAY IN ATTACKS

Chinese cyber-espionage group Bronze Butler (Tick) exploited CVE-2025-61932, a critical request origin verification flaw in Motex Lanscope Endpoint Manager versions 9.4.7.2 and earlier, as a zero-day vulnerability for several months before it was patched in October. The attackers exploited this vulnerability to achieve unauthenticated remote code execution with SYSTEM privileges, deploying an updated Gokcpdoor malware variant that features multiplexed command-and-control communication and DLL sideloading for evasion, along with tools such as goddi Active Directory dumper and 7-Zip for data exfiltration to cloud storage services. Organizations using Lanscope Endpoint Manager must immediately upgrade to patched versions, as no workarounds exist, while security teams should monitor for indicators of Bronze Butler activity, including Gokcpdoor malware, OAED Loader, and connections to ports 38000/38002.

bleepingcomputer.com · 2 min

TLDR InfoSec

ALLEGED U PENN HACKER CLAIMS THEY'RE IN IT FOR MONEY, NOT ‘PRIMARILY “ANTI-DEI”'

Hackers breached the University of Pennsylvania's systems, aiming to sell roughly 1.2 million lines of personal donor data. Unlike previous university hacks tied to diversity debates, this attack focused on financial gain, not ideology. U Penn is investigating and has involved the FBI as affected individuals have confirmed their stolen data.

theverge.com · 2 min

TLDR InfoSec

METROPOLITAN POLICE HAILS FACIAL RECOGNITION TECH AFTER RECORD YEAR FOR ARRESTS

London's Metropolitan Police credits live facial recognition technology with enabling 962 arrests over the past year. While officials cite improved public safety and broad support, privacy advocates raise concerns about racial bias, noting 80 percent of false alerts involved Black individuals. The report claims these disparities are not statistically significant, yet critics argue for better oversight and legal safeguards to protect civil rights.

theregister.com · 3 min

TLDR InfoSec

CLAUDE AI APIS CAN BE ABUSED FOR DATA EXFILTRATION

Attackers can exploit Anthropic's Claude AI APIs using indirect prompt injections to extract user data.

securityweek.com · 2 min

TLDR InfoSec

CYBERCRIMINALS EXPLOIT REMOTE MONITORING TOOLS TO INFILTRATE LOGISTICS AND FREIGHT NETWORKS

Threat actors are collaborating with organized crime groups to deploy legitimate RMM tools like ScreenConnect and SimpleHelp through spear-phishing and fraudulent freight listings to gain network access at logistics companies, enabling them to manipulate dispatch systems and steal physical cargo shipments, primarily food and beverage products.

thehackernews.com · 3 min

TLDR InfoSec

ALLEGED JABBER ZEUS CODER 'MRICQ' IN US CUSTODY

Ukrainian cybercriminal Yuriy Igorevich Rybtsov, known as "MrICQ," was extradited from Italy to face charges for developing the Jabber Zeus banking trojan, which used man-in-the-browser attacks and real-time one-time password interception to steal tens of millions from US businesses through payroll manipulation and money mule networks.

krebsonsecurity.com · 5 min